A data security detection method and system in a payment environment

Abstract

The present invention discloses a data security detection method and system in a payment environment, which relates to the field of payment security detection technology, including: constructing a payment behavior graph network according to the acquired multimodal data; analyzing and identifying high-density subgraphs and associated group structures in the graph network, and identifying cyclic paths in the associated group structures; extracting time series features according to the cyclic paths, clustering and identifying the periodicity and clustering features of the cyclic paths, and setting them as path features; constructing a cyclic payment scoring model based on the detected cyclic paths and time series features; receiving new transaction data in real time, obtaining cyclic payment scores according to the cyclic payment scoring model, and making payment data security judgments. By constructing a payment behavior graph network, identifying cyclic paths, and performing cluster analysis in combination with time series features, accurate real-time monitoring and risk judgment of payment data are achieved, and the security, detection accuracy, and response efficiency of the payment system are improved.

Description

Technical Field

[0001] The present invention relates to the field of payment security detection technology, and specifically to a data security detection method and system in a payment environment. Background Art

[0002] With the popularity of electronic payment and online transactions, the complexity of the payment environment and the diversity of transaction data have increased significantly, and the payment system is facing increasingly severe security threats. The detection and prevention of abnormal behavior has become a research focus in the field of payment security.

[0003] Traditional payment data detection methods mainly rely on rule setting and static feature matching, and make risk assessments through predefined rules or statistical models based on historical data. These methods can usually only identify known risk patterns and have difficulty dealing with new and dynamically changing abnormal behaviors. Especially when faced with complex and ever-changing payment networks and large amounts of transaction data generated in real time, the response speed and detection accuracy of traditional methods are obviously insufficient, which can easily lead to misjudgments or missed judgments, exposing the payment system to huge security risks.

[0004] In recent years, graph analysis and machine learning technologies have been gradually applied in payment behavior analysis. The use of graph network models can better reveal the complex relationships between accounts and the correlation between transaction behaviors. However, existing technologies still face challenges in building payment behavior graph networks, identifying loop paths, and quantifying path anomalies. In particular, when dealing with multimodal data fusion, real-time risk response, and dynamic adjustment of feature weights, the flexibility and real-time performance of existing solutions are limited. Summary of the invention

[0005] Based on the above-mentioned shortcomings of the prior art, the purpose of the present invention is to provide a data security detection method and system in a payment environment to solve the above-mentioned technical problems.

[0006] To achieve the above object, the present invention provides the following technical solution: a data security detection method in a payment environment, comprising:

[0007] Acquire multimodal data in a payment environment and perform preprocessing, wherein the multimodal data includes account information and payment order information;

[0008] A payment behavior graph network is constructed based on the preprocessed multimodal data, wherein the account information is set as the nodes of the graph network, and the payment order information is set as the edges and edge weights of the graph network;

[0009] Identify high-density subgraphs and associated group structures in the graph network according to a preset graph structure analysis algorithm, and identify cyclic paths in the associated group structure through a preset identification algorithm;

[0010] Extracting time series features according to the cycle path, clustering the time series features, identifying periodic features and clustering features of the cycle path, and setting the periodic features and clustering features as path features;

[0011] Based on the detected cycle path and time series features, a cycle payment scoring model is constructed, and the cycle payment score of the cycle path is calculated by combining the features of the graph nodes and the path features;

[0012] New transaction data is received in real time, a recurring payment score is obtained according to the recurring payment score model, and payment data security determination is performed according to the recurring payment score.

[0013] The present invention is further configured such that the account information includes account ID, account type, registration time, account status, account activity and transaction frequency; and the payment order information includes payment amount, payment time and payment type.

[0014] The present invention is further configured to construct a payment behavior graph network based on the preprocessed multimodal data, including:

[0015] Mapping the preprocessed account information into nodes of a graph network, wherein the features of the nodes include static features and dynamic features, wherein the static features include account ID, account type, registration time, and account status, and the dynamic features include account activity and transaction frequency;

[0016] Map the pre-processed payment order information into edges of a graph network, where the edge features include payment amount, payment time, and payment type;

[0017] Weights are set for the edges of the graph network, and the weights are obtained by weighted calculation based on the transaction amount, transaction frequency, and transaction time interval.

[0018] The present invention is further configured such that the identification logic of the high-density subgraph is as follows: defining the density standard of the subgraph division, determining the high-density subgraph by setting the density standard threshold, specifically including: calculating the density of the subgraph, wherein the density is defined as the ratio of the actual number of edges to the maximum theoretical number of edges; setting the density standard threshold, retaining the subgraphs with a density higher than the density standard threshold; starting from the densest node pair, gradually adding edges in descending order of weight, calculating the real-time density until the density is lower than the density standard threshold, and stopping the addition of edges;

[0019] The recognition logic of the associated group structure is as follows: calculate the centrality of the nodes in the high-density subgraph, and determine the central node according to the degree of connection between the node and other nodes; starting from the central node, gradually add nodes to form a local high-connectivity subgroup; until all nodes in the high-density subgraph are traversed, the associated group structure is obtained, in which the addition of nodes meets the restriction condition of increasing local connection density, that is, there is an edge between the newly added node and more than half of the nodes in the local high-connectivity subgroup.

