Transaction anomaly detection method and device, equipment and medium

Abstract

The invention discloses a transaction anomaly detection method and device, equipment and a medium, and belongs to the technical field of Internet. The method comprises the following steps: acquiring target detection data; performing fusion processing on the target detection data to obtain standard detection data; inputting the standard detection data into a pre-constructed global detection model, and determining whether transaction abnormity exists in each piece of target detection data; wherein the global detection model is formed by aggregating branch detection models of at least two transaction platforms; and storing the target detection data with the abnormal transaction on a preset block chain. According to the technical scheme, independent transaction anomaly detection is performed on each transaction platform by using the global detection model formed by aggregating the branch detection models of each transaction platform based on the block chain technology and the federated learning technology, so that data collaboration and sharing among the transaction platforms can be realized, the detection comprehensiveness of transaction anomaly is improved, and the transaction anomaly detection efficiency is improved. And meanwhile, the processing and detection efficiency of the target detection data is improved.

Description

Technical Field

[0001] The present application belongs to the field of Internet technology, and specifically relates to a transaction anomaly detection method, device, equipment and medium. Background Art

[0002] The cash flow anomaly detection system is a system used to monitor and analyze abnormal behavior in financial transaction flows. By collecting, processing and analyzing a large amount of financial transaction data, the cash flow anomaly detection system can identify and report abnormal transactions that are significantly different from normal transaction patterns. These abnormal transactions may indicate fraud, erroneous operations or other potential risks. Identifying transaction anomalies helps protect customer asset security and maintain the stability of the financial market.

[0003] The current money flow anomaly detection system mainly relies on centralized data processing and deep learning technology. The centralized processing mode is prone to user privacy leakage and is difficult to meet the requirements for real-time and efficient detection. In addition, the existing data island effect limits data sharing between different trading platforms, thereby weakening the comprehensiveness and accuracy of detection. Therefore, people in this field urgently need to solve these problems. Summary of the invention

[0004] The embodiments of the present application provide a transaction anomaly detection method, device, equipment and medium, the purpose of which is to achieve data collaboration and sharing among various transaction platforms, improve the comprehensiveness of transaction anomaly detection, and at the same time improve the processing and detection efficiency of target detection data.

[0005] In a first aspect, an embodiment of the present application provides a transaction anomaly detection method, the method comprising:

[0006] Acquire target detection data; wherein the target detection data includes at least one of transaction data, user behavior data, and multimodal data;

[0007] The detection data of each target is fused and processed to obtain standard detection data;

[0008] Input the standard detection data into a pre-built global detection model to determine whether each target detection data has transaction anomalies; wherein the global detection model is aggregated by branch detection models of at least two trading platforms;

[0009] The target detection data with transaction anomalies is stored on the preset blockchain.

[0010] In a second aspect, an embodiment of the present application provides a transaction anomaly detection device, the device comprising:

[0011] A detection data acquisition module, used to acquire target detection data; wherein the target detection data includes at least one of transaction data, user behavior data and multimodal data;

[0012] The data fusion processing module is used to fuse the detection data of each target to obtain standard detection data;

[0013] A transaction anomaly identification module, used to input the standard detection data into a pre-built global detection model to determine whether each target detection data has transaction anomalies; wherein the global detection model is aggregated by branch detection models of at least two transaction platforms;

[0014] The data storage module is used to store target detection data with transaction anomalies on a preset blockchain.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.

[0016] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0017] In a fifth aspect, an embodiment of the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the method described in the first aspect.

[0018] In an embodiment of the present application, target detection data is obtained; wherein the target detection data includes at least one of transaction data, user behavior data and multimodal data; each target detection data is fused and processed to obtain standard detection data; the standard detection data is input into a pre-built global detection model to determine whether each target detection data has transaction anomalies; wherein the global detection model is aggregated by branch detection models of at least two trading platforms; the target detection data with transaction anomalies is stored on a preset blockchain. The above-mentioned transaction anomaly detection method, based on blockchain technology and federated learning technology, uses a global detection model aggregated by branch detection models of each trading platform to perform independent transaction anomaly detection on each trading platform, which can realize data collaboration and sharing between trading platforms, improve the comprehensiveness of detection of transaction anomalies, and at the same time improve the processing and detection efficiency of target detection data. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1It is a flowchart of a transaction anomaly detection method provided in Example 1 of the present application;

[0020] Figure 2 This is a scenario example diagram of the transaction anomaly detection method provided in Example 1 of the present application;

