Abnormal transaction detection method based on continuous learning and knowledge base replay strategy

Abstract

The present invention discloses an abnormal transaction detection method based on continuous learning and knowledge base playback strategy, which belongs to the field of abnormal transaction detection technology. The method comprises: selecting representative financial transaction samples from a knowledge base, merging them with pre-processed financial transaction samples to form a training data set, and then incrementally training an abnormal transaction detection model, and performing abnormal transaction prediction tasks using the abnormal transaction detection model of the current training round that has completed the training. By selecting representative financial transaction samples that can retain the knowledge and experience of previous tasks, merging the representative financial transaction samples with the current data set that appears incrementally, and providing the training data set used for model updating, the model can continuously extract information from the representative financial transaction samples in the previous tasks, thereby improving the ability to identify abnormal situations.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal transaction detection, and in particular to an abnormal transaction detection method based on continuous learning and knowledge base playback strategy. Background Art

[0002] Financial transaction anomaly detection is a vital link in the financial field, which uses advanced technical means to identify and prevent possible fraud. As the means of criminals stealing bank card information and committing financial fraud are becoming more and more advanced, the establishment of a powerful and intelligent financial transaction anomaly detection system to timely identify and analyze abnormal transactions plays a vital role in effectively preventing financial losses and maintaining social stability. The general financial transaction anomaly detection method includes the following steps: users generate financial transactions; financial institutions receive transaction information; financial institutions build abnormal transaction detection models; determine whether the transaction is normal; if normal, the transaction is normal and no processing is done; if abnormal, the transaction is warned and handled manually. Among them, the way to construct the abnormal transaction detection model is crucial and is the core means to maintain the entire financial transaction order. Abnormal transaction detection system based on autoencoder such as Figure 1 As shown in the figure, a new abnormal transaction detection model is built by saving historical data and periodically combining it with new data. However, due to the huge volume of transaction data generated online, saving a large amount of historical data and then retraining it regularly will consume a lot of storage and computing resources. In addition, due to the continuous upgrading of fraud methods, the traditional modeling method of updating the model in stages is difficult to effectively detect in real time.

[0003] Inspired by biological systems, continuous learning focuses on accumulating model knowledge and updating the model incrementally, providing a usable solution for this. Continuous learning continuously accumulates and transfers model knowledge from previous stages in multi-stage tasks to assist in building the model of the next stage. It allows incremental updates based on the original model based on new data to reduce the resource consumption of building an abnormal transaction detection model from scratch. Currently, most research on continuous learning relies on specific experimental settings, that is, label information of financial transaction samples is available both in the model training stage and the test stage. However, in real-time online payment scenarios, transaction data emerges in the form of a continuous, unlabeled stream. In order to meet the needs of unsupervised fraud detection in real-time payment scenarios, innovative continuous learning methods for unlabeled data need to be further explored. Summary of the invention

[0004] The purpose of the present invention is to overcome the problems of the prior art and provide an abnormal transaction detection method based on continuous learning and knowledge base playback strategy.

[0005] The object of the present invention is to achieve the following technical solution: a method for detecting abnormal transactions based on continuous learning and knowledge base playback strategy, the method comprising the following steps:

[0006] Initialize the abnormal transaction detection model and allocate knowledge base storage space; the knowledge base is used to store normal financial transaction samples whose reconstruction loss is less than the reconstruction loss threshold, and the financial transaction samples include the transaction time, transaction location, transaction amount, and transaction frequency of each user's financial payment tool; the abnormal transaction detection model is an autoencoder;

[0007] Construct a training data set for the current training round, and train the abnormal transaction detection model based on the training data set for the current training round;

[0008] Using the abnormal transaction detection model of the current training round that has completed training, perform the abnormal transaction prediction task;

[0009] Constructing a training data set for the current training round, and training the abnormal transaction detection model based on the training data set for the current training round, including the following sub-steps:

[0010] Determine whether the training is the first training task;

[0011] If it is the first training task, preprocess the current financial transaction sample data to construct a training data set for the first training round; use the training data set for the first training round to train the initialized abnormal transaction detection model to obtain the abnormal transaction detection model corresponding to the first training round;

[0012] If it is not the first training task, pre-process the newly added financial transaction sample data within the update cycle time period; select representative financial transaction samples from the knowledge base, merge the representative financial transaction samples with the pre-processed financial transaction samples to form the training data set for the current training round;

[0013] Incremental training is performed on the abnormal transaction detection model obtained in the previous training round. During the incremental training process, parameter knowledge is extracted from the abnormal transaction detection model of the previous training round, and parameter optimization is performed to obtain the abnormal transaction detection model corresponding to the current training round.

[0014] In one example, the network architecture of the autoencoder is any one of a fully connected neural network, a recurrent neural network, a long short-term memory network, and a Transformer model.

