A security protection system for remote payment

Abstract

The present invention belongs to the technical field of payment protection, and discloses a remote payment security protection system; the system comprises: obtaining remote payment transaction data; preprocessing the remote payment transaction data; obtaining transaction feature data; clustering the transaction feature data based on a clustering algorithm to obtain n transaction clusters; finding abnormal transaction clusters from the n transaction clusters using a dragonfly algorithm; using Markov chain modeling for the transaction feature data in the abnormal transaction cluster to calculate the abnormal probability of the corresponding remote payment transaction data; presetting an abnormal threshold, and treating the remote payment transaction data with an abnormal probability greater than or equal to the abnormal threshold as a high-risk transaction; the security of remote payment is enhanced, the payment experience of users is improved, and a large amount of manpower and financial costs are saved at the same time.

Description

Technical Field

[0001] The present invention relates to the field of payment protection technology, and more specifically, to a remote payment security protection system. Background Art

[0002] The patent application with application publication number CN110472966A discloses a mobile payment security protection system, including: an authority setting device, which is set on a smart phone and is used to set the payment geographical scope allowed for mobile payment and the payment time period allowed for mobile payment according to the user's operation; an electronic payment device, which is used to start or close the current electronic payment project according to the user's operation; a positioning monitoring device, which has a built-in satellite navigation unit, which is used to provide the current navigation data of the smart phone; a timing device, which is used to provide the current time of the smart phone. Since the number of running tasks of the electronic payment device and related devices is adaptively adjusted based on the current data processing rate of the electronic payment device, the overall performance of the system is further optimized, thereby providing a double security protection mechanism for mobile payment.

[0003] The patent application with application publication number CN111192049A discloses a network security payment protection method and mobile terminal, including: after receiving the SMS verification code used for payment, encrypting the SMS verification code; receiving the decryption instruction of the SMS verification code, and judging whether the decryption instruction is correct; if correct, displaying the SMS verification code; if incorrect, displaying a prompt message that the SMS verification code has not been decrypted successfully, even if the SMS verification code is stolen, only the encrypted form of the SMS verification code can be seen, reducing the risk of the SMS verification code being stolen and used during the validity period, thereby ensuring the property safety of the property owner.

[0004] However, the existing cross-regional payment security protection still has many deficiencies. First, it is difficult for traditional systems to capture transaction patterns comprehensively and accurately. They often only focus on a single dimension and ignore the comprehensive analysis of multi-dimensional features, resulting in low accuracy in abnormal transaction detection, making it difficult to identify some carefully disguised fraudulent behaviors. Secondly, they lack the ability to dynamically adjust and cannot effectively adapt to changes in transaction patterns in different scenarios, such as transactions during holidays or special promotions, which can easily cause a large number of false alarms or missed reports. Furthermore, traditional protection methods are often limited to known fraud patterns and lack the ability to discover new fraud methods. They are in a passive defense state. With the advancement of fraud technology, As the world continues to evolve, new fraud methods emerge in an endless stream, and the inherent detection models are difficult to update and adapt in a timely manner, which often makes the system unprepared when faced with new frauds, causing huge economic losses; in addition, the risk assessment method is relatively rough and it is difficult to provide detailed results, which affects the accuracy of risk management decisions; resulting in inaccurate risk management strategies, which may cause unnecessary interference to normal transactions, and may also take insufficient protective measures for high-risk transactions; these problems combined lead to a lag in the timely detection and prevention of abnormal transactions. In actual applications, it may take a long time for the system to identify abnormal patterns, or it may be difficult to respond quickly after discovering the anomaly.

[0005] In view of this, the present invention proposes a remote payment security protection system to solve the above-mentioned problems. Summary of the invention

[0006] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solutions: a remote payment security protection system, comprising: a data acquisition module, for obtaining remote payment transaction data;

[0007] The data processing module is used to pre-process the remote payment transaction data and obtain transaction feature data;

[0008] The clustering module clusters the transaction feature data based on the clustering algorithm to obtain n transaction clusters;

[0009] The anomaly evaluation module is used to find abnormal transaction clusters from n transaction clusters using the dragonfly algorithm;

[0010] The abnormal correlation analysis module is used to use Markov chain modeling to calculate the abnormal probability of the corresponding cross-region payment transaction data based on the transaction feature data in the abnormal transaction cluster;

[0011] The high-risk monitoring module is used to preset anomaly thresholds and treat inter-regional payment transaction data with anomaly probability greater than or equal to the anomaly threshold as high-risk transactions; take security protection measures for high-risk transactions; and connect each module via wired and / or wireless means.

