Transaction risk identification method and device, equipment and medium

Abstract

The invention provides a transaction risk identification method, and relates to the field of artificial intelligence and the field of information security. The method comprises the following steps: acquiring transaction data of a to-be-identified user; extracting N time sequence transaction features of the transaction data by using a hidden layer of the first neural network model, wherein N is an integer greater than or equal to 1; obtaining a target data set based on the transaction data and the N time sequence transaction features; and inputting the target data set into a risk identification model to obtain a transaction risk category of the to-be-identified user. The time sequence information of the transaction data can be analyzed based on the neural network model, and the potential mapping relation extracted by the neural network model is embodied by the time sequence transaction characteristics, so that the target data set is obtained by combining with the transaction data, and the risk identification model can conveniently process the target data set to obtain an accurate transaction risk category. The invention further provides a transaction risk identification device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the fields of artificial intelligence and information security, and more specifically, to a transaction risk identification method, device, equipment, medium and program product. Background Art

[0002] In order to conceal the characteristics of risky transactions and evade crackdowns, criminals continue to upgrade their means of evading risk identification, such as maintaining cards and numbers, which are becoming increasingly complex. Traditional rule-based transaction risk judgment methods are no longer fully applicable to abnormal transaction scenarios dominated by new evasion methods in related technologies. Therefore, proposing a transaction risk identification method to improve the accuracy of identifying unauthorized transactions is an urgent problem to be solved. Summary of the invention

[0003] In view of the above problems, the present disclosure provides a transaction risk identification method, apparatus, device, medium and program product.

[0004] One aspect of an embodiment of the present disclosure provides a transaction risk identification method, including: obtaining transaction data of a user to be identified; extracting N time-series transaction features of the transaction data using a hidden layer of a first neural network model, where N is an integer greater than or equal to 1; obtaining a target data set based on the transaction data and the N time-series transaction features; and inputting the target data set into a risk identification model to obtain a transaction risk category of the user to be identified.

[0005] According to an embodiment of the present disclosure, the risk identification model includes M first sub-classification models, any two of the first sub-classification models are constructed based on different machine learning algorithms, and M is an integer greater than or equal to 2; inputting the target data set into the risk identification model to obtain the transaction risk category of the user to be identified includes: inputting the target data set into the M first sub-classification models respectively to obtain M intermediate risk identification results; based on the M intermediate risk identification results, obtaining the transaction risk category of the user to be identified.

[0006] According to an embodiment of the present disclosure, the risk identification model also includes a second sub-classification model. Based on the M intermediate risk identification results, obtaining the transaction risk category of the user to be identified includes: inputting the M intermediate risk identification results into the second sub-classification model to obtain the transaction risk category of the user to be identified.

[0007] According to an embodiment of the present disclosure, the first neural network model includes a long short-term memory artificial neural network model, and the method further includes: determining a specific hidden layer in the long short-term memory artificial neural network model that is consistent with the dimension of the transaction data; wherein, extracting N time series transaction features of the transaction data using the hidden layer of the first neural network model includes: inputting the transaction data into the long short-term memory artificial neural network model; and obtaining the output of the specific hidden layer as the N time series transaction features.

[0008] According to an embodiment of the present disclosure, obtaining transaction data of a user to be identified includes: determining Q transaction records of the user within a predetermined time period, where Q is an integer greater than or equal to 2; determining N transaction attributes of each transaction of the user to be identified; obtaining the N transaction attributes of each transaction in the Q transaction records to obtain the transaction data.

[0009] According to an embodiment of the present disclosure, obtaining a target data set based on the transaction data and the N time-series transaction features includes: concatenating the transaction data and the N time-series transaction features to obtain an intermediate data set; adding a user type feature set to the intermediate data set to obtain the target data set, wherein the user type feature set includes N type features of the user who initiated the user to be identified.

[0010] According to an embodiment of the present disclosure, before inputting the target data set into the risk identification model, the method also includes pre-training the risk identification model, specifically including: using the hidden layer of the first neural network model to extract N time-series transaction features of historical transaction data, wherein the historical transaction data comes from at least one historical transaction; obtaining a first training data set based on the historical transaction data and the N time-series transaction features; and updating the model parameters of the M first sub-classification models respectively based on the first training data set.

[0011] According to an embodiment of the present disclosure, updating the model parameters of the M first sub-classification models based on the first training data set includes: based on the K-fold cross-validation method, dividing the first training data set into K training subsets, K is an integer greater than or equal to 2; performing K training times on the M first sub-classification models, wherein each training determines any one of the K training subsets as test data, and the remaining K-1 training subsets are used as training data, and the training subsets used as the test data in any two trainings are different.

[0012] According to an embodiment of the present disclosure, the risk identification model also includes a second sub-classification model, and training the M first sub-classification models K times includes: in each training, obtaining the test results of the M first sub-classification models for the test data of the training, and the test results include the test risk identification results of each historical transaction in the test data; wherein the method also includes: obtaining a second training data set based on the K test results obtained from the K training times; and updating the model parameters of the second sub-classification model based on the second training data set.

