Transaction data anomaly detection method and device, program product and storage medium

Abstract

The embodiment of the invention provides a transaction data anomaly detection method and device, a program product and a storage medium, and the method comprises the steps: determining a target detection model combination from N groups of anomaly detection model combinations through employing sample transaction data, and enabling the target detection model combination to comprise M target sub-models which are sequentially connected; the first target transaction data is input into a target detection model combination to obtain an anomaly detection result sequence output by the last sub-model in the target detection model combination, in the target detection model combination, the input of the first sub-model is the first target transaction data, and the input of the second sub-model is the second target transaction data; the input of the other sub-models is the first target transaction data and the output result of the previous sub-model; and determining a target anomaly detection result of the first target transaction data based on the anomaly detection result sequence. The problem that abnormal transaction data cannot be efficiently detected in the prior art is solved, and the effect of improving the efficiency of detecting the abnormal transaction data is achieved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and more specifically, to a method and device for detecting anomalies in transaction data, a program product, and a storage medium. Background Art

[0002] At present, classification algorithms based on supervised learning and clustering algorithms based on unsupervised learning are common methods for achieving transaction risk management. However, the above methods require a large amount of labeled data to train the model, manually select and extract features, and consume a lot of computing resources and time to train and update the model. There is a problem that abnormal transaction data cannot be detected in real time and efficiently. Summary of the invention

[0003] The embodiments of the present application provide a method and device for detecting anomalies in transaction data, a program product, and a storage medium, so as to at least solve the problem in the related art that abnormal transaction data cannot be detected in real time and efficiently.

[0004] According to an embodiment of the present application, a method for detecting anomalies in transaction data is provided, comprising: determining a target detection model combination from N groups of anomaly detection model combinations using sample transaction data, wherein the target detection model combination includes M target sub-models connected in sequence, the M target sub-models belong to different types of anomaly detection models, and both N and M are natural numbers greater than 1; inputting first target transaction data into the target detection model combination to obtain an anomaly detection result sequence output by the last sub-model in the target detection model combination, wherein, in the target detection model combination, the input of the first sub-model is the first target transaction data, and the input of the remaining sub-models is the first target transaction data and the output result of the previous sub-model, each of the sub-models is used to perform anomaly detection on the input data, and the first target transaction data and the sample transaction data belong to the same type of data; determining a target anomaly detection result of the first target transaction data based on the anomaly detection result sequence.

[0005] In an exemplary embodiment, before determining the target detection model combination from N groups of anomaly detection model combinations using sample transaction data, the method further includes: performing target processing on the original transaction data to obtain the sample transaction data, wherein the target processing includes at least one of the following: deleting duplicate data in the original transaction data, correcting abnormal data in the original transaction data, filling missing data in the original transaction data, and converting the data format of the original transaction data; combining multiple sub-models according to preset rules to obtain N groups of the above-mentioned anomaly detection model combinations, wherein the preset rules are determined according to the types of the multiple sub-models, each group of the above-mentioned anomaly detection model combinations includes M sub-models connected in sequence, the M sub-models belong to different types of anomaly detection models, and the multiple sub-models include the M target sub-models.

[0006] In an exemplary embodiment, sample transaction data is used to determine a target detection model combination from N groups of anomaly detection model combinations, including: inputting the above sample transaction data into the N groups of the above anomaly detection model combinations respectively, and obtaining N groups of sample detection results output by the N groups of the above anomaly detection model combinations, wherein, in the above anomaly detection model combination, the input of the first sub-model is the above sample transaction data, and the input of the remaining sub-models is the above sample transaction data and the output result of the previous sub-model, each of the above sub-models is used to perform anomaly detection on the input data, and the above output result is the probability value of the degree of anomaly of the above sample transaction data; the above target detection model combination is determined based on the N groups of sample detection results.

[0007] In an exemplary embodiment, the above-mentioned sample transaction data are respectively input into N groups of the above-mentioned anomaly detection model combinations to obtain N groups of sample detection results output by the N groups of the above-mentioned anomaly detection model combinations, including: inputting the above-mentioned sample transaction data into N groups of the above-mentioned anomaly detection model combinations to obtain a sample detection sequence output by the last sub-model in each group of the above-mentioned anomaly detection model combinations; sorting the sample detection sequence of each group of the above-mentioned anomaly detection model combinations according to a first sorting rule to obtain a target sample detection sequence for each group of the above-mentioned anomaly detection model combinations; screening the above-mentioned sample detection results from the target sample detection sequence of each group of the above-mentioned anomaly detection model combinations according to a first threshold to obtain N groups of the above-mentioned sample detection results.

