Fraudulent transaction identification method and device, equipment, storage medium and program product

Abstract

The invention provides a fraudulent transaction identification method and device, equipment, a storage medium and a program product. Relates to the field of artificial intelligence. The method comprises the steps of obtaining current transaction data corresponding to a current transaction; determining a current transaction feature corresponding to the current transaction data; matching target transaction characteristics according to the current transaction data, wherein the target transaction characteristics comprise a target transaction posterior characteristic, a target transaction address characteristic, a target recent transaction real-time characteristic and a target transaction sequence; and inputting the target transaction characteristics into a fraud identification model trained to converge, and identifying whether the current transaction is a fraud transaction by adopting the fraud identification model trained to converge. According to the method, multi-dimensional feature information is added, fraud transaction behaviors can be fully mined, transaction fraud can be efficiently recognized, and the accuracy of transaction fraud recognition is improved.

Description

Technical Field

[0001] The application involves artificial intelligence technology, and in particular, a fraudulent transaction identification method, device, equipment, storage medium and program product. Background Art

[0002] With the rapid development of digital payment and financial activities, credit card transactions have become an important part of the modern financial system. However, the problem of fraudulent credit card transactions is becoming increasingly serious. For example, criminals conduct transactions by stealing customers' credit card information, which is not a normal transaction conducted by the customer himself, causing huge economic losses to both financial institutions and customers. Therefore, it is very important to effectively identify fraudulent credit card transactions.

[0003] Traditional credit card fraud transaction identification methods usually rely on pre-defined rules and pattern matching technology. However, this method cannot fully identify fraudulent transactions and also makes the accuracy of fraudulent transaction identification low. Summary of the invention

[0004] The present application provides a fraudulent transaction identification method, device, equipment, storage medium and program product to solve the problem that fraudulent transactions cannot be fully identified in the prior art and the accuracy of fraudulent transaction identification is low.

[0005] In a first aspect, the present application provides a fraudulent transaction identification method, comprising:

[0006] Get the current transaction data corresponding to the current transaction;

[0007] Determining a current transaction feature corresponding to the current transaction data;

[0008] Determine a target transaction feature that matches the current transaction data, the target transaction feature including: a posteriori target transaction feature, a target transaction address feature, a real-time target recent transaction feature, and a target transaction sequence; the target transaction feature is a feature determined based on a target historical transaction feature and a corresponding current transaction feature;

[0009] The target transaction feature is input into a fraud identification model trained to convergence, and the fraud identification model trained to convergence is used to identify whether the current transaction is a fraudulent transaction.

[0010] In a possible design, the current transaction characteristics include: current transaction amount, current transaction customer information and current transaction merchant information;

[0011] The target transaction posterior features include: target transaction customer posterior features, the target transaction customer posterior features include: the average consumption amount of the combined customer, the average consumption amount of each merchant type after combination, and at least one preset customer-related fraud rate feature;

[0012] The determining of the target transaction feature matching the current transaction data includes:

[0013] Obtain the historical transaction amount, historical transaction merchant information, and the number of fraudulent transactions in the historical transactions corresponding to the customer whose current transaction customer information is consistent with the historical transaction customer information;

[0014] According to the historical transaction amount and the historical transaction merchant information, and according to different time windows, determine the average consumption amount of customers and the average consumption amount under each merchant type;

[0015] Determine the combined average customer consumption amount and the combined average consumption amount for each merchant type based on the current transaction amount, the average customer consumption amount and the average consumption amount for each merchant type;

[0016] At least one preset customer-associated cheating rate feature is determined according to the current transaction customer information and the number of historical fraudulent transactions corresponding to the customer and according to different time windows.

[0017] In one possible design, the current transaction characteristics include: current transaction amount and current transaction merchant information;

[0018] The target transaction a posteriori features include: target transaction merchant a posteriori features, the target transaction merchant a posteriori features include: the average customer consumption amount after combination, the average consumption amount after combination under each merchant type, and at least one preset merchant-related cheating rate feature;

[0019] The determining of the target transaction feature matching the current transaction data includes:

[0020] Obtain the historical transaction amount, historical transaction merchant information, and the number of fraudulent transactions in the historical transactions corresponding to the customer whose information is consistent with the current transaction customer information;

[0021] According to the historical transaction amount and the historical transaction merchant information, and according to different time windows, determine the average consumption amount of each merchant and the average consumption amount under each merchant type;

[0022] Determine the combined average consumption amount of merchants and the combined average consumption amount of each merchant type according to the current transaction amount, the average consumption amount of each merchant and the average consumption amount of each merchant type;

[0023] At least one preset merchant-associated cheating rate feature is determined according to the current transaction merchant information and the number of fraudulent transactions in the merchant's corresponding historical transactions, and according to different time windows.

[0024] In a possible design, the current transaction characteristics include: current transaction customer information, current transaction address information and current transaction time information;

[0025] The target transaction address features include: the number of active areas accumulated in current and historical transactions and the distance accumulated in current and historical transactions according to transaction time;

[0026] The determining of the target transaction feature matching the current transaction data includes:

[0027] Obtain the historical transaction address and historical transaction time information corresponding to the customer whose information is consistent with the current transaction customer;

[0028] According to the current transaction address information and the historical transaction address information, and according to different time windows, the number of active areas accumulated by current and historical transactions is determined to obtain a plurality of numbers of active areas accumulated by current and historical transactions;

[0029] According to the current transaction time information and address information, the historical transaction time information and address information, and according to different time windows, the distance accumulated according to the transaction time in the current and historical transactions is determined to obtain the distance accumulated according to the transaction time in multiple current and historical transactions.

[0030] In a possible design, the current transaction characteristics include: information about the acquiring institution of the current transaction, information about the current transaction location, and information about the current transaction time;

[0031] The target recent transaction real-time features include: the number of acquiring institutions for current and historical transactions, target distance, target duration, and target movement speed;

[0032] The determining of the target transaction feature matching the current transaction data includes:

[0033] Obtain the acquiring institution information of the current transaction and historical transactions in multiple recent time periods, the location information of the most recent historical transaction, and the time information of the most recent historical transaction;

[0034] Determine the number of acquirers for multiple current and historical transactions based on the acquirer information;

[0035] Determine the target distance according to the current transaction location information and the most recent historical transaction location information;

[0036] Determine the target duration based on the current transaction time information and the most recent historical transaction time information;

[0037] The target moving speed is calculated according to the target distance and the target duration.

[0038] In one possible design, the fraud identification model trained to convergence includes: a transformer network structure trained to convergence;

[0039] The current transaction characteristics include: the merchant identification of the current transaction, the merchant type of the current transaction, the current transaction type, and the time information of the current transaction;

[0040] The determining of the target transaction feature matching the current transaction data includes:

[0041] Acquire multiple historical transaction data, and extract the merchant identifier, merchant type, and historical transaction type of the historical transaction in each historical transaction data;

[0042] Determine the time difference between each historical transaction and the current transaction according to the transaction time information of the current transaction and the time information of the historical transactions;

[0043] The merchant identification, merchant type, transaction type and time difference corresponding to each transaction are combined to obtain each target transaction data, and a target transaction sequence is generated according to each target transaction data.

[0044] In a possible design, before inputting the target transaction features into the fraud identification model trained to convergence, the method further includes:

[0045] The target transaction posterior features, target transaction address features, and target recent transaction real-time features are discretized with equal width to obtain the discretized transaction features of each target.

[0046] In a possible design, the fraud identification model trained to convergence is a Wide & Deep model trained to convergence; the Wide & Deep model includes a linear network structure, a Transformer network structure, and a DNN network structure;

[0047] The step of inputting the target transaction feature into a fraud identification model trained to convergence, and using the fraud identification model trained to convergence to identify whether the current transaction is a fraudulent transaction comprises:

[0048] Inputting the target transaction sequence into a transformer network structure trained to convergence, and using the transformer network structure trained to convergence to output regular features of the target transaction sequence;

[0049] Inputting the target transaction posterior features, target transaction address features, target recent transaction real-time features and corresponding target discretized transaction features into a DNN network structure trained to convergence, and using the DNN network structure to extract target high-order features;

[0050] Inputting the target transaction posterior features, target transaction address features, and target recent transaction real-time features into a linear network structure trained to convergence, and using the linear network structure trained to convergence to extract target low-order features;

[0051] Determine whether the current transaction is a fraudulent transaction according to the target transaction sequence regularity characteristics, the target high-order characteristics and the target low-order characteristics.

[0052] In one possible design, the training steps of the preset fraud model include:

[0053] Acquire training samples, wherein the training samples include sample transaction features and annotated identification types that match the transaction sample data, wherein the transaction sample data includes sample original transaction features; the sample transaction features include: sample transaction a posteriori features, sample transaction address features, sample recent transaction real-time features, and sample transaction sequence; the sample transaction features are features determined based on sample historical transaction features and corresponding sample original transaction features;

[0054] Using the training samples to train a preset fraud model;

[0055] In response to satisfying the training convergence condition, the fraud model satisfying the training convergence condition is determined as the fraud identification model trained to convergence.