[0012] Furthermore, the off-site payment transaction data includes transaction amount, transaction time, transaction location and transaction device information.

[0013] Furthermore, the method of preprocessing the remote payment transaction data includes:

[0014] Standardize or normalize continuous numerical data so that feature values ​​of different magnitudes are within the same numerical range; one-hot encode categorical data and convert them into numerical features; obtain standard transaction data;

[0015] Define m time windows and distribute the standard transaction data to the corresponding time windows according to the timestamps of the transactions. In each time window, calculate the transaction frequency, transaction amount statistics, transaction location distribution, transaction device type statistics and transaction amount change rate in the time window. Combine the calculated transaction frequency, transaction amount statistics, transaction location distribution, transaction device type statistics and transaction amount change rate into a feature vector to represent the transaction feature data in the corresponding time window.

[0016] Furthermore, the time window is defined as follows:

[0017] Calculate the current base transaction frequency ,in, For a preset time period, is the number of transactions;

[0018] Smooth the basic transaction frequency to obtain the smoothed transaction frequency; the smoothing formula is: ;in, For the moment Smoothed trading frequency, For the moment The smoothing factor is For the moment Smoothed trading frequency, is the trend influencing parameter, is the seasonal influence parameter, is the trend correction term, is the seasonal adjustment item;

[0019] ;in, The preset basic smoothing parameters, To adjust the parameters;

[0020] ,in, is the span coefficient, For the moment Time smoothing transaction frequency;

[0021] ;in, For the moment The seasonal factor at time is the average seasonal factor;

[0022] Calculate the size of the time window based on the smoothed transaction frequency ;in, is the deviation dynamic adjustment constant; is a positive number;

[0023] Set window size limit interval ; Limit the size of the time window to the window size limit interval; where, and are the minimum and maximum window sizes allowed, respectively;

[0024] Define a target number of transactions ; Calculate the allocated time window deviation ,in, The number of transactions for the standard transaction data within the allocated time window;

[0025] The deviation after dynamic adjustment is the dynamic adjustment constant ;in, is the adjustment rate; replace Recalculate the size of the time window; that is, complete the definition of the time window.

[0026] Furthermore, the method of clustering the transaction feature data includes:

[0027] Constructing cluster feature data ,in, For the Transaction feature data of transactions; construct similarity matrix , calculate the similarity matrix Elements in ;

[0028] ;in, is the bandwidth parameter of the Gaussian kernel, For the Transaction characteristic data of each transaction, For the The timestamp of the transaction, For the The timestamp of the transaction, is the time decay parameter, and is the equilibrium parameter, and ;

[0029] Based on the similarity matrix Elements in Calculate degree matrix ,in, is the operator symbol for diagonal matrices;

[0030] Based on degree matrix and the similarity matrix Compute the normalized Laplacian matrix ;

[0031] ;in, is the identity matrix;

[0032] Based on the normalized Laplacian matrix Solving for the generalized eigenvalues, we get non-zero eigenvalues, non-zero eigenvalues ​​are sorted in ascending order, and the first The eigenvectors corresponding to the non-zero eigenvalues ​​constitute the non-zero eigenvalue matrix ;

[0033] For non-zero eigenvalue matrices Construct a new feature matrix , the new feature matrix Matrix with non-zero eigenvalues The row elements of is a matrix with non-zero eigenvalues No. OK;

[0034] right Normalize each row in to obtain the feature matrix of the low-dimensional embedding space, denoted as ;based on , clustering is performed in the low-dimensional embedding space, and we get Transaction clustering.

[0035] Furthermore, the method of clustering in the low-dimensional embedding space includes:

[0036] Initialize the definition of clustering The first center point is selected randomly during clustering, and each new center point is selected with probability was selected, among which, It is a sample The distance to the nearest selected center point; All samples The distance to the nearest selected center point;

[0037] For each sample, the weighted distance to each center point is calculated. The weighted distance calculation formula is:

[0038] ;in, is the control coefficient, yes To The density function of the clusters, For the The center point of each cluster;

[0039] Will Assign to the cluster corresponding to the minimum weighted distance and update the cluster center; the method of updating the cluster center is to calculate a new center point for each cluster; Assign to the cluster corresponding to the minimum weighted distance, and update the cluster center until the center point no longer changes or reaches the preset maximum number of iterations; that is, Transaction clustering.

[0040] Furthermore, the calculation formula of the new center point is:

[0041] ;in yes The weight function of For the The set of samples of clusters is For the The new center of the cluster;

[0042] ;in, For the The center point of the clusters before updating, for Adaptive parameters of

[0043] ;in, for The local density estimate of for The distance to the center point of the cluster to which it belongs;

[0044] and These are all control parameters.