[0021] Figure 3 It is a flowchart of a transaction anomaly detection method provided in Example 2 of the present application;

[0022] Figure 4 It is a flowchart of a transaction anomaly detection method provided in Example 3 of the present application;

[0023] Figure 5 It is a structural diagram of a transaction anomaly detection device provided in Embodiment 4 of the present application;

[0024] Figure 6 It is a schematic diagram of the structure of an electronic device provided in Example 5 of the present application. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical scheme and advantages of the present application clearer, the specific embodiments of the present application are further described in detail below in conjunction with the accompanying drawings. It is understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for the convenience of description, only the part related to the present application but not all the contents are shown in the accompanying drawings. Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow chart describes each operation (or step) as a sequential process, many of the operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of each operation can be rearranged. The process can be terminated when its operation is completed, but it can also have additional steps not included in the accompanying drawings. The process can correspond to a method, a function, a procedure, a subroutine, a subprogram, etc.

[0026] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0027] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0028] The transaction anomaly detection method, device, equipment and medium provided in the embodiments of the present application are described in detail below in conjunction with the accompanying drawings through specific embodiments and their application scenarios.

[0029] Embodiment 1

[0030] Figure 1 : is a flow chart of the transaction anomaly detection method provided in Example 1 of the present application. Figure 1 As shown, the specific steps include:

[0031] S101, obtaining target detection data; wherein the target detection data includes at least one of transaction data, user behavior data and multimodal data;

[0032] First of all, this application is applicable to scenarios where it is necessary to identify whether there are transaction anomalies in the transaction business of the trading platform. Based on the above usage scenarios, it can be understood that the execution subject of this application can be a trading platform and a central server. Specifically, the acquisition and fusion processing of target detection data, the determination of whether there are transaction anomalies, and data storage can be performed by the trading platform, and the construction and update of the global detection model are performed by the central server. The model data of each trading platform is shared, and each trading platform can independently detect transaction anomalies in the target detection data.

[0033] Among them, the trading platform can refer to various service platforms that include trading services, such as a game platform with a recharge function or a banking platform that provides online business processing, etc., and no excessive restrictions are made here; the server generally has strong computing power, large storage space and high reliability, and is used to perform critical tasks or provide services to multiple clients. In this technical solution, the central server is connected to each trading platform, and is mainly responsible for aggregating the branch detection models of each trading platform to obtain a global detection model.

[0034] Target detection data may refer to data that needs to be detected. It is understandable that target detection data should be related to the transaction business of the trading platform, and may include transaction data, user behavior data, and multimodal data, etc. Among them, transaction data may refer to data directly related to the transaction business, such as transaction records, etc.; user behavior data may refer to the record data of the user's operation behavior during the user's transaction business; multimodal data may refer to other data obtained by external devices during the user's transaction business, such as voice data and surveillance video data, etc.

[0035] The target detection data can be obtained by using a preset real-time data acquisition interface of the trading platform, or by obtaining the target detection data from a pre-storage space of the trading platform according to a preset period, or by obtaining the target detection data in response to a data acquisition drive event of the trading platform. Optionally, the above-mentioned methods of obtaining the target detection data can be mixed and matched in a personalized manner according to the performance and requirements of the trading platform or the trading business, and no excessive restrictions are made here.

[0036] S102, fusing the detection data of each target to obtain standard detection data;

[0037] Standard detection data may refer to data that is accurate, complete, and can be recognized and analyzed by a global detection model. Fusion processing may refer to the process of merging different types of target detection data into a new type of data to be analyzed and detected by global detection data. The method of fusion processing of each target detection data may be to perform data cleaning and standardization processing on each target detection data to obtain pre-processed detection data. When there is only one type of target detection data, the pre-processed detection data is determined as standard detection data, or, when there are at least two types of target detection data, the pre-processed detection data is fused to obtain standard detection data.

[0038] S103, inputting the standard detection data into a pre-built global detection model to determine whether each target detection data has transaction anomalies; wherein the global detection model is aggregated by branch detection models of at least two trading platforms;

[0039] The global detection model may refer to a machine learning model trained with reference to the detection data of all trading platforms; the branch detection model of a trading platform may refer to a machine learning model trained with reference to the detection data of the trading platform. The global detection model and the branch detection model can autonomously detect the input standard detection data to determine whether there are transaction anomalies in the target detection data corresponding to the standard detection data. The global detection model and the branch detection model can provide feedback as output data on the determination result of whether there are transaction anomalies in each target detection data. Among them, transaction anomalies may refer to abnormal situations that occur during the transaction business, resulting in the inability to complete the transaction business normally or the transaction results not meeting expectations.

