Payment anomaly detection method and device, storage medium and electronic equipment

Abstract

The invention discloses a payment anomaly detection method and device, a storage medium and electronic equipment. Relates to the technical field of electronic information. Performing feature extraction processing on the target payment data to obtain target feature values corresponding to the plurality of payment features; based on the target feature values corresponding to the multiple payment features, a payment anomaly detection model is adopted to obtain a target payment detection result of the target payment data, and the target payment detection result is used for indicating whether the target payment data is abnormal payment data or not; wherein the payment anomaly detection model is obtained through machine learning based on feature values corresponding to multiple payment features in the multiple pieces of payment service data and actual payment detection results corresponding to the multiple pieces of payment service data. According to the invention, the technical problem of low accuracy of the detection result of the payment anomaly detection method in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of electronic information technology, and in particular to a payment anomaly detection method, device, storage medium and electronic equipment. Background Art

[0002] The current payment business covers a variety of scenarios, and many dimensions need to be considered when detecting abnormal payment behavior. Moreover, in the feature selection process, features with low relevance tend to be used, while features with high relevance but high importance are ignored, making the model results too focused on the overall situation. This leads to low accuracy of payment anomaly detection results.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present invention provide a payment anomaly detection method, device, storage medium and electronic device to at least solve the technical problem of low accuracy of detection results in the payment anomaly detection method in the related art.

[0005] According to one aspect of an embodiment of the present invention, a payment anomaly detection method is provided, comprising: acquiring target payment data; performing feature extraction processing on the target payment data to obtain target feature values ​​corresponding to a plurality of payment features; based on the target feature values ​​corresponding to the plurality of payment features, using a payment anomaly detection model to obtain a target payment detection result of the target payment data, wherein the target payment detection result is used to indicate whether the target payment data is abnormal payment data; wherein the payment anomaly detection model is obtained through machine learning based on the feature values ​​corresponding to the plurality of payment features in a plurality of payment business data, and the actual payment detection results corresponding to the plurality of payment business data.

[0006] According to another aspect of an embodiment of the present invention, a payment anomaly detection device is also provided, including: a data acquisition module, used to acquire target payment data; a feature extraction module, used to perform feature extraction processing on the target payment data to obtain target feature values ​​corresponding to multiple payment features; a result prediction module, used to obtain a target payment detection result of the target payment data based on the target feature values ​​corresponding to the multiple payment features, using a payment anomaly detection model, wherein the target payment detection result is used to indicate whether the target payment data is abnormal payment data; wherein the payment anomaly detection model is obtained through machine learning based on the feature values ​​corresponding to the multiple payment features in multiple payment business data, and the actual payment detection results corresponding to the multiple payment business data.

[0007] According to another aspect of an embodiment of the present invention, a non-volatile storage medium is provided, wherein the non-volatile storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing any one of the payment anomaly detection methods.

[0008] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the payment anomaly detection methods.

[0009] In an embodiment of the present invention, target payment data is obtained; feature extraction processing is performed on the target payment data to obtain target feature values ​​corresponding to multiple payment features; based on the target feature values ​​corresponding to the multiple payment features, a payment anomaly detection model is used to obtain a target payment detection result of the target payment data, wherein the target payment detection result is used to indicate whether the target payment data is abnormal payment data; wherein the payment anomaly detection model is based on feature values ​​corresponding to multiple payment features in multiple payment business data, and actual payment detection results corresponding to multiple payment business data, obtained through machine learning, thereby achieving the purpose of accurately determining whether there is a payment anomaly based on the constructed payment anomaly detection model, thereby achieving the technical effect of improving the accuracy of payment anomaly detection, and further solving the technical problem of low accuracy of detection results in the payment anomaly detection method in the related technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0011] Figure 1 is a flow chart of a payment anomaly detection method according to an embodiment of the present invention;

[0012] Figure 2 is a flow chart of an optional payment anomaly detection method according to an embodiment of the present invention;

[0013] Figure 3 It is a schematic diagram of a payment anomaly detection device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0014] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0015] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0016] According to an embodiment of the present invention, a method embodiment of payment anomaly detection is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0017] Figure 1 is a flow chart of a payment anomaly detection method according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0018] Step S102, obtaining target payment data;

[0019] Optionally, the target payment data is payment data obtained by executing a target payment service.

[0020] Step S104, performing feature extraction processing on the target payment data to obtain target feature values ​​corresponding to a plurality of payment features;

[0021] Optionally, the multiple payment features can be screened from the multiple initial features, and data is screened from the target payment data according to the multiple payment features, and the screened data is used as the target feature values ​​corresponding to the multiple payment features. The multiple payment features are input features of the payment anomaly detection model.

[0022] Step S106, based on the target feature values ​​corresponding to the multiple payment features, a payment anomaly detection model is used to obtain a target payment detection result of the target payment data, wherein the target payment detection result is used to indicate whether the target payment data is abnormal payment data;

[0023] Optionally, the payment anomaly detection model is obtained through machine learning based on the feature values ​​corresponding to multiple payment features included in multiple payment business data, and the actual payment detection results corresponding to the multiple payment business data. And the multiple payment features are screened from multiple initial features based on multiple different feature screening methods. The payment anomaly detection model is trained based on the feature values ​​corresponding to multiple payment features in multiple payment business data and the corresponding actual payment detection results. The obtained payment anomaly detection model can learn the correlation between multiple payment features and payment anomaly detection results. In the model application stage, the target feature values ​​corresponding to the multiple payment features are input into the payment anomaly detection model, and the target payment detection results corresponding to the target payment data can be quickly and accurately obtained. Based on the target payment detection results, it can be determined whether there is abnormal payment data in the target payment data, that is, whether there is payment anomaly in the target payment data.

[0024] In an optional embodiment, before obtaining the target payment detection result of the target payment data by using the payment anomaly detection model based on the target feature values ​​corresponding to the multiple payment features, the method further includes: based on the multiple payment business data and the actual payment detection results corresponding to the multiple payment business data, using multiple feature screening methods to perform feature screening on the multiple initial features respectively to obtain the candidate feature sets corresponding to the multiple feature screening methods; finding the intersection of the candidate feature sets corresponding to the multiple feature screening methods to obtain the target candidate feature set; performing feature optimization on the target candidate feature set based on multiple parameter optimization strategies to obtain multiple optimized feature sets, wherein the multiple parameter optimization strategies correspond one-to-one to the multiple optimized feature sets; based on the feature values ​​corresponding to the features included in the multiple optimized feature sets in the training data set, using the gradient boosting decision tree algorithm to perform machine learning to obtain multiple candidate models, wherein the multiple candidate models correspond one-to-one to the multiple optimized feature sets, and the training data set includes part of the payment business data in the multiple payment business data and the actual payment detection results corresponding to the part of the payment business data; obtaining the payment anomaly detection model based on the candidate models that meet the predetermined conditions among the multiple candidate models.