[0015] In one example, a representative sample of financial transactions is selected from the knowledge base, including:

[0016] Normalize each attribute of each financial transaction sample, calculate the average value of each attribute, form a feature sequence based on the average value of each attribute, and use the feature sequence as the centroid of the knowledge base at the current stage;

[0017] The distance from each financial transaction sample to the centroid is calculated, and the financial transaction samples whose distance is less than the distance threshold are regarded as representative financial transaction samples.

[0018] In one example, after obtaining the abnormal transaction detection model corresponding to the first training round and / or obtaining the abnormal transaction detection model corresponding to the current training round, the method further includes:

[0019] The reconstruction loss of the financial transaction samples is calculated, and a number of normal financial transaction samples whose reconstruction loss is less than a reconstruction loss threshold are stored in the knowledge base.

[0020] In one example, parameter knowledge is extracted from the abnormal transaction detection model of the previous training round, and parameter optimization is performed, including:

[0021] The parameters of the abnormal transaction detection model in the current round of training tasks are compared with the parameter knowledge extracted from the abnormal transaction detection model in the previous round, and the parameter differences obtained from the comparison are incorporated into the loss function of the current round of parameter optimization, so that the parameters with larger weights in the abnormal transaction detection model in the previous round will maintain larger weights in the loss function of the current round of training tasks.

[0022] In one example, after obtaining the abnormal transaction detection model corresponding to the current training round, the following steps are also included:

[0023] Parameter knowledge is extracted from the abnormal transaction detection model of the current training round based on the elastic weight consolidation method.

[0024] In one example, the abnormal transaction detection model of the current training round that has completed training is used to perform the abnormal transaction prediction task, including:

[0025] Input the financial transaction samples to be detected into the abnormal transaction detection model of the current training round;

[0026] Calculate the difference between the input and output of the current round of financial transaction samples to be detected, and divide the transactions to be detected into the positive domain, negative domain or boundary domain in combination with the preset three decision threshold pairs; if the financial transaction samples to be detected are divided into the positive domain, they are normal transactions; if the financial transaction samples to be detected are divided into the negative domain, they are abnormal transactions, and a transaction warning is issued; if the financial transaction samples to be detected are divided into the boundary domain, they are fuzzy transactions, and no processing is done for the time being, and wait for the next round of abnormal transaction detection model to complete training to detect the financial transaction samples to be detected that are divided into the boundary domain.

[0027] In one example, determining three decision threshold pairs includes the following sub-steps:

[0028] Input the training data set into the trained abnormal transaction detection model, compare the input and output results, calculate and save the reconstruction loss of each financial transaction sample, and calculate the mean and standard deviation of the reconstruction loss. Use the sum of the mean and l times the standard deviation as the lower threshold, and the sum of the mean and m times the standard deviation as the upper threshold. Form three decision threshold pairs based on the lower threshold and the upper threshold; l and m are positive numbers, and l<m.

[0029] It should be further explained that the technical features corresponding to the above examples can be combined or replaced with each other to form a new technical solution.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] 1. In one example, by constructing a playback knowledge base, storing normal financial transaction samples, and selecting representative financial transaction samples that can retain the knowledge and experience of previous tasks from the knowledge base, the representative financial transaction samples are merged with the incremental current data set to provide a training data set for model update. The model can continuously extract information from representative financial transaction samples in previous tasks, improve the ability to identify abnormal situations, and enable the model to effectively identify abnormal financial transaction samples when facing new and unknown credit card samples. At the same time, the present invention incrementally updates the abnormal transaction detection model of the autoencoder structure, and based on continuous learning, accumulation and transmission of detection knowledge, applies continuous learning to the unsupervised learning scenario of financial transaction anomaly detection, thereby improving the robustness and accuracy of credit card detection.

[0032] 2. In one example, the closer the financial transaction sample is to the centroid of the knowledge base, the closer it is to the average trend of the knowledge base in the feature space, and the more likely it is to contain the most valuable information for the current model training. The financial transaction samples selected in this way are used to train the abnormal transaction detection model, which can effectively improve the detection performance of the model in unknown scenarios.

[0033] 3. In one example, after obtaining the abnormal transaction detection model for each round, normal financial transaction samples that are less than the reconstruction loss threshold are selected and stored in the knowledge base, the financial transaction samples in the previous tasks are accumulated, and then the model of the current round is trained so that the current round model has the ability to identify anomalies in the previous task scenarios.