[0013] According to an embodiment of the present disclosure, updating the model parameters of the second sub-classification model based on the second training data set includes: inputting the second training data set into the second sub-classification model to obtain a predicted transaction risk category for each historical transaction; inputting the predicted transaction risk category and the transaction risk category label of each historical transaction into an objective function to obtain an objective function value; if the objective function value does not meet the training end conditions, updating the model parameters of the second sub-classification model based on the objective function.

[0014] According to an embodiment of the present disclosure, in addition to updating the model parameters of the second sub-classification model based on the objective function, the method also includes: updating the model parameters of the M first sub-classification models respectively based on the objective function; and / or updating the model parameters of the first neural network model based on the objective function.

[0015] Another aspect of an embodiment of the present disclosure provides a transaction risk identification device, including: a data acquisition module, used to acquire transaction data of a user to be identified; a feature extraction module, used to extract N time-series transaction features of the transaction data using a hidden layer of a first neural network model, where N is an integer greater than or equal to 1; a target data module, used to obtain a target data set based on the transaction data and the N time-series transaction features; and a risk identification module, used to input the target data set into a risk identification model to obtain a transaction risk category of the user to be identified.

[0016] Another aspect of an embodiment of the present disclosure provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the method as described above.

[0017] Another aspect of the embodiments of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method as described above.

[0018] Another aspect of the embodiments of the present disclosure further provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0019] One or more of the above-mentioned embodiments have the following beneficial effects: it is able to analyze the time series information of transaction data based on the neural network model, and reflect the potential mapping relationship extracted by the neural network model with the time series transaction characteristics, and then combine it with the transaction data to obtain the target data set, so as to facilitate the risk identification model to process the target data set to obtain accurate transaction risk categories. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0021] Figure 1 A diagram schematically shows an application scenario of the transaction risk identification method according to an embodiment of the present disclosure;

[0022] Figure 2 A flowchart of a transaction risk identification method according to an embodiment of the present disclosure is schematically shown;

[0023] Figure 3 A flowchart for obtaining a transaction risk category according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 4 A flowchart for obtaining transaction data according to an embodiment of the present disclosure is schematically shown;

[0025] Figure 5 A flowchart for extracting time-series transaction features according to an embodiment of the present disclosure is schematically shown;

[0026] Figure 6 The schematic diagram shows the architecture of the long short-term memory artificial neural network model according to the embodiment of the present disclosure;

[0027] Figure 7 A flowchart of obtaining a target data set according to an embodiment of the present disclosure is schematically shown;

[0028] Figure 8 Schematically shows a flow chart of pre-training a risk identification model according to an embodiment of the present disclosure;

[0029] Fig. 9 Schematically shows a flow chart of performing K training on the first sub-classification model according to an embodiment of the present disclosure;

[0030] Fig.10 A flowchart of updating the model parameters of the second sub-classification model according to an embodiment of the present disclosure is schematically shown;

[0031] Fig.11 Schematically shows an architecture diagram of performing K training on the first sub-classification model according to an embodiment of the present disclosure;

[0032] Fig.12 Schematically shows an architecture diagram for generating a second training data set according to the fusion output of an embodiment of the present disclosure;

[0033] Fig.13 A schematic diagram showing an architecture for updating the model parameters of the second sub-classification model according to an embodiment of the present disclosure;

[0034] Fig.14 A schematic diagram showing a structural block diagram of a transaction risk identification device 1400 according to an embodiment of the present invention; and

[0035] Fig.15 A block diagram of an electronic device suitable for implementing a transaction risk identification method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0036] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0037] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0038] In related technologies, the determination of whether there are risky transactions (such as risky transactions) is often made through transaction data, inflow and outflow amounts, active days of mobile banking, and other data within a certain period of the user to be identified. There is a large amount of time series information, such as the daily consumption amount, time period, and transaction objects of normal users to be identified are relatively fixed. Risky transaction users to be identified may generate a large number of transactions in an unconventional time period or time point, which will be reflected in the time series transaction graph as peaks and troughs.

[0039] For single-peak transaction data, the daily average transaction amount fluctuation, variance, standard deviation and other statistical information based on rules can reflect the abnormal transaction information of the user to be identified. However, there are multiple peaks and troughs in the time series transaction graph of atypical risk transactions. If the traditional rules based on numerical calculation are used, it is difficult to reflect the multiple peaks and troughs of such transaction information. The standard deviation and other information will tend to make the user to be identified as a normal user to be identified. Therefore, it is urgent to propose a transaction risk identification method to improve the accuracy of identifying abnormal transactions.

[0040] Some embodiments of the present disclosure propose a transaction risk identification method, which can rely on a neural network model to analyze the time series information of transaction data, and reflect the potential mapping relationship extracted by the neural network model with time series transaction characteristics, and then combine it with the transaction data to obtain a target data set, so as to facilitate the risk identification model to process the target data set to obtain accurate transaction risk categories.

[0041] Figure 1 The following schematically shows an application scenario diagram of the transaction risk identification method according to an embodiment of the present disclosure. It should be noted that: Figure 1 What is shown are merely examples to which the embodiments of the present disclosure can be applied, so as to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0042] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0043] The user can use the terminal devices 101, 102, 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications to be identified can be installed on the terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, mailbox client to be identified, social platform software, etc. (only as examples).

[0044] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0045] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0046] Server 105 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud computing, network services, and middleware services.