[0020] The present invention is further configured such that a preset recognition algorithm recognizes a cyclic path in an associated group structure, including:

[0021] Starting from each node of the association group structure, the visited nodes are recorded, and a node path list is constructed. When the currently visited node already exists in the path list, a cyclic path in the association group structure is identified, wherein complexity control is performed by setting a cyclic path length limit;

[0022] The identified cycle path is reversely checked, that is, traced back from the end node of the path to the starting node to ensure that there are no unvisited nodes in the cycle path, and at the same time check the correctness of the direction of the cycle path.

[0023] The present invention is further configured to extract time series features according to the cycle path, cluster the time series features, identify the periodic features and clustering features of the cycle path, and set the periodic features and clustering features as path features, including:

[0024] Extract the payment time from each edge in the cycle path, construct time series data, and set the time series data as time series features according to the order of the cycle path;

[0025] Performing cluster analysis on time series features according to a clustering algorithm to identify the periodicity and clustering characteristics of transactions, wherein the time series features are analyzed by using an autocorrelation function, the correlation of the time series at different lag steps is calculated, and the periodicity characteristic value is obtained; by setting a sliding window of a fixed length, the transaction density within the sliding window is calculated according to the sliding window density function, and the transaction density is set as a clustering feature;

[0026] The periodicity feature and clustering feature are set as path features, that is, path feature = [periodicity feature, clustering feature].

[0027] The present invention is further configured to construct a cyclic payment scoring model based on the detected cyclic path and time series features, and calculate the cyclic payment score of the cyclic path in combination with the features of the graph nodes and the path features, including:

[0028] The time series features, node features and path features of the cycle path are vectorized to form a feature vector, where the node feature vector V N Including account activity ACT, transaction frequency Freq and node degree Deg; path feature vector V P Including periodic features Per and clustering features Clus; time series features V T ; The node feature vector V N 、Path feature vector V P and time series features V T Merge into the path overall feature vector ;

[0029] The path overall feature vector V is subjected to nonlinear feature fusion to construct a feature mapping matrix M; the feature mapping matrix M and the path feature vector V are subjected to weight transformation to obtain a feature transformation matrix T;

[0030] According to the feature transformation matrix T, the cycle payment score of the cycle path is calculated.

[0031] The present invention is further configured such that the calculation logic of nonlinear feature fusion is: , where M is the feature mapping matrix, W1 and W2 are weight matrices, b1 and b2 are bias vectors, is the activation function, tanh and ReLU are the hyperbolic tangent function and the rectified linear unit function respectively;

[0032] The calculation logic of weight transformation is: , where T is the feature transformation matrix, is the path feature vector V P The transpose of

[0033] The calculation logic of the recurring payment score is: , where Score is the cycle payment score, Tr(T) is the trace of the feature transformation matrix, n is the number of edges in the cycle path, and Path Freq,i is the transaction frequency and transaction frequency of both parties of the ith edge transaction, Node Deg,i is the node degree of both parties in the ith edge transaction, Time Gap,i is the time interval between the two parties of the ith edge transaction.

[0034] The present invention is further configured to perform payment data security determination according to the cyclic payment score, including:

[0035] When the recurring payment score is greater than the first payment score threshold, the corresponding payment order is marked as a high-risk transaction, and the transaction is frozen and manually reviewed;

[0036] When the recurring payment score is less than or equal to the first payment score threshold and greater than the second payment score threshold, the corresponding payment order is marked as a medium-risk transaction, and the payer is prompted to verify and confirm;

[0037] When the recurring payment score is less than or equal to the second payment score threshold, the corresponding payment order is marked as low risk and the transaction is allowed to proceed.

[0038] The present invention also provides a data security detection system in a payment environment, the system comprising:

[0039] Data acquisition module: acquires multimodal data in the payment environment and performs preprocessing, wherein the multimodal data includes account information and payment order information;

[0040] Constructing a network module: constructing a payment behavior graph network based on the preprocessed multimodal data, wherein the account information is set as the nodes of the graph network, and the payment order information is set as the edges and edge weights of the graph network;

[0041] Path identification module: identifies high-density subgraphs and associated group structures in the graph network according to the preset graph structure analysis algorithm, and identifies cyclic paths in the associated group structure through the preset identification algorithm;

[0042] Setting feature module: extracting time series features according to the cycle path, clustering through the time series features, identifying periodic features and clustering features of the cycle path, and setting the periodic features and clustering features as path features;

[0043] Scoring calculation module: Based on the detected cycle path and time series features, a cycle payment scoring model is constructed, and the cycle payment score of the cycle path is calculated by combining the features of the graph nodes and the path features;

[0044] Security determination module: receiving new transaction data in real time through stream processing technology, obtaining a cyclic payment score according to the cyclic payment score model, and making a payment data security determination according to the cyclic payment score.

