Anomaly Transaction Detection Method Based on Continuous Learning and Dual Autoencoder Architecture

Abstract

The present invention discloses an abnormal transaction detection method based on continuous learning and dual autoencoder architecture, which belongs to the field of credit card abnormal transaction detection. The method includes: according to the similarity between the credit card sample and the abnormal credit card sample, combined with a preset one or three decision threshold pairs, the credit card sample to be selected is divided into a positive domain, a negative domain or a boundary domain to construct a training data set; incrementally update the abnormal detection model of the autoencoder architecture; perform the credit card abnormal detection task, predict the uncertain credit card sample multiple times, and output the detection result. The present invention evaluates the similarity between the credit card sample and the abnormal credit card, selects the credit card sample with a low similarity to the abnormal credit card sample in combination with the three decisions, selects the part with a low similarity to the abnormal credit card sample as the training credit card sample data set of this round, reduces the interference of the credit card sample with a high similarity to the abnormal credit card sample on the training of the abnormal detection model, thereby improving the accuracy, robustness and generalization ability of the abnormal detection model.

Description

Technical Field

[0001] The present invention relates to the technical field of credit card abnormal transaction detection, and in particular to an abnormal transaction detection method based on continuous learning and dual autoencoder architecture. Background Art

[0002] With the rapid expansion of e-commerce and online payment, the volume of credit card transactions has shown an exponential growth trend. This trend has become more prominent in the digital age, and with it comes more frequent and complex threats of credit card fraud. The general detection process of financial transaction fraud is as follows: Figure 1 As shown in the figure, the following steps are included: users generate financial transactions; financial institutions receive transaction information; financial institutions build detection models; determine whether the transaction is normal; if normal, normal transactions are not processed; if abnormal, the transaction is warned and processed manually. It is crucial to establish a powerful and intelligent financial transaction anomaly detection system based on the detection model, which can timely discover and analyze abnormal transactions, effectively prevent capital losses, and maintain social stability and order.

[0003] Abnormal transaction detection system based on autoencoder model Figure 2 As shown in the figure, the system saves a large amount of historical data and retrains the autoencoder model regularly. Over time, the accumulation of historical data will lead to increasing storage requirements, and retraining the model requires a lot of computing resources and time. Secondly, since historical data may not fully reflect the current transaction situation, regular retraining of the model may not be able to capture the latest fraud patterns in a timely manner, affecting the accuracy and timeliness of the anomaly detection system. In addition, with the growth of online transaction volume, the size of the historical data set will continue to expand, limiting the scalability of the anomaly detection system and making it difficult to adapt to the growing amount of transaction data. At present, how to build an effective detection model in a resource-efficient way has become a research topic that has attracted much attention.

[0004] The current detection of abnormal credit card transactions is still based only on existing data modeling. In the increasingly complex and rapidly changing financial market, fraudsters are constantly changing their methods to circumvent traditional static models. In this case, the traditional method of detecting abnormal credit card transactions is no longer effective. Continuous learning accumulates knowledge from each stage based on deep neural network (DNN) to build a model with more stable performance, which can not only help future tasks achieve better results, but also have better performance for previous tasks. Continuous learning breaks the traditional machine learning paradigm of "modeling a single task in isolation", but emphasizes overcoming the forgetting of knowledge learned from past tasks in a series of tasks and passing this knowledge to the upcoming tasks. Continuous learning emphasizes accumulating model knowledge and updating the model incrementally, which provides a new idea for solving the challenges faced by anomaly detection. However, most of the current research on continuous learning still relies on supervised experimental settings. How to apply continuous learning to unsupervised learning scenarios needs further exploration to meet the needs of fraud detection in unsupervised real-time transactions. Summary of the invention

[0005] The purpose of the present invention is to overcome the problems of the prior art and provide an abnormal transaction detection method based on continuous learning and dual autoencoder architecture.

[0006] The purpose of the present invention is to achieve the following technical solution: an abnormal transaction detection method based on continuous learning and dual autoencoder architecture, the method comprising the following steps:

[0007] Build an anomaly database and initialize the credit card anomaly detection model, which is the first autoencoder;

[0008] Filter credit card samples for current task training as training data sets; the credit card samples include basic cardholder information and credit card transaction information, the basic cardholder information includes gender, education, marital status, age, and the credit card transaction information includes transaction time, transaction location, transaction amount, and transaction frequency;

[0009] Incrementally update the anomaly detection model based on the training dataset of the current task;

[0010] Perform credit card anomaly detection tasks, predict uncertain credit card samples multiple times, and output detection results;

[0011] Screening credit card samples for training the current task includes the following sub-steps:

[0012] The similarity between the credit card sample to be selected and the abnormal credit card sample is calculated according to the sample selection module, and the credit card sample to be selected is divided into a positive domain, a negative domain or a boundary domain in combination with the first and third decision threshold pairs of the sample selection module preset in the current training round;

[0013] If it is classified into the positive domain, the credit card sample is uploaded to the abnormal database; if it is classified into the negative domain, the credit card sample is retained; if it is classified into the boundary domain, the credit card sample is discarded;

[0014] Integrate the reserved credit card samples to construct a training dataset.

[0015] In one example, the network architecture of the first autoencoder and the second autoencoder is any one of a fully connected neural network, a recurrent neural network, a long short-term memory network, and a Transformer model.