[0025] Optionally, in order to avoid the problem of inaccurate feature selection due to the construction of the payment anomaly detection model directly based on fixed parameters, which leads to low accuracy of the payment anomaly detection results. Multiple feature screening methods can be used to screen features separately to obtain multiple candidate feature sets; by taking the intersection of multiple candidate feature sets, the features commonly included in the multiple candidate feature sets can be obtained, and the target candidate feature set is constructed based on the features commonly included in the multiple candidate feature sets. The target candidate feature set screened in the above manner contains features that meet multiple feature screening conditions at the same time. The feature considerations obtained on this basis are more comprehensive and more in line with the needs of payment anomaly detection. Further, the corresponding feature optimization method is used to comprehensively optimize the features of the multiple candidate feature sets, and the corresponding optimized feature set is constructed based on the features selected by the feature optimization to achieve further optimization and screening of the features; the parameter values ​​of the feature parameters included in each optimized feature set are used as input, and the corresponding actual payment detection results are used as output for model training, and the obtained multiple candidate models can respectively learn the relationship between the features included in the corresponding optimized feature set and the payment detection results; further, the optimal candidate model that meets the predetermined conditions is selected from the multiple candidate models as the payment anomaly detection model.

[0026] It should be noted that the related art mainly adopts the method of directly building a payment anomaly detection model based on fixed parameters and using a single algorithm. There may be great challenges in accuracy and recall rate when truncating the payment peak. This makes the stability of most algorithms for abnormal payment behavior detection insufficient, which in turn leads to low accuracy of payment anomaly detection results. Different from the related art, in this embodiment, a variety of different feature screening methods are used to respectively construct corresponding candidate feature sets, and feature optimization and model screening are comprehensively performed based on the candidate feature sets. Thereby, the candidate model that meets the predetermined conditions is selected as the abnormal payment detection model, and the input features of the abnormal payment detection model are the multiple payment features finally determined. The above method can realize the optimization and selection of the model in the process of feature screening. The payment anomaly detection model constructed on this basis not only has the optimal parameters, but is also more accurate and reliable, and better meets the payment detection needs.

[0027] In an optional embodiment, based on multiple payment business data and actual payment detection results corresponding to the multiple payment business data, multiple feature screening methods are used to screen multiple initial features respectively to obtain candidate feature sets corresponding to the multiple feature screening methods, including: dividing the multiple payment business data and the actual payment detection results corresponding to the multiple payment business data into multiple data sets to obtain a training data set, a test data set and an observation data set; based on the training data set, calling a preset feature selection method in the target toolkit to screen multiple initial features to obtain a first candidate feature set; based on the test data set, calling a preset feature quality assessment method in the target toolkit to perform quality assessment on multiple initial features to obtain quality assessment results, and obtaining a second candidate feature set based on the quality assessment results; based on the first candidate feature set and the second candidate feature set, obtaining a third candidate feature set; based on the training data set, performing a KS test on each of the multiple initial features and other features respectively to obtain a KS test result between each feature and other features; based on the KS test result between each feature and other features, obtaining a fourth candidate feature set; wherein, the candidate feature sets corresponding to the multiple feature screening methods respectively include at least the third candidate feature set and the fourth candidate feature set.

[0028] Optionally, multiple payment service data and actual payment detection results corresponding to the multiple payment service data are divided into multiple data sets to obtain a training data set D train , test data set D test and an observation data set, wherein the observation data set may be three, including observation sample set oot1, observation sample set oot2, and observation sample set oot3. The target toolkit may be a toad package, based on the training data set, calling the preset feature selection selection method in the toad package, screening features from multiple initial features, and forming a first candidate feature set corresponding to the training data set; calling the preset feature quality assessment quality method in the toad package, screening features from multiple initial features, and forming a second candidate feature set corresponding to the test data set; calling the Population Stability Index (PSI) method in the toad package, performing comparative analysis on the features included in the first candidate feature set and the second candidate feature set, and obtaining a third candidate feature set; performing KS tests on multiple initial features in pairs based on the training data set, and obtaining KS test results between each feature and other features; screening features from multiple initial features based on the obtained KS test results, and constructing a fourth candidate feature set based on the screened features; further finding the intersection of the third candidate feature set and the fourth candidate feature set, and obtaining the target candidate feature set.

[0029] Optionally, the second candidate feature set may be three, and the test data set D test Divide it into three parts randomly according to 1:1:1 to get D1 test , D2 test , D3 test Three test subsets. For the training data set D train Use the feature selection method to select features. Use the feature quality evaluation method for the selected features, and set it to only calculate the information value (iv). test , D2 test , D3 test Using the PSI method, D train Finally, the features of Population Stability Index (PSI) method in [0, 0.1] and iv <= 1 are selected. The screening data set is:

[0030] D train =(n,y);D1 test =(k1,y);D2 test =(k2,y);D3 test =(k3,y);

[0031] Among them, k1, k2, k3 are D1 test , D2 test , D3 test The number of feature data included in each; y represents the total number of multiple initial features. train Respectively with D1 test , D2 test , D3 test By combining, three candidate feature sets (ie, three second candidate feature sets) including features y1, y2, and y3 are obtained in turn.

[0032] It should be noted that toad is a Python library that provides a series of tools for data exploration and feature selection. The toad package contains some commonly used data analysis and feature selection methods, which can help users perform data preprocessing and feature engineering. The selection method is a feature selection method in the toad package, which is used to select features that have an important impact on model prediction from the data set. The selection method can eliminate irrelevant features and improve the prediction performance of the model. The quality method is a feature evaluation method in the toad package, which is used to evaluate the importance of features. In this embodiment, it is set to only calculate the iv value to measure the correlation between the feature and the target variable. The iv value is an indicator used to measure the correlation between a feature and a target variable, which can help evaluate the importance of the feature. The higher the iv value, the greater the impact of the feature on the target variable. The PSI method is used to compare the stability between two distributions. In this embodiment, it is used to compare D train and D1 test , D2 test , D3 test The feature distribution differences between them are used to select features with high stability as candidate features.

[0033] In the above method, the features with higher iv values ​​are selected through the selection method and the quality method, and then the feature distribution is compared through the PSI method, and the features with high stability are selected as candidate features (i.e. y1, y2, y3). The above process can select features that have an important impact on model prediction and are highly stable, so as to improve the prediction performance and generalization ability of the model.