[0008] In an exemplary embodiment, the target detection model combination is determined based on N groups of the sample detection results, including: comparing each group of the sample detection results with the reference detection results to obtain N comparison results, wherein the reference detection results are true detection results of the sample transaction data; determining the target detection model combination based on the N comparison results, wherein the target detection model combination corresponds to a target comparison result among the N comparison results, and a matching degree between the target comparison result and the reference detection result is greater than a preset threshold.

[0009] In an exemplary embodiment, determining the target anomaly detection result of the first target transaction data based on the anomaly detection result sequence includes: sorting the anomaly detection result sequence according to a second sorting rule to obtain the target anomaly detection sequence of the target detection model combination; and filtering the target anomaly detection result from the target anomaly detection sequence according to a second threshold.

[0010] According to an embodiment of the present application, a transaction data anomaly detection device is provided, comprising: a first determination module, used to determine a target detection model combination from N groups of anomaly detection model combinations using sample transaction data, wherein the target detection model combination includes M sub-models connected in sequence, the M sub-models belong to different types of anomaly detection models, and both N and M are natural numbers greater than 1; a first input module, used to input the first target transaction data into the target detection model combination to obtain an anomaly detection result sequence output by the last sub-model in the target detection model combination, wherein, in the target detection model combination, the input of the first sub-model is the first target transaction data, and the input of the remaining sub-models is the first target transaction data and the output result of the previous sub-model, each of the sub-models is used to perform anomaly detection on the input data, and the first target transaction data and the sample transaction data belong to the same type of data; a second determination module, used to determine the target anomaly detection result of the first target transaction data based on the anomaly detection result sequence.

[0011] In an exemplary embodiment, the above-mentioned device also includes: a first processing module, which is used to perform target processing on the original transaction data before using the sample transaction data to determine the target detection model combination from N groups of anomaly detection model combinations to obtain the above-mentioned sample transaction data, wherein the above-mentioned target processing includes at least one of the following: deleting duplicate data in the above-mentioned original transaction data, correcting abnormal data in the above-mentioned original transaction data, filling missing data in the above-mentioned original transaction data, and converting the data format of the above-mentioned original transaction data; a first combination module, which is used to combine multiple sub-models according to preset rules to obtain N groups of the above-mentioned anomaly detection model combinations, wherein the above-mentioned preset rules are determined according to the types of the above-mentioned multiple sub-models, and each group of the above-mentioned anomaly detection model combinations includes M sub-models connected in sequence, the above-mentioned M sub-models belong to different types of anomaly detection models, and the multiple sub-models include the above-mentioned M target sub-models.

[0012] In an exemplary embodiment, the first determination module includes: a first input submodule, used to input the sample transaction data into N groups of the anomaly detection model combinations, respectively, to obtain N groups of sample detection results output by the N groups of the anomaly detection model combinations, wherein, in the anomaly detection model combination, the input of the first submodel is the sample transaction data, and the input of the remaining submodels is the sample transaction data and the output result of the previous submodel, each of the submodels is used to perform anomaly detection on the input data, and the output result is the probability value of the degree of anomaly of the sample transaction data; the first determination submodule is used to determine the target detection model combination based on the N groups of sample detection results.

[0013] In an exemplary embodiment, the above-mentioned first input submodule includes: a first input unit, used to input the above-mentioned sample transaction data into N groups of the above-mentioned anomaly detection model combinations respectively, to obtain the sample detection sequence output by the last submodel in each group of the above-mentioned anomaly detection model combinations; a first sorting unit, used to sort the sample detection sequence of each group of the above-mentioned anomaly detection model combinations according to a first sorting rule, to obtain a target sample detection sequence for each group of the above-mentioned anomaly detection model combinations; a first screening unit, used to screen the above-mentioned sample detection results from the target sample detection sequence of each group of the above-mentioned anomaly detection model combinations according to a first threshold, to obtain N groups of the above-mentioned sample detection results.

[0014] In an exemplary embodiment, the first determination submodule includes: a first comparison unit, used to compare each group of the sample detection results with the reference detection results to obtain N comparison results, wherein the reference detection results are true detection results of the sample transaction data; a first determination unit, used to determine the target detection model combination based on the N comparison results, wherein the target detection model combination corresponds to the target comparison result among the N comparison results, and the matching degree between the target comparison result and the reference detection result is greater than a preset threshold.