[0034] 4. In one example, according to the detection of financial transaction samples of training data in the corresponding stage by each task model, an adaptive decision threshold is dynamically set based on the mean and standard deviation of the reconstruction loss to achieve delayed decision processing of uncertain financial transaction samples, which can better prevent abnormal transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The specific implementation methods of the present invention are further described in detail below in conjunction with the accompanying drawings. The accompanying drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The same reference numerals are used in these drawings to represent the same or similar parts. The schematic embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0036] Figure 1 This is a framework diagram of the abnormal transaction detection system based on the autoencoder model;

[0037] Figure 2 A method flow chart provided for an example of the present invention;

[0038] Figure 3 A method architecture diagram provided for an example of the present invention. DETAILED DESCRIPTION

[0039] The technical solution of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] In the description of the present invention, it should be noted that the directions or positional relationships indicated by "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside", etc. are directions or positional relationships based on the drawings, which are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In addition, the use of ordinal numbers (e.g., "first and second", "first to fourth", etc.) is to distinguish objects, and is not limited to this order, and cannot be understood as indicating or implying relative importance.

[0041] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, "installation", "connection" and "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0042] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0043] The present invention aims to propose an abnormal transaction detection method based on continuous learning and knowledge base playback strategy, which can continuously enhance the performance of the model, improve the accuracy of prediction, and further control the uncertainty of the detection results, so as to facilitate financial institutions to detect abnormal transactions in a resource-efficient and highly accurate manner.

[0044] In one example, if Figure 2 As shown, a method for detecting abnormal transactions based on continuous learning and knowledge base playback strategy includes the following steps:

[0045] S1: Initialize the abnormal transaction detection model and allocate knowledge base storage space.

[0046] The abnormal transaction detection model is an autoencoder, including an encoder and a decoder. The encoder and decoder preferably have the same structure, which can be any of a fully connected neural network, a recurrent neural network, a long short-term memory network, and a Transformer model. In this example, the encoder and decoder are both fully connected neural networks, including an input layer, several hidden layers, and an output layer. Input financial transaction samples After a series of feature compression and reconstruction by the encoder and decoder, the result is finally output through the output layer .enter With output The difference between them is quantified as reconstruction loss, and is used to measure the model's ability to extract data features. When normal trading volume accounts for the majority, the autoencoder can better extract the features of normal data, but it is difficult to extract the features of abnormal data, which leads to a small reconstruction loss for normal trading financial transaction samples and a large reconstruction loss for abnormal trading financial transaction samples.

[0047] Furthermore, the knowledge base is used to store normal financial transaction samples with reconstruction losses less than the reconstruction loss threshold. The financial transaction samples include the transaction time, transaction location, transaction amount, and transaction frequency of each user's financial payment tool, that is, the transaction time, transaction amount, and other transaction information of each credit card, savings card, etc. of the user are separately used as a financial transaction sample. Furthermore, the financial transaction samples also include basic information of the cardholder, including gender, education, marital status, age, etc.

[0048] Preferably, in order to enhance the model anomaly detection capability, a prototype-based multi-granularity playback knowledge base is constructed, which can store normal financial transaction samples of different data structures or different levels of data models, thereby providing rich sample information. After that, the present invention will select representative financial transaction samples from the knowledge base and merge them with the incremental current data set to provide a training data set for model updating.

[0049] S2: Construct a training data set for the current training round, and train the abnormal transaction detection model based on the training data set for the current training round.

[0050] In step S2, a continuous learning strategy is adopted to train the abnormal transaction detection model, with each round of model training as a training task.

[0051] In step S2, a training data set of the current training round is constructed, and the abnormal transaction detection model is trained based on the training data set of the current training round, including the following sub-steps:

[0052] S21: Determine whether the training is the first training task, if so, go to step S22; otherwise, go to step S23.

[0053] S22: Preprocess the current financial transaction sample data to construct a training data set for the first training round; use the training data set for the first training round to train the initialized abnormal transaction detection model to obtain the abnormal transaction detection model corresponding to the first training round.

[0054] Preferably, after obtaining the abnormal transaction detection model corresponding to the first training round in step S22, the method further includes:

[0055] The reconstruction loss of the financial transaction samples is calculated, and several normal financial transaction samples whose reconstruction loss is less than the reconstruction loss threshold are stored in the knowledge base, thereby accumulating the financial transaction samples in the previous tasks.

[0056] S23: Preprocessing the newly added financial transaction sample data within the update cycle time period; selecting representative financial transaction samples from the knowledge base, merging the representative financial transaction samples with the preprocessed financial transaction samples to form a training data set for the current training round.

[0057] S24: performing incremental training on the abnormal transaction detection model obtained in the previous training round. During the incremental training process, parameter knowledge is extracted from the abnormal transaction detection model of the previous training round, and parameter optimization is performed to obtain the abnormal transaction detection model corresponding to the current training round.