[0040] Among them, the method of pre-constructing a global detection model can be adopted to locally build a branch detection model in each trading platform according to the historical detection data of the trading platform, aggregate the branch detection models of each trading platform, obtain the global detection model, and distribute the global detection model to each trading platform.

[0041] In this technical solution, the process of pre-building a global detection model optionally includes:

[0042] In each trading platform, a branch detection model is locally constructed based on the historical detection data of the trading platform;

[0043] Aggregate the branch detection models of each trading platform to obtain a global detection model;

[0044] Distributing the global detection model to each trading platform;

[0045] Accordingly, the standard detection data is input into a pre-built global detection model to determine whether each target detection data has transaction anomalies, including:

[0046] When the trading platform receives the global detection model, the standard detection data is input into the global detection model in the trading platform to determine whether there is any transaction anomaly in each target detection data.

[0047] The historical detection data of a trading platform may refer to the detection data of each target generated on the trading platform before the current time point. Locally building a branch detection model may refer to independently training a branch detection model on a trading platform based on the historical detection data of the trading platform. Specifically, the training may be performed by using the TensorFlowFederated framework. The TensorFlow Federated framework is an open source framework developed by Google Brain, which is specifically used for machine learning and other calculations on distributed data.

[0048] The way to aggregate the branch detection models of each trading platform can be to use the PySyft framework to perform secure model aggregation through homomorphic encryption or differential privacy technology to obtain a global detection model. Among them, the PySyft framework is an extension of the PyTorch deep learning framework, which integrates technologies such as federated learning, multi-party secure computing, differential privacy, and remote execution, and provides a flexible and easy-to-use library for data sharing and model training in a secure and decentralized environment; homomorphic encryption technology is a cryptographic technology based on the computational complexity theory of mathematical problems, which allows users to directly calculate encrypted data without decrypting the data first; differential privacy technology is a privacy protection method proposed to solve the problem of personal information security in the big data era. By adding noise to the data, attackers cannot obtain the private information of specific individuals through data analysis.

[0049] Figure 2 : is a scene example diagram of the transaction anomaly detection method provided in Example 1 of the present application. Figure 2 As shown, each trading platform sends the branch detection model to the central server, and the central server aggregates the branch detection models of each trading platform to obtain a global detection model, and returns the global detection model to each trading platform. Among them, transmitting the branch detection model and the global detection model actually means transmitting the model parameter data of the branch detection model and the global detection model.

[0050] After the trading platform receives the global detection model, the standard detection data is input into the received global detection model in the trading platform to determine whether there is a transaction anomaly in each target detection data. Before the trading platform receives the global detection model, the standard detection data can be input into the branch detection model of the trading platform in the trading platform to determine whether there is a transaction anomaly in each target detection data.

[0051] Optionally, after the trading platform receives the global detection model, it can continue to optimize and update the global detection model based on the newly input standard detection data, and transmit the optimized and updated model to the central server according to a preset period. The central server aggregates the optimized and updated models from each trading platform, obtains a new global detection model, and distributes it back to each trading platform. Each trading platform uses the new global detection model to determine whether there are any transaction anomalies in the target detection data.

[0052] The benefit of this arrangement is that by constructing a branch detection model locally on each trading platform and aggregating the branch detection models to obtain a global detection model, the sharing of model parameter data between trading platforms can be achieved. By using the global detection model on each trading platform to independently determine whether there are transaction anomalies in each target detection data, the problem of low detection efficiency caused by centralized detection of target detection data on each trading platform can be effectively solved. Sharing of target detection data between trading platforms can also be avoided, thereby ensuring the security of user privacy.

[0053] In the technical solution, optionally, the standard detection data is input into a pre-built global detection model to determine whether each target detection data has transaction anomalies, including:

[0054] The H2O.ai platform is used to detect and classify the standard detection data based on a pre-built global detection model to determine whether there are any transaction anomalies in each target detection data.