[0016] In one example, determining the first three decision threshold pairs includes the following sub-steps:

[0017] Input the credit card samples into the sample selection module, obtain the confidence of the evaluation results of the similarity between each credit card sample and the abnormal credit card sample, and sort the confidence of each evaluation result to form a first confidence sequence;

[0018] The amount of credit card samples in the boundary domain is calculated based on the ratio of the number of credit card sample data entering the boundary domain to the total number of credit card sample data input, the left boundary of the first threshold pair is the confidence level of the evaluation result corresponding to half of the difference between the number of the first confidence sequence and the number of credit card samples in the boundary domain, and the right boundary of the first threshold pair is the confidence level of the evaluation result corresponding to half of the sum of the number of the first confidence sequence and the number of credit card samples in the boundary domain;

[0019] A first three-branch decision threshold pair is determined according to the left boundary and the right boundary of the first threshold pair.

[0020] In one example, incrementally updating an anomaly detection model based on a training dataset of a current task includes the following sub-steps:

[0021] Preprocess the newly added credit card sample data during the update cycle to obtain the training data set for the current round, and perform incremental training on the anomaly detection model obtained in the previous round of training. During the incremental training process, use the parameter knowledge extracted from the anomaly detection model obtained in the previous training round to perform parameter optimization and obtain the anomaly detection model corresponding to the current training round.

[0022] Utilize the parameter knowledge extracted from the anomaly detection model obtained from the previous training round to perform parameter optimization, including:

[0023] The parameters of the anomaly detection model in the current round of training tasks are compared with the parameter knowledge extracted from the anomaly detection model obtained from the previous round of training tasks, and the parameter differences obtained from the comparison are incorporated into the loss function of the model parameter optimization of the current round of model training tasks, so that the parameters with larger weights in the credit card anomaly detection model obtained in the previous round of training tasks have larger weights in the loss function of the current round of training tasks.

[0024] In one example, a credit card anomaly detection task is performed to predict uncertain credit card samples multiple times, including the following sub-steps:

[0025] Input the credit card sample to be tested into the anomaly detection model and output the detection result of the credit card sample;

[0026] According to the confidence of the similarity test results of the credit card sample to be tested and the normal credit card sample, combined with the second and third decision threshold pairs of the preset anomaly detection model, the credit card sample to be tested is divided into a positive domain, a negative domain or a boundary domain;

[0027] If it is classified into the positive domain, the credit card to be detected is a normal credit card; if it is classified into the negative domain, the credit card to be detected is an abnormal credit card; if it is classified into the boundary domain, wait for the anomaly detection model to complete the next round of training, and then perform credit card anomaly detection on this credit card sample to be detected again.

[0028] In one example, determining the second three-branch decision threshold pair includes the following sub-steps:

[0029] Sorting the confidence levels of similarity detection results of the to-be-detected credit card sample and the normal credit card sample to form a second confidence level sequence;

[0030] The number of credit card samples in the boundary domain is calculated based on the ratio of the number of credit card sample data to be detected that enters the boundary domain to the total number of credit card sample data input, the left boundary of the second threshold pair is the confidence level of the evaluation result corresponding to half of the difference between the number of second confidence sequence and the number of credit card samples in the boundary domain, and the right boundary of the second threshold pair is the confidence level of the evaluation result corresponding to half of the sum of the number of second confidence sequence and the number of credit card samples in the boundary domain;

[0031] A second three-branch decision threshold pair is determined according to the left boundary and the right boundary of the second threshold pair.

[0032] In one example, after the detection result is output, the following is also included:

[0033] Determine whether the set model update cycle has been reached;

[0034] If not, perform the credit card anomaly detection task, predict the uncertain credit card samples multiple times, and output the detection results;

[0035] If yes, perform the following substeps:

[0036] Filter credit card samples used for current task training as training data sets;

[0037] Incrementally update the anomaly detection model based on the training dataset of the current task;

[0038] Perform credit card anomaly detection tasks, predict uncertain credit card samples multiple times, and output detection results.

[0039] In one example, the model update cycle is a fixed time period or an update cycle is when the credit card sample data currently available for incremental training reaches a threshold data amount.

[0040] It should be further explained that the technical features corresponding to the above examples can be combined or replaced with each other to form a new technical solution.

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] 1. In one example, the anomaly detection model of the autoencoder architecture is updated in a dynamic manner. Based on continuous learning, accumulation and transfer of detection knowledge, continuous learning is applied to the unsupervised learning scenario of credit card anomaly detection, which can adapt to the fraud detection needs of unsupervised real-time transactions, help target institutions such as banks to adapt to new transaction models and fraud methods in a timely manner, and improve the robustness and accuracy of credit card detection. At the same time, the present invention evaluates the similarity between credit card samples and abnormal credit cards, selects credit card samples with low similarity to abnormal credit card samples in combination with three decisions, and selects the part with low similarity to abnormal credit card samples as the training credit card sample data set for this round, reducing the interference of credit card samples with high similarity to abnormal credit card samples on the training of anomaly detection models, thereby improving the robustness and generalization ability of anomaly detection models. Finally, credit card samples with low similarity to abnormal credit card samples are used as input for training anomaly detection models, so that the model can more accurately identify and predict uncertain credit card samples, further improving the accuracy of detection.

[0043] 2. In one example, the present invention introduces three-branch decision-making to reduce the inaccuracy of abnormal credit card transaction detection results in view of the distribution characteristics of the data at each stage. In addition, in order to more accurately capture potential credit card fraud behaviors at each stage, the present invention adaptively and dynamically sets the decision thresholds in the three-branch decision-making, which can better reduce the possibility of false positives and false negatives and improve the detection performance.