[0058] Preferably, after step S24, the following steps are further included:

[0059] S25: Adopt elastic weight consolidation (EWC), a regularization-based method, to extract parameter knowledge from the abnormal transaction detection model of the current training round. In the scenario where resources are efficient, in order to balance the two factors of model effect and resource consumption, the present invention adopts EWC, a regularization-based method, to achieve continuous learning. This method transfers the knowledge learned in the previous task to the next task by suppressing the amplitude of changes in important parameters, providing a solution for improving the performance of the abnormal transaction detection model under resource efficiency. In addition, in order to enhance the stability of the model in identifying abnormal transactions, the present invention establishes a multi-granularity playback knowledge base. According to the playback criteria, the financial transaction samples of the previous task are selected for playback, so that the parameter optimization of the current stage is carried out based on it and the newly added financial transaction samples. After completing the parameter optimization, representative financial transaction samples are selected from the financial transaction samples of the current stage and saved in the multi-granularity playback knowledge base.

[0060] Preferably, after obtaining the abnormal transaction detection model corresponding to the current training round in step S24, the method further includes:

[0061] The reconstruction loss of the financial transaction samples is calculated, and several normal financial transaction samples whose reconstruction loss is less than the reconstruction loss threshold are stored in the knowledge base, thereby accumulating the financial transaction samples in the previous tasks.

[0062] S3: Utilize the abnormal transaction detection model of the current training round that has completed training to perform abnormal transaction prediction tasks and output the detection results, thereby realizing the detection of financial transactions.

[0063] Preferably, after step S3, the following steps are further included:

[0064] S4: Determine whether the model update node has been reached. If so, return to step S2 and enter the next round of training, otherwise return to step S3. The model update cycle is a fixed time period or when the current financial transaction sample data available for incremental training reaches a certain amount of data as an update cycle.

[0065] This example proposes a method for detecting abnormal financial transactions based on continuous learning. In the case where it is difficult to build a real-time and effective model based on all financial transactions, the performance of the model is continuously enhanced and the accuracy of detection is improved. The present invention adopts a continuous learning strategy to train the abnormal transaction detection model at each stage. After the model of the previous stage is trained, the parameter knowledge of the model is extracted and passed to the next stage, and representative financial transaction samples are selected and stored in the financial transaction sample knowledge base, thereby assisting the model training of the next stage; in addition, the present invention also incorporates three-branch decision-making into the model application, that is, first, according to the detection of the financial transaction samples of the training data of the corresponding stage by each task model, the three-branch decision threshold pair of the model is adaptively set. In actual application, after receiving the transaction information to be detected, the current latest model is used to reconstruct the information of the transaction to be detected, and then the corresponding decision is executed according to the three-branch decision threshold, so as to realize the delayed decision processing of uncertain financial transaction samples, so as to better prevent abnormal transactions.

[0066] In one example, for the first training task, using the training data set of the first training round, training the initialized abnormal transaction detection model includes:

[0067] (1) Construct an abnormal transaction detection model with an autoencoder structure;

[0068] Construct an autoencoder model consisting of an input layer, several hidden layers, and an output layer.

[0069] (2) Train the abnormal transaction detection model for the first task;

[0070] The existing financial transaction sample data that can be used for training when training the abnormal transaction detection model of the first task of the financial institution is preprocessed to obtain a training financial transaction sample set; data preprocessing methods include but are not limited to processing missing data, deleting redundant features, constructing new features, balancing data categories, etc., in order to prepare for training high-quality models. Then, the abnormal transaction detection model is trained using the back propagation method based on the training financial transaction sample set to obtain the abnormal transaction detection model corresponding to the first task.

[0071] Preferably, after completing the training of the abnormal transaction detection model of the first task, the step of extracting the parameter knowledge of the model is also included:

[0072] The EWC method is used to extract the parameter knowledge of the model. In the context of limited resources, the EWC method takes the importance of the parameters in the model as knowledge, and the information about the importance of the model parameters is transmitted between models. This knowledge will be passed to the next task, thereby limiting the range of changes in important parameters, so as to guide the next task to refer to this knowledge when training the model.

[0073] Preferably, after completing the training of the abnormal transaction detection model of the first task or extracting the parameter knowledge of the model, the process further includes accumulating financial transaction samples, including:

[0074] The financial transaction sample replay method is used to maintain the model's ability to identify previous abnormal situations. The financial transaction sample replay method accumulates representative financial transaction samples of the first task into a prototype-based multi-granularity replay knowledge base, so that subsequent tasks have the ability to identify abnormal transactions in the first task.

[0075] In one example, incremental training of an abnormal transaction detection model obtained in a previous training round includes:

[0076] (1) When the model update node set by the target financial institution is reached, the newly added financial transaction sample data that can be used for training during the update period is preprocessed and then combined with the replayed financial transaction samples selected from the prototype-based multi-granularity replay knowledge base to form a training data set for the current model training task;

[0077] The update cycle can be a fixed time (such as half a day or a day), and the model is updated every fixed time. In addition, the model can be updated according to the number of newly added financial transaction samples, that is, the upper limit of the financial transaction sample capacity is set. Whenever the newly added financial transaction samples reach this upper limit, the model is updated and the stored financial transaction samples are cleared. Data preprocessing methods include but are not limited to processing missing data, deleting redundant features, constructing new features, balancing data categories, etc.