[0034] For the training data set D train The two-sample Kolmogorov-Smirnov (Kolmogorov-Smirnov_2samp, ks_2samp) method is used for the features of the pairwise KS test results, where the KS test results include the KS statistic Stat and the significance level p. The KS statistic is used to measure the degree of difference in the distribution of the two sets of feature data. The larger the value, the greater the difference in the distribution of the two sets of feature data. It is used to judge the significance of the KS statistic, that is, whether the two sets of feature data come from the same distribution. If the p value is less than the significance level (such as 0.05), the null hypothesis is rejected, that is, the distribution of the two sets of feature data is considered to be significantly different. The results of the KS test between each pair of features are shown in Table 1 below.

[0035] Table 1. Test of distribution between features

[0036]

[0037] Only the upper half of the matrix shown in Table 1 can be calculated. Select the feature pairs that satisfy the following distribution interval: 0.5*p<=stat<=2*p, and then remove the duplicates. Assuming there are x features, it is considered that the correlation between these x features is high, and the x features are used as the D-based train The selected candidate features form a set of four candidate features based on the x features.

[0038] Optionally, based on multiple parameter optimization strategies, a hyperparameter optimization Hyperopt method is used to optimize the target candidate feature sets respectively to obtain multiple optimized feature sets. Specifically, the parameter space can be defined in the following form:

[0039]

[0040] Among them, learning rate Represents the learning rate, which controls the step size of model parameter update in each iteration; learning rate The smaller it is, the slower the model converges, but it may achieve better generalization performance; hp.uniform(0.01, 0.1) means learning rate The range of values ​​is a uniform random sampling between 0.01 and 0.1. estimators is the number of weak learners, i.e., the number of iterations; n estimators The larger the n is, the more complex the model is and the more likely it is to overfit. hp.quniform(50, 6000, 1) means sampling with a step size of 1 from a uniform distribution between 50 and 6000. That is, n estimatorsIt can be any integer value among 50, 51, 52, …, 5999, 6000. max_depth indicates the maximum depth of the decision tree; the larger the max_depth is, the higher the complexity and fitting ability of the model will be. hp.choice(1, 6, 1) means sampling with a step size of 1 within the given selection range. In this example, max_depth can be one of 1, 2, 3, 4, 5, and 6. subsample is the subsampling ratio, which controls the training sample ratio of each tree; when subsample is less than 1, it is random gradient boosting. hp.uniform(0.2, 0.9) means sampling from a uniform distribution between 0.2 and 0.9, which is used to specify the subsample ratio. The empty parameter is used for the empty feature ratio of feature selection, that is, the ratio of empty features that will be considered in feature selection. np.arange(0, 0.5, 0.01) means generating an array from 0 to 0.5 with a step size of 0.01, that is, a series of values ​​including 0 but not including 0.5. The corr parameter is used for the feature correlation threshold of feature selection, indicating the threshold range of feature correlation in feature selection. np.arange(0.35, 0.65, 0.01) means generating an array from 0.35 to 0.65 with a step size of 0.01, that is, a series of values ​​including 0.35 but not including 0.65; such arrays are usually used to represent the range of correlation values. The exclude parameter is used to exclude the threshold of features in the KS test, indicating the range of features excluded in the KS test.

[0041] It should be noted that when defining the parameter space, the model hyperparameters such as learning rate, number of weak learners, decision tree depth, subsampling ratio, as well as the empty feature ratio in feature selection, feature correlation threshold, and threshold for excluding features in KS test are taken as part of the parameter space, and the best parameter combination is searched through the Hyperopt method to optimize model performance and generalization ability. By adjusting these parameters, the prediction accuracy and generalization ability of the model can be improved, and feature selection and feature correlation analysis can be performed at the same time to further optimize the feature selection and training process of the model.

[0042] Optionally, in the process of performing feature optimization on the target candidate feature set based on multiple parameter optimization strategies, obtaining multiple optimized feature sets, and using the gradient boosting decision tree algorithm to perform machine learning based on the feature values ​​corresponding to the features included in the multiple optimized feature sets in the training data set, and obtaining multiple candidate models, the objective function is set, a global variable is defined as: the best negative sample recognition accuracy, and the precondition is set as: the negative sample recall rate>=0.9. The optimization method uses tpe.suggest, that is, the tree-structured Parzen Estimator (TPE) algorithm is used as the parameter optimization method, and the best parameter combination is found by continuously exploring the parameter space and adjusting the search direction according to the previous results. Set best=fmax(obj, space, tpe, suggest, max_evals=1500). Then set the best parameters to obtain best_params, and finally train the model to obtain the best parameters. Among them, tpe.suggest represents the function of providing parameter suggestions when using the TPE algorithm for parameter optimization. best represents the best optimization result or parameter combination; obj represents the objective function, that is, the function to be maximized or minimized; space represents the parameter space, that is, the parameter range to be searched; max_evals represents the maximum number of iterations, that is, the maximum number of optimization searches.

[0043] Four training strategies (i.e., multiple parameter optimization strategies) can be set as follows: (1) Remove global variables and set premises, and set the goal to maximize the false positive rate minus the true positive rate max (fpr-tpr). (2) Remove global variables and set premises, and set the goal to maximize the area under the curve max (auc). (3) Remove global variables and set premises, and set the goal to maximize the recall rate max (recall). (4) Original global variables. Enable 4 files (corresponding to 4 training strategies) for multiple rounds of training, using the LightGBM classifier method.

[0044] Based on D train According to the above four training strategies, the gradient boosting decision tree algorithm is used to train the data in multiple rounds to reach the optimal parameters. test Conduct 4 tests. Set policy screening restrictions, use the policy that meets the predetermined conditions as the final policy, and use the corresponding candidate model as the target model for the subsequent construction of the payment anomaly detection model.

[0045] In an optional embodiment, a payment anomaly detection model is obtained based on a candidate model that meets predetermined conditions among multiple candidate models, including: determining that the first condition is: the number of features in the corresponding candidate feature set is the smallest, the second condition is: the number of negative samples that are incorrectly predicted as positive samples in the prediction results of the corresponding candidate model is the smallest, and the third condition is: the number of positive samples that are incorrectly predicted as negative samples in the prediction results of the corresponding candidate model is the smallest, wherein the positive samples are normal payment data and the negative samples are abnormal payment data; obtaining the payment anomaly detection model based on a candidate model that meets at least two of the first condition, the second condition and the third condition among multiple candidate models; or Or, when at least two candidate models among multiple candidate models satisfy the first condition, the payment anomaly detection model is obtained based on the candidate model with the least number of features among the at least two candidate models; or when at least two candidate models among multiple candidate models satisfy both the first and second conditions, the payment anomaly detection model is obtained based on the candidate model with the least number of features among the at least two candidate models; or when at least two candidate models among multiple candidate models satisfy both the first, second and third conditions, the payment anomaly detection model is obtained based on the candidate model with the largest number of features in the third candidate feature set among the at least two candidate models.