[0044] 3. In one example, three decisions are applied based on continuous learning to continuously optimize and upgrade the credit card abnormal transaction detection system in a resource-efficient manner. Incremental training of the anomaly detection model not only reduces the resource consumption caused by modeling all credit card samples, but also replaces the storage of historical credit card samples with accumulated knowledge, thereby reducing storage requirements and balancing detection effectiveness with resource effectiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The specific implementation methods of the present invention are further described in detail below in conjunction with the accompanying drawings. The accompanying drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The same reference numerals are used in these drawings to represent the same or similar parts. The schematic embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0046] Figure 1 A generalized detection flow chart for financial transaction fraud;

[0047] Figure 2 This is a framework diagram of the abnormal transaction detection system based on the autoencoder model;

[0048] Figure 3 A method flow chart provided for an example of the present invention;

[0049] Figure 4 A schematic diagram of an autoencoder provided as an example of the present invention;

[0050] Figure 5 A three-branch decision diagram provided for an example of the present invention;

[0051] Figure 6 A flow chart for constructing a training data set provided for an example of the present invention;

[0052] Figure 7 A schematic diagram of continuous training of an anomaly detection model provided for an example of the present invention. DETAILED DESCRIPTION

[0053] The technical solution of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] In the description of the present invention, ordinal numbers (eg, “first and second,” “first to fourth,” etc.) are used to distinguish objects and are not limited to the order and should not be understood as indicating or implying relative importance.

[0055] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, "connected" and "connected" should be understood in a broad sense, which may be directly connected or indirectly connected through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0056] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0057] In one example, if Figure 3 As shown, an abnormal transaction detection method based on continuous learning and dual autoencoder architecture includes the following steps:

[0058] S1: Build an anomaly database and initialize the credit card anomaly detection model.

[0059] Among them, building an abnormal database includes:

[0060] Design and establish a database structure to store abnormal credit card sample data. Determine the data type and association of each field, establish a regular database backup mechanism to ensure that abnormal credit card sample data can be restored in time in the event of an unexpected situation. At the same time, take necessary security measures, such as encryption, access control, etc., to prevent unauthorized access.

[0061] Furthermore, the initialization of the anomaly detection model includes defining the model structure, configuring learning parameters, etc. The anomaly detection model of the present invention is a first autoencoder, including an encoder and a decoder, the encoder is any one of a fully connected neural network, a recurrent neural network, a long short-term memory network, and a Transformer model, and the decoder is any one of a fully connected neural network, a recurrent neural network, a long short-term memory network, and a Transformer model. Preferably, the encoder and the decoder use the same neural network. In this example, the encoder and the decoder of the first autoencoder are both fully connected neural networks, including a sequentially connected input layer, several hidden layers, and an output layer. Constructing a credit card abnormal transaction detection model includes:

[0062] Construct a fully connected neural network with an input layer, several hidden layers, and an output layer. The input credit card sample undergoes a series of linear processing and activation processing through the weight matrix and bias vector, and then is processed by logistic regression, and finally the final result is output through the output layer. Logistic regression is used for the first The activation operation of a neuron can be expressed as follows:

[0063] ;

[0064] in, is the first The output of a neuron, which is between 0 and 1, represents the probability that the credit card sample belongs to the positive class; is the feature vector of the input credit card sample; It is The weight vector of each neuron; represents transpose; It is The bias term of each neuron; Represents the exponential function.

[0065] Furthermore, if Figure 4 As shown, the task of the autoencoder is to learn a low-dimensional representation of the credit card data. , where the encoder converts the credit card sample Mapping to hidden representation , the decoder will hide the representation Mapping back to original input data , realizing data reconstruction. This process can be expressed as the following mathematical formula:

[0066] Encoder: ,in is the encoder function.

[0067] Decoder: ,in is the decoder function.

[0068] The autoencoder learns parameters by minimizing the reconstruction error between the input data and the reconstructed data. The mean squared error (MSE) is usually used as the loss function:

[0069] ;

[0070] in, is the number of credit card samples; and are the input data and the corresponding reconstructed data respectively.

[0071] S2: Filter credit card samples for current task training as training dataset, including the following sub-steps:

[0072] S21: Calculate the similarity between the credit card sample to be selected and the abnormal credit card sample according to the sample selection module, and divide the credit card sample to be selected into a positive domain, a negative domain or a boundary domain in combination with the first three decision threshold pairs of the sample selection module of the preset current training round; wherein the credit card sample includes the basic information of the cardholder and the credit card transaction information, the basic information of the cardholder includes gender, education, marital status, and age, and the credit card transaction information includes transaction time, transaction location, transaction amount, and transaction frequency; the similarity calculation can be achieved by calculating the similarity of the feature representation between the credit card sample to be selected and the abnormal credit card sample (measured based on Euclidean distance or cosine similarity) by the sample selection module, and the sample selection module is the second autoencoder.

[0073] S22: If it is classified into the positive domain, it indicates that the similarity between the credit card sample and the abnormal credit card sample is high, and the credit card sample is classified as an abnormal credit card sample and uploaded to the abnormal database; if it is classified into the negative domain, it indicates that the similarity between the credit card sample and the abnormal credit card sample is low, and the credit card sample is classified as a normal credit card sample and retained; if it is classified into the boundary domain, it cannot be determined whether the credit card sample belongs to a normal credit card sample or an abnormal credit card sample, and the credit card sample is discarded;

[0074] S23: Integrate the reserved credit card samples to construct a training dataset.

