Method and device for preventing financial fraud

Abstract

The invention provides a method and device for preventing financial fraud, relates to the technical field of computers, and is applied to a payment scenario, and the method comprises the steps: extracting user behavior characteristics based on the daily behaviors of a user, and carrying out the vectorization of the user behavior characteristics, and obtaining the historical behavior data of the user; training an anomaly detection model according to the historical behavior data of the user to obtain a trained anomaly detection model; and monitoring user behaviors in real time, and detecting abnormal behaviors from the user behaviors in real time by using the trained anomaly detection model. According to the invention, the abnormal behavior is detected in real time from the user behavior through the abnormal detection model, and the financial fraud behavior in the payment scene can be identified.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a method and device for preventing financial fraud. Background Art

[0002] With the rapid development of the global market, the payment business has gradually become a high-frequency financial transaction scenario, but it has also provided a breeding ground for financial fraud; financial fraud in the payment scenario includes pretending to be a student or parent to make payments, illegal fund transfers, false payments, forged school admission notices, etc. Some fraud groups even commit fraud by forging school information. However, relevant technologies cannot identify these financial fraud behaviors in the payment scenario.

[0003] Currently, no effective technical solution has been proposed to address the problem that relevant technologies are unable to identify financial fraud in payment scenarios. Summary of the invention

[0004] The main purpose of the present invention is to provide a method and device for preventing financial fraud, so as to solve the problem in the related art that financial fraud behavior cannot be identified in the payment scenario.

[0005] In order to achieve the above-mentioned object, the first aspect of the present disclosure provides a method for preventing financial fraud, which is applied to a payment scenario, and the method comprises: Extracting user behavior features based on the user's daily behavior, vectorizing the user behavior features, and obtaining the user's historical behavior data, wherein the user behavior features include any one or more of the user's login frequency, IP address change, and payment device type; An anomaly detection model is trained according to the user's historical behavior data to obtain a trained anomaly detection model, wherein the anomaly detection model is an isolation forest algorithm or a density-based DBSCAN clustering algorithm; Monitor user behavior in real time and use the trained anomaly detection model to detect abnormal behavior from user behavior in real time.

[0006] Optionally, the user behavior features are vectorized, including: Determine the behavior feature vector B(u) of user u according to the following formula: , in, represents the first behavioral feature of user u, represents the i-th behavior feature of user u, represents the mth behavior feature of user u, and m represents the total number of user behavior features.

[0007] Optionally, the trained anomaly detection model is used to detect abnormal behaviors from user behaviors in real time, including: The data corresponding to the user behavior is used as user behavior data; Using the isolation forest algorithm, the user behavior data is divided into multiple subsets by randomly selecting features and a first threshold, and the splitting depth of the user behavior data in the isolation tree is determined; Determine the abnormality score of the user behavior data according to the split depth of the user behavior data in the isolation tree; The abnormal score S(x,n) of user behavior data is determined according to the following formula: , Where E(h(x)) is the average split depth of user behavior data x in the isolation tree, and c(n) is the adjustment factor of the data set size n; If the abnormality score of the user behavior data is greater than or equal to the first threshold, the user behavior data is marked as abnormal data, and the user behavior corresponding to the user behavior data is marked as abnormal behavior.

[0008] Optionally, the method further comprises: The payment links in the payment path are regarded as payment nodes. According to the sequence of payment links in the payment path, each payment path is represented as a directed path. ,in, Indicates the starting payment node, represents the i-th payment node, Indicates the end payment node, r is the total number of payment nodes, and payment nodes include user accounts, payment channels, and school accounts; Determine the path score based on the user's historical behavior data and the school's payment requirements; The path score is determined according to the following formula : , in, Represents adjacent payment nodes in the payment path and The higher the association weight, the more consistent it is with the historical payment pattern. Starting payment node Historical risk score; If the path score is less than or equal to the second threshold, the corresponding payment path is risky.