[0078] Preferably, after forming the training data set for the current model training task, the following is further included:

[0079] Replay financial transaction samples: Generate and replay financial transaction samples of previous tasks based on the replay criteria, and combine them with the newly added financial transaction samples of the current task to perform parameter optimization.

[0080] (2) Incrementally train the abnormal transaction detection model obtained from the previous training task using the training data set of the current model training task. During the incremental training process, the parameter knowledge extracted from the abnormal transaction detection model obtained from the previous training task is used to perform parameter optimization, obtain the abnormal transaction detection model corresponding to the current training task, and extract the parameter knowledge of the model.

[0081] Preferably, the parameter knowledge extracted from the abnormal transaction detection model obtained from the previous training task is used for parameter optimization, specifically: the parameters of the model in the current training task are compared with the parameter knowledge extracted from the abnormal transaction detection model obtained from the previous task, and the parameter difference between the two is incorporated into the loss function of the model parameter optimization of the current task, and the parameters with larger weights in the abnormal transaction detection model obtained in the previous task have larger weights in the loss function of the current task. When minimizing the loss function of the current task, the range of parameter changes is limited because the difference between the parameters of the new and old tasks is taken into consideration in the loss function. The more important parameters in the previous task have larger weights in the current loss function, and have a greater impact on the loss function of the current task than general parameters. By minimizing the loss function, strict restrictions on the range of changes in different parameters are achieved, thereby retaining the knowledge learned in the previous task.

[0082] Preferably, after extracting the parameter knowledge of the model, the process also includes accumulating financial transaction samples:

[0083] The financial transaction sample replay method is used to maintain the model's ability to identify previous abnormal situations. The financial transaction sample replay method accumulates representative financial transaction samples of previous tasks into a prototype-based multi-granularity replay knowledge base, so that subsequent tasks have the ability to identify abnormal transactions in the first task.

[0084] With two tasks , For example, the total training data set for the two tasks is Contains training data sets corresponding to the two tasks and .Task After the model is built, the task is selected from the prototype-based multi-granularity replay knowledge base according to the selection mechanism. Select previous financial transaction samples for playback. The larger the number of replayed financial transaction samples, the more attention is paid to the knowledge of previous tasks, and the better the model can control early abnormal transactions. The value of the playback sample can be adjusted according to actual needs. If you need to increase the attention to previous abnormal situations, you can appropriately increase the number of replayed financial transaction samples. capacity.

[0085] The selection mechanism is described as follows:

[0086] ① Determine the centroid of the knowledge base. First, normalize each attribute of the financial transaction sample, and then calculate the average value of each indicator based on all financial transaction samples in the knowledge base. The average value of each attribute constitutes a feature sequence, which is used as the centroid of the knowledge base at the current stage. .

[0087] ② Determine the replay financial transaction samples. Normalization task The various attributes of the credit card sample are calculated and recorded based on the Euclidean distance. The financial transaction samples whose distance d is less than the distance threshold are regarded as representative financial transaction samples to participate in model training and optimization. The distance threshold can be set based on historical experience, or the distances from the credit card samples to the centroid can be sorted from small to large, and the distance threshold can be determined based on the distance value with the highest sorting, such as selecting the third distance value as the distance threshold, or the minimum distance value as the distance threshold.

[0088] EWC transfers model knowledge to tasks . Weight information of model parameters As knowledge, it is extracted by EWC and passed to the task , limit the task Parameter weight information The specific principle of constructing the loss function is as follows:

[0089] ① According to the Bayesian formula, use the parameter The prior probability , marginal probability , conditional probability , the posterior probability can be calculated by the following formula :

[0090] .

[0091] ②Because the dataset D is completely divided into tasks and tasks , the above formula is equivalent to:

[0092] .

[0093] in, Representation Task The conditional probability of Representation Task The posterior probability of Representation Task The marginal probability of .

[0094] ③Since each subset affects the posterior probability, according to the Laplace approximation method, the loss function of EWC can be expressed as:

[0095] ;

[0096] in, represents the total loss; Representative tasks loss; Based on the data set The Laplace approximation of the calculated posterior probability; λ is the relative importance of the task; Indicates the current model parameters. The value of the parameter; Indicates that in the task The parameters learned The value of .

[0097] ④Task When building a model, the parameters are in the task The loss in is part of the total loss, and the parameters are relative to the task parameter The final selected parameters are to make To obtain the minimum value of the parameters, ideally, the task Have better performance; simultaneous tasks The more important the parameter is, the smaller the change is compared to the current parameter.