[0075] Through steps S21-S23, the credit card samples are evaluated and screened based on the three decisions, and the part with low similarity to the abnormal credit card samples is selected as the training credit card sample data set for this round. This selection is intended to reduce the interference of credit card samples with high similarity to abnormal credit card samples on model training, thereby improving the robustness and generalization ability of the model. Finally, these credit card samples are used as input for training the credit card anomaly model so that the model can more accurately identify and predict uncertain credit card samples.

[0076] S3: Incrementally update the anomaly detection model based on the training dataset of the current task.

[0077] Specifically, the training anomaly detection model adopts a continuous learning strategy, with each round of model training as a training task. For the credit card abnormal transaction detection model of the first task, the existing credit card sample data that can be used for training when the bank trains the credit card abnormal transaction detection model of the first task is used for preprocessing to obtain a training credit card sample set; data preprocessing methods include but are not limited to processing missing data, deleting redundant features, constructing new features, balancing data categories, etc., in order to prepare for training high-quality models. Then, based on the training credit card sample set, the credit card abnormal transaction detection model is trained using the back propagation method to obtain the credit card abnormal transaction detection model corresponding to the first task.

[0078] Based on the existing anomaly detection model, by introducing new task-related training data, the anomaly detection model is further trained and optimized to adapt to the abnormal pattern changes that may be contained in the new data. This method allows the anomaly detection model to continuously learn and update its knowledge base, thereby improving the ability to identify newly emerging abnormal credit card behaviors, while maintaining the memory of old credit card anomaly detections, effectively integrating new knowledge without retraining the entire model.

[0079] S4: Perform the credit card anomaly detection task, predict uncertain credit card samples multiple times, and output the detection results.

[0080] For banks, when faced with a credit card testing application, the pre-processed credit card samples to be tested are used as input, and the latest anomaly detection model updated in a dynamically manner is used to test the credit card samples to be tested. The current latest abnormal transaction detection model can output the detection results of the credit risk category based on the two-branch decision, that is, output the detection result of whether the current credit card sample to be tested is a normal credit card sample.

[0081] Preferably, after step S4, the following steps are further included:

[0082] S5: Determine whether the set model update cycle has been reached. If so, return to step S2 to start a new task; if not, return to step S4.

[0083] Among them, the model update cycle here can be a fixed time period (such as half a day or a day). Since the number of credit card sample data obtained in each fixed time period may vary greatly, for example, the newly added credit card sample data in a certain period is relatively small, while the newly added credit card sample data in another period is relatively large, in order to timely update the anomaly detection model to obtain more accurate predictions, the current credit card sample data that can be used for incremental training can reach a certain data volume (threshold data volume) as an update cycle.

[0084] This invention aims to propose a method for detecting abnormal credit card transactions based on continuous learning, providing excellent credit card security protection for users and banks in a dynamic financial environment. Faced with the challenge of limited credit card samples caused by escalating fraud, this method significantly improves the accuracy of credit card transaction detection by continuously optimizing model performance. Through a synergistic three-branch decision framework, the system deeply analyzes user transaction records, promptly detects and prevents potential fraudulent behavior, and effectively reduces the credit risk of banks. This technological innovation will provide the financial industry with a more reliable and flexible credit card abnormal transaction detection solution, and create a safer credit transaction environment for users and banks.

[0085] In one example, the credit card sample selection module uses three-way decision making to screen the credit card sample data of each round. The credit card sample selection module is a second encoder, and its network architecture is any one of a fully connected neural network, a recurrent neural network, a long short-term memory network, and a Transformer model. In this example, the second autoencoder is preferably the same structure as the first autoencoder, including an encoder and a decoder, both of which are fully connected neural networks, including a layer of input layer, several hidden layers and an output layer connected in sequence. The credit card samples in the training data set of the current training round are input into the credit card sample selection module of the current round to obtain the evaluation results of the similarity between each credit card sample and the abnormal credit card sample, and the confidence of each evaluation result is statistically calculated.

[0086] Furthermore, if Figure 5 As shown in the figure, three-way decisions (3WD) divide all credit card samples into three independent areas, namely the positive domain, the negative domain or the boundary domain, according to the probability that the credit card samples belong to a certain category. For credit card samples in the boundary domain with low confidence in the evaluation results, the three-way decision does not immediately assign a category to them, but the updated model makes a judgment for them later. When the confidence of the credit card sample meets the requirement, it will be assigned the corresponding category. This model enables 3WD to handle the uncertainty of credit card samples and can handle more complex decision problems compared to two-way decisions.

[0087] Three decisions on the boundary threshold And Sigmoid evaluation function Next, the credit card sample collection Divide into positive domains without intersection ( ), negative domain ( ) or boundary domain ( ), Represents a credit card sample, is the credit card sample data label. The credit card sample division method can be described as:

[0088] .

[0089] Furthermore, the relationship between the positive domain, negative domain and boundary domain can be described as:

[0090] .

[0091] in, represents the empty set; Indicates intersection; In order to avoid artificially setting thresholds In order to reduce the subjective impact of prediction, this embodiment generates threshold pairs based on data features. Since the data distribution of each task may change in real scenarios, this embodiment combines the data distribution to generate threshold pairs that meet the data distribution for each task adaptability, thereby improving the robustness of the three-branch decision framework. The adaptive method of the threshold pairs is as follows:

[0092] (1) Set the ratio of credit card samples in the boundary domain to the total credit card samples in the corresponding task input The larger the ratio is, the more attention is paid to the uncertainty of the prediction results, and the more the bank can strengthen the detection of abnormal credit cards. The bank can adjust the ratio according to actual needs. For example, when the number of credit card samples is large, the ratio of credit card samples in the boundary domain can be appropriately increased.