[0047] In applications such as user-side applications to be identified and web applications (abbreviated as APP in English), the user-side to be identified (i.e., the front end) and the server-side (i.e., the back end) can communicate data through network messages. For example, in the user-side to be identified of the APP, the parameters that the server-side needs to obtain from the user-side to be identified are assembled, and the network request method is called to send them to the server-side.

[0048] In some embodiments, users can initiate transactions through mobile banking APP, such as transfers, withdrawals, financial management, etc. The server 105 can obtain transaction data of the user to be identified, and perform transaction risk identification to obtain the transaction risk category of the user to be identified.

[0049] It should be noted that the transaction risk identification method provided in the embodiment of the present invention can be executed by the terminal device 101, 102, 103 or the server 105. Accordingly, the transaction risk identification device provided in the embodiment of the present invention can generally be set in the terminal device 101, 102, 103 or the server 105. The transaction risk identification method provided in the embodiment of the present invention can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal device 101, 102, 103 and / or the server 105. Accordingly, the transaction risk identification device provided in the embodiment of the present invention can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal device 101, 102, 103 and / or the server 105.

[0050] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0051] The following will be based on Figure 1 The scene described by Figure 2 to Figure 13 The transaction risk identification method of the embodiment of the present disclosure is described in detail.

[0052] Figure 2 The flowchart of the transaction risk identification method according to the embodiment of the present disclosure is schematically shown. Figure 2 As shown, the transaction risk identification method of this embodiment includes:

[0053] In operation S210, transaction data of the user to be identified is obtained.

[0054] For example, to obtain transaction data of at least one transaction within a period of time, the current real-time transaction data of the user to be identified and the transaction data of a certain period of time in the past can be obtained, or the data of all transactions of the user to be identified in a certain period of time can be obtained regularly. It should be noted that the "user" in the embodiments of this specification can refer to the user of at least one party in the transaction.

[0055] The transaction data of operation S210 may include the user object information to be identified and the transaction information. The user object information to be identified is used by the system to learn the association between the users to be identified, and the transaction information is used to learn the association between transactions. For example, the user object information to be identified includes the user account to be identified, mobile phone number, user portrait to be identified, accounting mailbox, etc. The transaction information of the user to be identified includes the transaction ID, transaction time, total transaction amount, transaction type, mailing address, payment method, payment tool, IP address and device fingerprint, etc.

[0056] In operation S220, N time-series transaction features of the transaction data are extracted using the hidden layer of the first neural network model, where N is an integer greater than or equal to 1.

[0057] The first neural network model is constructed based on a neural network algorithm that can extract time series information, such as RNN (recursive neural network) and its variants, CNN (convolutional neural network), Transformer architecture, long short-term memory artificial neural network model, etc. Correspondingly, the first neural network model can also be replaced by a second neural network model, a third neural network model, etc. that can extract time series information.

[0058] For example, when the first neural network model is constructed, a complete deep neural network model for classification is constructed, but only one of the Hidden layers output information is selected as a new data set, instead of directly classifying it. Because when the deep neural network is used for prediction, it is very easy to produce overfitting and poor interpretability. After training, the Hidden layer can output time series transaction features containing time series information well.

[0059] In operation S230 , a target data set is obtained based on the transaction data and N time-series transaction features.

[0060] For example, judging whether there is abnormal transaction behavior is often done through transaction data within a certain period, based on the amount of inflows and outflows, the number of days of mobile banking activity, and other data, which contains a large amount of time series information. Time series transaction features characterize the sequential dependency, long-range dependency, and dynamic changes of the input of transaction data, which enables subsequent classification models to learn the potential mapping relationship between transaction data and risk categories.

[0061] The target data set can be constructed by directly fusing the transaction data and N time-series transaction features, for example, directly concatenating them, or extracting features from the concatenated data again through a neural network model. The target data set can also be constructed by introducing new transaction features based on the transaction data and N time-series transaction features.

[0062] In operation S240, the target data set is input into a risk identification model to obtain a transaction risk category of the user to be identified.

[0063] Transaction risks generally involve the following situations: one is a clear violation of laws and regulations, and the other is a clear violation of financial institution regulations or abnormal transactions with potential risks. For example, the corresponding probability value can be determined by analyzing the degree of risk. In specific implementation, the risk category of the transaction can be determined based on the probability value. For example, it can be divided into four risk categories, Ⅰ, Ⅱ, Ⅲ, and Ⅳ, arranged from small to large.

[0064] Machine learning can be used in advance to optimize the objective function to train the risk identification model, and the risk identification model can be further used to analyze the users to be identified, identify abnormal transactions or users with risks, and effectively improve the accuracy and efficiency of transaction risk prediction.

[0065] According to the embodiments of the present disclosure, it is possible to analyze the time series information of transaction data based on a neural network model, and reflect the potential mapping relationship extracted by the neural network model with time series transaction characteristics, which is then combined with the transaction data to obtain a target data set, making it easier for a risk identification model to process the target data set to obtain accurate transaction risk categories.

[0066] Figure 3 The flowchart for obtaining the transaction risk category according to an embodiment of the present disclosure is schematically shown.