[0009] Optionally, the method further comprises: Each user is regarded as a user node. Based on the relationship between all users, an undirected weighted graph G=(V,E) is used to construct a user relationship network, where V represents the set of user nodes, E represents the set of edges between user nodes, and the weight of the edge represents the strength of the association between two users. Use the PageRank algorithm to determine the risk of the user corresponding to the user node and identify high-risk users; All users are classified into at least one user group through the K-Means clustering algorithm, and the user group to which the high-risk users belong is marked as a high-risk group, where the high-risk group includes potential payment and illegal fund transfer groups; The risk of the user corresponding to the user node is determined according to the following PageRank formula: in, For user nodes The PageRank value used to measure the user node The risk of, d is the damping factor, the value is 0.85, For user nodes Connected user nodes A collection of For user nodes The PageRank value, For user nodes The number of connected edges; If the PageRank value of the user node is greater than or equal to the third threshold, the user corresponding to the user node is identified as a high-risk user.

[0010] Optionally, the method further comprises: Generate zero-knowledge proofs using the zk-SNARKs protocol; When a user makes a payment, zero-knowledge proof is used to prove to a third party that there is no abnormality in the user's behavior, ensuring that the user's payment is compliant and that specific transaction data is not exposed.

[0011] Optionally, the method further comprises: Use a multi-task machine learning model to learn historical transactions from multiple dimensions, where the machine learning model is XGBoost or random forest, and the multiple dimensions include user account history, payment amount, and time interval; Use a multi-task machine learning model to predict multiple risk probabilities corresponding to multiple risk factors of the current transaction, where each task outputs a risk probability for each risk factor. The multiple risk factors include payment risk, illegal fund transfer risk, and abnormal list hit probability; Perform weighted summation of multiple risk probabilities to generate a comprehensive risk score for multiple risk factors; Determine whether to refuse to process the current transaction based on the comprehensive risk score; Determine the comprehensive risk score of user u's current transaction t according to the following formula: : in, and They represent the prediction functions for payment on behalf of others, illegal fund transfers, and abnormal list hits, respectively. and They represent the weight coefficients for payment on behalf of others, illegal fund transfer and abnormal list hits respectively; If the comprehensive risk score of the current transaction is greater than or equal to the fourth threshold, the current transaction is determined to be a high-risk transaction and is rejected.

[0012] Optionally, the method further comprises: Call the external anti-fraud database through the application program interface to query in real time whether the user is on the abnormal list of the external anti-fraud database. If the user is on the abnormal list, the transaction will be automatically rejected; The transaction is matched using the fraud patterns provided by an external anti-fraud database. If a match is successful, the transaction is identified as risky and rejected.

[0013] Optionally, the method further comprises: Call the payment channel selected for each payment through the application program interface, and dynamically check whether the payment channel complies with the current national or school regulations to ensure the security of the payment channel; When it is found that the payment channel does not comply with current national or school regulations, or when a payment is judged to be high-risk, the payment funds will be frozen.

[0014] A second aspect of the present disclosure provides a device for preventing financial fraud, which is applied to a payment scenario, and includes: An extraction unit, used to extract user behavior features based on the user's daily behavior, vectorize the user behavior features, and obtain the user's historical behavior data; A training unit, used for training an anomaly detection model according to the historical behavior data of the user to obtain a trained anomaly detection model; The detection unit is used to monitor user behavior in real time and detect abnormal behavior from user behavior in real time using the trained anomaly detection model.

[0015] A third aspect of the present disclosure provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute the method for preventing financial fraud provided by any one of the first aspects.

[0016] The fourth aspect of the present disclosure provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor executes the method for preventing financial fraud provided in any one of the first aspects.

[0017] The method for preventing financial fraud provided by the present invention is applied to payment scenarios. By using an anomaly detection model to detect abnormal behavior from user behavior in real time, financial fraud behavior in payment scenarios can be identified, solving the problem in related technologies that financial fraud behavior cannot be identified in payment scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the related technologies, the drawings required for use in the specific embodiments or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A flowchart of a method for preventing financial fraud provided by an embodiment of the present disclosure; Figure 2 A block diagram of a device for preventing financial fraud provided by an embodiment of the present disclosure; Figure 3 A block diagram of an electronic device provided for an embodiment of the present disclosure. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the scheme of the present disclosure, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without creative work should fall within the scope of protection of the present disclosure.