[0045] The present invention provides a data security detection method and system in a payment environment. The method obtains multimodal data in the payment environment and performs preprocessing, wherein the multimodal data includes account information and payment order information; constructs a payment behavior graph network according to the preprocessed multimodal data, wherein the account information is set as a node of the graph network, and the payment order information is set as an edge and an edge weight of the graph network; identifies a high-density subgraph and an associated group structure in the graph network according to a preset graph structure analysis algorithm, and identifies a cyclic path in the associated group structure by a preset recognition algorithm; extracts time series features according to the cyclic path, clusters the time series features, identifies the periodicity and clustering features of the cyclic path, and sets the periodicity and clustering features as path features; constructs a cyclic payment scoring model based on the detected cyclic path and time series features, and calculates the cyclic payment score of the cyclic path in combination with the features of the graph nodes and the path features; receives new transaction data in real time, obtains a cyclic payment score according to the cyclic payment scoring model, and performs payment data security judgment according to the cyclic payment score, and the beneficial effects produced include:

[0046] Improve data association analysis capabilities: This invention constructs a payment behavior graph network by mapping account information as nodes and payment order information as edges, and sets weights through multi-dimensional features to accurately reflect key factors such as transaction amount, frequency, and time interval. The construction method of this graph network can fully reveal the complex relationship between accounts and the correlation of transaction behaviors, greatly improving the ability to identify abnormal payment behaviors;

[0047] Dynamically capture abnormal transaction behavior: The present invention uses a preset recognition algorithm to identify high-density subgraphs and associated group structures in the graph network, and performs real-time detection of cyclic paths in the group structure. By setting path length and repetition rate limits, the computational complexity is controlled, and abnormal transaction loops in the payment network are effectively captured, providing a strong foundation for the identification of abnormal payment behavior;

[0048] Improve the accuracy of anomaly detection: This invention can identify the periodicity and clustering characteristics of transactions by extracting time series features from the cycle path and performing cluster analysis on the extracted time features. These features are used as path features and directly used to calculate anomaly scores, so that the scoring model can more flexibly and accurately reflect the abnormal patterns in payment behavior.

[0049] Refined evaluation of path abnormality: The circular payment scoring model proposed in this paper combines node characteristics, path characteristics and time series characteristics, and uses a nonlinear transformation matrix for comprehensive analysis, which can comprehensively quantify the degree of abnormality of the circular path. The higher the score, the more significant the abnormal characteristics of the path, thereby effectively screening out high-risk transaction paths and achieving refined risk assessment.

[0050] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0052] Figure 1 A flowchart of a data security detection method in a payment environment is shown as an exemplary embodiment of the present invention;

[0053] Figure 2 The present invention is a schematic diagram showing the structure of a data security detection system in a payment environment according to an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0054] The following will describe the embodiments of the present invention with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention, not for limiting the scope of protection of the present invention.

[0055] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0056] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it is obvious to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present invention difficult to understand. Example

[0057] A data security detection method in a payment environment, such as Figure 1 As shown, including:

[0058] Acquire multimodal data in a payment environment and perform preprocessing, wherein the multimodal data includes account information and payment order information;

[0059] A payment behavior graph network is constructed based on the preprocessed multimodal data, wherein the account information is set as the nodes of the graph network, and the payment order information is set as the edges and edge weights of the graph network;

[0060] Identify high-density subgraphs and associated group structures in the graph network according to a preset graph structure analysis algorithm, and identify cyclic paths in the associated group structure through a preset identification algorithm;

[0061] Extracting time series features according to the cycle path, clustering the time series features, identifying periodic features and clustering features of the cycle path, and setting the periodic features and clustering features as path features;

[0062] Based on the detected cycle path and time series features, a cycle payment scoring model is constructed, and the cycle payment score of the cycle path is calculated by combining the features of the graph nodes and the path features;

[0063] New transaction data is received in real time, a recurring payment score is obtained according to the recurring payment score model, and payment data security determination is performed according to the recurring payment score.

[0064] Specifically, multimodal data is obtained from the payment environment, including account information and payment order information. Multimodal data refers to data from different sources or forms. By integrating these data, the characteristics of payment behavior can be fully characterized; the present invention is further configured that the account information includes account ID, account type, registration time, account status, account activity and transaction frequency; the payment order information includes payment amount, payment time and payment type. Specifically, the account ID is a number or identifier used to uniquely identify each account in the payment system, usually a unique string of numbers, letters or symbols. It is the core symbol for identifying and tracking accounts in the system. When building a graph network, the account ID is used to set nodes and is the basic information for distinguishing different accounts and establishing account associations. The account type is used to describe the nature and category of the account, including personal accounts, corporate accounts, merchant accounts and other types. The registration time refers to the timestamp when the account is registered or created in the payment system, including the specific date and time. The registration time reflects the length of time and active cycle of the account. The account status is used to describe the current validity and operability of the account. The status includes normal, frozen, reported lost, cancelled and other situations. The account activity refers to the frequency of operation and usage of the account within a period of time, which is usually measured by the frequency of operations such as login and transaction of the account. The higher the activity, the more frequent the account operation. The transaction frequency refers to the number of transactions that occur in an account within a specific time period, which is an indicator of the frequency of interaction between the account and other accounts. A high transaction frequency may indicate abnormal fund flow in an account; the payment amount refers to the amount of funds transferred in each transaction; the payment time refers to the time point when a specific payment behavior occurs, including the date and exact time; the payment type refers to the classification information of the payment method, such as transfer, withdrawal, consumption payment, top-up, etc. Different payment types correspond to different behavior patterns, and the information of payment type helps to understand the purpose and rationality of the transaction. Further, preprocessing includes standardizing, cleaning, deduplicating, and filling missing values ​​of the acquired data to ensure data quality, and converting it into a unified format for subsequent analysis and use. This is a prior art and will not be elaborated here.