[0056] In a second aspect, the present application provides a fraudulent transaction identification device, comprising:

[0057] An acquisition module, used to acquire current transaction data corresponding to the current transaction, and determine current transaction features corresponding to the current transaction data;

[0058] A determination module, used to determine target transaction features that match the current transaction data, wherein the target transaction features include: target transaction a posteriori features, target transaction address features, target recent transaction real-time features, and target transaction sequence; the target transaction features are features determined based on target historical transaction features and corresponding current transaction features;

[0059] The identification module is used to input the target transaction feature into a fraud identification model trained to convergence, and use the fraud identification model trained to convergence to identify whether the current transaction is a fraudulent transaction.

[0060] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0061] The memory stores computer-executable instructions;

[0062] The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of the first aspects;

[0063] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method described in the first aspect.

[0064] In a fifth aspect, the present application provides a computer program product, including a computer program, which implements the method described in the first aspect when executed by a processor.

[0065] The fraudulent transaction identification method, device, equipment, storage medium and program product provided by the present application obtain current transaction data corresponding to the current transaction; determine the current transaction features corresponding to the current transaction data; determine the target transaction features matching the current transaction data according to the current transaction features; wherein the target transaction features include: target transaction posterior features, target transaction address features, target recent transaction real-time features and target transaction sequence; the target transaction features are features determined according to the target historical transaction features and the corresponding current transaction features, the target transaction features are input into the fraud identification model trained to convergence, and the training to convergence is used to identify the target transaction features. The convergent fraud identification model identifies whether the current transaction is a fraudulent transaction. Since the target transaction features of multiple dimensions are determined based on the current transaction features and historical transaction features, the target transaction features of multiple dimensions can more fully reflect whether the current transaction behavior is consistent with the normal transaction behavior of the customer. Therefore, when the fraud identification model trained to convergence is used to determine whether the current transaction is a fraudulent transaction based on the target transaction features of multiple dimensions, it can more accurately and comprehensively determine whether the current transaction is a fraudulent transaction, effectively improve the problem of low accuracy in abnormal transaction identification caused by pre-defined rules and pattern matching dependencies, and reduce false positives or omissions of transaction fraud. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0067] Figure 1 An application scenario diagram of the fraudulent transaction identification method provided in this application;

[0068] Figure 2Another application scenario diagram of the fraudulent transaction identification method provided in this application;

[0069] Figure 3 A flowchart of a fraudulent transaction identification method provided in an embodiment of the present application;

[0070] Figure 4 A real-time feature block diagram of a target recent transaction provided in an embodiment of the present application;

[0071] Figure 5 The Wide&Deep model network structure provided in an embodiment of the present application;

[0072] Figure 6 A flowchart of a fraudulent transaction identification method provided in another embodiment of the present application;

[0073] Figure 7 A schematic diagram of a device for a fraudulent transaction identification method provided in an embodiment of the present application;

[0074] Figure 8 It is a schematic diagram of the structure of an electronic device provided in one embodiment of the present application.

[0075] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0076] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0077] It should be noted that during the implementation of this application plan, all applicable laws and regulations will be strictly followed, and all aspects of the collection, storage, use, processing, circulation, provision and even external disclosure of all financial information and customer data will be carried out in a legal and compliant manner to ensure that there is no risk of illegal or irregular behavior throughout the process, and to resolutely maintain social public order and good moral customs.

[0078] It should be noted that in the description of the embodiments of this application, any software tools, component designs, etc. mentioned are intended to be used as exemplary references, and are intended to clearly illustrate the feasibility of the implementation path of the technical solution of this application, rather than indicating that the applicant has actually adopted or will inevitably adopt the solution. These mentioned external elements are only used to assist understanding and do not constitute limitations or constraints on the specific implementation content of this application.

[0079] First, the terms involved in this application are explained:

[0080] Posterior features: refers to features that are summarized or determined based on a certain dimension based on historical data.

[0081] Transformer: Also known as a converter, it refers to a network structure for deep learning modeling of sequence data.

[0082] Wide&Deep model: is a deep learning model, which is mostly used in classification scenarios. The core idea is to combine the memorization ability of the linear model with the generalization ability of the deep neural network to achieve better recommendation results. The model consists of two parts, the Wide part and the Deep part. The Wide part is a generalized linear model, which is mainly responsible for processing memory ability. It directly learns and uses the co-occurrence frequency of items or features in historical data, and can quickly process and memorize a large number of historical behavior features. The Deep part is a multi-layer feedforward neural network, which is mainly responsible for processing generalization ability. It can automatically learn high-order nonlinear features.

[0083] In order to clearly understand the technical solution of the present application, the solution of the prior art is first introduced in detail.

[0084] Traditional detection methods based on rules and pattern matching, which rely only on static feature data, are unable to cope with increasingly complex and changeable fraud methods. Fraudsters continue to adopt new technologies and strategies to conduct fraudulent activities, such as cross-border transactions, phishing, false identity registration, etc. These methods often exceed the scope of static rules. At the same time, the traditional technical method of using the distance between the transaction address and the permanent residence to judge the transaction risk can reflect the abnormality of transaction behavior to a certain extent, but this method ignores the temporary activities that customers may have, such as business trips and tourism. This leads to the fact that in these cases, normal transaction behaviors may also be misjudged as fraud, increasing the false alarm rate. The analysis method based on customer historical transaction data in traditional technology can build a customer habit model from multiple dimensions such as time, amount, location, target type and transaction channel; but it only relies on historical transactions to analyze customer habits and lacks analysis methods from the merchant feature dimension, which greatly reduces the accuracy of the final judgment effect.

[0085] Therefore, in the face of existing technical problems, in order to improve the accuracy of transaction fraud identification by analyzing customer habits from historical transactions, target transaction posterior features are introduced. The target transaction posterior features can include target transaction customer posterior features and target transaction merchant posterior features. In order to reduce the false alarm rate of fraud identification that is prone to occur in temporary business trips, going abroad, etc., this application also introduces target transaction address features from the historical transaction address level; and in order to better utilize the timing information contained in customer information, the target recent transaction real-time features and target transaction sequence are introduced; finally, in order to better improve the generalization ability of the algorithm model, a fraud identification model trained to convergence is used, such as a Wide & Deep network structure to identify the above four types of features, fully explore the characteristics of fraudulent transaction behavior, accurately and comprehensively identify fraudulent transactions, and thus reduce the false alarm rate of fraudulent transactions.

[0086] Figure 1 This is an application scenario diagram that can implement the fraudulent transaction identification method provided by this application, such as Figure 1 As shown, the scene diagram corresponding to the fraudulent transaction identification method provided by the present application includes a terminal device 101, a server 102, and a data server 103. The transaction fraud identification device can be integrated in 102, and the basic information and historical transaction data of the customer can be stored in the database server 103; specifically, the terminal device 101 includes a corresponding bank card payment client, and the customer performs corresponding transactions on the client; after the customer enters the password, the transaction message is sent to the server 102, and the transaction message includes the current transaction data. The server 102 extracts the current transaction data and obtains the historical transaction data corresponding to the current transaction data from the data server 103 that records the customer's transaction information in real time; then the server 102 determines the target transaction features that match the current transaction data, wherein the transaction features include the target transaction a posteriori features, the target transaction address features, the target recent transaction real-time features, and the target transaction sequence; the server 102 inputs the target transaction features into the fraud identification model trained to convergence, and uses the fraud identification model trained to convergence to identify whether the current transaction is a fraudulent transaction; if it is determined to be a fraudulent transaction, the server 102 sends a fraudulent transaction prompt information to the terminal device 101 through a phone call or text message. In order to inform the customer that the current transaction is a fraudulent transaction. Optionally, the current transaction can also be closed, so that the current transaction payment fails; if it is determined to be a normal transaction, a payment success message is directly fed back.

[0087] Figure 2Another application scenario diagram for implementing the fraud transaction identification method provided by the present application, the devices involved in the application scenario may include: a terminal device 201, a server 202 and a data server 203; specifically, the terminal device 201 includes a corresponding bank card payment client, and the customer performs a corresponding transaction on the client and completes the payment; the data server 203 records the current transaction information in real time, and feeds back the customer information update to the server 203; the server 202 obtains the current transaction information related to the newly updated transaction data from the data server 203, and determines the matched target transaction features and inputs the target transaction features into the fraud identification model trained to convergence, and uses the fraud identification model trained to convergence to identify whether the current transaction is a fraud transaction; if it is determined to be a fraud transaction, the server 202 sends a fraud transaction prompt information to the terminal device 201 via telephone or text message, and optionally, the corresponding bank card account can also be frozen.

[0088] The server is a form of a fraudulent transaction identification device, and the fraudulent transaction identification device may also be in other forms, which are not limited in this example. The fraudulent transaction device is a type of electronic device.

[0089] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0090] Figure 3 A flowchart of a fraudulent transaction identification method provided in an embodiment of the application is shown in FIG. Figure 3 As shown, the execution subject of this embodiment is a fraudulent transaction identification device, which can be implemented by a computer program; it can also be implemented by a medium storing relevant computer programs, such as a USB flash drive and / or a CD, or it can also be implemented by a physical device integrated or installed with relevant computer programs, such as a chip or a fraudulent transaction identification device. The fraudulent transaction identification device can be a server, a server cluster or other electronic equipment, etc. The fraudulent transaction identification method provided in this embodiment includes the following steps:

[0091] Step 301: Obtain current transaction data corresponding to the current transaction.

[0092] The current transaction refers to a transaction that is about to be paid. Specifically, after the customer completes the input of the payment password through a client or a webpage, the current transaction data corresponding to the current transaction can be obtained.

[0093] The current transaction data refers to the data related to the payment transaction to be completed, which can be carried in the current transaction message.