[0021] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so as to describe the embodiments of the present disclosure described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0022] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0023] With the rapid development of the global market, the payment business has gradually become a high-frequency financial transaction scenario, but it has also provided a breeding ground for financial fraud; financial fraud in the payment scenario includes pretending to be a student or parent to make payments, illegal fund transfers, false payments, forged school admission notices, etc. Some fraud groups even commit fraud by forging school information. However, relevant technologies cannot identify these financial fraud behaviors in the payment scenario.

[0024] In order to solve the above problems, the present disclosure provides a method for preventing financial fraud, which is applied to payment scenarios, such as Figure 1 As shown, the method includes the following steps S11 to S13: Step S11: extracting user behavior features based on the user's daily behavior, vectorizing the user behavior features, and obtaining the user's historical behavior data, wherein the user behavior features include any one or more of the user's login frequency, IP address change, and payment device type; extracting user behavior features based on the user's daily behavior or daily operating habits, the user behavior features can be extracted by recording information such as the user's login frequency and the number of IP address changes, and a user behavior profile can also be established; In an optional implementation of the present disclosure, vectorizing the user behavior features in step S11 includes: Determine the behavior feature vector B(u) of user u according to the following formula: in, represents the first behavioral feature of user u, represents the i-th behavior feature of user u, represents the mth behavior feature of user u, and m represents the total number of user behavior features.

[0025] Step S12: training an anomaly detection model according to the user's historical behavior data to obtain a trained anomaly detection model, wherein the anomaly detection model is an isolation forest algorithm or a density-based DBSCAN clustering algorithm; Step S13: Monitor user behavior in real time, and use the trained anomaly detection model to detect abnormal behavior from user behavior in real time. For example, when the type of user payment device suddenly changes or the IP address changes frequently, it will be marked as abnormal behavior or suspicious behavior. The present disclosure can comprehensively monitor the user's payment behavior and transaction behavior in real time, identify potential financial fraud in user behavior, and ensure the safety of funds through models or algorithms such as anomaly detection models.

[0026] The method for preventing financial fraud provided by the embodiment of the present disclosure is applied to payment scenarios. By using an anomaly detection model to detect abnormal behavior from user behavior in real time, financial fraud behavior in payment scenarios can be identified, solving the problem in related technologies that financial fraud behavior cannot be identified in payment scenarios.

[0027] In an optional implementation of the present disclosure, the step S13 of using the trained anomaly detection model to detect abnormal behavior from user behavior in real time includes: The data corresponding to the user behavior is used as user behavior data; user behavior data may include the frequency of user login devices, payment device type, IP address change records, etc.; Using the isolation forest algorithm, the user behavior data is divided into multiple subsets by randomly selecting features and a first threshold, and the split depth of the user behavior data in the isolation tree is determined; when using the isolation forest algorithm, the user behavior data can be processed as sample data, and the split depth of a certain sample data in the isolation tree is observed. The shallower the split depth, the easier it is for the sample data to be isolated, which means that the sample data is abnormal data; Determine the abnormality score of the user behavior data according to the split depth of the user behavior data in the isolation tree; The abnormal score S(x,n) of user behavior data is determined according to the following formula: Where E(h(x)) is the average split depth of user behavior data x in the isolation tree, and c(n) is the adjustment factor of the data set size n; If the abnormality score of the user behavior data is greater than or equal to the first threshold, the user behavior data is marked as abnormal data, and the user behavior corresponding to the user behavior data is marked as abnormal behavior. When the abnormality score of the user behavior data is greater than or equal to the first threshold, it is marked as abnormal data.

[0028] The embodiments of the present disclosure can identify abnormal data in user behavior data, detect abnormal behavior in user actions, and determine whether the current operation is abnormal by extracting user historical behavior characteristics; by combining the isolation forest algorithm and user behavior characteristics, dynamic anomaly detection of each user operation is achieved. Compared with setting static rules in related technologies, the present disclosure can adaptively discover potential financial fraud behaviors.