[0093] (2) According to the ratio of credit card samples in the preset boundary domain of the task to the credit card samples of the corresponding task and the confidence of the credit card sample selection module of the corresponding task in the detection results of the training credit card samples, the three decision threshold pairs of the corresponding task are determined:

[0094] Specifically, first the task Training credit card sample data , put it into the credit card sample selection module of its task In the process, the credit card sample selection module calculates the confidence level of the risk categories of these credit card samples.

[0095] Then, the obtained confidence levels are sorted from low to high to form a sequence ,in Representative tasks Training credit card samples The sample size of credit cards, Indicates the confidence level of the similarity assessment results between each credit card sample and the abnormal credit card sample; Represents the number of credit card samples for training credit card samples; Represents an index.

[0096] Next, according to the established credit card sample boundary domain ratio , calculate the number of credit card samples in the boundary domain , the calculation expression is: .

[0097] Finally, determine the task The threshold value is on the left boundary and right border They are and , so that each task model can adaptively generate the corresponding three decision threshold pairs.

[0098] In the specific application of the credit card sample selection module, the latest model is used to evaluate the similarity between the credit card to be detected and the abnormal credit card, and the confidence of the evaluation result is statistically analyzed and compared with the three decision threshold pairs corresponding to the latest model, so that three decisions can be made:

[0099] If the confidence level of the similarity assessment result between the credit card to be tested and the abnormal credit card is higher than the upper threshold (right boundary) of the three decision threshold pairs, the credit card to be tested is classified into the positive domain, indicating that it has a high similarity with the abnormal credit card sample and can be directly uploaded to the anomaly database.

[0100] If the confidence level of the similarity assessment result between the credit card to be tested and the abnormal credit card is lower than the lower threshold (left boundary) of the three decision threshold pairs, the credit card to be tested is classified into the negative domain, indicating that the similarity with the abnormal credit card sample is low and the credit card sample can be saved.

[0101] If the confidence of the similarity evaluation result between the credit card to be tested and the abnormal credit card is between the lower threshold and the upper threshold of the three decision threshold pairs, the credit card to be tested is divided into the boundary domain. This indicates that the similarity with the abnormal credit card sample is not clear yet, and the credit card sample can be discarded.

[0102] At this time, if Figure 6 As shown in the figure, screening credit card samples for current task training as training data sets includes the following sub-steps:

[0103] S20': Establish an anomaly database; specifically, after completing the training of the anomaly detection model K based on the training set K', the anomaly detection model K detects the credit card sample to be detected, and determines whether it is an abnormal credit card sample based on the detection result. If so, upload it to the anomaly database. Figure 6 In , K and K+1 represent different rounds of detection tasks, and K' and (K+1)' correspond to the corresponding training sets under different rounds of detection tasks.

[0104] S21': The credit card sample selection module detects the similarity between the credit card sample and the abnormal credit card sample in the abnormal database, and combines the preset threshold to select the left border. and right border , the credit card samples to be selected are divided into positive domain, negative domain or boundary domain.

[0105] S22': If it is divided into the positive domain, it indicates that the similarity between the credit card sample and the abnormal credit card sample is high, and the credit card sample is divided into an abnormal credit card sample and uploaded to the abnormal database; if it is divided into the negative domain, it indicates that the similarity between the credit card sample and the abnormal credit card sample is low, and the credit card sample is divided into a normal credit card sample and retained; if it is divided into the boundary domain, it cannot be determined whether the credit card sample belongs to a normal credit card sample or an abnormal credit card sample, and the credit card sample is discarded;

[0106] S23': Integrate the reserved credit card samples to construct a training dataset.

[0107] In one example, if Figure 7 As shown, the continuous training of the anomaly detection model includes:

[0108] (1) When the model update cycle set by the bank arrives, the newly added credit card sample data that can be used for training during the update cycle period is preprocessed to obtain the training data set for the current model training task; if it is the first training task, the existing credit card samples are preprocessed to build the anomaly detection model corresponding to the first training round;

[0109] (2) Use the training data set of the current model training task to perform incremental training on the credit card abnormal transaction detection model obtained in the previous training task. During the incremental training process, use the parameter knowledge extracted from the credit card abnormal transaction detection model obtained in the previous training task to perform parameter optimization, obtain the credit card abnormal transaction detection model corresponding to the current training task, and extract the parameter knowledge of the model.

[0110] Preferably, a reused credit card sample is added based on the training data set obtained for the current model training task, and the determination of the reused credit card sample includes the following steps:

[0111] Each attribute of each credit card sample in the knowledge base is normalized, and the average value of each attribute is calculated. The feature sequence is formed according to the average value of each attribute, and the feature sequence is used as the centroid of the knowledge base at the current stage; wherein, the knowledge base stores representative normal credit card samples (samples with reconstruction loss less than the first reconstruction loss threshold are regarded as normal credit card samples, and the reconstruction loss is the reconstruction loss output by the anomaly detection model. The anomaly detection model is trained based on a large number of normal credit card samples, and the first reconstruction loss threshold is determined based on the data reconstruction of a large number of normal credit card samples by the anomaly detection model), so as to help the anomaly detection model identify abnormal transactions in the previous task. The attributes of the credit card samples include transaction time, transaction location, transaction amount, transaction frequency, etc.