[0098] To the task Accumulate and select financial transaction samples Financial transaction samples are put into the knowledge base. The specific selection mechanism is described as follows:

[0099] Computational tasks The reconstruction loss of financial transaction samples is added, and the reconstruction losses of financial transaction samples are sorted from small to large. Financial transaction samples are added to the knowledge base as representative financial transaction samples of the task. Therefore, this example can make the performance of the abnormal transaction detection model more and more stable and the prediction effect more and more accurate by introducing continuous learning.

[0100] In one example, using the abnormal transaction detection model of the current training round that has completed training, performing an abnormal transaction prediction task includes:

[0101] Input the financial transaction samples to be detected into the abnormal transaction detection model of the current training round;

[0102] Calculate the difference between the input and output of the current round of financial transaction samples to be detected, and divide the transactions to be detected into the positive domain, negative domain or boundary domain in combination with the preset three decision threshold pairs; if the financial transaction samples to be detected are divided into the positive domain, they are normal transactions; if the financial transaction samples to be detected are divided into the negative domain, they are abnormal transactions, and a transaction warning is issued; if the financial transaction samples to be detected are divided into the boundary domain, they are fuzzy transactions, and no processing is done for the time being, and wait for the next round of abnormal transaction detection model to complete training to detect the financial transaction samples to be detected that are divided into the boundary domain.

[0103] Specifically, in the specific application of the model, for the target financial institution, the financial transaction (financial transaction sample to be detected) is used as input, and the reconstruction result is output using the latest abnormal transaction detection model. In order to control the abnormal transactions of the target financial institution within a certain range, this embodiment adopts three-way decision to process uncertain financial transaction samples. Three-way decisions (3WD) divide all financial transaction samples into three independent regions, namely the positive domain, the negative domain or the boundary domain, based on the probability that the object belongs to a certain category. For financial transaction samples whose reconstruction loss is in the boundary domain, the three-way decision does not immediately assign a category to them, but allows the updated model to detect again until a deterministic result is obtained or the maximum number of detections is reached. This mode enables 3WD to have the ability to handle the uncertainty of financial transaction samples, and can handle more complex decision problems compared to two-way decisions.

[0104] Three decisions on the boundary threshold And Sigmoid evaluation function Next, the credit card sample collection Divide into positive domains without intersection ( ), negative domain ( ) or boundary domain ( ), Represents a credit card sample, is the credit card sample data label. The credit card sample division method can be described as:

[0105] .

[0106] Furthermore, the relationship between the positive domain, negative domain and boundary domain can be described as:

[0107] .

[0108] in, represents the empty set; Indicates intersection; In order to avoid artificially setting thresholds In order to reduce the subjective impact of prediction, this example generates threshold pairs based on the arithmetic mean and standard deviation of the reconstruction loss of the training data set at each stage. Since the data distribution of each task may change in real scenarios, this embodiment combines the data distribution to generate threshold pairs that meet the data distribution for each task adaptability, thereby improving the robustness of the three-branch decision framework. The adaptive method of the threshold pairs is as follows:

[0109] Specifically, based on the current training model, the average and standard deviation of the reconstruction loss of the training data set are recorded as , , the sum of the mean and l times the standard deviation is used as the lower threshold, and the sum of the mean and m times the standard deviation is used as the upper threshold. Three decision threshold pairs are formed according to the lower threshold and the upper threshold; where l and m are positive numbers and l<m. In this example, the lower threshold of the current stage threshold pair is and upper threshold They are and .

[0110] In the specific application of the model, the current abnormal transaction detection model is used to detect whether the financial transactions generated by customers are abnormal, record the reconstruction loss of financial transaction samples, and compare them with the threshold pair to execute subsequent decisions:

[0111] If the reconstruction loss of the transaction information is higher than the upper threshold, the transaction information will be classified into the negative domain, the transaction will be warned, and it will be processed manually;

[0112] If the reconstruction loss of the transaction information is lower than the lower threshold of the three decision threshold pairs, the transaction information is classified into the positive domain, indicating that the transaction is normal and no processing is performed;

[0113] If the reconstruction loss of the transaction information is within the upper or lower threshold, the transaction information is classified into the boundary domain, indicating that the transaction is a fuzzy transaction and may be abnormal. The fuzzy transactions in the boundary domain are processed delayed and re-detected with the help of the updated model until the transaction is classified into the non-boundary domain or the termination mechanism is triggered.

[0114] In summary, this embodiment combines the autoencoder and the three-branch decision under the continuous learning paradigm. The framework is as follows Figure 3 As shown. For each round of training task K, the method of the present invention replays and accumulates financial transaction samples based on the prototype's multi-granularity replay knowledge base, and extracts the model's parameter knowledge to pass it to the next round of training tasks. In addition, according to the reconstruction error of the training data set, the three-branch decision threshold pair is adaptively set. In the actual application of the model, for the transaction records to be detected (corresponding to the test data in the figure), according to the comparison between the reconstruction loss of the transaction information and the three-branch decision threshold pairs, it is divided into corresponding areas and the corresponding decision is executed. If it enters the positive domain, it is regarded as a normal transaction and no processing is performed; if it enters the negative domain, the transaction is warned and handled manually; if it enters the boundary domain, the decision is delayed and tested again after the next model update, thereby strictly controlling the abnormal detection of transaction information.