[0094] Step 302: Determine the current transaction features corresponding to the current transaction data.

[0095] The current transaction feature is a feature corresponding to the current transaction data, which may include: current transaction customer ID, current transaction merchant ID, current transaction merchant type, current transaction location, current transaction acquiring institution, current transaction time, etc.

[0096] Specifically, in this embodiment, a preset feature extraction algorithm can be used to extract the current transaction features corresponding to the current transaction data. The current transaction message can also be parsed to obtain a field at a preset position in the current transaction message, and the current transaction features can be obtained from the field at the preset position. In this embodiment, the method for determining the current transaction features is not limited.

[0097] Step 303: Determine a target transaction feature that matches the current transaction data. The target transaction feature is a feature determined based on the target historical transaction feature and the corresponding current transaction feature.

[0098] Among them, the target transaction features include: target transaction a posteriori features, target transaction address features, target recent transaction real-time features and target transaction sequence.

[0099] Specifically, in this embodiment, the current transaction customer identifier and the current transaction merchant identifier corresponding to the current transaction data can be determined, and the historical transaction data of the same customer, the historical transaction data corresponding to the same merchant, and the historical transaction data of the same merchant type and the same merchant can be obtained from the database server. Based on the above historical transaction data, the target historical transaction features are extracted, and the target transaction features matching the current transaction data are determined based on the current transaction features and the target historical transaction features.

[0100] Among them, the target historical transaction characteristics may include: target historical transaction a posteriori characteristics, target historical transaction address characteristics, target historical recent transaction real-time characteristics and target historical transaction sequence, etc., which are not limited in this embodiment.

[0101] Step 304: Input the target transaction feature into the fraud identification model trained to convergence, and use the fraud identification model trained to convergence to identify whether the current transaction is a fraudulent transaction.

[0102] The fraud identification model may be a deep learning algorithm, which combines different types of basic network structures to achieve complementary advantages of different types of models and improve the generalization ability and robustness of the model. Optionally, it may be a Wide & Deep model.

[0103] Specifically, the target transaction features are input into a fraud recognition model trained to convergence in the server. The fraud recognition model trained to convergence analyzes and processes the target transaction features and identifies whether it is a fraudulent transaction. The probability of a fraudulent transaction can be output, and whether it is a fraudulent behavior is determined based on the output probability.

[0104] Optionally, the output probability can be compared with a preset threshold, and if it is greater than the preset threshold, it is determined to be a fraudulent transaction. Conversely, if it is less than or equal to the preset threshold, it is determined to be a normal transaction.

[0105] The preset threshold may be 85%, 95% or other appropriate values, which is not limited in this embodiment.

[0106] In this embodiment, the current transaction data corresponding to the current transaction is obtained; the current transaction features corresponding to the current transaction data are determined; and the target transaction features matching the current transaction data are determined according to the current transaction features; wherein the target transaction features include: a posteriori features of the target transaction, a target transaction address feature, a real-time feature of the target latest transaction, and a target transaction sequence; the target transaction features are features determined according to the target historical transaction features and the corresponding current transaction features, the target transaction features are input into a fraud identification model trained to convergence, and the fraud identification model trained to convergence is used to identify whether the current transaction is a fraudulent transaction method; since target transaction features of multiple dimensions are determined based on the current transaction features and the historical transaction features, the target transaction features of multiple dimensions can more fully reflect whether the current transaction behavior conforms to the normal transaction behavior of the customer, so when the fraud identification model trained to convergence is used to determine whether the current transaction is a fraudulent transaction based on the target transaction features of multiple dimensions, it can be more accurately and comprehensively determined whether the current transaction is a fraudulent transaction, effectively improving the problem of low accuracy in abnormal transaction identification caused by pre-defined rules and pattern matching dependencies, and reducing the false positives or omissions of transaction fraud.

[0107] As an optional implementation, based on the above embodiment, the current transaction characteristics include: current transaction amount, current transaction customer information and current transaction merchant information.

[0108] Accordingly, the target transaction posterior features include: target transaction customer posterior features, and the target transaction customer posterior features include: the combined average customer consumption amount, the combined average consumption amount under each merchant type, and at least one preset customer-related cheating rate feature.

[0109] Accordingly, target transaction features matching the current transaction data are determined, including:

[0110] Obtain the historical transaction amount, historical transaction merchant information, and number of fraudulent transactions in the historical transactions corresponding to the customer whose information is consistent with the current transaction customer information.

[0111] Among them, the historical transaction amount refers to the amount corresponding to each transaction completed by the current customer before this consumption.

[0112] Among them, historical transaction merchant information refers to the consumer merchant information corresponding to each transaction completed by the current customer before this consumption.

[0113] Among them, the number of fraudulent transactions in the customer's corresponding historical transactions refers to the number of fraudulent transactions that occurred in each transaction completed by the current customer before this consumption.

[0114] Specifically, the current transaction amount, current transaction customer information and current transaction merchant information corresponding to the current transaction data are determined in the server; then, based on the above current transaction data, the current customer's historical transaction amount, historical transaction merchant information and the number of fraudulent transactions in the customer's corresponding historical transactions are obtained from the data server.

[0115] Based on historical transaction amounts and historical transaction merchant information, and according to different time windows, determine the average customer consumption amount and the average consumption amount under each merchant type.

[0116] Among them, different window times refer to different time periods separated from the current consumption day.

[0117] The average customer spending amount refers to the average spending amount of the customer within the corresponding time window.

[0118] Correspondingly, the average consumption amount under a customer merchant type refers to the average value of all consumption amounts of the customer under the same type of merchant.

[0119] Among them, taking the average consumption amount of catering merchants within one day as an example, it can be expressed as:

[0120] (a1+a2+…+a n ) / n formula (1)

[0121] a1+a2+…+a n It represents the transaction amount of all current customers when they consume in catering merchants within one day; n represents the total number of consumption; the average consumption amount of other characteristics is calculated in this way.

[0122] Specifically, the average customer spending amount under different time windows and the average spending amount under each merchant type can be determined according to the above preset formula based on the historical transaction amount and historical transaction merchant information. Different time windows can be set to 1 day, 15 days, 30 days, 90 days, or other days without limitation.

[0123] The combined average customer consumption amount and the combined average consumption amount under each merchant type are determined based on the current transaction amount, the average customer consumption amount and the average consumption amount under each merchant type.

[0124] The combined average customer consumption amount refers to the average consumption amount after combining the customer's average consumption amount with the current transaction amount.

[0125] Optionally, the combined average consumption amount can be expressed as a ratio of the merchant's average consumption amount to the current transaction amount.

[0126] The average consumption amount after combination under each merchant type refers to the average consumption amount after combining the average consumption amount of each merchant type with the current transaction amount.

[0127] Optionally, the average consumption amount after combination under each merchant type can be expressed by the ratio of the average consumption amount of each merchant type to the current transaction amount.

[0128] At least one preset customer-related fraud rate feature is determined according to the current transaction customer information and the number of historical fraud transactions corresponding to the customer, and according to different time windows.

[0129] Among them, at least one preset customer-related fraud rate feature includes: customer gender fraud rate, customer age fraud rate, customer gender and age fraud rate, city fraud rate, and province and country fraud rate, etc.

[0130] Among them, the customer gender cheating rate is the ratio of the number of transactions in which false gender registration occurs for customers of the same gender to the total number of transactions of all customers of the same gender in the determination of different customers' transaction information within the corresponding time window; the customer age cheating rate is the ratio of the number of transactions in which false age registration occurs for different customers to the total number of transactions of all customers in the determination of different customers' transaction information within the corresponding time window; the customer gender and age cheating rate is the ratio of the number of transactions in which both gender and age information of customers of the same gender are falsely registered to the total number of transactions of all customers of the same gender in the determination of different customers' transaction information within the corresponding time window; the city cheating rate is the ratio of the number of transactions in which false registration occurs for different customers' city information to the total number of transactions of all customers in the determination of different customers' transaction information within the corresponding time window; the province cheating rate is the ratio of the number of transactions in which false registration occurs for different customers' province information to the total number of transactions of all customers in the determination of different customers' transaction information within the corresponding time window; the country cheating rate is the ratio of the number of transactions in which false registration occurs for different customers' country information to the total number of transactions of all customers in the determination of different customers' transaction information within the corresponding time window.

[0131] Here, the customer gender cheating rate is used as an example. If the customer is determined to be male through the current transaction customer information, the customer gender cheating rate determined within a 1-day time window can be expressed as shown in formula (2):

[0132] j / k formula (2)

[0133] k represents the number of historical transactions of all male customers within one day, j represents the number of fraudulent transactions, and the cheating rates of other features are calculated in a similar manner.

[0134] Specifically, the customer-associated fraud rate in different time windows can be calculated according to the above preset formula based on the extracted current customer information and the number of historical fraud transactions; thereby determining at least one preset customer-associated fraud rate feature; illustratively, different time windows can be set to 1 day, 15 days, 30 days, and 90 days, which are not limited here.