[0112] Calculate the distance from each credit card sample to the centroid, such as by using the Euclidean distance, and use the credit card samples whose distance is less than the distance threshold as reused credit card samples. Furthermore, add the reused credit card samples to the training data set of the current model training task to participate in model training and optimization. The distance threshold can be set based on historical experience, or the distances from the credit card samples to the centroid can be sorted from small to large, and the distance threshold can be determined based on the top distance values, such as selecting the third distance value as the distance threshold, or the minimum distance value as the distance threshold.

[0113] In this example, the model is trained by screening representative normal credit card samples that retain knowledge and experience from previous tasks. The model can continuously extract information from representative financial transaction samples in previous tasks, improve its ability to identify abnormal situations, and enable the model to effectively identify abnormal financial transaction samples when faced with new and unknown credit card samples.

[0114] Furthermore, in the continuous training of the anomaly detection model, the Elastic Weight Consolidation (EWC) method is used to extract the model's parameter knowledge without saving the real credit card samples in the previous stage. The EWC method uses the importance of the parameters in the model as knowledge, and the information about the importance of the model parameters is transmitted between models. This knowledge will be passed to the next task, thereby limiting the range of changes in important parameters, so as to guide the next task to refer to this knowledge when training the model.

[0115] Furthermore, the parameter knowledge extracted from the credit card abnormal transaction detection model obtained from the previous training task is used to perform parameter optimization. Specifically, the parameters of the model in the current training task are compared with the parameter knowledge extracted from the credit card abnormal transaction detection model obtained from the previous task, and the difference between the two is incorporated into the loss function of the model parameter optimization of the current task, so that the parameters with larger weights in the credit card abnormal transaction detection model obtained in the previous task have larger weights in the loss function of the current task. When minimizing the loss function of the current task, the difference between the parameters of the new and old tasks is taken into consideration in the loss function, and the range of parameter changes is limited. The more important parameters in the previous task have larger weights in the current loss function, and have a greater impact on the loss function of the current task than general parameters. By minimizing the loss function, strict restrictions on the range of changes in different parameters are achieved, thereby retaining the knowledge learned in the previous task.

[0116] With two tasks , For example, the total training data set for the two tasks Contains training data sets corresponding to the two tasks and Build Tasks After the anomaly detection model is constructed, the EWC method is used to transfer the model knowledge to the task . Weight information of model parameters As knowledge, Extracted by EWC and passed to the task , limit the task Parameter weight information The specific principle of constructing the loss function is as follows:

[0117] ① According to the Bayesian formula, use the parameter The prior probability , marginal probability , conditional probability , the posterior probability can be calculated by the following formula :

[0118] .

[0119] ②Due to data set Completely divided into tasks and tasks , the above formula is equivalent to:

[0120] .

[0121] in, Representation Task The conditional probability of Representation Task The posterior probability of Representation Task The marginal probability of .

[0122] ③Since each subset affects the posterior probability, according to the Laplace approximation method, the loss function of EWC can be expressed as:

[0123] ;

[0124] in, represents the total loss; Representation Task loss; Based on the data set The Laplace approximation of the posterior probability is calculated; is the relative importance of the task; Indicates the current model parameters. The value of the parameter; Indicates that in the task The parameters learned The value of .

[0125] ④Task When building a model, the parameters are in the task The loss in is part of the total loss, and the parameters are relative to the task parameter The final selected parameters are to make To obtain the minimum value of the parameters, ideally, the task Have better performance; simultaneous tasks The more important the parameter is, the smaller the change is compared to the current parameter.

[0126] This example uses the continuous learning framework to transfer the knowledge contained in the existing model to assist in the next stage of modeling. In the fraud escalation scenario, in order to balance the two factors of model performance and detection accuracy, the elastic weight consolidation method based on regularization is used to achieve continuous learning. This method transfers the knowledge learned in the previous task to the next task by suppressing the change range of important parameters, providing a solution for improving the performance of the credit card abnormal transaction detection model in a complex financial environment.

[0127] In one example, in order to control the bank's credit risk within a certain range, three-way decision-making is used to process uncertain credit card samples. The three-way decision-making divides all credit card samples into three independent regions, namely the positive domain, the negative domain, or the boundary domain, based on the probability that the object belongs to a certain category. Since the principle of the three-way decision-making has been introduced above, it will not be repeated here. In this example, multiple predictions of uncertain credit card samples include:

[0128] The latest anomaly detection model is used to evaluate the similarity between the screened uncertain credit card samples and normal credit card samples, and the confidence of the evaluation results is statistically calculated. The three decision threshold pairs corresponding to the latest model are compared to achieve the following three decisions:

[0129] If the confidence level of the similarity assessment result between the credit card to be tested and the normal credit card is higher than the upper threshold (right boundary) of the three decision threshold pairs, the credit card to be tested is classified into the positive domain, indicating that it has a high similarity with the normal credit card sample and can be detected as a normal credit card.

[0130] If the confidence level of the similarity assessment result between the credit card to be tested and the normal credit card is lower than the lower threshold (left boundary) of the three decision threshold pairs, the credit card to be tested is classified into the negative domain, indicating that the similarity with the normal credit card sample is low and can be detected as an abnormal credit card.

[0131] If the confidence of the similarity evaluation result between the credit card to be tested and the normal credit card is between the lower threshold and the upper threshold of the three decision threshold pairs, the credit card to be tested is divided into the boundary domain. This indicates that the test result is not clear yet, and the application can be delayed until the next model update before testing.