[0115] At the same time, the present invention controls the uncertainty of the detection results through three-way decision making, which can reduce the risk of the model failing to identify abnormal transactions in a timely manner. The present invention uses the autoencoder as the evaluation function of the three-way decision making, which not only ensures the objectivity of the evaluation function, but also innovatively realizes the combination of continuous learning and three-way decision making. Moreover, unlike the traditional three-way decision making that always uses a constant decision threshold, the present invention combines the data distribution of each task to set a dynamic adaptive decision threshold, thereby achieving effective control of uncertain financial transaction samples.

[0116] The above examples are combined to obtain a preferred example of the present invention, in which the method comprises the following steps:

[0117] S10: Initialize the abnormal transaction detection model and allocate knowledge base storage space;

[0118] S20: Construct a training data set for the current training round, and train the abnormal transaction detection model based on the training data set for the current training round:

[0119] S201: Determine whether the training is the first training task, if so, execute step S22, otherwise, execute step S23;

[0120] S202: Preprocess the current financial transaction sample data to construct a training data set for the first training round; use the training data set for the first training round to train the initialized abnormal transaction detection model to obtain the abnormal transaction detection model corresponding to the first training round; calculate the reconstruction loss of the financial transaction samples, and store several financial transaction samples with smaller reconstruction losses into the knowledge base;

[0121] S203: Preprocess the newly added financial transaction sample data during the update period. Select representative financial transaction samples from the prototype-based multi-granularity playback knowledge base, merge the representative financial transaction samples with the preprocessed financial transaction samples, and form a training data set for the current training round;

[0122] S204: performing incremental training on the abnormal transaction detection model obtained in the previous training round, and in the incremental training process, extracting parameter knowledge from the abnormal transaction detection model of the previous training round, and performing parameter optimization, so as to obtain the abnormal transaction detection model corresponding to the current training round; calculating the reconstruction loss of the financial transaction samples, and storing several financial transaction samples with smaller reconstruction loss into the knowledge base;

[0123] S205: extracting parameter knowledge from the abnormal transaction detection model of the current training round;

[0124] S30: Execute an abnormal transaction prediction task using the abnormal transaction detection model obtained in the current training round;

[0125] S40: Determine whether the model update node has been reached. If so, return to step S203 and enter the next round of training; otherwise, return to step S30.

[0126] In the process of incrementally constructing an abnormal transaction detection model, the present invention first initializes the abnormal transaction detection model, and then regards each iterative update of the model as a training task, which not only transfers parameter knowledge between models, but also keeps the financial transaction samples in the knowledge base regularly added. Specifically, in the first training task, the target financial institution performs data preprocessing on the existing financial transaction samples to obtain the first batch of training data sets, and trains the first autoencoder abnormal transaction detection model. In addition, the two statistics of mean and standard deviation are calculated based on the reconstruction loss of all financial transaction samples, and a certain amount of financial transaction samples with smaller reconstruction loss are added to the playback knowledge base; in subsequent training tasks, the newly added financial transaction sample data in the preprocessing update cycle, and based on EWC, the parameter knowledge of the model is gradually accumulated and transferred to the next task, to assist the abnormal transaction detection model in the new stage to perform parameter optimization, so as to achieve continuous guidance on model updates.

[0127] Furthermore, in the process of detecting abnormal transactions, in order to strengthen the precise prevention and control of abnormal transactions, the three-branch decision is used to detect uncertain financial transaction samples multiple times. Specifically, first, according to the reconstruction loss of the current training data set, the corresponding three-branch decision threshold pair is adaptively set; then, according to the abnormal degree of the transaction record, it is divided into corresponding areas, that is, the reconstruction loss of the financial transaction sample is compared with the threshold pair, and the corresponding operation is performed: if it is divided into the positive domain, it is regarded as a normal transaction and no processing is performed); if it is divided into the negative domain, the transaction is warned and handed over to manual processing; if it is divided into the boundary domain, it is regarded as a fuzzy transaction and no processing is performed for the time being, and it is detected again by the updated model until the transaction information is divided into the non-boundary domain, or the termination mechanism is triggered, so as to achieve delayed decision processing of uncertain financial transaction samples.