[0055] The H2O.ai platform includes open source, memory, distributed, ML (Machine Learning) and predictive analysis platforms, allowing users to build and generate ML models. Using the H2O.ai platform, based on the pre-built global detection model, the standard detection data can be detected and classified. The standard detection data (which can be in CSV or Parquet format) can be imported into the H2O.ai platform, and the global detection model can be loaded from the H2O.ai model library or local file. The global detection model outputs the abnormality level of each target detection data (which can include high risk, medium risk, low risk, and no risk), and the target detection data without risk is determined as having no transaction anomalies, and the target detection data with high risk, medium risk, and low risk are determined as having transaction anomalies.

[0056] The benefit of this solution is that the H2O.ai platform provides a simple and easy-to-understand interface and visualization interface, and the H2O.ai platform is based on a distributed computing framework and has a higher model training speed. By using the H2O.ai platform to determine whether there are transaction anomalies in each target detection data based on a pre-built global detection model, the operation can be simplified and real-time and efficient monitoring of target detection data can be achieved.

[0057] S104, storing the target detection data with transaction anomalies on a preset blockchain.

[0058] The preset blockchain may refer to a pre-set blockchain dedicated to storing target detection data with transaction anomalies. For example, the preset blockchain may adopt a Hyperledger Fabric blockchain. Blockchain is a distributed database that stores information in a secure, transparent and tamper-proof manner.

[0059] The method of storing the target detection data with transaction anomalies on a preset blockchain can be to store the target detection data with transaction anomalies on a preset blockchain through a pre-written smart contract. Among them, the smart contract is a commitment defined in digital form, including an agreement on which the contract participants can execute these commitments.

[0060] In an embodiment of the present application, target detection data is obtained; wherein the target detection data includes at least one of transaction data, user behavior data and multimodal data; each target detection data is fused and processed to obtain standard detection data; the standard detection data is input into a pre-built global detection model to determine whether each target detection data has transaction anomalies; wherein the global detection model is aggregated by branch detection models of at least two trading platforms; the target detection data with transaction anomalies is stored on a preset blockchain. The above-mentioned transaction anomaly detection method, based on blockchain technology and federated learning technology, uses a global detection model aggregated by branch detection models of each trading platform to perform independent transaction anomaly detection on each trading platform, which can realize data collaboration and sharing between trading platforms, improve the comprehensiveness of detection of transaction anomalies, and at the same time improve the processing and detection efficiency of target detection data.

[0061] Embodiment 2

[0062] Figure 3 This is a flow chart of the transaction anomaly detection method provided in Example 2 of the present application. This solution makes a better improvement on the above-mentioned embodiment, and the specific improvement is: storing the target detection data with transaction anomalies on a preset blockchain, including: storing the target detection data with transaction anomalies on a Hyperledger Fabric blockchain; and / or controlling other trading platforms except the trading platform to which the target detection data belongs to verify the target detection data through the Corda blockchain.

[0063] like Figure 3 As shown, the specific steps include:

[0064] S301, obtaining target detection data; wherein the target detection data includes at least one of transaction data, user behavior data and multimodal data;

[0065] S302, fusing the detection data of each target to obtain standard detection data;

[0066] S303, inputting the standard detection data into a pre-built global detection model to determine whether each target detection data has transaction anomalies; wherein the global detection model is aggregated by branch detection models of at least two trading platforms;

[0067] S304, storing the target detection data with transaction anomalies on the Hyperledger Fabric blockchain;

[0068] and / or,

[0069] Control other trading platforms except the trading platform to which the target detection data belongs to verify the target detection data through the Corda blockchain.

[0070] Hyperledger Fabric blockchain is an open source distributed ledger technology platform. Hyperledger Fabric is a permissioned chain, which means that participants need to be authorized to join the network, which makes Hyperledger Fabric suitable for application scenarios that require control of participants and transactions; Hyperledger Fabric supports private data and confidential transactions, allowing users to conduct transactions without disclosing the content of transactions; Hyperledger Fabric can be expanded to support a large number of participants and transactions, and provide high throughput and low latency. The method of storing target detection data with transaction anomalies on the Hyperledger Fabric blockchain can be adopted through a pre-written smart contract based on the Hyperledger Fabric blockchain to store target detection data with transaction anomalies on the Hyperledger Fabric blockchain.

[0071] The Corda blockchain is an open source distributed ledger technology platform designed specifically for the financial industry. Corda only shares transaction information with relevant parties, rather than broadcasting it publicly to the entire network, which enhances the privacy and confidentiality of transactions; Corda is designed to meet financial regulatory requirements and provides auditable transaction records; Corda can be expanded to support a large number of participants and transactions, and provide high throughput and low latency; Corda supports interoperability with other blockchain platforms and systems.