[0015] In an exemplary embodiment, the above-mentioned second determination module includes: a second sorting unit, used to sort the above-mentioned anomaly detection result sequence according to a second sorting rule to obtain the target anomaly detection sequence of the above-mentioned target detection model combination; a second screening unit, used to screen the above-mentioned target anomaly detection result from the above-mentioned target anomaly detection sequence according to a second threshold.

[0016] According to another embodiment of the present application, a computer program product is provided, including a computer program, wherein the computer program is configured for a processor to execute the steps of any of the above method embodiments.

[0017] According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to enable a processor to execute the steps in any of the above method embodiments.

[0018] According to another embodiment of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor is configured to execute the computer program to perform the steps in any one of the method embodiments.

[0019] Through this application, sample transaction data is used to determine a target detection model combination consisting of multiple M target sub-models; the first target transaction data in the target detection model combination is subjected to anomaly detection, and an anomaly detection result sequence output by the last sub-model in the target detection model combination is obtained, wherein, in the target detection model combination, the input of the first sub-model is the first target transaction data, and the input of the remaining sub-models is the first target transaction data and the output result of the previous sub-model, and each sub-model is used to perform anomaly detection on the input data, and the target anomaly detection result of the first target transaction data is determined based on the anomaly detection result sequence. The target detection model combination can fully combine the advantages of each target sub-model, so that the target detection model combination can have efficient detection capabilities in different situations, thereby solving the problem that the related technology cannot detect abnormal transaction data in real time and efficiently, and achieving the effect of improving the efficiency of detecting abnormal transaction data. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a hardware structure block diagram of a mobile terminal of a method for detecting abnormality of transaction data according to an embodiment of the present application;

[0021] Figure 2 is a flow chart of a method for detecting anomalies in transaction data according to an embodiment of the present application;

[0022] Figure 3 is a flowchart of anomaly detection of foreign exchange transaction data in a specific embodiment of the present application;

[0023] Figure 4 It is a structural block diagram of a transaction data anomaly detection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0026] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 1 is a hardware structure block diagram of a mobile terminal of a transaction data anomaly detection method according to an embodiment of the present application. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0027] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as a computer program corresponding to a method for detecting anomalies in transaction data in an embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0028] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0029] In this embodiment, a method for detecting anomalies in transaction data is provided. Figure 2 is a flow chart of a method for detecting anomalies in transaction data according to an embodiment of the present application. Figure 2 As shown, the process includes the following steps:

[0030] Step S202, using the sample transaction data to determine a target detection model combination from N groups of anomaly detection model combinations, wherein the target detection model combination includes M target sub-models connected in sequence, the M target sub-models belong to different types of anomaly detection models, and N and M are both natural numbers greater than 1;

[0031] Step S204: input the first target transaction data into the target detection model combination to obtain a sequence of anomaly detection results output by the last sub-model in the target detection model combination, wherein, in the target detection model combination, the input of the first sub-model is the first target transaction data, and the input of the remaining sub-models is the first target transaction data and the output result of the previous sub-model, each sub-model is used to perform anomaly detection on the input data, and the first target transaction data and the sample transaction data belong to the same type of data;

[0032] Step S206: determining a target anomaly detection result of the first target transaction data based on the anomaly detection result sequence.

[0033] In this embodiment, the execution subject of the above steps can be a terminal, a server, a specific processor set in the terminal or server, or a processor or processing device set relatively independently from the terminal or server, but is not limited thereto. For example, a risk assessment system of a commercial bank.

[0034] Optionally, the sample transaction data may be foreign exchange transaction data, including but not limited to: transaction customer, transaction date, transaction region, transaction amount, transaction currency, transaction quotation, transaction time, and transaction counterparty.

[0035] Optionally, the target sub-model type includes but is not limited to an anomaly detection model based on probability and statistical distribution, an anomaly detection model based on hyperplane partitioning, and an anomaly detection model based on neighborhood point distance.