[0046] Optionally, the first condition is set to: the number of features in the corresponding candidate feature set is the least, that is, the strategy of minimum number of features; the second condition is: in the prediction results of the corresponding candidate model, the number of negative samples that are mistakenly predicted as positive samples is the least, and the second condition can be obtained by setting the prediction score score based on the false positive (False Positive, FP), and selecting the strategy with the most negative samples below the score, where FP is used to indicate the number of negative samples that are mistakenly predicted as positive samples; the third condition is: in the prediction results of the corresponding candidate model, the number of positive samples that are mistakenly predicted as negative samples is the least, and the third condition can be obtained by setting the prediction score score based on FP, and selecting the strategy with the least positive samples under the score.

[0047] Assuming that there are more than one strategies that meet the first condition, the candidate model corresponding to the strategy with the least number of important features is selected to build the payment anomaly detection model; if there are more than one strategies that meet the first condition and the second condition, the candidate model corresponding to the strategy with the least number of important features is selected to build the payment anomaly detection model; if there are more than one strategies that meet the first condition, the second condition and the third condition at the same time, the candidate model corresponding to the strategy containing the number of features in the third candidate feature set is selected to build the payment anomaly detection model.

[0048] In an optional embodiment, a payment anomaly detection model is obtained based on a candidate model that meets predetermined conditions among multiple candidate models, including: determining the candidate model that meets the predetermined conditions among the multiple candidate models as a target model; performing data screening on the observation data set to obtain a target data set, wherein the target data set includes multiple target data and actual payment detection results corresponding to the multiple target data; based on the multiple target data, using the target model to obtain predicted payment detection results corresponding to the multiple target data; based on the predicted payment detection results corresponding to the multiple target data and the actual payment detection results corresponding to the multiple target data, verifying the target model; if the target model is verified, using the target model as the payment anomaly detection model.

[0049] Optionally, select candidate models that meet the predetermined conditions and determine them as target models to improve the accuracy and reliability of the model; make predictions based on the target data set to obtain payment detection results for detecting abnormal payments; verify the target model to ensure that the prediction results of the model on multiple target data are consistent with the actual results, thereby improving the credibility of the model; if the target model passes the verification, use it as a payment anomaly detection model for future payment anomaly detection tasks. In the above manner, the accuracy and precision of the payment anomaly detection model can be improved, and misjudgments and missed detections can be reduced. Through the verification process, the stability and reliability of the model can be ensured, and the credibility of the model in practical applications can be increased. Based on actual data and verification results, the payment anomaly detection model is continuously improved and optimized to improve the overall performance and effect of the system.

[0050] In an optional embodiment, the observation data set is screened to obtain a target data set, including: determining the joint probability density corresponding to multiple observation data included in the observation data set; determining the joint probability density corresponding to multiple test data included in the test data set; performing a KS test on the joint probability density corresponding to the multiple observation data included in the observation data set and the joint probability density corresponding to the multiple test data included in the test data set to obtain a target KS test result; selecting multiple target data from the multiple observation data based on the target KS test result; and constructing a target data set based on the multiple target data.

[0051] It can be understood that by calculating the joint probability density corresponding to each data in the observed data set, the distribution characteristics of the entire data set can be understood, which is helpful for further data analysis and modeling. Determine the joint probability density corresponding to the multiple test data included in the test data set: Similarly, by calculating the joint probability density corresponding to each data in the test data set, it is possible to evaluate whether the distribution of the test data set is consistent with the observed data set, providing a reference for subsequent model verification. By performing a KS test on the observed data set and the test data set, the degree of similarity between them can be obtained, providing a basis for subsequent data processing and modeling. According to the results of the KS test, target data with similar distribution to the observed data set can be screened out. These data will be used as the target data set for modeling, which will help improve the accuracy and generalization ability of the model. Based on the screened target data, constructing a target data set for subsequent modeling and analysis can better utilize data information and improve model effects and prediction capabilities.

[0052] In an optional embodiment, determining the joint probability densities respectively corresponding to multiple test data included in the test data set includes: dividing the multiple test data into multiple positive sample data and multiple negative sample data based on actual payment detection results respectively corresponding to the multiple test data; determining the joint probability density respectively corresponding to the multiple positive sample data and the joint probability density respectively corresponding to the multiple negative sample data; performing a KS test on the joint probability density respectively corresponding to the multiple observation data included in the observation data set and the joint probability density respectively corresponding to the multiple test data included in the test data set to obtain a target KS test result, including: performing a KS test on the joint probability density respectively corresponding to the multiple positive sample data and the joint probability density respectively corresponding to the multiple observation data to obtain a first KS test result; performing a KS test on the joint probability density respectively corresponding to the multiple negative sample data and the joint probability density respectively corresponding to the multiple observation data to obtain a second KS test result, wherein the target KS test result includes the first KS test result and the second KS test result.

[0053] In the above method, by performing a KS test on the observed data set and the test data set, the degree of similarity between them can be obtained, providing a basis for subsequent data processing and modeling. According to the KS test results, target data with similar distribution to the observed data set can be screened out. These data will be used as the target data set for modeling, which will help improve the accuracy and generalization ability of the model. The distribution of the observed data, positive sample data, and negative sample data is further compared through the KS test to determine the degree of fit of the model for the positive sample data and the negative sample data. Based on the first KS test result and the second KS test result, data with similar distribution to the positive sample data and the negative sample data can be simultaneously screened out from multiple observed data as target data for subsequent target model verification. The above method helps to verify whether the target model can distinguish positive samples from negative samples well, thereby improving the accuracy and robustness of model verification, and thus improving the reliability and practicality of the model.

[0054] Optionally, the number of observed data sets can be set to three, namely oot1, oot2, and oot3. Determine the candidate model that meets the predetermined conditions, that is, the input feature dimension of the target model is z, and calculate the joint probability distribution of z dimensions for the observed data sets oot1, oot2, and oot3 according to the subject, where each observation data corresponds to a subject. Assume that a single dimension is dim, there are sample subjects representing the value under dim, draw a frequency histogram, and calculate the probability of each subject under the single dimension dim, denoted as P. There are z dimensions, so the probabilities of a single subject in z dimensions are: P1, P2, ..., P z . Then the joint probability density of a single subject (i.e. each piece of observation data) is: P1*P2*…*P z . Calculate the joint probability density for each subject in oot1, oot2, and oot3, and their shapes are:

[0055] oot11=(o1, 1); oot22= (o2, 1); oot33= (o3, 1);

[0056] Among them, oot11, oot22, oot33 respectively represent the joint probability density sets obtained by calculating the joint probability density of each subject in oot1, oot2, oot3, o1, o2, o3 respectively represent the observation data included in oot1, oot2, oot3, and 1 indicates that the corresponding joint probability density set includes a dimension of features (that is, the joint probability density of the corresponding observation data).