[0045] Furthermore, the method of searching for the abnormal transaction cluster includes:

[0046] Define the group Dragonfly individuals, each dragonfly individual represents a potential abnormal transaction cluster, with a Dimensional vector express;

[0047] Define the abnormal fitness function and calculate the value of each dragonfly individual The value of the abnormal fitness function is recorded as the fitness value ;

[0048] ;in, , , and is the weight coefficient; is the density deviation factor, is the novelty index factor, is the time anomaly factor, is the transaction amount variation factor;

[0049] Density deviation factor ,in, For dragonfly individuals The density of is the average density of all dragonfly individuals, is the maximum density of all dragonfly individuals;

[0050] Novelty Index Factor ;in, It is a dragonfly individual The size of is the size of the largest dragonfly individual;

[0051] Temporal anomaly factor ;in, For dragonfly individuals The average transaction time, is the average value of global transaction time, is the global standard deviation of transaction time;

[0052] Transaction volume variation factor ;in ; for dragonfly individuals The standard deviation of transaction amount in For dragonfly individuals The average transaction amount in

[0053] For each dragonfly , update its position, calculate the fitness value of each dragonfly individual's new position, and update the global best solution and the worst solution; as the iteration proceeds until the preset maximum number of iterations is reached; the dragonfly individual corresponding to the global best solution finally output is the identified abnormal transaction cluster.

[0054] Furthermore, for each dragonfly individual , the formula to update its position is:

[0055] ;in, is the time step Dragonfly individual The change in position of is the time step Dragonfly individual location, is the time step Dragonfly individual location;

[0056] ;in and is the weight coefficient, is the inertia weight; is the separation limiting factor, is the alignment restriction factor, is the cohesion limiting factor, To move the limiting factor toward food, To stay away from enemy limiting factors, is the time step Dragonfly individual The change in position of

[0057] Separation limiting factor ,in, is the time step Dragonfly individual Neighboring dragonfly individuals location;

[0058] Alignment constraint factor ,in is the time step Neighboring dragonfly individuals speed, is the number of neighboring dragonfly individuals;

[0059] Cohesion limiting factor ;

[0060] Stay away from enemy limiting factors ,in is the time step The enemy's position at that time;

[0061] Movement of limiting factors towards food ;in, is the time step The location of the food source.

[0062] Furthermore, the calculation method of the abnormal probability includes:

[0063] Discretize the transaction feature data in the abnormal transaction cluster and define them as different states of the Markov chain; based on historical transaction data, count the transition probabilities between different states as elements of the state transition matrix and construct the state transition matrix P;

[0064] Define the initial state probability distribution of the Markov chain and convert the transaction feature data in each abnormal transaction cluster into their corresponding state sequences , use the forward algorithm to calculate the probability of the state sequence, recorded as the sequence probability ;

[0065] Based on the calculated sequence probability and the preset normal transaction probability threshold , calculate the abnormal probability .

[0066] The technical effects and advantages of the remote payment security protection system of the present invention are as follows:

[0067] The present invention can comprehensively and accurately capture the timing characteristics and behavior patterns of transactions, greatly improving the detection accuracy of abnormal transactions. Through dynamically adjusted time windows and multi-dimensional feature extraction, it can better adapt to changes in transaction patterns in different scenarios. Improved clustering effectively improves the processing capabilities of high-dimensional nonlinear data, making the identification of abnormal transaction clusters more accurate. The dragonfly algorithm has excellent global search capabilities and can effectively discover new fraud patterns. The abnormal probability calculation method based on Markov chain provides more refined and explainable risk assessment results, forming a comprehensive, accurate and adaptive cross-region payment security protection system, which significantly improves the detection and protection capabilities of abnormal transactions. It can not only timely discover and prevent high-risk transactions, but also provide valuable risk insights and optimize risk management strategies; it enhances the security of cross-region payments, improves users' payment experience, and saves a lot of manpower and financial costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 A schematic diagram of a remote payment security protection system of the present invention;

[0069] Figure 2 A schematic diagram of a remote payment security protection method of the present invention. DETAILED DESCRIPTION

[0070] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0071] Embodiment 1

[0072] See also Figure 1 As shown, the remote payment security protection system described in this embodiment includes:

[0073] Data collection module, used to obtain cross-region payment transaction data;

[0074] The data processing module is used to pre-process the remote payment transaction data and obtain transaction feature data;

[0075] The clustering module clusters the transaction feature data based on the clustering algorithm to obtain n transaction clusters;

[0076] The anomaly evaluation module is used to find abnormal transaction clusters from n transaction clusters using the dragonfly algorithm;

[0077] The abnormal correlation analysis module is used to use Markov chain modeling to calculate the abnormal probability of the corresponding cross-region payment transaction data based on the transaction feature data in the abnormal transaction cluster;

[0078] The high-risk monitoring module is used to preset abnormal thresholds and classify off-site payment transaction data with abnormal probability greater than or equal to the abnormal threshold as high-risk transactions; take security protection measures for high-risk transactions, such as double authentication, manual review, etc.; and connect each module via wired and / or wireless means to achieve data transmission between modules.