[0036] Through the above steps, the sample transaction data is used to determine a target detection model combination consisting of multiple M target sub-models; the first target transaction data in the target detection model combination is subjected to anomaly detection, and an anomaly detection result sequence output by the last sub-model in the target detection model combination is obtained, wherein, in the target detection model combination, the input of the first sub-model is the first target transaction data, and the input of the remaining sub-models is the first target transaction data and the output result of the previous sub-model, and each sub-model is used to perform anomaly detection on the input data, and the target anomaly detection result of the first target transaction data is determined based on the anomaly detection result sequence. The target detection model combination can fully combine the advantages of each target sub-model, so that the target detection model combination can have efficient detection capabilities in different situations, thereby solving the problem that the related technology cannot detect abnormal transaction data in real time and efficiently, and achieving the effect of improving the efficiency of detecting abnormal transaction data.

[0037] In an exemplary embodiment, before determining the target detection model combination from N groups of anomaly detection model combinations using sample transaction data, the method further includes: performing target processing on the original transaction data to obtain the sample transaction data, wherein the target processing includes at least one of the following: deleting duplicate data in the original transaction data, correcting abnormal data in the original transaction data, filling missing data in the original transaction data, and converting the data format of the original transaction data; combining multiple sub-models according to preset rules to obtain N groups of the above-mentioned anomaly detection model combinations, wherein the preset rules are determined according to the types of the multiple sub-models, each group of the above-mentioned anomaly detection model combinations includes M sub-models connected in sequence, the M sub-models belong to different types of anomaly detection models, and the multiple sub-models include the M target sub-models.

[0038] Optionally, in this embodiment, since the acquired original transaction data is highly noisy, for example, there are repeated and redundant transaction amounts, incorrect transaction time format, missing transaction amounts, etc., it is necessary to perform targeted processing on the acquired original transaction data according to the above situations. The sub-model types include but are not limited to anomaly detection models based on probability and statistical distribution, anomaly detection models based on hyperplane partitioning, and anomaly detection models based on neighborhood point distance. Among them, anomaly detection models based on probability and statistical distribution include but are not limited to: HBOS (Histogram-Based Outlier Score, Chinese name: Histogram-based Outlier Score Algorithm), CBLOF (Clustering-Based Local Outlier Factor, Chinese name: Clustering-Based Local Outlier Factor Algorithm), MCD (Minimum Covariance Determinant, Chinese name: Minimum Covariance Determinant Algorithm), PCA (Principal Component Analysis, Chinese name: Principal Component Analysis Algorithm), anomaly detection models based on hyperplane partitioning include but are not limited to: Isolation Forest (Chinese name: Isolation Forest Algorithm), Feature Bagging (Chinese name: Feature Random Subspace Algorithm), ABOD (Angle-Based Outlier Detection, Chinese name: Anomaly Detection Algorithm Based on Angle), anomaly detection models based on neighborhood point distance include but are not limited to: KNN (K-Nearest Neural Network). Neighbors (Chinese name: K nearest neighbor algorithm), Average KNN (Chinese name: Average K nearest neighbor algorithm), LOF (Local Outlier Factor Chinese name: Local Outlier Factor algorithm). According to the types of multiple sub-models, multiple anomaly detection model combinations can be combined, for example: HBOS-solation Forest-KNN, HBOS-Feature Bagging-KNN, KNN-solation Forest-HBOS. In this embodiment, by performing target processing on the original transaction data, different types of sub-models are combined to obtain multiple anomaly detection model combinations, thereby achieving the purpose of improving the quality and accuracy of sample transaction data and the performance and accuracy of the target detection model combination.

[0039] In an exemplary embodiment, sample transaction data is used to determine a target detection model combination from N groups of anomaly detection model combinations, including: inputting the above sample transaction data into the N groups of the above anomaly detection model combinations respectively, and obtaining N groups of sample detection results output by the N groups of the above anomaly detection model combinations, wherein, in the above anomaly detection model combination, the input of the first sub-model is the above sample transaction data, and the input of the remaining sub-models is the above sample transaction data and the output result of the previous sub-model, each of the above sub-models is used to perform anomaly detection on the input data, and the above output result is the probability value of the degree of anomaly of the above sample transaction data; the above target detection model combination is determined based on the N groups of sample detection results.