[0057] Optionally, given a single dimension dim, a common way to calculate the probability P of each subject in this dimension is to estimate it by plotting a frequency histogram. The specific implementation is as follows: First, count the number of times each subject appears in dimension dim, that is, the frequency. Divide the number of times each subject appears by the total sample size sample to obtain the frequency of each subject in dimension dim. Normalize the frequencies to ensure that the sum of all probabilities is 1, that is, the probability P of each subject in dimension dim is obtained.

[0058] Optionally, distinguish the positive and negative samples of D test , and calculate the joint probability density for each subject separately, with the dimension still being z. The following is obtained:

[0059] D test_0 =(d1, 1); D test_1 =(d2, 1);

[0060] Among them, D test_0 represents the set of joint probability densities composed of positive sample data in D test , and D test_1 represents the set of joint probability densities composed of negative sample data in D test . d1 represents the corresponding positive sample data in D test_0 , and d2 represents the corresponding negative sample data in D test_1 ; 1 indicates that the feature dimensions of D test_0 and D test_1 are both one-dimensional (i.e., joint probability density).

[0061] Split oot11 into several sets according to batch_size. Each batch is respectively used for D test_0 , D test_1 to perform the KS test, and the KS test results are shown in Table 2 below.

[0062] Table 2 Distribution Test

[0063] Batch_1 Batch_2 …… Batch_i <![CDATA[D test_0 ]]> Stat_10, p_10 Stat_20, p_20 …… Stat_i0, p_i0 <![CDATA[D test_1 ]]> Stat_11, p_11 Stat_21, p_21 …… Stat_i1, p_i1

[0064] Optionally, the observation dataset can be screened in the following way to obtain the target dataset: 1) The i batches can be tested, and the batches with stat>p are taken out, and the remaining batches with stat<p are merged again. 2) Set batch_size_2 for the re-merged batches, and continue to use the method in Table 2 to calculate stat and p, and repeat the verification operation in step 1) above. 3) Repeat steps 1) and 2) Repeat steps 1 and 2, and the upper limit of the loop can be set to q times. If it reaches q times, the remaining batches are discarded.

[0065] The same method as oot11 is used for oot22 and oot33. Finally, the observation set for prediction is obtained as the target data set:

[0066] oot11_q=(o1_q,z); oot22_q=(o2_q,z); oot33_q=(o3_q,z);

[0067] Among them, oot11_q, oot22_q, oot33_q are the target data sets obtained based on the observation data sets oot1, oot2, oot3 respectively; o1_q, o2_q, o3_q are the feature data included in oot11_q, oot22_q, oot33_q respectively; z represents the feature dimension of the target data set.

[0068] Through the above steps S102 to S106, the purpose of accurately determining whether there is a payment anomaly based on the constructed payment anomaly detection model can be achieved, thereby achieving the technical effect of improving the accuracy of payment anomaly detection, and then solving the technical problem of low accuracy of detection results in the payment anomaly detection method in the related technology.

[0069] Based on the above embodiments and optional embodiments, the present invention proposes an optional implementation mode: Figure 2 is a flow chart of an optional payment anomaly detection method according to an embodiment of the present invention. Figure 2 As shown, the method includes:

[0070] S1, obtain payment business data, perform preprocessing, define and construct table data: row is the main object, column is the feature variable, including:

[0071] S1.1: Obtain label data matching the payment business data from the business personnel, select the required business data table from the business database to match the label data, and create a data wide table, where the label data is the actual payment detection result corresponding to the payment business data, and the actual payment business detection result is used to indicate whether it is abnormal payment data.

[0072] S1.2: Transfer the data wide table to the target server.

[0073] S2, build training data set and test data set; build observation data set oot1, oot2, oot3; develop multi-dimensional features and obtain multiple payment features, including:

[0074] S2.1: Develop features based on the unique primary key (such as payment account) to obtain multiple initial features. You can use, but are not limited to, the Python environment. Divide by time. The required feature types are as follows:

[0075] Short-term features: label type;

[0076] Quasi-long cycle characteristics: 1 hour (h) / 12h / 24h;

[0077] Long-term characteristics: 15 days, 30 days, 60 days, 180 days;

[0078] S2.2: After processing from step S1.1 to step S2.1, construct the historical sample training data set D train , historical sample test data set D test , observation sample set oot1, observation sample set oot2, observation sample set oot3.

[0079] S3, uses the Light Gradient Boosting Machine (Light GBM) model for model training; builds parameter optimization module, feature selection module, feature correlation filtering module, sets objective function, and performs multiple rounds of training, including:

[0080] S3.1: Dataset division, the training dataset D is obtained from step S2.2 train =(n, m+label), test data set D test =(k, m+label). train and D test De-duplicate operations are performed according to the unique primary key, feature processing is performed, and null values ​​are filled with 0, where n represents D train The number of data in, m represents the number of initial features, label represents the data label; k represents D test The number of data items in .

[0081] S3.2: Build the feature selection module, import the target toolkit (toad package), and fix the parameter information value (InformationValue, iv) to 0.05. test Divide into three parts randomly according to the ratio of 1:1:1: test , D2 test , D3 test . train Use the feature selection method to select features. Use the feature quality evaluation method for the selected features and set it to only calculate the iv value. test , D2 test , D3 test Using the PSI method, D train Finally, the characteristics of the Population Stability Index (PSI) method in [0, 0.1] and iv <= 1 are selected.

[0082] S3.3: Construct a feature correlation filtering module to train the dataset D train The features are tested pairwise using the ks_2samp method. The KS test results between each pair of features.

[0083] Only the upper half of the matrix shown in Table 1 can be calculated. Select the feature pairs that satisfy the following distribution interval: 0.5*p<=stat<=2*p, and then remove the duplicates. Assuming there are x features, it is considered that the correlation between these x features is high, and the x features are used as the D-based train The selected candidate features form a set of four candidate features based on the x features.

[0084] S3.4: Take x, y1, y2, y3 in step S3.2 and step S3.3. Let Z = x∩y1∩y2∩y3. Z is the final selected feature.

[0085] S3.5: Construct a parameter optimization module and use the Hyperopt method to optimize hyperparameters. First, define the parameter space:

[0086]

[0087] Among them, the empty parameter and corr parameter in step S3.2 are used for feature selection and are also added to the parameter space, and the exclude parameter of the ks test in S3.3 is also added to the parameter space.

[0088] S3.6: Set the objective function, define a global variable as: best negative sample recognition accuracy, set the prerequisite as: negative sample recall >= 0.9. Use tpe.suggest as the optimization method. Set best = fmax(obj, space, tpe, suggest, max_evals = 1500). Then set the best parameters to get best_params, and finally train the model to get the best parameters.