[0079] Furthermore, the cross-region payment transaction data includes transaction amount, transaction time, transaction location and transaction device information (transaction device type).

[0080] The method of preprocessing the remote payment transaction data includes:

[0081] Standardize or normalize continuous numerical data (transaction amount, etc.) so that feature values ​​of different magnitudes are within the same numerical range; one-hot encode categorical data (such as transaction location, transaction equipment information, etc.) and convert them into numerical features; obtain standard transaction data.

[0082] Define m time windows and assign standard transaction data to corresponding time windows according to transaction timestamps.

[0083] The time window can be defined in the following ways:

[0084] Calculate the current base transaction frequency ,in, For a preset time period, is the number of transactions;

[0085] Smooth the basic transaction frequency to obtain the smoothed transaction frequency; the smoothing formula is:

[0086] ;in, For the moment Smoothed trading frequency, For the moment The smoothing factor is For the moment Smoothed trading frequency, is the trend influencing parameter, is the seasonal influence parameter, is the trend correction term, is a seasonal adjustment item.

[0087] ;in, is the preset basic smoothing parameter, To adjust the parameters, they are adjusted dynamically according to the deviation between the current frequency and the historical average;

[0088] in, is the span factor used to calculate the time span of the trend (a preset value), For the moment Time smoothing transaction frequency;

[0089] ;in, For the moment The seasonal factor at time is the average seasonal factor.

[0090] It should be noted that the periodicity of the data is analyzed using the autocorrelation function or Fourier transform to obtain the periodic unit, which is 24 hours per day, 7 days per week, or 12 months per year;

[0091] For each periodic unit, group the data into corresponding periodic units (such as 24 hours per day), calculate the average value of each periodic unit and the overall average value; then the seasonal index = the average of the periodic units; then It's time The product of the seasonal indices of all corresponding periods; for example, if it is 14:00 on Tuesday, then the time The seasonal factor at this time is Tuesday index × 14:00 index; the average seasonal factor is all The average value of .

[0092] Calculate the size of the time window based on the smoothed transaction frequency ;in, is the deviation dynamic adjustment constant, which is used as the basis for adjusting the window size (a dynamically adjusted value); is a small positive number to prevent division by zero errors.

[0093] To avoid the time window being too large or too small, set the window size limit interval ; Limit the size of the time window to the window size limit interval; where, and The minimum and maximum window sizes allowed.

[0094] The dynamic adjustment methods of the deviation dynamic adjustment constant include:

[0095] Define a target number of transactions (e.g. 100 transactions / window); calculate the deviation of the allocated time window ,in, The number of transactions for which standard transaction data is timed within the allocated time window.

[0096] The deviation after dynamic adjustment is the dynamic adjustment constant ;in, is the adjustment rate, which takes a positive value less than 1; replace The size of the time window for recalculation.

[0097] In each time window, the transaction frequency, transaction amount statistics, transaction location distribution, transaction device type statistics and transaction amount change rate within the time window are calculated;

[0098] Transaction amount statistics include mean, variance, maximum, minimum, median and quartiles; the mean is the average of all transaction amounts in each time window; the variance indicates the degree of dispersion of the transaction amount in each time window; the maximum and minimum values ​​record the highest and lowest transaction amounts in each time window; the median is the middle value of the transaction amount in each time window; and the quartiles are the 25%, 50% and 75% quantiles of the transaction amount in each time window.

[0099] The frequency of occurrence of different transaction locations in each time window is counted as the transaction location distribution; the usage ratio of various transaction devices in each time window is calculated as the transaction device type statistics; the percentage change of transaction amount between adjacent time windows is calculated as the transaction amount change rate.

[0100] The calculated transaction frequency, transaction amount statistics, transaction location distribution, transaction device type statistics and transaction amount change rate are combined into a feature vector to represent the transaction feature data within the time window.