[0128] The above specific implementation methods are detailed descriptions of the present invention. It cannot be determined that the specific implementation methods of the present invention are limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions and substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. A method for detecting abnormal transactions based on continuous learning and knowledge base playback strategy, characterized in that: The following steps are involved: Initialize the abnormal transaction detection model and allocate knowledge base storage space; the knowledge base is used to store normal financial transaction samples whose reconstruction loss is less than the reconstruction loss threshold, and the financial transaction samples include the transaction time, transaction location, transaction amount, and transaction frequency of each user's financial payment tool; the abnormal transaction detection model is an autoencoder; Construct a training data set for the current training round, and train the abnormal transaction detection model based on the training data set for the current training round; Using the abnormal transaction detection model of the current training round that has completed training, perform the abnormal transaction prediction task; Constructing a training data set for the current training round, and training the abnormal transaction detection model based on the training data set for the current training round, including the following sub-steps: Determine whether the training is the first training task; If it is the first training task, preprocess the current financial transaction sample data to construct the training data set for the first training round; Using the training data set of the first training round, the initialized abnormal transaction detection model is trained to obtain the abnormal transaction detection model corresponding to the first training round; If it is not the first training task, pre-process the newly added financial transaction sample data within the update cycle time period; Select representative financial transaction samples from the knowledge base, merge the representative financial transaction samples with the preprocessed financial transaction samples to form a training data set for the current training round; Incremental training is performed on the abnormal transaction detection model obtained in the previous training round. During the incremental training process, parameter knowledge is extracted from the abnormal transaction detection model in the previous training round, and parameter optimization is performed to obtain the abnormal transaction detection model corresponding to the current training round; A representative sample of financial transactions is selected from the knowledge base, including: Normalize each attribute of each financial transaction sample, calculate the average value of each attribute, form a feature sequence based on the average value of each attribute, and use the feature sequence as the centroid of the knowledge base at the current stage; Calculate the distance from each financial transaction sample to the centroid, and take the financial transaction samples whose distance is less than the distance threshold as representative financial transaction samples; The abnormal transaction detection model of the current training round that has completed training is used to perform the abnormal transaction prediction task, including: Input the financial transaction samples to be detected into the abnormal transaction detection model of the current training round; Calculate the difference between the input and output of the current round of financial transaction samples to be detected, and divide the transactions to be detected into the positive domain, negative domain or boundary domain in combination with the preset three decision threshold pairs; if the financial transaction samples to be detected are divided into the positive domain, they are normal transactions; if the financial transaction samples to be detected are divided into the negative domain, they are abnormal transactions, and a transaction warning is issued; if the financial transaction samples to be detected are divided into the boundary domain, they are fuzzy transactions, and no processing is done for the time being, and wait for the next round of abnormal transaction detection model to complete training to detect the financial transaction samples to be detected that are divided into the boundary domain.

2. The abnormal transaction detection method based on continuous learning and knowledge base playback strategy according to claim 1 is characterized in that: The network architecture of the autoencoder is any one of a fully connected neural network, a recurrent neural network, a long short-term memory network, and a Transformer model.

3. The abnormal transaction detection method based on continuous learning and knowledge base playback strategy according to claim 1 is characterized in that: After obtaining the abnormal transaction detection model corresponding to the first training round and / or obtaining the abnormal transaction detection model corresponding to the current training round, the method further includes: The reconstruction loss of the financial transaction samples is calculated, and a number of normal financial transaction samples whose reconstruction loss is less than a reconstruction loss threshold are stored in the knowledge base.

4. The abnormal transaction detection method based on continuous learning and knowledge base playback strategy according to claim 1 is characterized in that: Extract parameter knowledge from the abnormal transaction detection model of the previous training round and perform parameter optimization, including: The parameters of the abnormal transaction detection model in the current round of training tasks are compared with the parameter knowledge extracted from the abnormal transaction detection model in the previous round, and the parameter differences obtained from the comparison are incorporated into the loss function of the current round of parameter optimization, so that the parameters with larger weights in the abnormal transaction detection model in the previous round will maintain larger weights in the loss function of the current round of training tasks.

5. The abnormal transaction detection method based on continuous learning and knowledge base playback strategy according to claim 1 is characterized in that: After obtaining the abnormal transaction detection model corresponding to the current training round, it also includes: Parameter knowledge is extracted from the abnormal transaction detection model of the current training round based on the elastic weight consolidation method.

6. The abnormal transaction detection method based on continuous learning and knowledge base playback strategy according to claim 1 is characterized in that: The determination of three decision threshold pairs includes the following sub-steps: Input the training data set into the trained abnormal transaction detection model, compare the input and output results of the model, calculate the reconstruction loss of each financial transaction sample, and calculate the mean and standard deviation of the reconstruction loss. l The sum of times the standard deviation is taken as the lower limit threshold, and the mean and m The sum of times the standard deviation is used as the upper threshold, and three decision threshold pairs are formed according to the lower threshold and the upper threshold; l、m is a positive number, and l＜m .

Images