[0132] Preferably, in order to further analyze the abnormal credit card samples, the credit card sample selection module based on the autoencoder architecture further collects abnormal transaction credit card samples. Specifically, the task of the autoencoder is to learn the low-dimensional representation of the credit card data. The encoder converts the feature data of the credit card samples into Mapping to hidden representation , the decoder will hide the representation Mapping back to original input data , to achieve data reconstruction. If the reconstruction loss of the credit card sample is less than the second reconstruction loss threshold, the reconstruction loss is the reconstruction loss output by the sample selection module. The sample selection module is trained based on a large number of abnormal credit card samples. The second reconstruction loss threshold is determined based on the data reconstruction of a large number of abnormal credit card samples by the sample selection module. At this time, the reconstruction loss of the credit card sample is small, indicating that the credit card sample is very similar to the abnormal credit card sample group. Therefore, it is included in the abnormal database as an abnormal credit card sample for further analysis and processing.

[0133] The above examples are combined to obtain a preferred example of the present invention, in which the detection method comprises the following steps:

[0134] S10: Build an anomaly database and initialize the credit card anomaly detection model;

[0135] S20: Filter credit card samples for current task training based on the credit card sample selection module as training data sets;

[0136] S30: incrementally update the anomaly detection model based on the training dataset of the current task;

[0137] S40: Perform credit card anomaly detection tasks and predict uncertain credit card samples multiple times;

[0138] S50: Determine whether the set model update cycle has been reached. If so, return to step S20 to start a new task; otherwise, return to step S40.

[0139] In the process of training the credit card abnormality model, the present invention first constructs an abnormality database and initializes the credit card abnormal transaction detection model, then takes each round of training model as a training task, and constructs the training data set of the current training round through the credit card sample selection module to train the model, wherein, for the first training task, the current existing credit card sample data is directly preprocessed to obtain the corresponding training data set. Among them, data preprocessing is used to clean, convert and prepare the original data to make the data suitable for model training, including processing missing values, abnormal values ​​and repeated values, selecting the most relevant features, scaling and encoding the features, and performing data conversion and dimensionality reduction, thereby improving the training efficiency and generalization ability of the model. For subsequent other training tasks, the corresponding training data set is obtained by preprocessing the newly added credit card sample data within the update cycle (the time interval between the previous training round and the current training round). In addition, after each round of training is completed, the parameter knowledge of the extracted model is passed to the next task. In the process of training the model, the next task combines the parameter knowledge extracted from the credit card abnormal transaction detection model obtained from the previous training task to perform parameter optimization, thereby guiding the update of the model, thereby realizing continuous learning of the model. When applying the model, three decisions are incorporated. That is, first, according to the confidence distribution of the prediction results of the credit card samples in the corresponding training data set by the current task model, the three decision threshold pairs corresponding to the current task model are adaptively set. When the credit card sample to be detected is received, the anomaly detection model of the current task (the latest model) is used to obtain the evaluation result of the similarity between the credit card sample to be detected and the normal credit card sample, and the confidence of the evaluation result is statistically calculated. Then, the confidence is compared with the three decision threshold pairs corresponding to the model to perform the three-branch decision task for the credit card sample to be detected: if it is divided into the positive domain, the decision of detecting it as a normal credit card is executed; if it is divided into the negative domain, the decision of detecting it as an abnormal credit card is executed; if it is divided into the boundary domain, the decision is delayed, and the credit card abnormal transaction detection model is waited for the next round of training, and then the anomaly detection is performed again on the credit card sample to be detected. In this way, the delayed decision processing of credit card samples with uncertainty is realized, and the attention to the suspicious credit card samples is strengthened, which facilitates banks to prevent the risks brought by abnormal transactions and realizes the effective management of credit card abnormal risks.

[0140] At the same time, the present invention controls the uncertainty of the prediction results through three-way decision making, thereby reducing the uncertainty in bank detection. The Sigmoid function in the neural network model is used as the evaluation function of the three-way decision making, which not only ensures the objectivity of the evaluation function, but also innovatively realizes the combination of continuous learning and three-way decision making. Moreover, unlike the traditional three-way decision making that always uses a constant decision threshold, the present invention combines the data distribution of each task and dynamically formulates an appropriate decision threshold for each task, thereby achieving effective control of uncertain credit card samples.

[0141] The above specific implementation methods are detailed descriptions of the present invention. It cannot be determined that the specific implementation methods of the present invention are limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions and substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. An abnormal transaction detection method based on continuous learning and dual autoencoder architecture, characterized in that: The following steps are involved: Build an anomaly database and initialize the credit card anomaly detection model, which is the first autoencoder; Filter credit card samples for current task training as training data sets; the credit card samples include basic cardholder information and credit card transaction information, the basic cardholder information includes gender, education, marital status, age, and the credit card transaction information includes transaction time, transaction location, transaction amount, and transaction frequency; Incrementally update the anomaly detection model based on the training dataset of the current task; Perform credit card anomaly detection tasks, predict uncertain credit card samples multiple times, and output detection results; Screening credit card samples for training the current task includes the following sub-steps: The similarity between the credit card sample to be selected and the abnormal credit card sample is calculated according to the sample selection module, and the credit card sample to be selected is divided into a positive domain, a negative domain or a boundary domain in combination with the first three decision threshold pairs of the preset sample selection module; the sample selection module is a second autoencoder; If it is classified into the positive domain, the similarity between the credit card sample and the abnormal credit card sample is high, the credit card sample is classified as an abnormal credit card sample, and the credit card sample is uploaded to the abnormal database; if it is classified into the negative domain, the similarity between the credit card sample and the abnormal credit card sample is low, the credit card sample is classified as a normal credit card sample, and the credit card sample is retained; if it is classified into the boundary domain, it cannot be determined whether the credit card sample belongs to a normal credit card sample or an abnormal credit card sample, and the credit card sample is discarded; Integrate the reserved credit card samples to construct a training dataset; A reused credit card sample is added to the training data set obtained for the current model training task. The determination of the reused credit card sample includes the following steps: Normalize each attribute of each credit card sample in the knowledge base, calculate the average value of each attribute, form a feature sequence based on the average value of each attribute, and use the feature sequence as the centroid of the knowledge base at the current stage; Calculate the distance from each credit card sample to the centroid, and take the credit card samples whose distance is less than the distance threshold as reused credit card samples.