[0101] Furthermore, the method of clustering transaction feature data includes:

[0102] Constructing cluster feature data ,in, For the The transaction feature data of each transaction; the cluster feature data is standardized to obtain the standard cluster feature data ;in, is the mean vector of cluster feature data, is the standard deviation vector of the cluster feature data.

[0103] Constructing a similarity matrix , calculate the similarity matrix Elements in ;

[0104] ;in, is the bandwidth parameter of the Gaussian kernel, For the Transaction characteristic data of each transaction, For the The timestamp of the transaction, For the The timestamp of the transaction, is the time decay parameter, and is the equilibrium parameter, and .

[0105] Based on the similarity matrix Elements in Calculate degree matrix ,in, is the operator for diagonal matrices.

[0106] Based on degree matrix and the similarity matrix Compute the normalized Laplacian matrix ;

[0107] ;in, is the identity matrix;

[0108] Based on the normalized Laplacian matrix Solving for the generalized eigenvalues, we get non-zero eigenvalues, non-zero eigenvalues ​​are sorted in ascending order, and the first The eigenvectors corresponding to the non-zero eigenvalues ​​constitute the non-zero eigenvalue matrix .

[0109] The method for solving the generalized eigenvalue includes:

[0110] Formulate the generalized eigenvalue problem:

[0111] ;in, is the eigenvalue, is the eigenvector corresponding to the eigenvalue;

[0112] Convert the generalized eigenvalue problem to a standard eigenvalue problem:

[0113] ;in, ;

[0114] Solve the standard eigenvalue problem using numerical methods, such as the power method, QR algorithm, or Lanczos algorithm, to obtain eigenvalues, i.e., non-zero eigenvalues.

[0115] Construct a new feature matrix Y based on the non-zero eigenvalue matrix V. The new feature matrix The elements are the row elements of the non-zero eigenvalue matrix V, , is the non-zero eigenvalue matrix V OK;

[0116] right Normalize each row in to obtain the feature matrix of the low-dimensional embedding space, denoted as Y1;

[0117] Based on Y1, clustering is performed in the low-dimensional embedding space to obtain n transaction clusters.

[0118] Ways to cluster in a low-dimensional embedding space include:

[0119] Initialize n2 center points to define the cluster. The first center point is selected completely randomly during clustering, and each new center point is selected with probability was selected, among which, is the sample (elements in Y1) The distance to the nearest selected center point; All samples The distance to the nearest selected center point.

[0120] For each sample, the weighted distance to each center point is calculated. The weighted distance calculation formula is:

[0121] ;in, is the control coefficient, yes To The density function of the clusters (such as Gaussian kernel density function, average distance density function, etc.), For the The center point of a cluster.

[0122] Will Assign to the cluster corresponding to the minimum weighted distance and update the cluster center; the way to update the cluster center is to calculate a new center point for each cluster.

[0123] The new center point is calculated as:

[0124] ;in yes The weight function of For the The set of samples of clusters is For the The new center of the cluster.

[0125] ;in, For the The center point of the clusters before updating, for Adaptive parameters of

[0126] ;in, for The local density estimate of for The distance to the center point of the cluster to which it belongs; and These are all control parameters.

[0127] when When greater than 0, if Located in high-density areas ( larger), then Smaller, thus reducing When When it is less than 0, if Located in low-density areas ( smaller), then larger, thus increasing The value of can automatically adjust the weights of samples in high-density and low-density areas and focus on the core samples in high-density areas.

[0128] when When greater than 0, if If it is far from the center of the cluster to which it belongs, larger, thus increasing When When it is less than 0, if If it is closer to the center point of the cluster to which it belongs, Smaller, thus reducing The value of can automatically adjust the weight of the sample relative to the center point of the cluster to which it belongs, reducing the impact of outliers or noise samples far away from the center point.

[0129] Repeat Assign to the cluster corresponding to the minimum weighted distance, and update the cluster center until the center point no longer changes or reaches the preset maximum number of iterations; that is, n transaction clusters are obtained.

[0130] Furthermore, the methods for finding abnormal transaction clusters include:

[0131] It is defined that there are N2 dragonfly individuals in the population, each dragonfly individual represents a potential abnormal transaction cluster, represented by an N2-dimensional vector Indicates that the initial dragonfly individuals are randomly generated in the search space.

[0132] Define the abnormal fitness function and calculate the value of each dragonfly individual The value of the abnormal fitness function is recorded as the fitness value .

[0133] ;in, , , and is the weight coefficient, which is used to adjust the importance of each factor; is the density deviation factor, is the novelty index factor, is the time anomaly factor, is the transaction amount variation factor.