[0065] The present invention is further configured to construct a payment behavior graph network based on the preprocessed multimodal data, including:

[0066] The preprocessed account information is mapped to nodes of a graph network, where the features of the nodes include static features and dynamic features. The static features include account ID, account type, registration time, and account status, and the dynamic features include account activity and transaction frequency. Specifically, the preprocessed account information is mapped to nodes in a payment behavior graph network, and each node represents an account. In the graph, the nodes contain a variety of feature information, which are divided into static features and dynamic features. Static features are attributes that are inherent to the account and do not change frequently over time, including account ID, account type, registration time, and account status; dynamic features are attributes that are constantly updated as account behavior changes, including account activity and transaction frequency.

[0067] The preprocessed payment order information is mapped to the edge of the graph network, where the edge features include payment amount, payment time and payment type; specifically, the preprocessed payment order information is mapped to the edge of the graph network, where the edge represents the payment transaction between two nodes (accounts). The edge features include payment amount, payment time and payment type, which together describe the basic information and behavior patterns of the transaction.

[0068] Weights are set for the edges of the graph network, and the weights are obtained by weighted calculation based on the transaction amount, transaction frequency, and transaction time interval. Specifically, weights are set for the edges of the graph network, and the weight values ​​reflect the strength and importance of the transaction. The weights are calculated based on the payment amount, transaction frequency, and transaction time interval, and are obtained through a weighted algorithm. During the calculation process, the system will give a higher weight to the transaction amount, and at the same time combine the frequency and time interval of the transaction to form a comprehensive evaluation; the calculation formula is: ,in, , and It is a weighting coefficient used to adjust the impact of each feature on the total weight. The larger the amount, the greater the impact of the transaction on the overall payment network, so it is given a higher weight. The calculation of edge weights enhances the quantification of the strength of transaction relationships in the graph network, allowing anomaly detection to more accurately identify high-risk transaction paths. In particular, when identifying abnormal high-frequency transactions or large-scale capital flows, weight setting provides a stronger basis for rapid early warning.

[0069] The present invention is further configured that the identification logic of high-density subgraphs is: define the density standard of subgraph division, determine the high-density subgraphs by setting the density standard threshold, specifically including: calculate the density of the subgraph, the density is defined as the ratio of the actual number of edges to the maximum theoretical number of edges; set the density standard threshold, retain the subgraphs with density higher than the density standard threshold; start from the densest node pair, gradually add edges in descending order of weight, calculate the real-time density until the density is lower than the density standard threshold, and stop adding edges; specifically, the identification of high-density subgraphs is a key step in the network analysis of the payment behavior graph, and the main purpose is to identify the areas with close connections between nodes in the graph, reveal abnormal transaction behaviors and potential risk groups. By calculating the density of the subgraph, determine which areas are high-density subgraphs. Density is the ratio of the actual number of edges within the subgraph to the theoretical maximum number of edges. The theoretical maximum number of edges refers to the situation where all nodes in the subgraph are connected to each other. The calculation logic is: the number of nodes in the subgraph * (the number of nodes in the subgraph-1) / 2, reflecting the tightness of the connection between nodes in the subgraph; by setting the density standard threshold, ensure that the screening of high-density areas meets expectations. Subgraphs above the threshold are retained as high-density subgraphs, and areas below the threshold are ignored or eliminated; when constructing a high-density subgraph, start from the core node set and expand outward step by step, filter qualified nodes according to the density standard, and form the final high-density subgraph.

[0070] The identification logic of the associated group structure is as follows: calculate the centrality of the nodes in the high-density subgraph, determine the central node according to the degree of connection between the node and other nodes; start from the central node, gradually add nodes to form a local high-connectivity subgroup; until all nodes in the high-density subgraph are traversed, the associated group structure is obtained, wherein the addition of nodes meets the restriction condition of increasing local connection density, that is, there is an edge between the newly added node and more than half of the nodes in the local high-connectivity subgroup. Specifically, by calculating the centrality of the nodes in the high-density subgraph, and gradually expanding the subgroup according to the degree of connection between the nodes, a complete associated group structure is finally formed. This method ensures that the identified group has high cohesion and close association by limiting the local connection density of the newly added nodes; first calculate the centrality of each node in the high-density subgraph, the centrality reflects the importance and influence of the node in the graph, the higher the centrality, the more or more critical the connection of the node in the graph; according to the calculated centrality value, select the node with the highest centrality as the initial central node of the subgroup, and start to build a local high-connectivity subgroup; starting from the central node, gradually add nodes with high connectivity to the central node to the subgroup. Newly added nodes must be connected to more than half of the nodes in the existing subgroup to ensure the cohesion and closeness of the group; when all nodes are traversed and meet the conditions of increasing local connection density, a complete associated group structure is finally formed. This structure represents a highly cohesive node cluster, which usually corresponds to highly collaborative or abnormally intensive transaction behaviors; further, in graph network analysis, centrality is an indicator used to measure the importance of a node in the entire network. Commonly used centrality indicators include degree centrality, closeness centrality, and betweenness centrality. In the present invention, degree centrality is the main indicator used, that is, the more edges a node connects, the higher the centrality; through centrality analysis and the expansion rule of increasing density, it is possible to accurately identify highly collaborative or closely connected account groups in the transaction network, helping to discover potential abnormal behaviors.