[0040] Optionally, in this embodiment, for example, the sample transaction data includes foreign exchange transaction behavior data of customers A, B, and C, and the anomaly detection model combination A is HBOS-solation Forest-KNN. The sample transaction data is input into the anomaly detection model combination A, HBOS performs anomaly detection on the foreign exchange transaction behavior data of customers A, B, and C, and outputs the probability values ​​of the abnormality of customers A, B, and C to solation Forest, solation Forest performs anomaly detection on the foreign exchange transaction behavior data of customers A, B, and C and the probability values ​​of the abnormality of customers A, B, and C output by HBOS, and outputs the probability values ​​of the abnormality of customers A, B, and C to KNN, KNN performs anomaly detection on the foreign exchange transaction behavior data of customers A, B, and C and the probability values ​​of the abnormality of customers A, B, and C output by solation Forest, and outputs the probability values ​​of the abnormality of customers A, B, and C. In this embodiment, the sample transaction data is processed by combining sub-models, so that the subsequent sub-model can use the output result of the previous sub-model to achieve the purpose of more effectively identifying abnormal transaction data.

[0041] In an exemplary embodiment, the above-mentioned sample transaction data are respectively input into N groups of the above-mentioned anomaly detection model combinations to obtain N groups of sample detection results output by the N groups of the above-mentioned anomaly detection model combinations, including: inputting the above-mentioned sample transaction data into N groups of the above-mentioned anomaly detection model combinations to obtain a sample detection sequence output by the last sub-model in each group of the above-mentioned anomaly detection model combinations; sorting the sample detection sequence of each group of the above-mentioned anomaly detection model combinations according to a first sorting rule to obtain a target sample detection sequence for each group of the above-mentioned anomaly detection model combinations; screening the above-mentioned sample detection results from the target sample detection sequence of each group of the above-mentioned anomaly detection model combinations according to a first threshold to obtain N groups of the above-mentioned sample detection results.

[0042] Optionally, in this embodiment, based on the above embodiment, KNN performs anomaly detection on the foreign exchange transaction behavior data of customer A, customer B, and customer C and the probability values ​​of the abnormality of customer A, customer B, and customer C output by solation forest, and outputs the probability values ​​of the abnormality of customer A, customer B, and customer C, which is the sample detection sequence output by the last sub-model of the abnormality detection model combination A. The probability values ​​of the abnormality of customer A, customer B, and customer C can be sorted based on the first sorting rule from large to small to obtain a target sample detection sequence, and can be screened according to a specific threshold value (e.g., x%) of expert opinion as the sample detection result of the abnormality detection model combination A. In this embodiment, the sample detection result is obtained by screening the target sample detection sequence, so as to achieve the purpose of accurately determining the detection result of each abnormal model combination.

[0043] In an exemplary embodiment, the target detection model combination is determined based on N groups of the sample detection results, including: comparing each group of the sample detection results with the reference detection results to obtain N comparison results, wherein the reference detection results are true detection results of the sample transaction data; determining the target detection model combination based on the N comparison results, wherein the target detection model combination corresponds to a target comparison result among the N comparison results, and a matching degree between the target comparison result and the reference detection result is greater than a preset threshold.

[0044] Optionally, in this embodiment, the reference detection results determine abnormal transactions in the sample transaction data. Specifically, the sample transaction data can be marked based on existing rules, or can be summarized and analyzed based on historical abnormal transaction behavior data. Suspicious transactions can also be classified through a risk expert system. For example, if the customer's transaction frequency is suddenly abnormal, the customer's transaction amount in a short period of time is much higher than the normal level, and the customer frequently conducts transactions during non-business hours, the sample transaction data with similar characteristics can be marked as suspicious with reference to past historical abnormal transaction behaviors. Based on the reference detection results of the sample transaction data, the sample detection results obtained by the abnormal detection model combination are compared to see if they are accurate, thereby determining the target detection model combination. In this embodiment, the target detection model combination is determined by comparing each group of sample detection results with the reference detection results, thereby achieving the purpose of efficiently and accurately determining the target detection model combination.

[0045] In an exemplary embodiment, determining the target anomaly detection result of the first target transaction data based on the anomaly detection result sequence includes: sorting the anomaly detection result sequence according to a second sorting rule to obtain the target anomaly detection sequence of the target detection model combination; and filtering the target anomaly detection result from the target anomaly detection sequence according to a second threshold.

[0046] Optionally, in this embodiment, the anomaly detection result sequence can be sorted based on the second sorting rule from large to small to obtain a target anomaly detection sequence, which can be screened according to a specific threshold (e.g., x%) of expert opinion, that is, the sample detection result of the target detection model combination. In this embodiment, the target anomaly detection result is obtained by screening the target sample detection sequence, thereby achieving the purpose of accurately determining the detection result of the target detection model combination.