[0029] In an optional implementation manner of the present disclosure, after step S13, the method further includes: The payment links in the payment path are regarded as payment nodes. According to the sequence of payment links in the payment path, each payment path is represented as a directed path. ,in, Indicates the starting payment node, represents the i-th payment node, represents the end payment node, r is the total number of payment nodes, payment nodes include user accounts, payment channels and school accounts; among them, user accounts can be used as the starting payment node; Determine the path score based on the user's historical behavior data and the school's payment requirements; verify each payment path based on historical payment data, historical transaction data, and the school's payment requirements. For example, it can verify whether the payment channel for a specific country or school complies with regulations, whether there are abnormal fluctuations in the amount, etc., and verify whether this payment path complies with normal transaction habits through historical data; for example, if the payment path is not selected according to the usual process, it does not comply with normal transaction habits, resulting in a low path score, which is automatically marked as high risk and triggers manual review; The path score is determined according to the following formula : in, Represents adjacent payment nodes in the payment path and The higher the association weight, the more consistent it is with the historical payment pattern. Starting payment node The historical risk score of the user account; If the path score is less than or equal to the second threshold, the corresponding payment path is at risk. When the path score is less than or equal to the second threshold, the corresponding payment path is at risk.

[0030] By comparing the payment path with the historical behavior data, the embodiment of the present disclosure can evaluate whether the currently selected payment path has risks. If the score is low (for example, the payment channel is not selected according to the usual process), it is automatically marked as high risk and triggers manual review; by comparing the payment path with the historical behavior data, the path rationality is checked for each payment path. Compared with the static channel rule check in the related art, the present disclosure can dynamically identify potential abnormal payment paths, thereby effectively preventing complex fraudulent behaviors.

[0031] In an optional implementation manner of the present disclosure, after step S13, the method further includes: Each user is regarded as a user node. Based on the relationships among all users, an undirected weighted graph G=(V,E) is used to construct a user relationship network, where V represents the set of user nodes, E represents the set of edges between user nodes, and the weight of an edge represents the strength of association between two users. The relationship between all users can be a shared payer, a shared payment account, or shared device information. When two users share a payer, the weight of the edge is larger, indicating that the strength of association between the two users is stronger. Based on the relationships among all users, a user relationship network graph is constructed. The PageRank algorithm is used to determine the risk of the user corresponding to the user node and identify high-risk users; high-risk users can be identified through the PageRank algorithm; All users are classified into at least one user group through the K-Means clustering algorithm, and the user group to which high-risk users belong is marked as a high-risk group, where the high-risk group includes potential payment on behalf of others and illegal fund transfer groups; combining the PageRank algorithm and the K-Means clustering algorithm, high-risk users and user groups closely related to them can be marked as high-risk groups, and potential payment on behalf of others and illegal fund transfer groups can be detected; The risk of the user corresponding to the user node is determined according to the following PageRank formula: in, For user nodes The PageRank value used to measure the user node The risk of, d is the damping factor, the value is 0.85, For user nodes Connected user nodes A collection of For user nodes The PageRank value, For user nodes The number of connected edges, i.e. user nodes The out-degree of If the PageRank value of the user node is greater than or equal to the third threshold, the user corresponding to the user node is identified as a high-risk user.

[0032] The disclosed embodiment constructs a user relationship network map and uses the PageRank algorithm to evaluate the importance of user nodes. If a user node is closely associated with multiple high-risk user nodes, it is marked as a potential member of the payment agent or illegal fund transfer group. The disclosed embodiment applies the PageRank algorithm and the K-Means clustering algorithm to the payment agent and illegal fund transfer group detection. By analyzing the complex association relationships between users, it can effectively identify hidden high-risk groups and detect potential payment agent and illegal fund transfer groups.

[0033] In an optional implementation manner of the present disclosure, after step S13, the method further includes: Use the zk-SNARKs protocol to generate zero-knowledge proofs; in the payment scenario, in order to ensure the legality and compliance of the payment without exposing the specific transaction details, the zero-knowledge proof (ZKP) technology is introduced; When a user makes a payment, a zero-knowledge proof is used to prove to a third party that the user's behavior is normal, ensuring that the user's payment is compliant and that specific transaction data is not exposed. When a user makes a payment, ZKP can be used to prove to a third party (such as a bank or school) that the user has completed the compliance operation without revealing specific transaction data.