[0067] The risk identification model includes M first sub-classification models, any two of which are constructed based on different machine learning algorithms, and M is an integer greater than or equal to 2.

[0068] The M first sub-classification models may include at least two of the following:

[0069] GBDT sub-model built with LightGBM, GBDT sub-model built with Catboost, GBDT sub-model built with XGBOOST, Random Forest model, and Support Vector Machine.

[0070] Among them, the GBDT model is an integrated learning algorithm that improves prediction performance by iteratively training a decision tree model, and classifies by combining multiple CART trees to output prediction scores. This embodiment uses LightGBM, Catboost, and XGBOOST frameworks to build three GBDT sub-models. The three types of frameworks have the same principles, but there are still differences in algorithm implementation and optimization. Multiple sub-models can be constructed using their different optimization points. Random Forest model, the random forest model is similar to GBDT, but the generated sub-decision tree directly outputs the prediction result, and outputs the final prediction result of the model based on the voting results of all decision trees. Support Vector Machine (SVM) is a classic supervised learning algorithm for solving binary and multi-classification problems. The core idea of ​​SVM is to find an optimal hyperplane that can separate samples of different categories in the feature space and maximize the interval between two categories as much as possible. Unlike tree models, SVM looks at samples from the data space dimension.

[0071] like Figure 3 As shown, this embodiment is one of the embodiments of operation S240, and obtaining the transaction risk category includes:

[0072] In operation S310, the target data set is input into M first sub-classification models respectively to obtain M intermediate risk identification results.

[0073] In operation S320, based on the M intermediate risk identification results, a transaction risk category of the user to be identified is obtained.

[0074] In some embodiments, the reason for selecting the above-mentioned M first sub-classification models is that compared with deep neural networks, they have a stronger ability to process tabular data, and the model is more interpretable. It can output the importance ranking of each sub-model to help the business sort out and set transaction risk identification business rules.

[0075] According to the embodiments of the present disclosure, a method is proposed to extract time series transaction features and nonlinear features based on bank transaction data using a deep neural network model, construct a sub-model using a multi-category machine learning algorithm, and synthesize the sub-model output through a multi-model fusion technology to determine whether the user to be identified has risky behavior. A multi-model fusion mechanism is added. The advantage of multi-model fusion is that it can integrate the prediction advantages of various models to form an overall output, enhance the prediction effect of the overall model, avoid misjudgment, and improve prediction accuracy.

[0076] In operation S320, for example, a voting mechanism can be used to obtain the final transaction risk category based on the M intermediate risk identification results. Different models are equivalent to different voters, and the classification results given by the models are their votes. The category with more votes wins as the final result. For another example, the M intermediate risk identification results can be used as input data to obtain the transaction risk category using another classification model.

[0077] In some embodiments, the risk identification model also includes a second sub-classification model. Based on the M intermediate risk identification results, obtaining the transaction risk category of the user to be identified includes: inputting the M intermediate risk identification results into the second sub-classification model to obtain the transaction risk category of the user to be identified.

[0078] For example, by connecting a linear regression classifier (a simple structure prevents overfitting), linear regression assigns different weights to the prediction results of different models to form a linear regression function, which calculates and determines whether the user to be identified has risky behavior. Its accuracy is much higher than the traditional single model structure.

[0079] It is understood that the linear regression classifier is only an optional embodiment of the present disclosure. For example, at least one of logistic regression, naive Bayes, principal component analysis (PCA, reducing high-dimensional features to low dimensions and then using logistic regression for classification), decision tree, K-nearest neighbor (KNN), and neural network algorithms can be selected to construct the second sub-classification model.

[0080] Figure 4 The flowchart of obtaining transaction data according to an embodiment of the present disclosure is schematically shown. Figure 4 As shown, this embodiment is one of the embodiments of operation S210, including:

[0081] In operation S410, Q transaction records of a user within a predetermined time period are determined, where Q is an integer greater than or equal to 2.

[0082] In operation S420, N transaction attributes of each user to be identified are determined. Transaction attributes refer to transaction-related features in the transaction record, such as transaction amount, transaction time, transaction location, etc.

[0083] In operation S430, N transaction attributes of each transaction in Q transaction records are obtained to obtain transaction data. For example, Q transaction records include attribute data such as transaction amount and transaction time of each transaction in all transaction records of the user to be identified within a predetermined time period.

[0084] According to the embodiments of the present disclosure, transaction data with time series information can be effectively extracted and accurately identified, thereby improving the accuracy of risk assessment and preventing risks such as fraud.

[0085] Figure 5 The flowchart of extracting time-series transaction features according to an embodiment of the present disclosure is schematically shown. Figure 6 The schematic diagram shows the architecture of the long short-term memory artificial neural network model according to an embodiment of the present disclosure.

[0086] The first neural network model includes long short-term memory artificial neural network models, such as Figure 5 As shown, this embodiment is one of the embodiments of operation S220, including:

[0087] In operation S510 , a specific hidden layer in the long short-term memory artificial neural network model is determined that is consistent with the dimension of the transaction data.

[0088] Reference Figure 6 , a Long Short-Term Memory Artificial Neural Network (LSTM) model can have an input layer, one or more hidden layers, and an output layer. The LSTM model processes the input data by first increasing its dimension and then reducing its dimension, which can extract more time series information and avoid having too many parameters. During the dimension reduction operation, there is a specific hidden layer that is consistent with the transaction data dimension of the input layer.