2. The abnormal transaction detection method based on continuous learning and dual autoencoder architecture according to claim 1 is characterized in that: The network architecture of the first autoencoder and the second autoencoder is any one of a fully connected neural network, a recurrent neural network, a long short-term memory network, and a Transformer model.

3. The abnormal transaction detection method based on continuous learning and dual autoencoder architecture according to claim 1 is characterized in that: The determination of the first three decision threshold pairs comprises the following sub-steps: Input the credit card samples into the sample selection module, obtain the confidence of the evaluation results of the similarity between each credit card sample and the abnormal credit card sample, and sort the confidence of each evaluation result to form a first confidence sequence; The amount of credit card samples in the boundary domain is calculated based on the ratio of the number of credit card sample data entering the boundary domain to the total number of credit card sample data input, the left boundary of the first threshold pair is the confidence level of the evaluation result corresponding to half of the difference between the number of the first confidence sequence and the number of credit card samples in the boundary domain, and the right boundary of the first threshold pair is the confidence level of the evaluation result corresponding to half of the sum of the number of the first confidence sequence and the number of credit card samples in the boundary domain; A first three-branch decision threshold pair is determined according to the left boundary and the right boundary of the first threshold pair.

4. The abnormal transaction detection method based on continuous learning and dual autoencoder architecture according to claim 1 is characterized in that: The incremental updating of the anomaly detection model based on the training data set of the current task includes the following sub-steps: Preprocess the newly added credit card sample data during the update cycle to obtain the training data set for the current round, and perform incremental training on the anomaly detection model obtained in the previous round of training. During the incremental training process, use the parameter knowledge extracted from the anomaly detection model obtained in the previous training round to perform parameter optimization and obtain the anomaly detection model corresponding to the current training round. The method of performing parameter optimization using parameter knowledge extracted from the anomaly detection model obtained from the previous training round includes: The parameters of the anomaly detection model in the current round of training tasks are compared with the parameter knowledge extracted from the anomaly detection model obtained from the previous round of training tasks, and the parameter differences obtained from the comparison are incorporated into the loss function of the model parameter optimization of the current round of model training tasks, so that the parameters with larger weights in the credit card anomaly detection model obtained in the previous round of training tasks have larger weights in the loss function of the current round of training tasks.

5. The abnormal transaction detection method based on continuous learning and dual autoencoder architecture according to claim 1 is characterized in that: The execution of the credit card anomaly detection task and multiple predictions of uncertain credit card samples include the following sub-steps: Input the credit card sample to be tested into the anomaly detection model and output the detection result of the credit card sample; According to the confidence of the similarity test results of the credit card sample to be tested and the normal credit card sample, combined with the second and third decision threshold pairs of the preset anomaly detection model, the credit card sample to be tested is divided into the positive domain, the negative domain or the boundary domain; If it is classified into the positive domain, the credit card to be tested is a normal credit card; If it is classified into the negative domain, the credit card to be detected is an abnormal credit card; if it is classified into the boundary domain, wait for the anomaly detection model to complete the next round of training, and then perform credit card anomaly detection on this credit card sample to be detected again.

6. The abnormal transaction detection method based on continuous learning and dual autoencoder architecture according to claim 5 is characterized in that: The determination of the second and third decision threshold pairs includes the following sub-steps: Sorting the confidence levels of similarity detection results of the to-be-detected credit card sample and the normal credit card sample to form a second confidence level sequence; The number of credit card samples in the boundary domain is calculated based on the ratio of the number of credit card sample data to be detected that enters the boundary domain to the total number of credit card sample data input, the left boundary of the second threshold pair is the confidence level of the evaluation result corresponding to half of the difference between the number of second confidence sequence and the number of credit card samples in the boundary domain, and the right boundary of the second threshold pair is the confidence level of the evaluation result corresponding to half of the sum of the number of second confidence sequence and the number of credit card samples in the boundary domain; A second three-branch decision threshold pair is determined according to the left boundary and the right boundary of the second threshold pair.

7. The abnormal transaction detection method based on continuous learning and dual autoencoder architecture according to claim 1 is characterized in that: After outputting the detection result, the method further includes: Determine whether the set model update cycle has been reached; If not, perform the credit card anomaly detection task, predict the uncertain credit card samples multiple times, and output the detection results; If yes, perform the following substeps: Filter credit card samples used for current task training as training data sets; Incrementally update the anomaly detection model based on the training dataset of the current task; Perform credit card anomaly detection tasks, predict uncertain credit card samples multiple times, and output detection results.

8. The abnormal transaction detection method based on continuous learning and dual autoencoder architecture according to claim 7 is characterized in that: The model update cycle is a fixed time period or an update cycle when the credit card sample data currently available for incremental training reaches a threshold data volume.

Images