[0134] Density deviation factor ,in, For dragonfly individuals The density of (potentially anomalous transaction clusters), is the average density of all dragonfly individuals, is the maximum density of all dragonfly individuals;

[0135] Novelty Index Factor ;in, It is a dragonfly individual The size of It is the size of the largest dragonfly individual.

[0136] Temporal anomaly factor ;in, For dragonfly individuals The average transaction time, is the average value of global transaction time, is the standard deviation of global transaction time, and the temporal anomaly factor measures the difference between the temporal pattern of the cluster and the global pattern.

[0137] Transaction volume variation factor ;in For dragonfly individuals The standard deviation of transaction amount in For dragonfly individuals The average transaction amount in the cluster measures the volatility of the transaction amount within the cluster.

[0138] For each dragonfly , update its position, the update formula is:

[0139] ;in, is the time step Dragonfly individual The change in position of is the time step Dragonfly individual location, is the time step Dragonfly individual location.

[0140] ;

[0141] in and is the weight coefficient, is the inertia weight; is the separation limiting factor, is the alignment restriction factor, is the cohesion limiting factor, To move the limiting factor toward food, To stay away from enemy limiting factors, is the time step Dragonfly individual The position change.

[0142] Separation limiting factor ,in, is the time step Dragonfly individual Neighboring dragonfly individuals location;

[0143] Alignment constraint factor ,in is the time step Neighboring dragonfly individuals speed, is the number of neighboring dragonfly individuals.

[0144] Cohesion limiting factor ;

[0145] Stay away from enemy limiting factors ,in is the time step The enemy's (worst solution) position at that time;

[0146] Movement of limiting factors towards food ;in, is the time step The location of the food source (optimal solution) at time .

[0147] Guide dragonflies to move in the search space to find the optimal solution, and balance group behavior and individual exploration by adjusting the weights of various factors to improve the performance of the algorithm.

[0148] Calculate the fitness value of each dragonfly individual's new position, and update the global best solution (food source) and the worst solution (enemy); as the iteration proceeds, adjust the weight coefficient to balance exploration and utilization until the maximum number of iterations is reached or other termination conditions are met; the dragonfly individual corresponding to the final output global best solution is the identified abnormal transaction cluster.

[0149] Specifically, the calculation method of abnormal probability includes:

[0150] The transaction feature data in the abnormal transaction cluster is discretized and defined as different states of the Markov chain. Based on the historical transaction data, the transition probabilities between different states are statistically analyzed as elements of the state transfer matrix to construct the state transfer matrix P.

[0151] Define the initial state probability distribution of the Markov chain , estimated based on the frequency of occurrence of each state in historical data;

[0152] Convert the transaction feature data in each abnormal transaction cluster into their corresponding state sequences , use the forward algorithm to calculate the probability of the state sequence, recorded as the sequence probability ;

[0153] Based on the calculated sequence probability and the preset normal transaction probability threshold , calculate the abnormal probability .

[0154] The abnormal threshold is preset based on historical transaction data. Specifically, the probability distribution of normal transactions is statistically analyzed; the parameters of the probability distribution are estimated to determine the shape and parameter values ​​of the probability distribution, such as the mean and standard deviation of the normal distribution; according to the selected confidence level, the corresponding quantile is determined from the probability distribution as the abnormal threshold, for example, the confidence level is 95%.

[0155] This embodiment can comprehensively and accurately capture the timing characteristics and behavior patterns of transactions, greatly improving the detection accuracy of abnormal transactions. Through dynamically adjusted time windows and multi-dimensional feature extraction, it can better adapt to changes in transaction patterns in different scenarios. Improved clustering effectively improves the processing capabilities of high-dimensional nonlinear data, making the identification of abnormal transaction clusters more accurate. The dragonfly algorithm has excellent global search capabilities and can effectively discover new fraud patterns. The abnormal probability calculation method based on Markov chain provides more refined and explainable risk assessment results, forming a comprehensive, accurate and adaptive cross-region payment security protection system, which significantly improves the detection and protection capabilities of abnormal transactions. It can not only timely discover and prevent high-risk transactions, but also provide valuable risk insights and optimize risk management strategies; it enhances the security of cross-region payments, improves users' payment experience, and saves a lot of manpower and financial costs.

[0156] Embodiment 2

[0157] See also Figure 2 As shown, the part not described in detail in this embodiment is described in the first embodiment, which provides a remote payment security protection method, including:

[0158] S1. Obtaining cross-region payment transaction data;

[0159] S2. Preprocess the cross-region payment transaction data to obtain transaction feature data;

[0160] S3. Clustering the transaction feature data based on a clustering algorithm to obtain n transaction clusters;

[0161] S4, using the dragonfly algorithm to find abnormal transaction clusters from n transaction clusters;

[0162] S5. Using Markov chain modeling to model the transaction feature data in the abnormal transaction cluster, calculate the abnormal probability of the corresponding cross-region payment transaction data;

[0163] S6. Preset an abnormality threshold and treat inter-regional payment transaction data with an abnormality probability greater than or equal to the abnormality threshold as high-risk transactions.