[0089] S3.7: Encapsulate steps S3.2 to S3.6 into a complete model training process and record it as train_process. Then set multiple training strategies (i.e., multiple parameter optimization strategies): (1) Remove global variables and setting premises, and set the target to max(fpr-tpr). (2) Remove global variables and setting premises, and set the target to max(auc). (3) Remove global variables and setting premises, and set the target to max(recall). (4) Original global variables. Enable 4 notebook files for multiple rounds of training, using the lgb.LGBMClassifier(**lgb_param) method. S3.8: Based on D trainAccording to the four strategies, the gradient boosting decision tree algorithm is used to train the data in multiple rounds to reach the optimal parameters. test Conduct 4 tests. Set policy screening restrictions. If the policy meets the following restrictions, record it as the final policy, and determine the model corresponding to the final policy as the target model for the subsequent construction of the payment anomaly detection model:

[0090] Satisfy any two of the following:

[0091] Condition 1: The strategy with the minimum number of features after screening in step S3.7;

[0092] Condition 2: Set the prediction score according to FP and select the strategy with the most negative samples below the score;

[0093] Condition 3: Set the prediction score according to FP, and select the strategy with the least positive samples under the score. If more than one strategy meets condition 1, select the strategy with the least number of important features.

[0094] If there are more than one strategies that satisfy conditions 1 and 2, then select the strategy with the least number of important features; if there are more than one strategies that satisfy conditions 1, 2, and 3, then select the strategy that contains the most x in step S3.3.

[0095] The observation data sets oot1, oot2, and oot3 are batched and batched to batch_size, and the joint probability distribution is calculated. The joint probability distribution of the negative and positive samples in the test set is tested by KS test. The distribution similarity test and cycle limit are set to distinguish between the batches that pass and those that fail, including:

[0096] S4.1: The input feature dimension of the candidate model that meets the predetermined conditions in step S3 is fixed to z, and the joint probability distribution of z dimensions is calculated for the observed data sets oot1, oot2, and oot3 according to the subject, where each observation data corresponds to a subject, specifically including:

[0097] S4.1.1, assuming a single dimension is dim, there are sample subjects representing values ​​under dim, draw a frequency histogram, and calculate the probability of each subject under the single dimension dim, denoted as P.

[0098] S4.1.2, there are z dimensions, so the probabilities of a single subject in z dimensions are: P1, P2, ..., P z .

[0099] S4.1.3, then the joint probability density of a single subject is: P1*P2*…*P z

[0100] S4.1.4. Calculate the joint probability density for each of the subjects oot1, oot2, and oot3 respectively, and their shapes are as follows:

[0101] oot11 = (o1, 1); oot22 = (o2, 1); oot33 = (o3, 1);

[0102] S4.2: Distinguish the negative and positive samples of D test and calculate the joint probability density for each subject separately. The dimension is still z.

[0103] The following is obtained:

[0104] D test_0 = (d1, 1); D test_1 = (d2, 1);

[0105] S4.3: Set batch_size_1 and split oot11 into several sets according to batch_size. For each batch, perform the KS test on D test_0 , D test_1 and obtain the KS test results.

[0106] S4.3.1: It is possible to perform the test on i batches, take out the batches where stat > p, and merge the remaining batches where stat < p again.

[0107] S4.3.2: Set batch_size_2 for the re-merged batches, continue to use the method in Table 2 to calculate stat and p, and repeat step S1.

[0108] Repeat steps S1 to S2, and the upper limit of the loop can be set to q times. If it reaches q times, the remaining batches are discarded.

[0109] S4.4: Use the method in step S4.3 for oot22 and oot33. Finally, obtain the observed set for prediction as the target data set:

[0110] oot11_q = (o1_q, z); oot22_q = (o2_q, z); oot33_q = (o3_q, z);

[0111] S5. If the distribution similarity test is passed, use the model trained in step S3 for prediction. For the batches that do not pass, continue the steps in step S4 until the loop limit, including:

[0112] S5.1: After the operation of step S4, the observation set that meets the conditions (i.e., the target data set) is predicted using the best strategy after step S3. For a fixed score, the samples with scores below the score are checked by the strategy personnel. The remaining observation samples that fail step S4 are passed through the pass strategy or mixed into the new joint probability density set oot, and the operations of steps S3 to S5 are repeated.

[0113] In this embodiment, feature selection, feature correlation analysis, and hyperparameter optimization are integrated into lightGBM into one module for anomaly detection of payment data. On the oot validation set, the ks test after the joint probability distribution is used to distinguish observed samples, which is used to improve the accuracy and recall rate of the model in identifying abnormal payment behaviors, as well as the overall performance of the model.

[0114] It should be noted that this embodiment deeply combines the statistical method with the lightBGM algorithm and sets the optimal training strategy to effectively improve the performance and generalization ability of the model. At the same time, this embodiment uses two KS tests, taking into account the correlation and feature importance, and improving the robustness of model training.

[0115] Based on the above embodiment and optional embodiment, the present invention proposes an optional implementation of a payment anomaly detection method, the method comprising:

[0116] S21: Get the data provided by the business side, a total of 310,000 (W) payment data, the time range is 2023.1.1-2023.5.1. Three observation data sets oot1 is the sample of the whole month of June that passed the pre-screening rules, a total of 160,000 (W); oot2 is the sample of the whole month of July that passed the pre-screening rules, a total of 110,000; oot3 is the sample of the whole month of August that passed the pre-screening rules, a total of 130,000. Get relevant details from the business table.

[0117] S22: All samples in step S21 develop related features according to the unique primary key, and a total of 106 features are developed. The training data set and test tool set are constructed with a total of 31W*106. oot1 is 16W*106; oot2 is 11W*106; oot3 is 13W*106, where the value before "*" indicates the amount of data, that is, how many payment data are included in the corresponding data set; the value after "*" indicates the number of features.

[0118] S23: Split the training set according to 1:1:1, use the toad.selection method on the training set, only calculate the iv value, and select 56 important features. Use the toad.PSI method on test sets 1, 2, and 3, select features with PSI in the range of [0, 0.1] and iv<=1, and select 65, 43, and 41 respectively. Then compare the features of the training set, use the ks_stamp method, and after testing, 45 features meet the following conditions: 0.5*p<=stat<=2*p, recorded as x. Then take the intersection of the above features, a total of 33. Construct a parameter optimization module, use the Hyperopt method, set the objective function, encapsulate the above into a function, and train it. It is found that the strategy of removing global variables and setting premises and setting the target to max(fpr-tpr) meets the screening conditions.

[0119] S24: For oot1, oot2, and oot3, use 33-dimensional features to calculate the joint probability density for each subject. Then calculate the joint probability density of the z dimension for the test data set. Set batch_size=12354 for oot1, oot2, and oot3 respectively. Use the method in Table 2 above to perform a ks test on each batch of negative and positive samples in the test data set. If the distribution is consistent with that of the negative samples, send it to the next step. If it is not satisfied, put it back. Until the number of online times is reached, it is set to 15 times here. The number of samples eliminated is 9W.