[0071] The present invention is further configured such that a preset recognition algorithm recognizes a cyclic path in an associated group structure, including:

[0072] Starting from each node of the association group structure, the visited nodes are recorded, and a node path list is constructed. When the currently visited node already exists in the path list, a cyclic path in the association group structure is identified, wherein complexity control is performed by setting a cyclic path length limit;

[0073] For the identified loop path, reverse verification is performed, that is, tracing back from the end node of the path to the starting node to ensure that there are no unvisited nodes in the loop path, and at the same time check the correctness of the direction of the loop path. Specifically, the loop path in the payment network is identified and verified by constructing and reversely verifying the node path, which effectively controls the complexity of the algorithm, ensures the integrity and directionality of the identified loop path, and enhances the detection ability of abnormal transaction behavior; traverses each node in the associated group structure, gradually records the visited nodes, and forms a path list. Whenever a node that already exists in the path list is visited, it is confirmed that a loop path has been formed; by setting an upper limit on the path length, the depth search of the path is limited to prevent the computational complexity from rising sharply due to the long path. This restriction helps to identify loop paths within a reasonable range more quickly and improve detection efficiency; for the identified loop path, a reverse verification operation is performed, starting from the end node of the path, and gradually tracing back to the starting node to ensure that all nodes in the path are visited and not missed. At the same time, the directionality of the path is checked to ensure the legitimacy and consistency of the path; by recording the path from each node and limiting the path length, the complexity of the algorithm is effectively controlled, and the speed and accuracy of loop path identification are improved. The waste of computing resources and extended detection time caused by too long a path are avoided; the reverse check ensures that each node in the path is visited, without omissions or repeated visits, and ensures the reliability of the detection results. The path direction check further ensures that the path is consistent with the actual transaction direction to prevent false positives.

[0074] The present invention is further configured to extract time series features according to the cycle path, cluster the time series features, identify the periodic features and clustering features of the cycle path, and set the periodic features and clustering features as path features, including:

[0075] Extract the payment time from each edge in the cycle path, construct time series data, and set the time series data as time series features according to the order of the cycle path;

[0076] Performing cluster analysis on time series features according to a clustering algorithm to identify the periodicity and clustering characteristics of transactions, wherein the time series features are analyzed by using an autocorrelation function, the correlation of the time series at different lag steps is calculated, and the periodicity characteristic value is obtained; by setting a sliding window of a fixed length, the transaction density within the sliding window is calculated according to the sliding window density function, and the transaction density is set as a clustering feature;

[0077] The periodicity and clustering characteristics are set as path characteristics, that is, path characteristics = [periodicity, clustering characteristics]. Specifically, the time series characteristics are extracted from the cyclic path, and the logic of periodicity and clustering characteristics is identified through cluster analysis, aiming to deeply explore the time pattern in the cyclic payment path and reveal hidden abnormal transaction behaviors; in the identified cyclic path, the corresponding payment time data is extracted from each edge, and the payment time is arranged as a time series according to the order of occurrence of the transaction. These time series reflect the order and time distribution of transactions in the path; the extracted time series characteristics are clustered using the clustering analysis method to identify the time periodicity and clustering patterns of the transactions. Specifically, it includes: analyzing the periodicity of the time series through the autocorrelation function, calculating the correlation of the series at different lag steps, and extracting the periodicity characteristics; setting a sliding window of fixed length, calculating the transaction density in the sliding window as the clustering characteristics; modeling the identified periodicity and clustering characteristics as path characteristics to form a path feature vector [periodicity, clustering characteristics], which provides key parameters for subsequent anomaly detection. Furthermore, the autocorrelation function (ACF) is used to analyze the correlation between data points in a time series and their own data points at different lag steps. The autocorrelation function can identify repetitive patterns in a sequence, that is, periodicity. By calculating the changes in the autocorrelation value at different lag steps, the periodic characteristic value of the transaction can be extracted, indicating whether the transaction activity has a fixed period; the sliding window density function uses a sliding window of fixed length to slide on the time series to calculate the number density of transactions in each window. The transaction density reflects the concentration of transactions in a specific time period and is a direct manifestation of clustering characteristics. Through the extraction and clustering analysis of time series features, the system can reveal hidden patterns in transaction behavior, such as the time pattern of cyclical payments and the concentrated outbreak period of transactions; the periodicity and clustering characteristics can effectively characterize the time dynamic characteristics of the cyclic path, provide an accurate basis for risk scoring and anomaly detection, and significantly improve the accuracy of detection.