[0135] In this embodiment, the current transaction features include: the current transaction amount, the current transaction customer information and the current transaction merchant information; accordingly, the target transaction posterior features include: the target transaction customer posterior features, the target transaction customer posterior features include: the combined average customer consumption amount, the combined average consumption amount under each merchant type and at least one preset customer-related fraud rate feature; so when determining the target transaction features that match the current transaction data, the historical transaction amount, the historical transaction merchant information and the number of fraudulent transactions in the historical transactions corresponding to the customer who is consistent with the current transaction customer information are obtained; the customer average consumption amount and each merchant type are determined according to the historical transaction amount and the historical transaction merchant information, and according to different time windows. The average consumption amount under the current transaction amount, the average consumption amount of the customer and the average consumption amount under each merchant type are determined according to the current transaction amount, the average consumption amount of the customer and the average consumption amount under each merchant type; according to the current transaction customer information and the number of historical transaction fraud transactions corresponding to the customer, at least one preset customer-related fraud rate feature is determined according to different time windows, and the combined average consumption amount of the customer, the combined average consumption amount under each merchant type and at least one preset customer-related fraud rate feature can be extracted in different time windows, so that the target transaction features under multi-dimensional and multi-time windows can be extracted, which can help the transaction fraud model capture more potential fraud behavior patterns, thereby improving the accuracy and reliability of risk assessment.

[0136] As an optional implementation, based on the above embodiment, the current transaction characteristics include: current transaction amount and current transaction merchant information.

[0137] Correspondingly, the target transaction a posteriori features include: target transaction merchant a posteriori features; the target transaction merchant a posteriori features include: the combined average customer consumption amount, the combined average consumption amount under each merchant type and at least one preset merchant-associated cheating rate feature.

[0138] Determine the target transaction characteristics that match the current transaction data, including:

[0139] Obtain the historical transaction amount, historical transaction merchant information, and the number of fraudulent transactions in the historical transactions corresponding to the customer whose information is consistent with the current transaction customer information.

[0140] The number of fraudulent transactions in the historical transactions corresponding to the merchant is the number of fraudulent transactions that occurred in all merchant transactions in the historical transaction information corresponding to the current customer.

[0141] Specifically, the current transaction amount and the current transaction merchant information are determined in the server; then, based on the current transaction data, the historical transaction amount, historical transaction merchant information, and the number of fraudulent transactions in the historical transactions corresponding to the customer whose information is consistent with the current transaction customer information are matched from the data server.

[0142] Based on historical transaction amounts and historical transaction merchant information, and according to different time windows, determine the average consumption amount of each merchant and the average consumption amount of each merchant type.

[0143] The average merchant consumption amount refers to the average amount of merchant consumption by customers within the corresponding time window.

[0144] Specifically, the average merchant consumption amount under different time windows and the average consumption amount under each merchant type can be determined according to the extracted historical transaction amount and historical transaction merchant information according to the preset formula. For example, different time windows can be set to 1 day, 15 days, 30 days, 90 days, or other days, which are not limited here.

[0145] The average consumption amount of the combined merchants and the average consumption amount of the combined merchant types are determined based on the current transaction amount, the average consumption amount of each merchant and the average consumption amount of each merchant type.

[0146] Among them, the combined average consumption amount of merchants refers to the average consumption amount after combining the average consumption amount of each merchant with the current transaction amount.

[0147] Optionally, the combined average consumption amount of merchants can be expressed as a ratio of the average consumption amount of each merchant to the current transaction amount.

[0148] At least one preset merchant-associated cheating rate feature is determined according to the current transaction merchant information and the number of fraudulent transactions in the merchant's corresponding historical transactions, and according to different time windows.

[0149] The at least one preset merchant-associated cheating rate feature includes: merchant cheating rate and merchant type cheating rate.

[0150] Among them, the merchant cheating rate is the ratio of the number of false transactions among different customer merchant transactions to the total number of merchant transactions among all customers in the determination of different customer transaction information within the corresponding time window; among them, the merchant type-associated cheating rate is the ratio of the number of false transactions among different customers' same-type merchant transactions to the total number of transactions among the same-type merchants in the determination of customer transaction information within the corresponding time window.

[0151] Here, the merchant type cheating rate is taken as an example. If the merchant type of the customer consumption is determined to be catering, the customer merchant type cheating rate determined within a 1-day time window can be expressed as shown in formula (3):

[0152] i / m formula (3)

[0153] m represents the number of consumption at catering merchants in all customers’ historical transactions within one day, i represents the number of fraudulent transactions, and the cheating rates of other features are similar.

[0154] Specifically, the merchant information of the current transaction and the number of fraudulent transactions in the merchant's corresponding historical transactions can be extracted to calculate at least one preset merchant-associated fraud rate feature under different time windows according to formula (3), thereby determining at least one preset customer-associated fraud rate feature; illustratively, different time windows can be set to 1 day, 15 days, 30 days, and 90 days, which are not limited here.

[0155] In this embodiment, these amount-related posterior features are used to compare with the current transaction features, because the current fraudulent transaction is quite different from these amount-related posterior features, and can be well characterized by division. For example, if a customer's historical average consumption amount is 200 yuan, and the current transaction amount is 10,000 yuan, the difference is very large, and the risk of fraudulent transactions will be very high. The difference is reflected by the ratio of the average consumption amount to the current transaction amount. The cheating rate posterior feature refers to the cheating risk of the attribute itself. For example, the posterior cheating rate of men is 0.02%, and the posterior cheating rate of women is 0.01%, indicating that men are more likely to cheat than women. When the fraud identification model trained to convergence is scored, men will score higher than women in this dimension (the above is only an example).

[0156] In this embodiment, the current transaction features include: the current transaction amount and the current transaction merchant information; the target transaction a posteriori features include: the target transaction merchant a posteriori features, the target transaction merchant a posteriori features include: the combined average customer consumption amount, the combined average consumption amount under each merchant type and at least one preset merchant-associated cheating rate feature; determining the target transaction features that match the current transaction data includes: obtaining the historical transaction amount, the historical transaction merchant information, and the number of fraudulent transactions in the historical transactions corresponding to the customer who is consistent with the current transaction customer information; determining the average consumption amount of each merchant and the average consumption amount under each merchant type according to the historical transaction amount and the historical transaction merchant information, and according to different time windows; The combined average customer consumption amount and the combined average consumption amount under each merchant type are determined according to the current transaction amount, the average consumption amount of each merchant and the average consumption amount under each merchant type; at least one preset merchant-associated fraud rate feature is determined according to the current transaction merchant information and the number of fraudulent transactions in the merchant's corresponding historical transactions, and according to different time windows; the combined average customer consumption amount, the combined average consumption amount under each merchant type and at least one preset merchant-associated fraud rate feature can be extracted in different time windows, so the posterior characteristics of the target transaction merchants under multi-dimensional and multi-time windows can be extracted, which can help the transaction fraud model capture more potential fraud behavior patterns, thereby improving the accuracy and reliability of risk assessment.

[0157] As an optional implementation, based on the above embodiment, the current transaction characteristics include: current transaction customer information, current transaction address information and current transaction time information;

[0158] Determine the target transaction characteristics that match the current transaction data, including:

[0159] Get the historical transaction information corresponding to the customer whose information is consistent with the current transaction customer information.

[0160] Among them, the historical transaction address refers to the transaction location of the customer during the current customer's historical transactions.

[0161] Specifically, the server determines the pre-matched current transaction customer information, current transaction address information and current transaction time information in the current transaction data; and matches the historical transaction address and historical transaction time corresponding to the customer who is consistent with the current transaction customer information in the data server according to the current customer transaction data.

[0162] According to the current transaction address information and the historical transaction address information, and according to different time windows, the number of active areas accumulated by current and historical transactions is determined to obtain the number of active areas accumulated by multiple current and historical transactions.

[0163] The current and historical accumulated number of active areas refers to the number of different cities where the current customer is located when conducting current and historical transactions within the corresponding window.

[0164] Accordingly, take the calculation of the number of active areas accumulated by a customer in one day as an example: Assume that a customer makes n transactions in one day, distributed in three cities x, y, and z, and the transaction amount in each city is continuous (such as: a1+a2+…+a n , a represents the consumption amount); then the number of activity areas is 3. Among them, the transactions of this day include the current transactions.

[0165] According to the current transaction time information and address information, the historical transaction time information and address information, and according to different time windows, the distance accumulated according to the transaction time in the current and historical transactions is determined to obtain the distance accumulated according to the transaction time in multiple current and historical transactions.

[0166] Among them, the distance accumulated according to transaction time in current and historical transactions refers to the accumulation of the movement distance between transaction change cities by the current customer in chronological order within the corresponding time window.

[0167] Accordingly, take the distance calculation accumulated during one day's transaction time as an example: the customer's consumption is distributed in three cities, x, y, and z, and the customer moves between cities according to the transaction order. The distance accumulated according to the transaction time is the distance s1 between x and y plus the moving distance s2 between y and z. If the moving cities are repeated, the distance is 0. Among them, the transactions of this day include the current transaction.

[0168] Among them, different time windows can be set to 1 day, 3 days, 15 days, and 30 days, and there is no limitation here.

[0169] In this embodiment, the historical transaction address is compared with the current transaction address because the current fraudulent transaction address and the historical transaction address will be significantly different from the number of active areas and the cumulative distance of normal transactions. Generally speaking, the number of active areas and the cumulative distance calculated for the fraudulent transaction address are larger than those calculated for normal transactions, because there is a high probability that the fraudulent transaction such as card fraud is carried out in other active areas, such as other cities, which are not the city where the cardholder is located, resulting in a large calculated cumulative distance.