[0047] The present invention will be described below in conjunction with specific embodiments:

[0048] This specific embodiment is explained by taking foreign exchange transaction behavior data as an example. Figure 3 This is a flowchart of anomaly detection of foreign exchange transaction data in a specific embodiment of the present application, including the following steps:

[0049] S302, target processing of the original transaction data: to ensure the quality and applicability of foreign exchange transaction data. Target processing includes the following steps: 1. Data cleaning: deleting duplicate records, correcting erroneous information, standardizing data formats (unifying the unit of transaction amount, adjusting the timestamp format), etc.; 2. Missing value filling: For missing data, different strategies are used to fill, such as using the column average, median, or inference based on similar records. Through the above target processing, the sample transaction data shown in Table 1 is obtained;

[0050] Table 1:

[0051]

[0052] S304, constructing N groups of anomaly detection model combinations based on statistical and probability distribution models, hyperplane partitioning models, and neighborhood point distance models: Assume that the anomaly detection models based on probability and statistical distribution include: HBOS, CBLOF, MCD, PCA, the anomaly detection models based on hyperplane partitioning include: Isolation Forest, Feature Bagging, ABOD, and the anomaly detection models based on neighborhood point distance include: KNN, Average KNN, LOF. According to the types of multiple sub-models, 216 groups of anomaly detection model combinations can be combined, for example: HBOS-solation Forest-KNN, HBOS-Feature Bagging-KNN, KNN-solation Forest-HBOS. Taking the HBOS-solation Forest-KNN anomaly detection model combination as an example, the data in Table 1 are processed to obtain: HBOS performs anomaly detection on the foreign exchange trading behavior data of customer A, customer B, and customer C, and outputs the probability values ​​of the abnormality levels of customer A, customer B, and customer C to solation Forest as shown in Table 2; solationForest performs anomaly detection on the foreign exchange trading behavior data of customer A, customer B, and customer C and the probability values ​​of the abnormality levels of customer A, customer B, and customer C output by HBOS as shown in Table 3, and outputs the probability values ​​of the abnormality levels of customer A, customer B, and customer C to KNN; KNN performs anomaly detection on the foreign exchange trading behavior data of customer A, customer B, and customer C and the probability values ​​of the abnormality levels of customer A, customer B, and customer C output by solation Forest as shown in Table 4, and outputs the probability values ​​of the abnormality levels of customer A, customer B, and customer C.

[0053] Table 2:

[0054]

[0055] Table 3:

[0056]

[0057] Table 4:

[0058]

[0059] S306, determine the target detection model combination: the 216 groups of anomaly detection model combinations output 216 sample detection sequences, sort the probability values ​​of the abnormality of customer A, customer B, and customer C based on the first sorting rule from large to small to obtain the target sample detection sequence, and screen according to the specific threshold (for example: x%) of expert opinion as the sample detection result of the anomaly detection model combination. Taking Table 4 as an example, the probability values ​​output by the last sub-model KNN are sorted to obtain: customer A-0.999>customer C-0.654>customer B-0.432, and the foreign exchange transaction behavior of customer A is determined to be an abnormal transaction, which is the sample detection result of the HBOS-solation Forest-KNN anomaly detection model combination. The sample detection results of the 216 groups of anomaly detection model combinations are compared with the label of "whether it is a suspicious transaction" (corresponding to the above reference detection results), and the anomaly detection model combination with higher anomaly detection accuracy is determined from the 216 groups of anomaly detection model combinations, which is the target detection model combination. Specifically, sample transaction data can be marked based on existing rules, or summarized and analyzed based on historical abnormal transaction behavior data. The risk expert system can also determine the label of "whether it is a suspicious transaction", for example: the customer's transaction frequency is suddenly abnormal, the customer's transaction amount in a short period of time is much higher than the normal level, and the customer frequently conducts transactions during non-business hours. With reference to past historical abnormal transaction behaviors, sample transaction data with similar characteristics can be marked as suspicious;

[0060] S308, first target transaction data anomaly detection: applying the target detection model combination to the new data (corresponding to the above-mentioned first target transaction data), detecting the foreign exchange transaction behavior, and screening out the ones that can be traded.

[0061] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.