[0078] The present invention is further configured to construct a cyclic payment scoring model based on the detected cyclic path and time series features, and calculate the cyclic payment score of the cyclic path in combination with the features of the graph nodes and the path features, including:

[0079] The time series features, node features and path features of the cycle path are vectorized to form a feature vector, where the node feature vector V N Including account activity ACT, transaction frequency Freq and node degree Deg; path feature vector V P Including periodic features Per and clustering features Clus; time series features V T ; The node feature vector VN 、Path feature vector V P and time series features V T Merge into the path overall feature vector Specifically, the time series characteristics, node characteristics and path characteristics of the cycle path are vectorized to form an overall feature vector, which integrates account activity, transaction frequency, node degree, periodic characteristics, clustering characteristics and time series characteristics, providing data support for risk assessment and anomaly detection of payment behavior.

[0080] The path overall feature vector V is subjected to nonlinear feature fusion to construct a feature mapping matrix M; the feature mapping matrix M and the path feature vector V are subjected to weight transformation to obtain a feature transformation matrix T; the present invention is further configured such that the calculation logic of the nonlinear feature fusion is: , where M is the feature mapping matrix, W1 and W2 are weight matrices, b1 and b2 are bias vectors, is the activation function, tanh and ReLU are the hyperbolic tangent function and the rectified linear unit function respectively; the calculation logic of weight transformation is: , where T is the feature transformation matrix, is the path feature vector V P The transpose of ; Specifically, the above logic further sets the calculation logic of nonlinear feature fusion, which aims to construct a feature mapping matrix by nonlinearly mapping the overall feature vector of the path, and finally calculate the feature transformation matrix by combining the weight matrix and the activation function. This process involves the application of multiple matrix operations and nonlinear activation functions, which enhances the expressiveness of features and helps the accuracy of anomaly detection and path scoring; the activation function It is a commonly used activation function that maps the input to between 0 and 1 and is suitable for probability estimation; the hyperbolic tangent function tanh maps the input to between -1 and 1 and is often used to enhance the nonlinear expression ability of features; the rectified linear unit function ReLU maps negative values ​​to 0, and the positive values ​​remain unchanged, which is used to increase the nonlinearity of the model and reduce the gradient disappearance problem; the weight matrices W1 and W2 are coefficient matrices in matrix multiplication, which are used to perform linear transformations on the input features and determine the scaling and combination methods of the features; the bias vectors b1 and b2 are additional items of the weight matrix, which are used to translate the output of the activation function and adjust the center of the feature map; through nonlinear feature fusion, the system can capture more complex interactions in the overall characteristics of the path, making the feature expression more expressive and improving the effects of anomaly detection and risk assessment.

[0081] According to the feature transformation matrix T, the cycle payment score of the cycle path is calculated; the calculation logic of the cycle payment score is: , where Score is the cycle payment score, Tr(T) is the trace of the feature transformation matrix, n is the number of edges in the cycle path, and Path Freq,i is the transaction frequency and transaction frequency of both parties of the ith edge transaction, Node Deg,i is the node degree of both parties in the ith edge transaction, Time Gap,i is the time interval between the two parties of the i-th edge transaction. Specifically, the above calculation logic comprehensively evaluates the risk level of the circular path through the feature transformation matrix and the relevant features of each transaction edge in the path, generates a circular payment score, and combines the feature matrix and transaction details to accurately quantify the risk of the path and assist in identifying potential abnormal payment behaviors; the trace value calculates the sum of the elements on the diagonal of the matrix, which is an important value for evaluating feature fusion results. The larger the trace value, the higher the strength of the overall feature in evaluating circular payments; Used to adjust the risk contribution of frequent transactions. When the frequency is high and the node degree is low, the impact on the score is significant; conversely, when the node degree is high, the impact of the frequency will be weakened to avoid misjudging active nodes; is the impact of time interval on risk. The shorter the time interval, the more intensive the transaction, and the higher the risk score. This item dynamically adjusts the risk weight of frequent transactions through an exponential decay function. The addition of periodicity and clustering features further enhances the accuracy of risk detection. By comprehensively evaluating the trace value of the feature transformation matrix combined with transaction frequency, node degree and time interval, the system can accurately identify high-risk transaction paths.

[0082] The present invention is further configured to perform payment data security determination according to the cyclic payment score, including:

[0083] When the recurring payment score is greater than the first payment score threshold, the corresponding payment order is marked as a high-risk transaction, and the transaction is frozen and manually reviewed;

[0084] When the recurring payment score is less than or equal to the first payment score threshold and greater than the second payment score threshold, the corresponding payment order is marked as a medium-risk transaction, and the payer is prompted to verify and confirm;

[0085] When the recurring payment score is less than or equal to the second payment score threshold, the corresponding payment order is marked as low risk and the transaction is allowed to proceed. Specifically, the security of payment data is determined by the recurring payment score, and transactions are managed by risk classification based on the score value, and corresponding processing measures are taken to achieve effective identification and response to high-risk, medium-risk and low-risk transactions, ensuring the security of the payment environment; when the recurring payment score is greater than the first payment score threshold, the transaction is judged to be high risk. Such transactions have significant abnormal characteristics. High-risk transactions are marked and transaction freezing measures are taken, and manual review is triggered to ensure further confirmation of the legality of the transaction.