[0164] Embodiment 3

[0165] This embodiment discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the operation mode of the above-mentioned off-site payment security protection method is implemented.

[0166] Since the electronic device introduced in this embodiment is an electronic device used to implement a remote payment security protection method in the embodiment of this application, based on the remote payment security protection method introduced in the embodiment of this application, the technical personnel of this field can understand the specific implementation of the electronic device of this embodiment and its various variations, so how the electronic device implements the method in the embodiment of this application is not described in detail here. As long as the technical personnel of this field implement the electronic device used in the remote payment security protection method in the embodiment of this application, it belongs to the scope of protection to be protected by this application.

[0167] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0168] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technical users in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A remote payment security protection system, characterized in that: include: Data collection module, used to obtain cross-region payment transaction data; A data processing module, used for pre-processing the remote payment transaction data; Obtaining transaction characteristic data; The clustering module clusters the transaction feature data based on the clustering algorithm to obtain n transaction clusters; The anomaly evaluation module is used to find abnormal transaction clusters from n transaction clusters using the dragonfly algorithm; The abnormal correlation analysis module is used to use Markov chain modeling to calculate the abnormal probability of the corresponding cross-region payment transaction data based on the transaction feature data in the abnormal transaction cluster; A high-risk monitoring module is used to preset an abnormality threshold and treat inter-regional payment transaction data with an abnormality probability greater than or equal to the abnormality threshold as a high-risk transaction; Take security measures for high-risk transactions; connect each module via wired and / or wireless means; The method of preprocessing the remote payment transaction data includes: Standardize or normalize continuous numerical data so that feature values ​​of different magnitudes are within the same numerical range; perform one-hot encoding on categorical data and convert it into numerical features; Get standard transaction data; Define m time windows, and distribute the standard transaction data to the corresponding time windows according to the timestamps of the transactions; in each time window, calculate the transaction frequency, transaction amount statistics, transaction location distribution, transaction device type statistics, and transaction amount change rate in the time window; combine the calculated transaction frequency, transaction amount statistics, transaction location distribution, transaction device type statistics, and transaction amount change rate into a feature vector to represent the transaction feature data in the corresponding time window; The time window is defined in the following ways: Calculate the current base transaction frequency , For a preset time period, is the number of transactions; Smooth the basic transaction frequency to obtain the smoothed transaction frequency; the smoothing formula is: ;in, For the moment Smoothed trading frequency, For the moment The smoothing factor is For the moment Smoothed trading frequency, is the trend influencing parameter, is the seasonal influence parameter, is the trend correction term, is the seasonal adjustment item; ;in, is the preset basic smoothing parameter, To adjust the parameters; ,in, is the span coefficient, For the moment Time smoothing transaction frequency; ;in, For the moment The seasonal factor at time is the average seasonal factor; Calculate the size of the time window based on the smoothed transaction frequency ;in, is the deviation dynamic adjustment constant; is a positive number; Set the window size limit interval ; Limit the size of the time window to the window size limit interval; where, and are the minimum and maximum window sizes allowed, respectively; Define a target number of transactions ; Calculate the allocated time window deviation ,in, The number of transactions for the standard transaction data within the allocated time window; The deviation after dynamic adjustment is the dynamic adjustment constant in, is the adjustment rate; replace Recalculate the size of the time window; that is, complete the definition of the time window.

2. A remote payment security protection system according to claim 1, characterized in that: The cross-region payment transaction data includes transaction amount, transaction time, transaction location and transaction device information.

3. A remote payment security protection system according to claim 2, characterized in that: The method of clustering transaction feature data includes: Constructing cluster feature data ,in, For the Transaction feature data of transactions; construct similarity matrix , calculate the similarity matrix Elements in ; ;in, is the bandwidth parameter of the Gaussian kernel, For the Transaction characteristic data of each transaction, For the The timestamp of the transaction, For the The timestamp of the transaction, is the time decay parameter, and is the equilibrium parameter, and ; Based on the elements in the similarity matrix H Calculate degree matrix ,in, is the operator symbol for diagonal matrices; Based on degree matrix And the similarity matrix H calculates the normalized Laplacian matrix ; ;in, is the identity matrix; Based on the normalized Laplacian matrix Solving for the generalized eigenvalues, we get non-zero eigenvalues, non-zero eigenvalues ​​are sorted in ascending order, and the first The eigenvectors corresponding to the non-zero eigenvalues ​​constitute the non-zero eigenvalue matrix ; Based on the non-zero eigenvalue matrix Construct a new feature matrix , the new feature matrix The elements are the row elements of the non-zero eigenvalue matrix V, that is, is the first non-zero eigenvalue matrix V OK; right Normalize each row in to obtain the feature matrix of the low-dimensional embedding space, denoted as Y1; based on Y1, clustering is performed in the low-dimensional embedding space to obtain n transaction clusters.