[0089] In operation S520, the transaction data is input into a long short-term memory artificial neural network model.

[0090] In operation S530, the output of the specific hidden layer is obtained as N time-series transaction features.

[0091] The LSTM model is a deep learning model suitable for sequence data. It can capture long-term dependencies and temporal patterns in time series data. The LSTM model can better capture the temporal characteristics of abnormal transaction data and express its volatility with numerical values.

[0092] In some embodiments, in the selection of transaction data, the transaction amount of the user to be identified, the number of times the user to be identified logs into mobile banking, the amount of withdrawals from the ATM machine of the user to be identified, the transaction amount of Alipay, the transaction amount of WeChat, the purchase of financial products and other account information and the activity of the user to be identified can be selected as the input data set of LSTM. When constructing the LSTM model, a complete deep neural network model for classification will be constructed, but only the Hidden layer with the same dimension as the input layer will be selected, and N time series transaction features will be output as a new data set, instead of directly using LSTM for classification, because when the deep neural network is used for prediction, overfitting and poor interpretability are very likely to occur. After the neural network training, the Hidden layer can already output a new data set containing time series information well.

[0093] For example, if the transaction amount of the user to be identified in the past seven days is [100, 150, 120, 200, 180, 250, 230], the output of the middle layer may be [0.1, 0.3, 0.2, 0.4, 0.35, 0.5, 0.6]. By combining the corresponding positions of the new and old data sets, the ratio of daily transaction amounts will be further expanded, and the distinction will be stronger.

[0094] Figure 7 The flowchart of obtaining the target data set according to the embodiment of the present disclosure is schematically shown. Figure 7 As shown, this embodiment is one of the embodiments of operation S230, including:

[0095] In operation S710, the transaction data and N time-series transaction features are concatenated to obtain an intermediate data set.

[0096] For example, use the concat operation to splice. The concat operation refers to the operation of splicing two or more tensors in a certain dimension, where the splicing dimension must be consistent. In deep learning, the commonly used splicing methods are horizontal splicing and vertical splicing.

[0097] In operation S720, the user type feature set is added to the intermediate data set to obtain a target data set, wherein the user type feature set includes N type features of the user to be identified. The user type feature set may also be added by using a concat operation.

[0098] User type features can provide additional information to help identify a user's risk level. For example, the trading patterns and behaviors of high net worth users and ordinary users may be very different, so using user type as one of the features can more accurately assess trading risks. If an ordinary user's account suddenly starts to make large transactions, there may be risks, and adding user type features can better capture this abnormal behavior. If the model predicts that a transaction is risky, the user type feature can be used to explain it as high-risk behavior of high-risk users, thereby better explaining the model's prediction results.

[0099] After obtaining the output of the LSTM model, the target dataset is constructed by concatenating the original transaction dataset with the output of the Hidden layer of the LSTM model and adding user type feature information (such as bank business activation status, occupation, age, gender, marital status, whether the user is receiving salary payment, and other category features). The target dataset already contains the time series transaction information of the user to be identified as the input of the risk identification model.

[0100] According to an embodiment of the present disclosure, a target data set is obtained based on transaction data, N time-series transaction features, and a user type feature set, thereby achieving more accurate risk assessment, better risk detection, and improving model interpretability.

[0101] Figure 8 The flowchart of pre-training the risk identification model according to the embodiment of the present disclosure is schematically shown. Before the target data set is input into the risk identification model, Figure 8 As shown, the pre-trained risk identification model in this embodiment includes:

[0102] In operation S810, N time-series transaction features of historical transaction data are extracted using a hidden layer of a first neural network model, wherein the historical transaction data comes from at least one historical transaction.

[0103] It is possible to obtain historical transaction logs, user device information, transaction time and location and other basic historical transaction data, extract features used for machine learning from the basic historical transaction data, and obtain historical transaction data, such as the user object information to be identified and transaction information. For example, the number, frequency and amount of recent transactions of the user, the time and location of each transaction, and the number of accounts associated with the user device.

[0104] In operation S820, a first training data set is obtained based on the historical transaction data and N time-series transaction features.

[0105] The process of obtaining the target data set may be referred to the above operation S230 and its embodiments to obtain the first training data set.

[0106] In operation S830, model parameters of the M first sub-classification models are respectively updated based on the first training data set.

[0107] According to an embodiment of the present disclosure, after constructing M first sub-classification models, the first training data set is used uniformly to train and tune each sub-classification model, so that each sub-classification model obtains the optimal prediction result for the transaction data of the user to be identified under the corresponding hyperparameters.

[0108] Fig. 9 The flowchart of updating the model parameters of the second sub-classification model according to an embodiment of the present disclosure is schematically shown. Fig. 9 As shown, this embodiment is one of the embodiments of operation S830, including:

[0109] In operation S910 , based on a K-fold cross validation method, a first training data set is divided into K training subsets, where K is an integer greater than or equal to 2.

[0110] The K-fold cross validation method divides the original data set into K subsets, of which K-1 subsets are used to train the model, and the remaining 1 subset is used to evaluate the model performance. This process is repeated K times, each time using a different subset as the test set.