[0086] When the recurring payment score is between the first payment score threshold and the second payment score threshold, the transaction is judged as medium risk. Such transactions have certain risk characteristics, but they are not as significant as high-risk transactions. Prompts are issued for medium-risk transactions, requiring the payer to verify and confirm to increase the security of the transaction while ensuring that the normal payment experience is not affected.

[0087] When the recurring payment score is less than or equal to the second payment score threshold, the transaction is considered low risk. Such transactions are consistent with normal transaction behavior patterns. Allowing low-risk transactions to proceed normally avoids excessive intervention and maintains the efficient operation of the payment system.

[0088] By freezing and manually reviewing high-risk transactions, the system effectively prevents potential fraud and illegal capital flows and ensures the safety of users' funds. By performing graded management based on scores, the system can allocate resources in a targeted manner, focus on reviewing high-risk transactions, reduce interference with normal transactions, and improve overall operational efficiency. Example

[0089] See also Figure 2 , the exemplary data security detection system in a payment environment includes:

[0090] Data acquisition module: acquires multimodal data in the payment environment and performs preprocessing, wherein the multimodal data includes account information and payment order information;

[0091] Constructing a network module: constructing a payment behavior graph network based on the preprocessed multimodal data, wherein the account information is set as the nodes of the graph network, and the payment order information is set as the edges and edge weights of the graph network;

[0092] Path identification module: identifies high-density subgraphs and associated group structures in the graph network according to the preset graph structure analysis algorithm, and identifies cyclic paths in the associated group structure through the preset identification algorithm;

[0093] Setting feature module: extracting time series features according to the cycle path, clustering through the time series features, identifying periodic features and clustering features of the cycle path, and setting the periodic features and clustering features as path features;

[0094] Scoring calculation module: Based on the detected cycle path and time series features, a cycle payment scoring model is constructed, and the cycle payment score of the cycle path is calculated by combining the features of the graph nodes and the path features;

[0095] Security determination module: receiving new transaction data in real time through stream processing technology, obtaining a cyclic payment score according to the cyclic payment score model, and making a payment data security determination according to the cyclic payment score.

[0096] It should be noted that the data security detection system under a payment environment provided by the above embodiment and the data security detection method under a payment environment provided by the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs an operation has been described in detail in the method embodiment and will not be repeated here. In actual application, the data security detection system under a payment environment provided by the above embodiment can allocate the above functions to different functional modules as needed, that is, divide the internal structure of the system into different functional modules to complete all or part of the functions described above, and this is not limited here.

[0097] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0098] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0099] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0100] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0101] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0102] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0103] In the several embodiments provided in the present application, it should be understood that the disclosed system can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0104] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0105] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0106] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0107] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data security detection method in a payment environment, characterized in that: include: Acquire multimodal data in a payment environment and perform preprocessing, wherein the multimodal data includes account information and payment order information; A payment behavior graph network is constructed based on the preprocessed multimodal data, wherein the account information is set as the nodes of the graph network, and the payment order information is set as the edges and edge weights of the graph network; Identify high-density subgraphs and associated group structures in the graph network according to a preset graph structure analysis algorithm, and identify cyclic paths in the associated group structure through a preset identification algorithm; Extracting time series features according to the cycle path, clustering the time series features, identifying periodic features and clustering features of the cycle path, and setting the periodic features and clustering features as path features; Based on the detected cycle path and time series features, a cycle payment scoring model is constructed, and the cycle payment score of the cycle path is calculated by combining the features of the graph nodes and the path features, including: vectorizing the time series features, node features and path features of the cycle path to form a feature vector, where the node feature vector V N Including account activity ACT, transaction frequency Freq and node degree Deg; path feature vector V p Including periodic features Per and clustering features Clus; time series features V T ; The node feature vector V N 、Path feature vector V p and time series features V T Merge into the path overall feature vector ; Perform nonlinear feature fusion on the overall feature vector V of the path to construct the feature mapping matrix M; Perform weight transformation on the feature mapping matrix M and the path feature vector V to obtain the feature transformation matrix T; Calculate the cyclic payment score of the cyclic path based on the feature transformation matrix T; The calculation logic of nonlinear feature fusion is: , where M is the feature mapping matrix, W1 and W2 are weight matrices, b1 and b2 are bias vectors, is the activation function, tanh and ReLU are the hyperbolic tangent function and the rectified linear unit function respectively; the calculation logic of weight transformation is: , where T is the feature transformation matrix, is the path feature vector V p The calculation logic of the circular payment score is: , where Score is the cycle payment score, Tr(T) is the trace of the feature transformation matrix, n is the number of edges in the cycle path, and Path Freq,i is the transaction frequency and transaction frequency of both parties of the ith edge transaction, Node Deg,i is the node degree of both parties in the ith edge transaction, Time Gap,i is the time interval between the two parties of the i-th edge transaction; New transaction data is received in real time, a recurring payment score is obtained according to the recurring payment score model, and payment data security determination is performed according to the recurring payment score.