[0170] In this embodiment, the current transaction features include: current transaction customer information, current transaction address information and current transaction time information; the target transaction address features include: the number of active areas accumulated in current and historical transactions and the distance accumulated according to transaction time in current and historical transactions; determining the target transaction features matching the current transaction data includes: obtaining the historical transaction address and historical transaction time information corresponding to the customer whose information is consistent with the current transaction customer information; determining the number of active areas accumulated in current and historical transactions according to different time windows based on the current transaction address information and the historical transaction address information, so as to obtain the number of active areas accumulated in multiple ...; determining the number of active areas accumulated in current and historical transactions according to different time windows; determining the target transaction features matching the current transaction data includes: obtaining the historical transaction address and historical transaction time information corresponding to the customer whose information is consistent with the current transaction customer information; determining the number of active areas accumulated in current and historical transactions according to different time windows; determining the target transaction features matching the current transaction data includes: obtaining the historical transaction address and historical transaction time information corresponding to the customer whose information is consistent with the current transaction customer information; determining the number of active areas accumulated in current and historical transactions according to different time windows; determining the target Time information and address information, historical transaction time information and address information, and determine the distance accumulated according to transaction time in current and historical transactions according to different time windows to obtain the distance accumulated according to transaction time in multiple current and historical transactions; the above in-depth analysis of the number of customer activity areas and moving distances will help to more accurately analyze the transaction characteristics of customers who frequently trade across cities or move large distances; prevent the traditional technical method of using the distance between the transaction address and the permanent residence to judge transaction risks, which will lead to customers being misjudged as fraud due to possible temporary activities; and thus help to more accurately assess the risks of transactions, thereby reducing the false alarm rate of fraudulent transaction identification.

[0171] As an optional implementation, based on the above embodiment, the current transaction characteristics include: information about the acquiring institution of the current transaction, information about the current transaction location, and information about the current transaction time;

[0172] The target’s recent transaction real-time features include: the number of acquirers for current and historical transactions, target distance, target duration, and target movement speed;

[0173] Determine the target transaction characteristics that match the current transaction data, including:

[0174] Obtain the acquiring institution information of the current transaction and historical transactions in multiple recent time periods, the location information of the most recent historical transaction, and the time information of the most recent historical transaction;

[0175] Among them, the acquiring institution information of historical transactions refers to the institution information that provides bank card services to merchants for the current customer within the corresponding most recent time window; the location information of the most recent historical transaction refers to the location information of the previous transaction corresponding to the current customer; the time information of the most recent historical transaction refers to the time information of the previous transaction corresponding to the current customer.

[0176] Among them, the current transaction location information and the historical transaction location information can be expressed by longitude and latitude.

[0177] Specifically, the acquiring institution information, current transaction location information and current transaction time information of the current transaction in the current transaction data are determined in the server; and based on the current transaction data, the acquiring institution data, the most recent historical transaction location data and the most recent historical transaction time data of the corresponding current customer's historical transactions in multiple recent time periods are matched from the database.

[0178] Determine the number of acquirers for multiple current and historical transactions based on acquirer information.

[0179] Among them, the number of acquiring institutions accumulated from multiple current and historical transactions refers to the number of acquiring institutions of the customer in different time windows; the number of acquiring institutions determined in different time windows includes the acquiring institutions currently conducting transactions.

[0180] The target distance is determined based on the current transaction position information and the most recent historical transaction position information.

[0181] The target distance refers to the difference between the longitude and latitude of the customer’s current transaction and the longitude and latitude of the most recent transaction in history, which reflects the change in the spatial location of the transaction.

[0182] Accordingly, the number of acquirers in different time windows may be determined according to the acquirers of current and historical transactions in the manner described above as the number of acquirers accumulated for multiple current and historical transactions; Figure 4 As shown, for example, different time windows can be set to the last 1 hour, 3 hours, and 6 hours, or can be set to other times, which are not limited here;

[0183] Determine the target duration based on the current transaction time information and the most recent historical transaction time information.

[0184] Among them, the target duration is the transaction time difference between the customer's current transaction time and the most recent transaction time in history, which reflects the transaction frequency.

[0185] The target's movement speed based on the target distance and target duration.

[0186] Among them, the target movement speed refers to the ratio of the target distance to the target movement time, which reflects the speed at which the customer's transaction location moves.

[0187] In this embodiment, the current transaction features include: the acquiring institution information of the current transaction, the current transaction location information and the current transaction time information; the real-time features of the target recent transaction include: the number of acquiring institutions for current and historical transactions, the target distance, the target duration and the target moving speed; determining the target transaction features that match the current transaction data includes: obtaining the acquiring institution information of the current transaction and historical transactions in multiple recent time periods, the most recent historical transaction location information and the most recent historical transaction time information; determining the number of acquiring institutions for multiple current and historical transactions based on the acquiring institution information; determining the target distance based on the current transaction location information and the most recent historical transaction location information; determining the target duration based on the current transaction time information and the most recent historical transaction time information; calculating the target moving speed based on the target distance and the target duration; by calculating the current transaction location, target distance, target duration, etc., the user's movement trajectory can be tracked in real time, and abnormal changes in geographical location can be discovered in a timely manner, which effectively improves the problem of low fraudulent transaction recognition rate caused by the difficulty of methods that rely solely on static feature data to cope with increasingly complex and changeable fraud methods, which is of great significance for identifying fraudulent transactions and preventing credit card fraud.

[0188] As an optional implementation, based on the above embodiment, the converged fraud identification model includes: a transformer network structure trained to converge.

[0189] The current transaction features include: the merchant ID of the current transaction (which can be expressed as: mrch_id), the merchant type of the current transaction (which can be expressed as: mrch_id), the current transaction type (which can be expressed as: trans_type), and the time information of the current transaction (which can be expressed as: time_diff).

[0190] The process of determining the target transaction features that match the current transaction data includes:

[0191] Acquire multiple historical transaction data, and extract the merchant ID, merchant type, and historical transaction type of the historical transaction in each historical transaction data.

[0192] The merchant ID refers to the ID corresponding to the merchant with which the customer has conducted transactions. The ID can be the name, number, etc. of the merchant, which is not limited here. The historical transaction merchant type refers to the type corresponding to the merchant in the customer's historical transactions; the historical transaction type refers to the category of the customer's historical transactions.

[0193] Specifically, the server determines the merchant identifier of the current transaction, the merchant type of the current transaction, the current transaction type and the current transaction time in the current transaction data, and matches the merchant identifier, historical transaction merchant type, historical transaction type and current transaction time of the historical transactions corresponding to the customer whose customer information is consistent with the current transaction from the data server based on the current transaction data.

[0194] The time difference between each historical transaction and the current transaction is determined based on the transaction time information of the current transaction and the time information of the historical transactions.

[0195] When merging the merchant ID, merchant type, transaction type and time difference corresponding to each transaction, they can be spliced ​​in the order of the merchant ID, merchant type, transaction type and time difference corresponding to each transaction to obtain each target transaction data.

[0196] When a target transaction sequence is generated according to each target transaction data, each target transaction data is a one-dimensional sequence, and each one-dimensional sequence is arranged and spliced ​​to form a target transaction sequence.

[0197] Exemplarily, the target transaction data can be represented as an item. If there are 100 transactions, there are 100 items. The 100 items are arranged and spliced ​​to form a target transaction sequence.

[0198] In this embodiment, the basis is that there are significant differences between the user's historical normal transaction sequence and the transaction sequence of fraudulent transactions. By introducing a Transformer trained to convergence, the rules of normal historical transactions are discovered. When it is found that the current transaction violates the rules of historical transactions, the probability that this transaction is a fraudulent transaction will be relatively high.

[0199] In this embodiment, a transformer network structure is trained to convergence; the current transaction features include: a merchant identifier of the current transaction, a merchant type of the current transaction, a current transaction type, and time information of the current transaction; determining a target transaction feature that matches the current transaction data includes: obtaining multiple historical transaction data, extracting the merchant identifier of the historical transaction, the merchant type of the historical transaction, and the historical transaction type in each historical transaction data; determining the time difference between each historical transaction and the current transaction based on the transaction time information of the current transaction and the time information of the historical transaction; merging the merchant identifier, merchant type, transaction type, and time difference corresponding to each transaction to obtain each target transaction data, and generating a target transaction sequence based on each target transaction data; the above method combines multi-dimensional features such as merchant identifier, merchant type, and transaction type to form a target transaction sequence, which provides richer feature data for the fraud recognition model and breaks the mindset of relying solely on customer habits for transaction fraud recognition; it helps the fraud recognition model to dig out customers' deeper transaction behavior habits, thereby improving the accuracy of fraud transaction recognition.

[0200] As an optional implementation, based on the above embodiment, before the target transaction features are input into the fraud identification model trained to convergence, the following steps are included:

[0201] The target transaction posterior features, target transaction address features, and target recent transaction real-time features are discretized with equal width to obtain the discretized transaction features of each target.

[0202] Discretization refers to dividing continuous values ​​into n different groups with equal distances.

[0203] Accordingly, the fixed width between each group is calculated according to the number of groups n determined by the feature, and the width is modulo the original feature value for the discretized group, as shown in formula (4)

[0204] wide= (max-min) / n formula (4)

[0205] wide represents the discretization width, n represents the discretization interval, min and max represent the minimum and maximum values ​​in the feature data to be discretized respectively; the lower limit of the i-th interval is min+i*wide, and the upper limit is max+i*wide. The upper and lower limits of all intervals are calculated. When the original feature value falls into a certain interval, the corresponding i is assigned to the feature as the discretized feature.