[0062] In this embodiment, a transaction data anomaly detection device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0063] Figure 4 is a structural block diagram of a transaction data anomaly detection device according to an embodiment of the present application, such as Figure 4 As shown, the device comprises:

[0064] A first determination module 402 is used to determine a target detection model combination from N groups of anomaly detection model combinations using sample transaction data, wherein the target detection model combination includes M sub-models connected in sequence, the M sub-models belong to different types of anomaly detection models, and both N and M are natural numbers greater than 1;

[0065] The first input module 404 is used to input the first target transaction data into the target detection model combination to obtain a sequence of anomaly detection results output by the last sub-model in the target detection model combination, wherein, in the target detection model combination, the input of the first sub-model is the first target transaction data, and the input of the remaining sub-models is the first target transaction data and the output result of the previous sub-model, each of the sub-models is used to perform anomaly detection on the input data, and the first target transaction data and the sample transaction data are of the same type of data;

[0066] The second determination module 406 is used to determine the target anomaly detection result of the first target transaction data based on the anomaly detection result sequence.

[0067] In an exemplary embodiment, the above-mentioned device also includes: a first processing module, which is used to perform target processing on the original transaction data before using the sample transaction data to determine the target detection model combination from N groups of anomaly detection model combinations to obtain the above-mentioned sample transaction data, wherein the above-mentioned target processing includes at least one of the following: deleting duplicate data in the above-mentioned original transaction data, correcting abnormal data in the above-mentioned original transaction data, filling missing data in the above-mentioned original transaction data, and converting the data format of the above-mentioned original transaction data; a first combination module, which is used to combine multiple sub-models according to preset rules to obtain N groups of the above-mentioned anomaly detection model combinations, wherein the above-mentioned preset rules are determined according to the types of the above-mentioned multiple sub-models, and each group of the above-mentioned anomaly detection model combinations includes M sub-models connected in sequence, the above-mentioned M sub-models belong to different types of anomaly detection models, and the multiple sub-models include the above-mentioned M target sub-models.

[0068] In an exemplary embodiment, the first determination module includes: a first input submodule, used to input the sample transaction data into N groups of the anomaly detection model combinations, respectively, to obtain N groups of sample detection results output by the N groups of the anomaly detection model combinations, wherein, in the anomaly detection model combination, the input of the first submodel is the sample transaction data, and the input of the remaining submodels is the sample transaction data and the output result of the previous submodel, each of the submodels is used to perform anomaly detection on the input data, and the output result is the probability value of the degree of anomaly of the sample transaction data; the first determination submodule is used to determine the target detection model combination based on the N groups of sample detection results.

[0069] In an exemplary embodiment, the above-mentioned first input submodule includes: a first input unit, used to input the above-mentioned sample transaction data into N groups of the above-mentioned anomaly detection model combinations respectively, to obtain the sample detection sequence output by the last submodel in each group of the above-mentioned anomaly detection model combinations; a first sorting unit, used to sort the sample detection sequence of each group of the above-mentioned anomaly detection model combinations according to a first sorting rule, to obtain a target sample detection sequence for each group of the above-mentioned anomaly detection model combinations; a first screening unit, used to screen the above-mentioned sample detection results from the target sample detection sequence of each group of the above-mentioned anomaly detection model combinations according to a first threshold, to obtain N groups of the above-mentioned sample detection results.

[0070] In an exemplary embodiment, the first determination submodule includes: a first comparison unit, used to compare each group of the sample detection results with the reference detection results to obtain N comparison results, wherein the reference detection results are true detection results of the sample transaction data; a first determination unit, used to determine the target detection model combination based on the N comparison results, wherein the target detection model combination corresponds to the target comparison result among the N comparison results, and the matching degree between the target comparison result and the reference detection result is greater than a preset threshold.

[0071] In an exemplary embodiment, the above-mentioned second determination module includes: a second sorting unit, used to sort the above-mentioned anomaly detection result sequence according to a second sorting rule to obtain the target anomaly detection sequence of the above-mentioned target detection model combination; a second screening unit, used to screen the above-mentioned target anomaly detection result from the above-mentioned target anomaly detection sequence according to a second threshold.

[0072] An embodiment of the present application provides a computer program product, including a computer program, and when the computer program is executed by a processor, the steps in any one of the above method embodiments are implemented.

[0073] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when run.