[0111] In operation S920, the M first sub-classification models are trained K times, wherein in each training, any one of the K training subsets is determined as test data, and the remaining K-1 training subsets are used as training data, and the training subsets used as test data in any two trainings are different.

[0112] For example, let the values ​​of K and M be 5, and divide the first training data set into five sub-training sets through five-fold cross validation. Then, each first sub-classification model is trained using four sub-training sets, and the remaining sub-training set is predicted to obtain the test result.

[0113] Fig.10 The flowchart of performing K training on the first sub-classification model according to an embodiment of the present disclosure is schematically shown. Fig.11 The schematic diagram shows an architecture diagram of performing K training on the first sub-classification model according to an embodiment of the present disclosure. Fig.12 The schematic diagram shows an architecture diagram for generating a second training data set by fusion output according to an embodiment of the present disclosure. Fig.13 The schematic diagram shows an architecture diagram for updating the model parameters of the second sub-classification model according to an embodiment of the present disclosure.

[0114] like Fig.10 As shown, this embodiment is one of the embodiments of operation S920, including:

[0115] In operation S1010, in each training, test results of the M first sub-classification models on the test data of the training are obtained, and the test results include a test risk identification result for each historical transaction in the test data.

[0116] In operation S1020, a second training data set is obtained based on K test results obtained from K trainings.

[0117] In operation S1030, model parameters of the second sub-classification model are updated based on the second training data set.

[0118] For example, refer to Fig.11 and Fig.12 After the five sub-machine learning models generate corresponding meta-feature training subsets 1 to 5, they are merged to generate the second training data set. Each column of the second training data set is the prediction probability corresponding to each sub-classification model. If the value of M is 5, the generated second training data set has a total of five columns.

[0119] Each row of the second training data set is in the form of [0.12, 0.75, 0.76, 0.42, 0.89], which contains five model output prediction probability values ​​(values ​​between 0 and 1, the closer the value is to 1, the higher the possibility of predicting abnormal trading behavior). The advantage of multi-model fusion is that it can integrate the prediction advantages of various models to form an overall output and enhance the prediction effect of the overall model. For example, three of the five models judge it as a user to be identified who has conducted abnormal transactions, and two models judge it as a normal user. Through the model fusion mechanism, it is highly likely that the user is still judged as a user who has conducted abnormal transactions, which enhances the overall robustness and robustness of the model.

[0120] In some embodiments, updating the model parameters of the second sub-classification model based on the second training data set includes: inputting the second training data set into the second sub-classification model to obtain the predicted transaction risk category of each historical transaction. Inputting the predicted transaction risk category and the transaction risk category label of each historical transaction into the objective function to obtain the objective function value. If the objective function value does not meet the training end condition, updating the model parameters of the second sub-classification model based on the objective function. The objective function may include a cross entropy loss function, an L2 norm, etc.

[0121] For example, the second sub-classification model selects a linear regression classifier. It can be understood that the linear regression classifier is only an optional embodiment of the present disclosure. Fig.11 , Fig.12 and Fig.13 , the second training data set generated by the five first sub-classification models is used as input, and then connected to the linear regression classifier, and the linear regression classifier is trained based on the predicted probability of the sub-machine learning combined with the sample label. When obtaining historical transaction data, it can be determined whether there is a transaction risk as a sample label. After the linear regression classifier training is completed, it can be judged whether the user to be identified has made abnormal transactions, and the model accuracy is more ideal by combining the five first sub-classification models.

[0122] For example, in the abnormal transaction detection model, more attention is paid to whether the user to be identified has abnormal transaction behavior, and the degree of attention to the misjudgment rate is not high. Through model fusion, it is possible to better identify whether highly suspicious users to be identified who are around the prediction probability threshold have abnormal transaction behavior. For example, the sub-model prediction sequence of a user to be identified is [0.48, 0.49, 0.67, 0.43, 0.50], and the discrimination threshold of the sub-model defaults to 0.5. If a single model is used for prediction, it is very likely that the user to be identified is normal. However, with the addition of a multi-model fusion mechanism, the user to be identified will also be judged as having abnormal transaction behavior to avoid omission.

[0123] After obtaining the second training data set consisting of the outputs of five sub-models, a simple linear regression classifier is connected (the simple structure prevents it from overfitting). Linear regression assigns different weights to different models to form a linear regression function, which calculates and determines whether the user to be identified has abnormal trading behavior, and the effect is better than the voting mechanism.

[0124] In some embodiments, in addition to updating the model parameters of the second sub-classification model based on the objective function, the method further includes: updating the model parameters of the M first sub-classification models based on the objective function. And / or updating the model parameters of the first neural network model based on the objective function. In this embodiment, the objective function may include the loss functions of the second sub-classification model, the first sub-classification model, and the first neural network model.

[0125] The model parameters of the M first sub-classification models and the first neural network model can be pre-trained respectively, such as performing K training on the M first sub-classification models in operation S920. Then, the objective function is calculated according to the prediction result output by the second sub-classification model, and the model parameters of the M first sub-classification models and the first neural network model are updated again, so as to realize an end-to-end training method.