[0206] The target discretization sequence refers to: the discretized target transaction sequence.

[0207] In this embodiment, before inputting the target transaction features into the fraud identification model trained to convergence, the method further includes: performing equal-width discretization operations on the target transaction posterior features, the target transaction address features, and the target recent transaction real-time features, respectively, to obtain each target discretized transaction feature. Converting continuous numerical features into discrete interval features through equal-width discretization operations can effectively reduce the dimension and complexity of the feature space, help avoid overfitting of the transaction fraud model, and thus improve the generalization ability of the model.

[0208] As an optional implementation, based on the above embodiment, the fraud identification model trained to convergence is a Wide & Deep model trained to convergence, such as Figure 5 As shown, the Wide & Deep model includes a linear network structure (LinearNetwork), a Transformer network structure, and a DNN network structure;

[0209] The target transaction features are input into the fraud recognition model trained to convergence, and the fraud recognition model trained to convergence is used to identify whether the current transaction is a fraudulent transaction, including:

[0210] The target transaction sequence is input into the transformer network structure trained to convergence, and the transformer network structure trained to convergence is used to output the regular features of the target transaction sequence.

[0211] Among them, the Transformer encoder network structure is mainly used to extract high-order features of the number of historical transactions, including: word embedding layer (English: embedding), multi-head self-attention layer (English: multihead self-attention) layer and feedforward neural network (abbreviated as: FNN) layer.

[0212] Among them, the encoder network structure is an important part of the Transformer model. It is composed of multiple identical encoder layers stacked together and is responsible for encoding the input sequence into a series of high-dimensional vector representations. These vectors can capture the semantic and contextual information in the input sequence; the word embedding layer is responsible for mapping each word in the vocabulary to a dense vector of a fixed length. These vectors are learned during the training process to capture the similarities and semantic relationships between words; the multi-head self-attention layer is a special attention mechanism that can obtain the attention distribution of different subspaces of the input sequence by running multiple independent self-attention mechanisms in parallel, thereby more comprehensively capturing the potential multiple semantic associations in the sequence; the feedforward neural network is a basic structure in the neural network, consisting of an input layer, a hidden layer, and an output layer; it is characterized by its hierarchical neuron structure, each neuron is only connected to the previous layer, there is no feedback path, and information is transmitted unidirectionally from the input layer to the output layer.

[0213] Then, for this solution, the target transaction sequence is input into the encoder network structure, and the word embedding layer in the encoder network structure is used to capture the semantic information related to the target transaction sequence, and output a target transaction vector of fixed dimension; then, this vector is input into the multi-head self-attention layer to capture more potential semantic association information in the target transaction vector, and output a vector of the same dimension as the input vector of this layer; then this output vector is input into the feedforward neural network for feature extraction to capture more abstract features; the output layer of the feedforward neural network outputs the regular features of the target transaction sequence. The target transaction posterior features, target transaction address features, target recent transaction real-time features, and corresponding target discretized transaction features are input into the DNN network structure trained to convergence, and the DNN network structure is used to extract the target high-order features.

[0214] Among them, Figure 5 As shown in FIG. 1 , the target transaction posterior features, the target transaction address features, the target recent transaction real-time features and the corresponding target discretized transaction features can be called original deep features.

[0215] Target high-order features refer to features that can more accurately express and highly abstract the key information of the target transaction sequence.

[0216] Among them, DNN network refers to a multi-layer neural network, which forms a deep structure by connecting multiple neurons together; it has a strong learning ability, can accurately capture nonlinear relationships, and can extract high-order features of the target at a higher level. For example, Figure 5 In the DNN, the layer consists of a concatenation layer and multiple fully connected layers. The concatenation layer is a very important operation layer, which is mainly responsible for concatenating two or more tensors along a specified path to generate a new tensor. The fully connected layer is usually composed of multiple neurons. Through the processing of the fully connected layer, the high-dimensional feature representation can be mapped to a low-dimensional space, thereby reducing the amount of computation and the risk of overfitting.

[0217] In this embodiment, the original deep feature is input into the concatenation layer, which concatenates multiple target transaction features in the original deep feature and outputs a one-dimensional vector. This one-dimensional vector is then input into the fully connected layer for higher-dimensional feature extraction, and the final target high-order feature is formed through high-dimensional abstraction of multiple layers of fully connected layers.

[0218] The target transaction posterior features, target transaction address features, and target recent transaction real-time features are input into the linear network structure trained to convergence, and the target low-level features are extracted using the linear network structure trained to convergence.

[0219] Among them, the target transaction posterior features, target transaction address features, and target recent transaction real-time features are also referred to as original wide features. Target low-order features refer to the original or basic features directly extracted from the target transaction sequence. These features have a lower level of abstraction and directly reflect the basic properties and local structure of the target transaction sequence.

[0220] Among them, linear networks are usually composed of a large number of simple neurons. They usually learn data features by adjusting the weights and bias values ​​of the network, and can be used to accurately extract low-order features.

[0221] It is understandable that there are many types of linear networks and DNN networks, and this embodiment does not limit this.

[0222] Determine whether the current transaction is a fraudulent transaction based on the target transaction sequence regularity characteristics, target high-order characteristics and target low-order characteristics.

[0223] Specifically, the above low-order features, high-order features and target transaction sequence are input into the classification prediction layer of the Wide & Deep model for classification prediction to determine whether it is a fraudulent transaction. The classification prediction layer can be a fully connected layer, which is usually the last layer of the network; the fully connected layer maps the feature representation to a vector equal to the number of categories, and each element corresponds to the predicted score or probability of a category. The result with the largest predicted score or probability can be used as the current fraudulent transaction identification result.

[0224] In this embodiment, the fraud identification model trained to convergence is a Wide & Deep model trained to convergence; the Wide & Deep model includes a linear network structure, a Transformer network structure and a DNN network structure; inputting the target transaction feature into the fraud identification model trained to convergence, and using the fraud identification model trained to convergence to identify whether the current transaction is a fraudulent transaction includes: inputting the target transaction sequence into the transformer Transformer network structure trained to convergence, and using the Transformer network structure trained to convergence to output the regular features of the target transaction sequence; inputting the target transaction posterior features, the target transaction address features, the target recent transaction real-time features and the corresponding target discretized transaction features into the DNN network structure trained to convergence, and using the DNN network structure to extract the target high-order features; inputting the target transaction posterior features, the target transaction address features and the target recent transaction real-time features into the linear network structure trained to convergence, and using the linear network structure trained to convergence to extract the target low-order features; determining whether the current transaction is a fraudulent transaction according to the regular features of the target transaction sequence, the target high-order features and the target low-order features. The provided training-to-convergence fraud transaction identification algorithm is a Wide&Deep model that includes three different network structures. The Wide&Deep model can comprehensively utilize low-order, high-order and sequence features to form a highly abstract and more comprehensive feature representation. The learning and training of this feature helps to improve the accuracy, generalization ability and robustness of the fraud identification model.

[0225] As an optional implementation, based on the above embodiment, the training steps of the preset fraud model include:

[0226] Obtain training samples, which include sample transaction features and annotated identification types that match transaction sample data. The transaction sample data includes sample original transaction features. Sample transaction features include: sample transaction posterior features, sample transaction address features, sample recent transaction real-time features, and sample transaction sequence. Sample transaction features are features determined based on sample historical transaction features and corresponding sample original transaction features.

[0227] Among them, the identification type of the sample annotation matched by the transaction sample data refers to the label of the sample data corresponding to the fraudulent transaction or the normal transaction. The label can be represented by 0 and 1, or other numbers, and there is no specific limitation on this.

[0228] Specifically, multiple transaction sample data of a certain user can be extracted to construct training samples. Specifically, the training samples can be constructed by using the above-mentioned method similar to the method of determining the target transaction features matched by the current transaction data. Then the above-mentioned training samples can be randomly shuffled; and then the training samples can be divided into training sets and prediction sets according to the preset ratio. The training set is used to input into the preset fraud model for training; the prediction set is used to input into the fraud model that has converged in training for prediction, so as to verify the accuracy and robustness of the algorithm model.

[0229] The preset fraud model is a preset Wide&Deep model. The fraud model of the training convergence condition is a Wide&Deep model trained to convergence.

[0230] There are no restrictions on the sample size and the ratio of training and testing sets, as long as the model training conditions and effects are met.

[0231] The preset fraud model is iteratively trained using training samples.

[0232] Among them, iterative training refers to the process of traversing the training data set multiple times and continuously optimizing the parameters of the model to improve the performance of the model on a given task.

[0233] In response to satisfying the training convergence condition, the fraud model satisfying the training convergence condition is determined as the fraud identification model trained to convergence.

[0234] The training convergence condition may be set as the value of the training loss function gradually decreasing and becoming stable, the training reaching a preset upper limit of the number of iterations, the performance of the validation set no longer improving, etc., which is not limited in this embodiment;

[0235] Among them, the validation set is a part of the data divided from the original data set, which is used to evaluate the performance of the model during the model training process, but does not participate in the model training process.

[0236] Exemplarily, the sample data is placed in the Wide&Deep model and model training begins; after a long period of continuous iterative training, the validation set is synchronously input into the trained model in each iterative training, thereby generating a validation accuracy rate, which is compared with the previous validation accuracy rate each time. When the validation accuracy rate no longer improves, the model is considered to have converged.