[0072] The method of controlling other trading platforms other than the trading platform to which the target detection data belongs to verify the target detection data through the Corda blockchain can be adopted by storing the target detection data with transaction anomalies on the Hyperledger Fabric blockchain and controlling other trading platforms to verify the target detection data through the consensus mechanism of the Corda blockchain. Among them, the working principle of the consensus mechanism of the Corda blockchain is: when a participant initiates a transaction, the transaction information will be sent to other relevant participants; each participant will verify the legality and validity of the transaction, and check whether the transaction complies with the relevant smart contract; if the transaction is verified, the participant will sign it; the signed transaction will be propagated to other nodes in the network; when all relevant participants have signed the transaction, the status of the transaction will be updated to the state machine of each node.

[0073] The benefit of this scheme is that the transparency of the blockchain can help timely discover and warn of transaction anomalies. At the same time, by using blockchain to store data, the data can be ensured to be tamper-proof and traceable, thereby enhancing the credibility of transaction anomaly detection. By controlling other trading platforms except the trading platform to which the target detection data belongs to verify the target detection data through the Corda blockchain, collaboration between the various trading platforms can be achieved, and the authenticity and credibility of the target detection data with transaction anomalies can be verified, thereby achieving the purpose of collaborative risk prevention.

[0074] In this technical solution, optionally, the method further includes:

[0075] The training records, update records and detection records of the branch detection model and the global detection model are stored on the Ethereum blockchain.

[0076] The training records of the branch detection model and the global detection model may refer to the recorded data of the training process of the branch detection model and the global detection model, which may include training data, training parameters, model structure and training results, etc.; the update records of the branch detection model and the global detection model may refer to the recorded data of the optimization update process of the branch detection model and the global detection model, which may include the update reason, update content and update time, etc.; the detection records of the branch detection model and the global detection model may refer to the recorded data of the detection process of the branch detection model and the global detection model, which may include input data, detection time, detection results and detection indicators, etc.

[0077] The training records, update records and detection records of the branch detection model and the global detection model can be stored on the Ethereum blockchain by using a pre-written smart contract based on the Ethereum blockchain. The Ethereum blockchain is a public blockchain platform that supports the development and operation of smart contracts and decentralized applications.

[0078] The benefit of this arrangement is that by storing the training records, update records and detection records of the branch detection model and the global detection model on the Ethereum blockchain, the immutability and traceability of the training records, update records and detection records can be ensured, thereby enhancing the credibility of transaction anomaly detection, and each trading platform can verify the training records, update records and detection records to ensure the transparency of each process of the detection model.

[0079] Embodiment 3

[0080] Figure 4 This is a flow chart of the transaction anomaly detection method provided in Example 3 of the present application. This solution makes a better improvement on the above-mentioned embodiment, and the specific improvement is: obtaining target detection data includes: obtaining target detection data through a preset real-time data acquisition interface of the trading platform; and / or, obtaining target detection data from a pre-storage space of the trading platform according to a preset period; and / or, obtaining target detection data in response to a data acquisition drive event of the trading platform.

[0081] like Figure 4 As shown, the specific steps include:

[0082] S401, acquiring target detection data through a preset real-time data acquisition interface of the trading platform;

[0083] and / or,

[0084] Obtaining target detection data from the pre-storage space of the trading platform according to a preset period;

[0085] and / or,

[0086] Responding to a data acquisition driving event of the trading platform, acquiring target detection data;

[0087] The preset real-time data acquisition interface can be a preset interface for transmitting and acquiring target detection data immediately after the target detection data is generated. The interface refers to an application programming interface, which provides a set of predefined functions, procedures, protocols and tools to allow different software components to interact with each other. Depending on the different target detection data, the method of acquiring target detection data through the preset real-time data acquisition interface of the trading platform is also different accordingly.

[0088] For transaction data, you can use RESTful API (Application Programming Interface) to obtain it, and use OAuth for security authentication. For example, a bank provides real-time transaction data through RESTful API, and can call RESTful API every second to pull the latest transaction records and store them in the local database. Among them, RESTful API is an architectural style for building network applications; OAuth is an open standard protocol that allows users to authorize third-party applications to access their account information without sharing their passwords.

[0089] For user behavior data, JavaScript code can be embedded in the user interface to collect user click, browse and other behavior data in real time and transmit it through the interface. For example, in a financial software, every time a user clicks a button or link, the JavaScript code will record the behavior and transmit the data through the Google Analytics API. Among them, JavaScript is a scripting language widely used in web development, which can make web pages more dynamic, interactive and feature-rich; Google Analytics API is a tool for extracting data from Google Analytics accounts.