[0120] S25: Re-divide the samples obtained in step S24 into oot1, oot2, and oot3, use the best strategy from step S3 to make predictions, and synchronize the prediction results with the strategy personnel.

[0121] In this embodiment, a payment anomaly detection device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the terms "module" and "device" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0122] According to an embodiment of the present invention, there is also provided an embodiment of a device for implementing the above payment anomaly detection method. Figure 3 is a schematic diagram of the structure of a payment anomaly detection device according to an embodiment of the present invention. Figure 3 As shown, the payment anomaly detection device includes: a data acquisition module 300, a feature extraction module 302, and a result prediction module 304, wherein:

[0123] A data acquisition module 300 is used to acquire target payment data;

[0124] The feature extraction module 302 is connected to the data acquisition module 300 and is used to perform feature extraction processing on the target payment data to obtain target feature values ​​corresponding to multiple payment features respectively;

[0125] A result prediction module 304, connected to the feature extraction module 302, is used to obtain a target payment detection result of the target payment data by using a payment anomaly detection model based on target feature values ​​corresponding to the multiple payment features, wherein the target payment detection result is used to indicate whether the target payment data is abnormal payment data;

[0126] Among them, the payment anomaly detection model is obtained through machine learning based on the feature values ​​corresponding to the multiple payment features in the multiple payment business data, and the actual payment detection results corresponding to the multiple payment business data.

[0127] In an embodiment of the present invention, a data acquisition module 300 is set up to acquire target payment data; a feature extraction module 302 is connected to the data acquisition module 300 to perform feature extraction processing on the target payment data to obtain target feature values ​​corresponding to multiple payment features; a result prediction module 304 is connected to the feature extraction module 302 to obtain a target payment detection result of the target payment data based on the target feature values ​​corresponding to the multiple payment features, using a payment anomaly detection model, wherein the target payment detection result is used to indicate whether the target payment data is abnormal payment data; wherein the payment anomaly detection model is based on the feature values ​​corresponding to the multiple payment features in multiple payment business data, and the actual payment detection results corresponding to the multiple payment business data, and is obtained through machine learning, thereby achieving the purpose of accurately determining whether there is a payment anomaly based on the constructed payment anomaly detection model, thereby achieving the technical effect of improving the accuracy of payment anomaly detection, and then solving the technical problem of low accuracy of detection results in the payment anomaly detection method in the related art.

[0128] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0129] It should be noted that the above data acquisition module 300, feature extraction module 302, and result prediction module 304 correspond to steps S102 to S106 in the embodiment, and the examples and application scenarios implemented by the above modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments. It should be noted that the above modules can be run in a computer terminal as part of the device.

[0130] It should be noted that the optional or preferred implementation of this embodiment can refer to the relevant description in the embodiment, which will not be repeated here.

[0131] The above-mentioned payment anomaly detection device may also include a processor and a memory. The above-mentioned data acquisition module 300, feature extraction module 302, result prediction module 304, etc. are all stored in the memory as program modules, and the processor executes the above-mentioned program modules stored in the memory to realize corresponding functions.

[0132] The processor includes a kernel, which retrieves the corresponding program module from the memory. The kernel may be one or more. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. The memory includes at least one memory chip.

[0133] According to an embodiment of the present application, an embodiment of a non-volatile storage medium is also provided. Optionally, in this embodiment, the non-volatile storage medium includes a stored program, wherein when the program is executed, the device where the non-volatile storage medium is located is controlled to execute any one of the payment anomaly detection methods.

[0134] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group, and the non-volatile storage medium includes a stored program.

[0135] Optionally, when the program is running, the device where the non-volatile storage medium is located is controlled to perform the following functions: obtaining target payment data; performing feature extraction processing on the target payment data to obtain target feature values ​​corresponding to multiple payment features; based on the target feature values ​​corresponding to the multiple payment features, using a payment anomaly detection model to obtain a target payment detection result of the target payment data, wherein the target payment detection result is used to indicate whether the target payment data is abnormal payment data; wherein the payment anomaly detection model is obtained through machine learning based on the feature values ​​corresponding to the multiple payment features in multiple payment business data, and the actual payment detection results corresponding to the multiple payment business data.

[0136] According to an embodiment of the present application, an embodiment of a processor is also provided. Optionally, in this embodiment, the processor is used to run a program, wherein the program executes any one of the payment anomaly detection methods when running.

[0137] According to an embodiment of the present application, an embodiment of a computer program product is also provided. When executed on a data processing device, it is suitable for executing a program that initializes any one of the steps of the above-mentioned payment anomaly detection method.

[0138] Optionally, the above-mentioned computer program product, when executed on a data processing device, is suitable for executing a program initialized with the following method steps: obtaining target payment data; performing feature extraction processing on the target payment data to obtain target feature values ​​corresponding to multiple payment features; based on the target feature values ​​corresponding to the multiple payment features, using a payment anomaly detection model to obtain a target payment detection result of the target payment data, wherein the target payment detection result is used to indicate whether the target payment data is abnormal payment data; wherein the payment anomaly detection model is obtained through machine learning based on the feature values ​​corresponding to the multiple payment features in multiple payment business data, and the actual payment detection results corresponding to the multiple payment business data.

[0139] An embodiment of the present invention provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: acquiring target payment data; performing feature extraction processing on the target payment data to obtain target feature values ​​corresponding to multiple payment features; based on the target feature values ​​corresponding to the multiple payment features, using a payment anomaly detection model to obtain a target payment detection result of the target payment data, wherein the target payment detection result is used to indicate whether the target payment data is abnormal payment data; wherein the payment anomaly detection model is obtained through machine learning based on the feature values ​​corresponding to the multiple payment features in multiple payment business data, and the actual payment detection results corresponding to the multiple payment business data.

[0140] The above sequence of the embodiments of the present invention is for description only and does not represent the superiority or inferiority of the embodiments.

[0141] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0142] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the above modules can be a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, modules or indirect coupling or communication connection of modules, which can be electrical or other forms.

[0143] The modules described above as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0144] In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of software functional modules.

[0145] If the above-mentioned integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable non-volatile storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a non-volatile storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the various embodiments of the present invention. The aforementioned non-volatile storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0146] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A payment anomaly detection method, characterized in that: include: Get target payment data; Performing feature extraction processing on the target payment data to obtain target feature values ​​corresponding to a plurality of payment features respectively; Based on the target feature values ​​respectively corresponding to the multiple payment features, a payment anomaly detection model is used to obtain a target payment detection result of the target payment data, wherein the target payment detection result is used to indicate whether the target payment data is abnormal payment data; Among them, the payment anomaly detection model is obtained through machine learning based on the feature values ​​corresponding to the multiple payment features in the multiple payment business data, and the actual payment detection results corresponding to the multiple payment business data.