4. A remote payment security protection system according to claim 3, characterized in that: The method of clustering in the low-dimensional embedding space includes: Initialize n2 center points to define the cluster. The first center point is selected completely randomly during clustering, and each new center point is selected with probability was selected, among which, It is a sample The distance to the nearest selected center point; All samples The distance to the nearest selected center point; For each sample, the weighted distance to each center point is calculated. The weighted distance calculation formula is: ;in, is the control coefficient, yes To The density function of the clusters, For the The center point of each cluster; Will Assign to the cluster corresponding to the minimum weighted distance and update the cluster center; the method of updating the cluster center is to calculate a new center point for each cluster; Assign to the cluster corresponding to the minimum weighted distance, and update the cluster center until the center point no longer changes or reaches the preset maximum number of iterations; that is, n transaction clusters are obtained.

5. A remote payment security protection system according to claim 4, characterized in that: The calculation formula of the new center point is: ;in yes The weight function of For the The set of samples of clusters is For the The new center of the cluster; ;in, For the The center point of the clusters before updating, for Adaptive parameters of ;in, for The local density estimate of for The distance to the center point of the cluster to which it belongs; and These are all control parameters.

6. A remote payment security protection system according to claim 5, characterized in that: The method for finding the abnormal transaction cluster includes: It is defined that there are N2 dragonfly individuals in the population, each dragonfly individual represents a potential abnormal transaction cluster, represented by an N2-dimensional vector express; Define the abnormal fitness function and calculate the value of each dragonfly individual The value of the abnormal fitness function is recorded as the fitness value ; ； in, and is the weight coefficient; is the density deviation factor, is the novelty index factor, is the time anomaly factor, is the transaction amount variation factor; Density deviation factor ,in, For dragonfly individuals The density of is the average density of all dragonfly individuals, is the maximum density of all dragonfly individuals; Novelty Index Factor ;in, It is a dragonfly individual The size of is the size of the largest dragonfly individual; Temporal anomaly factor ;in, For dragonfly individuals The average transaction time, is the average value of global transaction time, is the standard deviation of global transaction time; Transaction volume variation factor ;in For dragonfly individuals The standard deviation of transaction amount in For dragonfly individuals The average transaction amount in For each dragonfly , update its position, calculate the fitness value of each dragonfly individual's new position, and update the global best solution and the worst solution; as the iteration proceeds until the preset maximum number of iterations is reached; the dragonfly individual corresponding to the global best solution finally output is the identified abnormal transaction cluster.

7. A remote payment security protection system according to claim 6, characterized in that: For each dragonfly individual , the formula to update its position is: ;in, is the time step Dragonfly individual The change in position of is the time step Dragonfly individual location; ;in, and is the weight coefficient, is the inertia weight; is the separation limiting factor, is the alignment restriction factor, is the cohesion limiting factor, To move the limiting factor toward food, To stay away from enemy limiting factors, is the time step Dragonfly individual The change in position of Separation limiting factor ,in, is the time step Dragonfly individual Neighboring dragonfly individuals location; Alignment constraint factor ,in is the time step Neighboring dragonfly individuals speed, is the number of neighboring dragonfly individuals; Cohesion limiting factor ; Stay away from enemy limiting factors ,in is the time step The enemy's position at that time; Movement of limiting factors towards food ;in, is the time step The location of the food source.

8. A remote payment security protection system according to claim 7, characterized in that: The calculation method of the abnormal probability includes: Discretize the transaction feature data in the abnormal transaction cluster and define them as different states of the Markov chain; based on historical transaction data, count the transition probabilities between different states as elements of the state transition matrix and construct the state transition matrix P; Define the initial state probability distribution of the Markov chain and convert the transaction feature data in each abnormal transaction cluster into their corresponding state sequences , use the forward algorithm to calculate the probability of the state sequence, recorded as the sequence probability ; Based on the calculated sequence probability and the preset normal transaction probability threshold , calculate the abnormal probability .

Images