[0090] For multimodal data, it can be collected in real time through IoT (Internet of Things) devices such as cameras and microphones, and transmitted through the MQTT protocol. For example, a camera installed at a bank branch records video in real time when a customer is trading, and transmits it to the server for storage and analysis through the MQTT protocol. Among them, IoT devices refer to physical devices that can connect to the Internet and communicate with other devices; the MQTT (Message Queuing Telemetry Transport) protocol is a lightweight communication protocol based on the publish / subscribe paradigm, working on the TCP / IP protocol family, providing real-time and reliable message services for remote devices with low hardware performance and in poor network conditions.

[0091] The pre-storage space of the trading platform may refer to a storage space on the trading platform for temporarily storing target detection data. The preset period may be set according to the detection requirements for the target detection data and the size of the pre-storage space of the trading platform. Depending on the target detection data, the method of obtaining the target detection data from the pre-storage space of the trading platform according to the preset period is also different.

[0092] For transaction data, a scheduled task can be set to transfer the target detection data to the data lake through ETL tools (Extract, Transform, Load) every preset period. For example, newly generated transaction records are extracted from the bank's transaction database every hour, and Apache Nifi is used to transfer the data to the Hadoop data lake. Among them, ETL tools can help enterprises efficiently extract data from multiple source systems, clean and transform the data, and finally load it into the target data warehouse or database to support data analysis and business decision-making through the three steps of extraction, transformation, and loading; Apache NiFi is an easy-to-use, powerful and reliable data processing and distribution system that indicates data routing, transformation and flow relationships in the system through highly configurable indicator diagrams, and supports dynamic data pulling from multiple data sources; Hadoop data lake is a data storage and processing platform built on the Hadoop ecosystem, which uses Hadoop's distributed computing capabilities to provide efficient, flexible and scalable storage and processing capabilities for large-scale data.

[0093] For user behavior data, you can collect user behavior log files regularly, use Logstash to parse the log content, and store it in Elasticsearch. For example, download the user's operation log in the financial software from the server in the early morning every day, parse it through Logstash and import it into Elasticsearch for behavior analysis. Among them, the behavior log file can refer to a file that records user or system behavior; Logstash is a data collection engine with real-time channel capabilities, which is used for log collection, analysis, and filtering. Logstash supports a large number of data acquisition methods and works in a c / s architecture. The client is installed on the host where the log needs to be collected. The server is responsible for filtering, modifying, and other operations on the received node logs and sending them to Elasticsearch; Elasticsearch is an open source distributed search server based on Lucene, which is used for full-text search, structured search, and analysis. It provides a full-text search engine with distributed multi-user capabilities and is based on a RESTful web interface.

[0094] For multimodal data, it can be downloaded in batches from various IoT devices at regular intervals and stored in HDFS (Hadoop Distributed File System). For example, every night, the surveillance videos of the day are downloaded in batches from the cameras of bank branches and stored in the big data platform through HDFS. HDFS is a distributed file system designed for storing massive amounts of data. It is designed to run in large clusters and provide high-throughput data access.

[0095] The data acquisition driving event may refer to an event that requires acquisition of target detection data when the event occurs. Depending on the different target detection data, in response to the data acquisition driving event of the trading platform, the method of acquiring the target detection data is also different accordingly.

[0096] For transaction data, event messages can be generated in real time when a transaction occurs and transmitted through the Kafka message queue. For example, every time a bank processes a transaction, a transaction event message is generated and sent to the Kafka message queue to consume messages in real time and store transaction data. Kafka is written in Scala and Java and is a high-throughput, persistent, distributed publish-subscribe message queue system that is mainly used to process all action stream data in consumer-scale websites.

[0097] For user behavior data, user behavior events are triggered in real time, and stream processing is performed through Apache Flink, which is analyzed in real time and stored in the database. For example, when a user performs an operation in a financial software, a behavior event is triggered, and user behavior data is processed and analyzed in real time through Apache Flink and stored in the database. Among them, Apache Flink is a distributed data flow engine written in Java and Scala. Flink executes any stream data program in a data parallel and pipeline manner. At the same time, its pipeline runtime system can also execute batch and stream processing programs.