2. The method according to claim 1, characterized in that Before obtaining the target payment detection result of the target payment data by using a payment anomaly detection model based on the target feature values ​​respectively corresponding to the multiple payment features, the method further includes: Based on the multiple payment service data and the actual payment detection results respectively corresponding to the multiple payment service data, multiple feature screening methods are used to screen the multiple initial features respectively to obtain candidate feature sets respectively corresponding to the multiple feature screening methods; Obtaining the intersection of the candidate feature sets corresponding to the plurality of feature screening methods to obtain a target candidate feature set; Based on a plurality of parameter optimization strategies, feature optimization is performed on the target candidate feature set respectively to obtain a plurality of optimized feature sets, wherein the plurality of parameter optimization strategies correspond one to one to the plurality of optimized feature sets; Based on the feature values ​​corresponding to the features included in the multiple optimized feature sets in the training data set, a gradient boosting decision tree algorithm is used to perform machine learning to obtain multiple candidate models, wherein the multiple candidate models correspond to the multiple optimized feature sets one by one, and the training data set includes part of the payment service data in the multiple payment service data, and actual payment detection results corresponding to the part of the payment service data; The payment anomaly detection model is obtained based on a candidate model that meets a predetermined condition among the multiple candidate models.

3. The method according to claim 2, characterized in that Based on the multiple payment service data and the actual payment detection results respectively corresponding to the multiple payment service data, the multiple feature screening methods are used to screen the multiple initial features respectively to obtain candidate feature sets respectively corresponding to the multiple feature screening methods, including: Dividing the plurality of payment service data and the actual payment detection results respectively corresponding to the plurality of payment service data into a plurality of data sets to obtain the training data set, the test data set and the observation data set; Based on the training data set, calling a preset feature selection method in the target toolkit to perform feature screening on the multiple initial features to obtain a first candidate feature set; Based on the test data set, calling a preset feature quality assessment method in the target toolkit to perform quality assessment on the multiple initial features to obtain a quality assessment result, and obtaining a second candidate feature set based on the quality assessment result; Based on the first candidate feature set and the second candidate feature set, obtaining a third candidate feature set; Based on the training data set, performing KS test on each of the multiple initial features and other features respectively to obtain KS test results between each feature and other features respectively; based on the KS test results between each feature and other features respectively, obtaining a fourth candidate feature set; Among them, the candidate feature sets corresponding to the multiple feature screening methods respectively include at least the third candidate feature set and the fourth candidate feature set.

4. The method according to claim 3, characterized in that The step of obtaining the payment anomaly detection model based on a candidate model that satisfies a predetermined condition among the multiple candidate models includes: Determine the first condition as follows: the number of features in the corresponding candidate feature set is the least; the second condition is as follows: the number of negative samples that are incorrectly predicted as positive samples in the prediction results of the corresponding candidate model is the least; the third condition is as follows: the number of positive samples that are incorrectly predicted as negative samples in the prediction results of the corresponding candidate model is the least, wherein the positive samples are normal payment data and the negative samples are abnormal payment data; obtaining the payment anomaly detection model based on a candidate model that satisfies at least two of the first condition, the second condition, and the third condition among the multiple candidate models; or When at least two candidate models among the multiple candidate models satisfy the first condition, the payment anomaly detection model is obtained based on the candidate model with the least number of features among the at least two candidate models; or When at least two candidate models among the multiple candidate models satisfy both the first condition and the second condition, the payment anomaly detection model is obtained based on the candidate model with the least number of features among the at least two candidate models; or When there are at least two candidate models among the multiple candidate models that simultaneously satisfy the first condition, the second condition and the third condition, the payment anomaly detection model is obtained based on the candidate model among the at least two candidate models that contains the largest number of features in the third candidate feature set.

5. The method according to claim 3, characterized in that: The step of obtaining the payment anomaly detection model based on a candidate model that satisfies a predetermined condition among the multiple candidate models includes: Determine a candidate model that satisfies the predetermined condition among the multiple candidate models as a target model; Screening the observed data set to obtain a target data set, wherein the target data set includes a plurality of target data and actual payment detection results corresponding to the plurality of target data; Based on the multiple target data, using the target model, obtaining predicted payment detection results corresponding to the multiple target data respectively; Verifying the target model based on the predicted payment detection results respectively corresponding to the multiple target data and the actual payment detection results respectively corresponding to the multiple target data; When the target model passes the verification, the target model is used as the payment anomaly detection model.

6. The method according to claim 5, characterized in that The step of screening the observed data set to obtain a target data set includes: Determine the joint probability density corresponding to the plurality of observation data included in the observation data set; Determine the joint probability densities respectively corresponding to the plurality of test data included in the test data set; Performing a KS test on the joint probability densities respectively corresponding to the multiple observation data included in the observation data set and the joint probability densities respectively corresponding to the multiple test data included in the test data set to obtain a target KS test result; Based on the target KS test result, selecting the plurality of target data from the plurality of observation data; The target data set is constructed based on the multiple pieces of target data.

7. The method according to claim 6, characterized in that The determining of the joint probability densities respectively corresponding to the plurality of test data included in the test data set comprises: dividing the plurality of test data into a plurality of positive sample data and a plurality of negative sample data based on the actual payment detection results respectively corresponding to the plurality of test data; determining the joint probability densities respectively corresponding to the plurality of positive sample data and the joint probability densities respectively corresponding to the plurality of negative sample data; The KS test is performed on the joint probability density corresponding to the multiple observation data included in the observation data set, and the joint probability density corresponding to the multiple test data included in the test data set to obtain a target KS test result, including: performing a KS test on the joint probability density corresponding to the multiple positive sample data, and the joint probability density corresponding to the multiple observation data, to obtain a first KS test result; performing a KS test on the joint probability density corresponding to the multiple negative sample data, and the joint probability density corresponding to the multiple observation data, to obtain a second KS test result, wherein the target KS test result includes the first KS test result and the second KS test result.

8. A payment anomaly detection device, characterized in that: include: A data acquisition module, used to acquire target payment data; A feature extraction module, used to perform feature extraction processing on the target payment data to obtain target feature values ​​corresponding to multiple payment features respectively; A result prediction module, used to obtain a target payment detection result of the target payment data based on the target feature values ​​respectively corresponding to the multiple payment features by using a payment anomaly detection model, wherein the target payment detection result is used to indicate whether the target payment data is abnormal payment data; Among them, the payment anomaly detection model is obtained through machine learning based on the feature values ​​corresponding to the multiple payment features in the multiple payment business data, and the actual payment detection results corresponding to the multiple payment business data.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the payment anomaly detection method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the payment anomaly detection method described in any one of claims 1 to 7.

Images