[0237] In this embodiment, the training steps of the preset fraud model include: obtaining training samples, the training samples include sample transaction features and marked identification types that match the transaction sample data, and the transaction sample data include the sample original transaction features; the sample transaction features include: sample transaction posterior features, sample transaction address features, sample recent transaction real-time features and sample transaction sequences; the sample transaction features are features determined based on the sample historical transaction features and the corresponding sample original transaction features; the preset fraud model is trained using the training samples; in response to meeting the training convergence conditions, the fraud model that meets the training convergence conditions is determined as the fraud identification model trained to convergence; the more comprehensive construction of sample data in this embodiment can construct a customer habit model from multiple dimensions such as merchants, time, amount, location, target type and transaction channel, fully explore the characteristics of fraudulent transaction behavior, and accurately and comprehensively identify fraudulent transactions; improve the problem of low transaction recognition rate caused by the limited coverage of traditional rule-based and pattern matching detection methods.

[0238] Figure 6 A flowchart of a fraudulent transaction identification method provided by another embodiment of the present application is shown in FIG. Figure 6 As shown, the fraud identification method provided in this embodiment includes the following steps:

[0239] Step 601, obtaining training samples, includes: the training samples include sample transaction features matching transaction sample data and annotated identification types.

[0240] Step 602, iteratively train a preset fraud model using training samples; in response to satisfying a training convergence condition, determine the fraud model satisfying the training convergence condition as a fraud identification model trained to convergence.

[0241] Step 603, obtaining current transaction data corresponding to the current transaction.

[0242] Step 604, determining the current transaction features corresponding to the current transaction data.

[0243] Step 605, determining target transaction features that match the current transaction data.

[0244] Step 606: Input the target transaction feature into the fraud identification model trained to convergence, and use the fraud identification model trained to convergence to identify whether the current transaction is a fraudulent transaction.

[0245] In this embodiment, the implementation method and technical effects of steps 601 to 606 are similar to the implementation methods of the corresponding solutions in the above embodiments, and will not be repeated here.

[0246] Figure 7This is a schematic diagram of the structure of a fraudulent transaction identification device provided in an embodiment of the present application. The fraudulent transaction identification provided in this embodiment is located in the fraudulent transaction identification device. The fraudulent transaction identification device can be an electronic device. The fraudulent transaction identification device 70 provided in this embodiment includes: an acquisition module 71, a determination module 72, and an identification module 73.

[0247] Among them, the acquisition module 71 is used to obtain the current transaction data corresponding to the current transaction, and determine the current transaction features corresponding to the current transaction data; the determination module 72 is used to determine the target transaction features that match the current transaction data; the target transaction features are features determined based on the target historical transaction features and the corresponding current transaction features; the identification module 73 is used to input the target transaction features into the fraud identification model trained to convergence, and use the fraud identification model trained to convergence to identify whether the current transaction is a fraudulent transaction.

[0248] Optionally, the current transaction characteristics include: current transaction amount, current transaction customer information and current transaction merchant information;

[0249] Accordingly, the target transaction posterior features include: target transaction customer posterior features, the target transaction customer posterior features include: the average consumption amount of the combined customer, the average consumption amount of each merchant type after combination, and at least one preset customer-related fraud rate feature;

[0250] The determination module 72, when determining the target transaction feature matching the current transaction data, is specifically used to:

[0251] Obtain historical transaction amounts, historical transaction merchant information, and the number of fraudulent transactions in historical transactions corresponding to the customer whose information is consistent with the current transaction customer information; determine the customer's average consumption amount and the average consumption amount under each merchant type based on the historical transaction amount and the historical transaction merchant information, and according to different time windows; determine the combined customer average consumption amount and the combined average consumption amount under each merchant type based on the current transaction amount, the customer's average consumption amount, and the average consumption amount under each merchant type; determine at least one preset customer-associated cheating rate feature based on the current transaction customer information and the number of fraudulent transactions in the customer's historical transactions, and according to different time windows.

[0252] Optionally, the current transaction characteristics include: current transaction amount and current transaction merchant information;

[0253] Accordingly, the target transaction a posteriori features include: target transaction merchant a posteriori features, the target transaction merchant a posteriori features include: the average customer consumption amount after combination, the average consumption amount after combination under each merchant type, and at least one preset merchant-related cheating rate feature;

[0254] The determination module 72, when determining the target transaction feature matching the current transaction data, is specifically used to:

[0255] Obtain historical transaction amounts, historical transaction merchant information, and the number of fraudulent transactions in historical transactions corresponding to the customer whose information is consistent with the current transaction customer information; determine the average consumption amount of each merchant and the average consumption amount of each merchant type based on the historical transaction amount and the historical transaction merchant information, and according to different time windows; determine the combined average consumption amount of the merchants and the combined average consumption amount of each merchant type based on the current transaction amount, the average consumption amount of each merchant, and the average consumption amount of each merchant type; determine at least one preset merchant-associated cheating rate feature based on the current transaction merchant information and the number of fraudulent transactions in historical transactions corresponding to the merchant, and according to different time windows.

[0256] Optionally, the current transaction characteristics include: current transaction customer information, current transaction address information and current transaction time information;

[0257] Accordingly, the target transaction address features include: the number of active areas accumulated by current and historical transactions and the distance accumulated by transaction time in current and historical transactions;

[0258] The determination module 72, when determining the target transaction feature matching the current transaction data, is specifically used to:

[0259] Obtain the historical transaction address and historical transaction time information corresponding to the customer whose information is consistent with the current transaction customer; determine the number of active areas accumulated for current and historical transactions according to the current transaction address information and the historical transaction address information, and according to different time windows, so as to obtain the number of active areas accumulated for multiple current and historical transactions; determine the distance accumulated by transaction time in current and historical transactions according to the current transaction time information and address information, the historical transaction time information and address information, and according to different time windows, so as to obtain the distance accumulated by transaction time in multiple current and historical transactions.

[0260] Optionally, the current transaction characteristics include: information about the acquiring institution of the current transaction, information about the current transaction location, and information about the current transaction time;

[0261] Accordingly, the target’s recent transaction real-time features include: the number of acquirers for current and historical transactions, target distance, target duration, and target movement speed;

[0262] The determination module 72, when determining the target transaction feature matching the current transaction data, is specifically used to:

[0263] Obtain the acquiring institution information of the current transaction and historical transactions in multiple recent time periods, the location information of the most recent historical transaction, and the time information of the most recent historical transaction; determine the number of acquiring institutions for multiple current and historical transactions based on the acquiring institution information; determine the target distance based on the current transaction location information and the most recent historical transaction location information; determine the target duration based on the current transaction time information and the most recent historical transaction time information; calculate the target movement speed based on the target distance and target duration.

[0264] Optionally, the fraud identification model trained to convergence includes: a transformer network structure trained to convergence;

[0265] Accordingly, the current transaction characteristics include: the merchant identification of the current transaction, the merchant type of the current transaction, the current transaction type, and the time information of the current transaction;

[0266] The determination module 72, when determining the target transaction feature matching the current transaction data, is specifically used to:

[0267] Acquire multiple historical transaction data, extract the merchant identifier, merchant type, and transaction type of the historical transaction in each historical transaction data; determine the time difference between each historical transaction and the current transaction based on the transaction time information of the current transaction and the time information of the historical transaction; merge the merchant identifier, merchant type, transaction type, and time difference corresponding to each transaction to obtain each target transaction data, and generate a target transaction sequence based on each target transaction data.

[0268] Optionally, the fraudulent transaction identification device provided in this embodiment further includes an operation module.

[0269] Among them, the operation module is used to perform equal-width discretization operations on the target transaction posterior features, the target transaction address features, and the target recent transaction real-time features, respectively, to obtain the discrete transaction features of each target.

[0270] Optionally, the fraud identification model trained to convergence is a Wide & Deep model trained to convergence; the Wide & Deep model includes a linear network structure, a Transformer network structure, and a DNN network structure;

[0271] Accordingly, the identification module 73 is specifically used for:

[0272] The target transaction sequence is input into the transformer network structure trained to convergence, and the transformer network structure trained to convergence is used to output the regular features of the target transaction sequence; the target transaction posterior features, target transaction address features, target recent transaction real-time features and corresponding target discretized transaction features are input into the DNN network structure trained to convergence, and the DNN network structure is used to extract the target high-order features; the target transaction posterior features, target transaction address features and target recent transaction real-time features are input into the linear network structure trained to convergence, and the linear network structure trained to convergence is used to extract the target low-order features; whether the current transaction is a fraudulent transaction is determined based on the regular features of the target transaction sequence, the target high-order features and the target low-order features.

[0273] Optionally, a training module is also included.

[0274] Among them, the training module is used to obtain training samples, and the training samples include sample transaction features and marked identification types that match the transaction sample data. The transaction sample data includes the sample original transaction features; the sample transaction features include: sample transaction posterior features, sample transaction address features, sample recent transaction real-time features and sample transaction sequences; the sample transaction features are features determined based on the sample historical transaction features and the corresponding sample original transaction features; the training samples are used to train the preset fraud model; in response to meeting the training convergence conditions, the fraud model that meets the training convergence conditions is determined as the fraud identification model trained to convergence.

[0275] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 8 As shown, the electronic device 80 provided in this embodiment includes: a processor 81 and a memory 82 communicatively connected to the processor 81 .