[0098] For multimodal data, we collect multimodal data in real time, use Apache Storm for real-time stream processing, extract valuable information and store it. For example, the cameras at bank branches collect video in real time, process it through Apache Storm, extract key frames and audio clips and store them in the database. Apache Storm is a large-scale distributed stream computing platform that provides a distributed, highly fault-tolerant and scalable solution for real-time computing, supporting efficient and reliable data processing processes.

[0099] S402, fusing the detection data of each target to obtain standard detection data;

[0100] In this technical solution, optionally, each target detection data is fused to obtain standard detection data, including:

[0101] Perform data cleaning and standardization on each target detection data to obtain pre-processed detection data;

[0102] In the case where there is only one type of target detection data, determining the preprocessed detection data as standard detection data;

[0103] or,

[0104] In the case where there are at least two types of target detection data, the pre-processed detection data are fused to obtain standard detection data.

[0105] Data cleaning can refer to the process of processing raw data to remove erroneous, incomplete, duplicate or inconsistent data to improve data quality. For target detection data, data cleaning mainly includes removing duplicate values, processing missing values, and standardizing data formats, which can be achieved by calling the Pandas library in Python. Among them, Python is a widely used high-level programming language, and its design philosophy emphasizes code readability and concise syntax; the Pandas library is an open source library widely used in the field of Python data analysis, providing efficient, flexible and easy-to-use data structures and data analysis tools.

[0106] Standardization processing can be a processing operation used to ensure the consistency of data. For target detection data, standardization processing mainly includes data type conversion and range scaling, which can be implemented using the Apache Spark framework in Python. Among them, the Apache Spark framework is an open source framework suitable for parallel processing of big data tasks across cluster computers.

[0107] The data obtained after data cleaning and standardization of each target detection data is the preprocessed detection data. The fusion processing of the preprocessed detection data can be achieved through the Python language using various data enhancement techniques of Scikit-learn, such as data scaling, normalization, and feature engineering. Among them, Scikit-learn is a free software machine learning library for the Python programming language, which provides a large number of machine learning algorithms and tools, and is widely used in various machine learning tasks such as classification, regression, clustering, and dimensionality reduction.

[0108] The benefit of this setting is that by cleaning and standardizing the data of each target detection data, and fusing them when there are at least two types of target detection data, the consistency and accuracy of the data can be improved, and the noise and deviation can be effectively reduced, thereby improving the performance of the detection model and ultimately achieving a more accurate and stable transaction anomaly detection effect.

[0109] S403, inputting the standard detection data into a pre-built global detection model to determine whether each target detection data has transaction anomalies; wherein the global detection model is aggregated by branch detection models of at least two trading platforms;

[0110] S404, storing the target detection data with transaction anomalies on a preset blockchain.

[0111] The advantage of this arrangement of the scheme is that by adopting a mixture of multiple methods to obtain target detection data, it can flexibly adapt to different data scenarios and improve the applicability of the scheme.

[0112] Embodiment 4

[0113] Figure 5 Schematic diagram of the structure of the transaction anomaly detection device provided in the fourth embodiment of the present application. Figure 5 As shown, the device comprises:

[0114] A detection data acquisition module 510 is used to acquire target detection data; wherein the target detection data includes at least one of transaction data, user behavior data and multimodal data;

[0115] The data fusion processing module 520 is used to perform fusion processing on each target detection data to obtain standard detection data;

[0116] The transaction anomaly identification module 530 is used to input the standard detection data into a pre-built global detection model to determine whether each target detection data has transaction anomalies; wherein the global detection model is aggregated by branch detection models of at least two transaction platforms;

[0117] The data storage module 540 is used to store the target detection data with transaction anomalies on a preset blockchain.

[0118] In an embodiment of the present application, a detection data acquisition module is used to acquire target detection data; wherein the target detection data includes at least one of transaction data, user behavior data and multimodal data; a data fusion processing module is used to perform fusion processing on each target detection data to obtain standard detection data; a transaction anomaly identification module is used to input the standard detection data into a pre-built global detection model to determine whether each target detection data has transaction anomalies; wherein the global detection model is aggregated by branch detection models of at least two transaction platforms; a data storage module is used to store target detection data with transaction anomalies on a preset blockchain. The above-mentioned transaction anomaly detection device, based on blockchain technology and federated learning technology, uses a global detection model aggregated by branch detection models of each transaction platform to perform independent transaction anomaly detection on each transaction platform, which can realize data collaboration and sharing between each transaction platform, improve the comprehensiveness of detection of transaction anomalies, and at the same time improve the processing and detection efficiency of target detection data.