2. The data security detection method in a payment environment according to claim 1, characterized in that: The account information includes account ID, account type, registration time, account status, account activity and transaction frequency; the payment order information includes payment amount, payment time and payment type.

3. The data security detection method in a payment environment according to claim 2 is characterized in that: The payment behavior graph network is constructed based on the preprocessed multimodal data, including: Mapping the preprocessed account information into nodes of a graph network, wherein the features of the nodes include static features and dynamic features, wherein the static features include account ID, account type, registration time, and account status, and the dynamic features include account activity and transaction frequency; Map the pre-processed payment order information into edges of a graph network, where the edge features include payment amount, payment time, and payment type; Weights are set for the edges of the graph network, and the weights are obtained by weighted calculation based on the transaction amount, transaction frequency, and transaction time interval.

4. The data security detection method in a payment environment according to claim 1, characterized in that: The identification logic of high-density subgraphs is as follows: define the density standard for subgraph division, determine the high-density subgraphs by setting the density standard threshold, specifically including: calculate the density of the subgraph, the density is defined as the ratio of the actual number of edges to the maximum theoretical number of edges; set the density standard threshold, retain the subgraphs with density higher than the density standard threshold; start from the densest node pair, gradually add edges in descending order of weight, calculate the real-time density until the density is lower than the density standard threshold, and stop adding edges; The recognition logic of the associated group structure is as follows: calculate the centrality of the nodes in the high-density subgraph, and determine the central node according to the degree of connection between the node and other nodes; starting from the central node, gradually add nodes to form a local high-connectivity subgroup; until all nodes in the high-density subgraph are traversed, the associated group structure is obtained, in which the addition of nodes meets the restriction condition of increasing local connection density, that is, there is an edge between the newly added node and more than half of the nodes in the local high-connectivity subgroup.

5. The data security detection method in a payment environment according to claim 4 is characterized in that: Pre-defined recognition algorithms identify cyclic paths in the structure of associated groups, including: Starting from each node of the association group structure, the visited nodes are recorded, and a node path list is constructed. When the currently visited node already exists in the path list, a cyclic path in the association group structure is identified, wherein complexity control is performed by setting a cyclic path length limit; The identified cycle path is reversely checked, that is, traced back from the end node of the path to the starting node to ensure that there are no unvisited nodes in the cycle path, and at the same time check the correctness of the direction of the cycle path.

6. The data security detection method in a payment environment according to claim 1, characterized in that: Extracting time series features according to the cycle path, clustering the time series features, identifying periodic features and clustering features of the cycle path, and setting the periodic features and clustering features as path features, including: Extract the payment time from each edge in the cycle path, construct the time series data, and set the time series data as the time series feature according to the order of the cycle path; Performing cluster analysis on time series features according to a clustering algorithm to identify the periodicity and clustering characteristics of transactions, wherein the time series features are analyzed by using an autocorrelation function, the correlation of the time series at different lag steps is calculated, and the periodicity characteristic value is obtained; by setting a sliding window of a fixed length, the transaction density within the sliding window is calculated according to the sliding window density function, and the transaction density is set as a clustering feature; The periodicity feature and clustering feature are set as path features, that is, path feature = [periodicity feature, clustering feature].

7. The data security detection method in a payment environment according to claim 1, characterized in that: The payment data security determination is performed according to the circular payment score, including: When the recurring payment score is greater than the first payment score threshold, the corresponding payment order is marked as a high-risk transaction, and the transaction is frozen and manually reviewed; When the recurring payment score is less than or equal to the first payment score threshold and greater than the second payment score threshold, the corresponding payment order is marked as a medium-risk transaction, and the payer is prompted to verify and confirm; When the recurring payment score is less than or equal to the second payment score threshold, the corresponding payment order is marked as low risk and the transaction is allowed to proceed.

8. A data security detection system in a payment environment, used to implement a data security detection method in a payment environment as described in any one of claims 1 to 7, characterized in that: include: Data acquisition module: acquires multimodal data in the payment environment and performs preprocessing, wherein the multimodal data includes account information and payment order information; Constructing a network module: constructing a payment behavior graph network based on the preprocessed multimodal data, wherein the account information is set as the nodes of the graph network, and the payment order information is set as the edges and edge weights of the graph network; Path identification module: Identify high-density subgraphs and associated group structures in the graph network according to the preset graph structure analysis algorithm, and identify cyclic paths in the associated group structure through the preset identification algorithm; Setting feature module: extracting time series features according to the cycle path, clustering through the time series features, identifying periodic features and clustering features of the cycle path, and setting the periodic features and clustering features as path features; Scoring calculation module: Based on the detected cycle path and time series features, a cycle payment scoring model is constructed, and the cycle payment score of the cycle path is calculated by combining the features of the graph nodes and the path features; Security determination module: receiving new transaction data in real time through stream processing technology, obtaining a cyclic payment score according to the cyclic payment score model, and making a payment data security determination according to the cyclic payment score.

Images