[0126] According to the embodiments of the present disclosure, end-to-end training can be applicable to complex scenarios, and can enable multiple models to better learn and utilize the correlation between data, thereby improving the prediction and classification capabilities of the models.

[0127] Some embodiments of the present disclosure extract machine learning features through the output of the middle layer of the LSTM deep learning model based on the daily transaction data of the bank's users to be identified, and use the extracted features as machine learning. A sub-model is constructed through the SVM, random forest, and GBDT algorithms, and the sub-model output is statistically analyzed using LR to output a probability judgment of whether the user to be identified has abnormal transaction behavior.

[0128] Furthermore, some embodiments of the present disclosure perform automatic feature engineering based on LSTM deep neural network, and use five different machine learning sub-models to perform classification prediction and then fuse the output results to determine whether the user to be identified has risky trading behavior. LSTM deep neural network is used for feature extraction to explore the time series and nonlinear relationship between data. In the machine learning model construction stage, multiple different sub-machine learning models are created according to different algorithm characteristics, and the advantages of various algorithms are integrated through model fusion technology for output, ensuring the robustness and robustness of the overall model.

[0129] Based on the above transaction risk identification method, the present disclosure also provides a transaction risk identification device. Fig.14 The device is described in detail.

[0130] Fig.14 The structure block diagram of the transaction risk identification device 1400 according to an embodiment of the present invention is schematically shown.

[0131] like Fig.14 The transaction risk identification device 1400 may include a data acquisition module 1410 , a feature extraction module 1420 , a target data module 1430 and a risk identification module 1440 .

[0132] The data acquisition module 1410 may perform operation S210 to acquire transaction data of the user to be identified.

[0133] In some embodiments, the data acquisition module 1410 may perform operations S410 to 430, which will not be described in detail herein.

[0134] The feature extraction module 1420 can perform operation S220 to extract N time-series transaction features of the transaction data using the hidden layer of the first neural network model, where N is an integer greater than or equal to 1.

[0135] In some embodiments, the feature extraction module 1420 may perform operations S510 to 530, which will not be described in detail herein.

[0136] The target data module 1430 may perform operation S230 to obtain a target data set based on the transaction data and N time-series transaction features.

[0137] In some embodiments, the target data module 1430 may perform operations S710 to 720, which will not be described in detail herein.

[0138] The risk identification module 1440 may perform operation S240 to input the target data set into a risk identification model to obtain a transaction risk category of the user to be identified.

[0139] In some embodiments, the risk identification module 1440 may perform operations S310 to S320, which will not be described in detail herein.

[0140] In some embodiments, the transaction risk identification device 1400 may include a model training module, which may execute operations S810 to 830, operations S910 to 920, and operations S1010 to 1030, which will not be described in detail herein.

[0141] In some embodiments, in addition to updating the model parameters of the second sub-classification model based on the objective function, the model training module is also used to: update the model parameters of the M first sub-classification models based on the objective function, and / or update the model parameters of the first neural network model based on the objective function.

[0142] It should be noted that the transaction risk identification device 1400 includes two components for executing the above Figure 2 to Figure 13 The modules of each step of any embodiment described. The implementation methods, technical problems solved, functions realized, and technical effects achieved of each module / unit / subunit, etc. in the device part embodiment are respectively the same or similar to the implementation methods, technical problems solved, functions realized, and technical effects achieved of each corresponding step in the method part embodiment, and will not be repeated here.

[0143] According to an embodiment of the present disclosure, any multiple modules among the data acquisition module 1410, the feature extraction module 1420, the target data module 1430 and the risk identification module 1440 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module.

[0144] According to an embodiment of the present disclosure, at least one of the data acquisition module 1410, the feature extraction module 1420, the target data module 1430 and the risk identification module 1440 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or may be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or by any one of the three implementation methods of software, hardware and firmware or by an appropriate combination of any of them. Alternatively, at least one of the data acquisition module 1410, the feature extraction module 1420, the target data module 1430 and the risk identification module 1440 may be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function may be performed.

[0145] Fig.15 A block diagram of an electronic device suitable for implementing a transaction risk identification method according to an embodiment of the present disclosure is schematically shown.

[0146] like Fig.15 As shown, the electronic device 1500 according to an embodiment of the present disclosure includes a processor 1501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1502 or a program loaded from a storage part 1508 into a random access memory (RAM) 1503. The processor 1501 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1501 may also include an onboard memory for caching purposes. The processor 1501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0147] In RAM 1503, various programs and data required for the operation of electronic device 1500 are stored. Processor 1501, ROM 1502 and RAM 1503 are connected to each other through bus 1504. Processor 1501 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1502 and / or RAM 1503. It should be noted that the program can also be stored in one or more memories other than ROM 1502 and RAM 1503. Processor 1501 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0148] According to an embodiment of the present disclosure, the electronic device 1500 may further include an input / output (I / O) interface 1505, which is also connected to the bus 1504. The electronic device 1500 may further include one or more of the following components connected to the I / O interface 1505: an input portion 1506 including a keyboard, a mouse, etc. An output portion 1507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc. A storage portion 1508 including a hard disk, etc. And a communication portion 1509 including a network interface card such as a LAN card, a modem, etc. The communication portion 1509 performs communication processing via a network such as the Internet. A drive 1510 is also connected to the I / O interface 1505 as needed. A removable medium 1511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1510 as needed, so that the computer program read therefrom is installed into the storage portion 1508 as needed.