[0276] The memory 82 stores computer-executable instructions; the processor 81 executes the computer-executable instructions stored in the memory to implement the fraudulent transaction identification method provided by any of the above embodiments. For details, please refer to the relevant description in the above method embodiments, and no further details will be given here.

[0277] The program may include program code, and the program code includes computer-executable instructions. The memory 82 may include a high-speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory.

[0278] In this embodiment, the memory 82 is connected to the processor 81 via a bus. The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0279] The embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored, and when the computer-executable instructions are executed by a processor, they are used to implement the fraudulent transaction identification method provided in any of the above embodiments. For example, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0280] An embodiment of the present application also provides a computer program product, including a computer program, which implements the fraudulent transaction identification method provided in any one of the above embodiments when executed by a processor.

[0281] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0282] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0283] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0284] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0285] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. If not specifically stated, the processor may be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, an ASIC, etc. If not specifically stated, the storage unit may be any appropriate magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory RRAM (Resistive Random Access Memory), a dynamic random access memory DRAM (Dynamic Random Access Memory), a static random access memory SRAM (Static Random-Access Memory), an enhanced dynamic random access memory EDRAM (Enhanced Dynamic Random Access Memory), a high-bandwidth memory HBM (High-Bandwidth Memory), a hybrid memory cube HMC (Hybrid Memory Cube), etc.

[0286] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0287] In the above embodiments, the description of each embodiment has its own emphasis. For the part that is not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered as the scope recorded in this specification. After considering the specification and practicing the invention disclosed here, those skilled in the art will easily think of other embodiments of the present application. This application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary technical means in the technical field that are not disclosed in this application. The description and embodiments are only regarded as exemplary, and the true scope and spirit of the present application are indicated by the following claims. It should be understood that the present application is not limited to the precise structure described above and shown in the drawings, and various modifications and changes can be made without departing from its scope. The scope of the present application is limited only by the attached claims.

Claims

1. A fraudulent transaction identification method, characterized in that: include: Get the current transaction data corresponding to the current transaction; Determining a current transaction feature corresponding to the current transaction data; Determine a target transaction feature that matches the current transaction data, the target transaction feature including: a posteriori target transaction feature, a target transaction address feature, a real-time target recent transaction feature, and a target transaction sequence; the target transaction feature is a feature determined based on a target historical transaction feature and a corresponding current transaction feature; The target transaction feature is input into a fraud identification model trained to convergence, and the fraud identification model trained to convergence is used to identify whether the current transaction is a fraudulent transaction.

2. The method according to claim 1, characterized in that The current transaction characteristics include: current transaction amount, current transaction customer information and current transaction merchant information; The target transaction posterior features include: target transaction customer posterior features, the target transaction customer posterior features include: the average consumption amount of the combined customer, the average consumption amount of each merchant type after combination, and at least one preset customer-related fraud rate feature; The determining of the target transaction feature matching the current transaction data includes: Obtain the historical transaction amount, historical transaction merchant information, and the number of fraudulent transactions in the historical transactions corresponding to the customer whose current transaction customer information is consistent with the historical transaction customer information; According to the historical transaction amount and the historical transaction merchant information, and according to different time windows, determine the average consumption amount of customers and the average consumption amount under each merchant type; Determine the combined average customer consumption amount and the combined average consumption amount for each merchant type based on the current transaction amount, the average customer consumption amount and the average consumption amount for each merchant type; At least one preset customer-associated cheating rate feature is determined according to the current transaction customer information and the number of historical fraudulent transactions corresponding to the customer and according to different time windows.

3. The method according to claim 1, characterized in that: The current transaction characteristics include: current transaction amount and current transaction merchant information; The target transaction a posteriori features include: target transaction merchant a posteriori features, the target transaction merchant a posteriori features include: the average customer consumption amount after combination, the average consumption amount after combination under each merchant type, and at least one preset merchant-related cheating rate feature; The determining of the target transaction feature matching the current transaction data includes: Obtain the historical transaction amount, historical transaction merchant information, and the number of fraudulent transactions in the historical transactions corresponding to the customer whose information is consistent with the current transaction customer information; According to the historical transaction amount and the historical transaction merchant information, and according to different time windows, determine the average consumption amount of each merchant and the average consumption amount under each merchant type; Determine the combined average consumption amount of merchants and the combined average consumption amount of each merchant type according to the current transaction amount, the average consumption amount of each merchant and the average consumption amount of each merchant type; At least one preset merchant-associated cheating rate feature is determined according to the current transaction merchant information and the number of fraudulent transactions in the merchant's corresponding historical transactions, and according to different time windows.

4. The method according to claim 1, characterized in that The current transaction characteristics include: current transaction customer information, current transaction address information and current transaction time information; The target transaction address features include: the number of active areas accumulated in current and historical transactions and the distance accumulated in current and historical transactions according to transaction time; The determining of the target transaction feature matching the current transaction data includes: Obtain the historical transaction address and historical transaction time information corresponding to the customer whose information is consistent with the current transaction customer; According to the current transaction address information and the historical transaction address information, and according to different time windows, the number of active areas accumulated by current and historical transactions is determined to obtain a plurality of numbers of active areas accumulated by current and historical transactions; According to the current transaction time information and address information, the historical transaction time information and address information, and according to different time windows, the distance accumulated according to the transaction time in the current and historical transactions is determined to obtain the distance accumulated according to the transaction time in multiple current and historical transactions.

5. The method according to claim 1, characterized in that: The current transaction characteristics include: information about the acquiring institution of the current transaction, information about the current transaction location, and information about the current transaction time; The target recent transaction real-time features include: the number of acquiring institutions for current and historical transactions, target distance, target duration, and target movement speed; The determining of the target transaction feature matching the current transaction data includes: Obtain the acquiring institution information of the current transaction and historical transactions in multiple recent time periods, the location information of the most recent historical transaction, and the time information of the most recent historical transaction; Determine the number of acquirers for multiple current and historical transactions based on the acquirer information; Determine the target distance according to the current transaction location information and the most recent historical transaction location information; Determine the target duration based on the current transaction time information and the most recent historical transaction time information; The target moving speed is calculated according to the target distance and the target duration.

6. The method according to claim 1, characterized in that The fraud identification model trained to convergence includes: a transformer network structure trained to convergence; The current transaction characteristics include: the merchant identification of the current transaction, the merchant type of the current transaction, the current transaction type, and the time information of the current transaction; The determining of the target transaction feature matching the current transaction data includes: Acquire multiple historical transaction data, and extract the merchant identifier, merchant type, and historical transaction type of the historical transaction in each historical transaction data; Determine the time difference between each historical transaction and the current transaction according to the transaction time information of the current transaction and the time information of the historical transactions; The merchant identification, merchant type, transaction type and time difference corresponding to each transaction are combined to obtain each target transaction data, and a target transaction sequence is generated according to each target transaction data.

7. The method according to claim 1, characterized in that Before inputting the target transaction features into the fraud identification model trained to convergence, the method further includes: The target transaction posterior features, target transaction address features, and target recent transaction real-time features are discretized with equal width to obtain the discretized transaction features of each target.

8. The method according to claim 7, characterized in that The fraud identification model trained to convergence is a Wide & Deep model trained to convergence; the Wide & Deep model includes a linear network structure, a Transformer network structure and a DNN network structure; The step of inputting the target transaction feature into a fraud identification model trained to convergence, and using the fraud identification model trained to convergence to identify whether the current transaction is a fraudulent transaction comprises: Inputting the target transaction sequence into a transformer network structure trained to convergence, and using the transformer network structure trained to convergence to output regular features of the target transaction sequence; Inputting the target transaction posterior features, target transaction address features, target recent transaction real-time features and corresponding target discretized transaction features into a DNN network structure trained to convergence, and using the DNN network structure to extract target high-order features; Inputting the target transaction posterior features, target transaction address features, and target recent transaction real-time features into a linear network structure trained to convergence, and using the linear network structure trained to convergence to extract target low-order features; Determine whether the current transaction is a fraudulent transaction according to the target transaction sequence regularity characteristics, the target high-order characteristics and the target low-order characteristics.

9. The method according to any one of claims 1 to 8, characterized in that: The training steps for the pre-set fraud model include: Acquire training samples, wherein the training samples include sample transaction features and annotated identification types that match the transaction sample data, wherein the transaction sample data includes sample original transaction features; the sample transaction features include: sample transaction a posteriori features, sample transaction address features, sample recent transaction real-time features, and sample transaction sequence; the sample transaction features are features determined based on sample historical transaction features and corresponding sample original transaction features; Using the training samples to train a preset fraud model; In response to satisfying the training convergence condition, the fraud model satisfying the training convergence condition is determined as the fraud identification model trained to convergence.

10. A fraudulent transaction identification device, comprising: An acquisition module, used to acquire current transaction data corresponding to the current transaction, and determine current transaction features corresponding to the current transaction data; A determination module, used to determine target transaction features that match the current transaction data, wherein the target transaction features include: target transaction a posteriori features, target transaction address features, target recent transaction real-time features, and target transaction sequence; the target transaction features are features determined based on target historical transaction features and corresponding current transaction features; The identification module is used to input the target transaction feature into a fraud identification model trained to convergence, and use the fraud identification model trained to convergence to identify whether the current transaction is a fraudulent transaction.

11. An electronic device, comprising: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 9 when executed by a processor.

13. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the fraud identification method according to any one of claims 1 to 9.

Images