[0074] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0075] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0076] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0077] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0078] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0079] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting anomalies in transaction data, characterized in that: include: Determine a target detection model combination from N groups of anomaly detection model combinations using sample transaction data, wherein the target detection model combination includes M target sub-models connected in sequence, the M target sub-models belong to different types of anomaly detection models, and both N and M are natural numbers greater than 1; Inputting the first target transaction data into the target detection model combination to obtain a sequence of anomaly detection results output by the last sub-model in the target detection model combination, wherein in the target detection model combination, the input of the first sub-model is the first target transaction data, and the inputs of the remaining sub-models are the first target transaction data and the output results of the previous sub-model, each of the sub-models is used to perform anomaly detection on the input data, and the first target transaction data and the sample transaction data are of the same type of data; A target anomaly detection result of the first target transaction data is determined based on the anomaly detection result sequence.

2. The method according to claim 1, characterized in that Before determining the target detection model combination from the N groups of anomaly detection model combinations using the sample transaction data, the method further includes: Performing target processing on the original transaction data to obtain the sample transaction data, wherein the target processing includes at least one of the following: deleting duplicate data in the original transaction data, correcting abnormal data in the original transaction data, filling missing data in the original transaction data, and converting the data format of the original transaction data; Combine multiple sub-models according to preset rules to obtain N groups of anomaly detection model combinations, wherein the preset rules are determined according to the types of the multiple sub-models, each group of the anomaly detection model combination includes M sub-models connected in sequence, the M sub-models belong to different types of anomaly detection models, and the multiple sub-models include the M target sub-models.

3. The method according to claim 1, characterized in that Using sample transaction data, a target detection model combination is determined from N groups of anomaly detection model combinations, including: Input the sample transaction data into N groups of the anomaly detection model combinations respectively, and obtain N groups of sample detection results output by the N groups of the anomaly detection model combinations, wherein in the anomaly detection model combination, the input of the first sub-model is the sample transaction data, and the input of the remaining sub-models is the sample transaction data and the output result of the previous sub-model, each of the sub-models is used to perform anomaly detection on the input data, and the output result is the probability value of the degree of anomaly of the sample transaction data; The target detection model combination is determined based on the N groups of sample detection results.

4. The method according to claim 3, characterized in that Inputting the sample transaction data into N groups of the anomaly detection model combinations respectively, and obtaining N groups of sample detection results output by the N groups of the anomaly detection model combinations, including: Input the sample transaction data into N groups of anomaly detection model combinations respectively, and obtain a sample detection sequence output by the last sub-model in each group of anomaly detection model combinations; Sorting the sample detection sequence of each group of the anomaly detection model combination according to the first sorting rule to obtain the target sample detection sequence of each group of the anomaly detection model combination; The sample detection results are obtained by screening the target sample detection sequence of each group of the abnormal detection model combination according to the first threshold, and N groups of the sample detection results are obtained.

5. The method according to claim 3, characterized in that: Determining the target detection model combination based on the N groups of sample detection results includes: Compare each group of sample test results with the reference test results to obtain N comparison results, wherein the reference test results are true test results of the sample transaction data; The target detection model combination is determined based on the N comparison results, wherein the target detection model combination corresponds to a target comparison result among the N comparison results, and a matching degree between the target comparison result and the reference detection result is greater than a preset threshold.

6. The method according to claim 1, characterized in that Determining a target anomaly detection result of the first target transaction data based on the anomaly detection result sequence includes: Sorting the anomaly detection result sequence according to a second sorting rule to obtain a target anomaly detection sequence of the target detection model combination; The target anomaly detection result is obtained by screening from the target anomaly detection sequence according to a second threshold.

7. A transaction data anomaly detection device, characterized in that: include: A first determination module is used to determine a target detection model combination from N groups of anomaly detection model combinations using sample transaction data, wherein the target detection model combination includes M sub-models connected in sequence, the M sub-models belong to different types of anomaly detection models, and both N and M are natural numbers greater than 1; A first input module, used for inputting the first target transaction data into the target detection model combination to obtain a sequence of anomaly detection results output by the last sub-model in the target detection model combination, wherein in the target detection model combination, the input of the first sub-model is the first target transaction data, and the input of the remaining sub-models is the first target transaction data and the output result of the previous sub-model, each of the sub-models is used for performing anomaly detection on the input data, and the first target transaction data and the sample transaction data are of the same type of data; The second determination module is used to determine a target anomaly detection result of the first target transaction data based on the anomaly detection result sequence.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 6 when executed by a processor.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 6 are implemented.

Images