[0149] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments. It may also exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0150] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1502 and / or RAM 1503 described above and / or one or more memories other than ROM 1502 and RAM 1503.

[0151] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided by the embodiment of the present disclosure.

[0152] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 1501. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0153] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1509, and / or installed from the removable medium 1511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0154] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1509, and / or installed from the removable medium 1511. When the computer program is executed by the processor 1501, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0155] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0156] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A transaction risk identification method, comprising: Obtain transaction data of the user to be identified; Extracting N time-series transaction features of the transaction data using the hidden layer of the first neural network model, where N is an integer greater than or equal to 1; Obtain a target data set based on the transaction data and the N time-series transaction features; The target data set is input into a risk identification model to obtain a transaction risk category of the user to be identified.

2. The method according to claim 1, wherein: The risk identification model includes M first sub-classification models, any two of which are constructed based on different machine learning algorithms, and M is an integer greater than or equal to 2; The target data set is input into the risk identification model to obtain the transaction risk category of the user to be identified, including: Inputting the target data set into the M first sub-classification models respectively to obtain M intermediate risk identification results; Based on the M intermediate risk identification results, the transaction risk category of the user to be identified is obtained.

3. The method according to claim 2, wherein: The risk identification model further includes a second sub-classification model, and based on the M intermediate risk identification results, the transaction risk category of the user to be identified includes: The M intermediate risk identification results are input into the second sub-classification model to obtain the transaction risk category of the user to be identified.

4. The method according to claim 1, wherein: The first neural network model includes a long short-term memory artificial neural network model, and the method further includes: Determining a specific hidden layer in the long short-term memory artificial neural network model that is consistent with the dimensions of the transaction data; The method of extracting N time series transaction features of the transaction data using the hidden layer of the first neural network model includes: Inputting the transaction data into the long short-term memory artificial neural network model; The output of the specific hidden layer is obtained as the N time series transaction features.

5. The method according to claim 1, wherein: Obtaining transaction data of the user to be identified includes: Determine Q transaction records of the user within a predetermined time period, where Q is an integer greater than or equal to 2; Determine N transaction attributes of each of the to-be-identified users; The N transaction attributes of each transaction in the Q transaction records are obtained to obtain the transaction data.

6. The method according to claim 1, wherein: The target data set obtained based on the transaction data and the N time series transaction features includes: Concatenating the transaction data and the N time series transaction features to obtain an intermediate data set; The target data set is obtained by adding a user type feature set to the intermediate data set, wherein the user type feature set includes N type features of the user who initiates the user to be identified.

7. The method according to claim 2, wherein: Before inputting the target data set into the risk identification model, the method further includes pre-training the risk identification model, specifically including: Extracting N time-series transaction features of historical transaction data using the hidden layer of the first neural network model, wherein the historical transaction data comes from at least one historical transaction; Obtaining a first training data set based on the historical transaction data and the N time-series transaction features; The model parameters of the M first sub-classification models are updated respectively based on the first training data set.

8. The method according to claim 7, wherein: Updating the model parameters of the M first sub-classification models based on the first training data set respectively includes: Based on the K-fold cross-validation method, dividing the first training data set into K training subsets, where K is an integer greater than or equal to 2; The M first sub-classification models are trained K times, wherein in each training, any one of the K training subsets is determined as test data, and the remaining K-1 training subsets are used as training data, and the training subsets used as the test data in any two trainings are different.

9. The method according to claim 8, wherein: The risk identification model further includes a second sub-classification model, and training the M first sub-classification models K times includes: In each training, obtaining the test results of each of the M first sub-classification models on the test data of the training, wherein the test results include the test risk identification results of each historical transaction in the test data; Wherein, the method further comprises: Based on the K test results obtained from the K trainings, a second training data set is obtained; The model parameters of the second sub-classification model are updated based on the second training data set.

10. The method according to claim 9, wherein: Updating the model parameters of the second sub-classification model based on the second training data set includes: Inputting the second training data set into the second sub-classification model to obtain a predicted transaction risk category for each historical transaction; Inputting the predicted transaction risk category and the transaction risk category label of each historical transaction into the objective function to obtain the objective function value; If the objective function value does not meet the training end condition, the model parameters of the second sub-classification model are updated based on the objective function.

11. The method according to claim 10, wherein: In addition to updating the model parameters of the second sub-classification model based on the objective function, the method further includes: updating the model parameters of the M first sub-classification models respectively based on the objective function; and / or Model parameters of the first neural network model are updated based on the objective function.

12. A transaction risk identification device, comprising: A data acquisition module, used to acquire transaction data of the user to be identified; A feature extraction module, used to extract N time series transaction features of the transaction data using the hidden layer of the first neural network model, where N is an integer greater than or equal to 1; A target data module, used to obtain a target data set based on the transaction data and the N time-series transaction features; The risk identification module is used to input the target data set into the risk identification model to obtain the transaction risk category of the user to be identified.

13. An electronic device, comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to execute the method according to any one of claims 1 to 11.

14. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 11.

15. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

Images