[0119] The transaction anomaly detection device in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. The non-mobile electronic device can be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0120] The transaction anomaly detection device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an IOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0121] The transaction anomaly detection device provided in the embodiment of the present application can implement each process implemented in the above-mentioned embodiments one to three, and will not be described again here to avoid repetition.

[0122] Embodiment 5

[0123] like Figure 6As shown, an embodiment of the present application also provides an electronic device 600, including a processor 601, a memory 602, and a program or instruction stored in the memory 602 and executable on the processor 601. When the program or instruction is executed by the processor 601, each process of the above-mentioned transaction anomaly detection method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0124] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0125] Embodiment 6

[0126] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned transaction anomaly detection method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0127] The processor is a processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0128] Embodiment 7

[0129] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned transaction anomaly detection method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0130] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0131] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0132] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0133] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0134] The above are only preferred embodiments of the present application and the technical principles used. The present application is not limited to the specific embodiments described herein, and various obvious changes, readjustments and substitutions that can be made by those skilled in the art will not deviate from the scope of protection of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the claims.

Claims

1. A transaction anomaly detection method, characterized in that: The method comprises: Acquire target detection data; wherein the target detection data includes at least one of transaction data, user behavior data, and multimodal data; The detection data of each target is fused and processed to obtain standard detection data; Input the standard detection data into a pre-built global detection model to determine whether each target detection data has transaction anomalies; wherein the global detection model is aggregated by branch detection models of at least two trading platforms; The target detection data with transaction anomalies is stored on the preset blockchain.

2. The transaction anomaly detection method according to claim 1, characterized in that: The process of pre-building a global detection model includes: In each trading platform, a branch detection model is locally constructed based on the historical detection data of the trading platform; Aggregate the branch detection models of each trading platform to obtain a global detection model; Distributing the global detection model to each trading platform; Accordingly, the standard detection data is input into a pre-built global detection model to determine whether each target detection data has transaction anomalies, including: When the trading platform receives the global detection model, the standard detection data is input into the global detection model in the trading platform to determine whether there is any transaction anomaly in each target detection data.

3. The transaction anomaly detection method according to claim 1, characterized in that: The standard detection data is input into a pre-built global detection model to determine whether each target detection data has transaction anomalies, including: The H2O.ai platform is used to detect and classify the standard detection data based on a pre-built global detection model to determine whether there are any transaction anomalies in each target detection data.

4. The transaction anomaly detection method according to claim 1, characterized in that: The target detection data with transaction anomalies is stored on the preset blockchain, including: Storing target detection data with transaction anomalies on the Hyperledger Fabric blockchain; and / or, Control other trading platforms except the trading platform to which the target detection data belongs to verify the target detection data through the Corda blockchain.

5. The transaction anomaly detection method according to claim 1, characterized in that: The method further comprises: The training records, update records and detection records of the global detection model are stored on the Ethereum blockchain.

6. The transaction anomaly detection method according to claim 1, characterized in that: Obtain target detection data, including: Obtain target detection data through the preset real-time data acquisition interface of the trading platform; and / or, Obtaining target detection data from the pre-storage space of the trading platform according to a preset period; and / or, In response to a data acquisition driving event of the trading platform, target detection data is acquired.

7. The transaction anomaly detection method according to claim 1, characterized in that: The detection data of each target is fused and processed to obtain standard detection data, including: Perform data cleaning and standardization on each target detection data to obtain pre-processed detection data; In the case where there is only one type of target detection data, determining the pre-processed detection data as standard detection data; or, In the case where there are at least two types of target detection data, the pre-processed detection data are fused to obtain standard detection data.

8. A transaction anomaly detection device, characterized in that: The device comprises: A detection data acquisition module, used to acquire target detection data; wherein the target detection data includes at least one of transaction data, user behavior data and multimodal data; The data fusion processing module is used to fuse the detection data of each target to obtain standard detection data; A transaction anomaly identification module, used to input the standard detection data into a pre-built global detection model to determine whether each target detection data has transaction anomalies; wherein the global detection model is aggregated by branch detection models of at least two transaction platforms; The data storage module is used to store target detection data with transaction anomalies on a preset blockchain.

9. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the transaction anomaly detection method as described in any one of claims 1 to 7.

10. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the transaction anomaly detection method according to any one of claims 1 to 7 are implemented.

Images