[0034] The disclosed embodiment uses the zk-SNARKs (zero-knowledge succinct non-interactive argument of knowledge) protocol to generate zero-knowledge proofs, which can be quickly verified without the need for interaction; the specific algorithm is as follows: Suppose a proposition C(x,w)=1, where x is a public input (such as a school account) and w is private information (such as a payment amount); the zk-SNARKs protocol generates a proof π, so that the verifier can verify C(x,w)=1 without knowing the specific private information w.

[0035] The disclosed embodiment generates zero-knowledge proof through the zk-SNARKs protocol, which can ensure that the payment is legal and compliant without exposing the specific transaction data details; in payment scenarios with high compliance requirements, zero-knowledge proof technology is used to generate a payment completion certificate, and the certificate is submitted to a third-party organization to ensure compliance; by using zero-knowledge proof technology, payment compliance verification is achieved while ensuring privacy and security, which can meet the cross-border compliance requirements in payment business.

[0036] In an optional implementation manner of the present disclosure, after step S13, the method further includes: Use a multi-task machine learning model to learn historical transactions from multiple dimensions, where the machine learning model is XGBoost or random forest, and the multiple dimensions include user account history, payment amount, and time interval; Use a multi-task machine learning model to predict multiple risk probabilities corresponding to multiple risk factors of the current transaction, where each task outputs a risk probability for each risk factor. The multiple risk factors include payment risk, illegal fund transfer risk, and abnormal list hit probability; Perform weighted summation of multiple risk probabilities to generate a comprehensive risk score for multiple risk factors; learn historical transaction patterns through a multi-task machine learning model to predict the comprehensive risk score of the current transaction; Determine whether to refuse to process the current transaction based on the comprehensive risk score; Determine the comprehensive risk score of user u's current transaction t according to the following formula: : in, and They represent the prediction functions for payment on behalf of others, illegal fund transfers, and abnormal list hits, respectively. and They represent the weight coefficients for payment on behalf of others, illegal fund transfer and abnormal list hits respectively; If the comprehensive risk score of the current transaction is greater than or equal to the fourth threshold, the current transaction is determined to be a high-risk transaction and the current transaction is rejected. After the current transaction is rejected, the current transaction can be manually reviewed again.

[0037] The disclosed embodiment calculates the comprehensive risk score of the current transaction through a machine learning model. If the comprehensive risk score exceeds the preset fourth threshold, it is marked as a high-risk transaction and the funds are automatically frozen. Through the multi-task machine learning model, it is possible to simultaneously predict the risk probabilities of multiple risk factors and generate a comprehensive score through weighted summation, thereby greatly improving the accuracy of risk control.

[0038] In an optional implementation manner of the present disclosure, after step S13, the method further includes: Call the external anti-fraud database through the application program interface to query in real time whether the user is on the abnormal list of the external anti-fraud database. If the user hits the abnormal list, the transaction will be automatically rejected. It can be integrated with the external anti-fraud database in real time to query whether the user is on the abnormal list through the application program interface (API); Utilize the fraud patterns provided by the external anti-fraud database to match transactions. If the match is successful, the transaction is identified as risky and rejected. Internal risk control data can be updated based on the latest fraud patterns provided by the external anti-fraud database and applied to real-time transactions; for example, by matching common fraud behavior patterns (such as multiple cross-border payments in a short period of time), potential risks can be identified in advance and actions can be taken.

[0039] In an optional implementation manner of the present disclosure, after step S13, the method further includes: Call the payment channel selected for each payment through the application program interface, and dynamically check whether the payment channel complies with the current national or school regulations to ensure the security of the payment channel; dynamically verify whether the channel selected for each payment complies with the current national or school regulations, and check whether there are risks in the payment channel through API calls. If a payment channel has a large number of abnormal transactions recently, the payment channel will be disabled; When it is found that the payment channel does not comply with the current national or school regulations, or when it is determined that a payment has a high risk, the payment funds will be frozen. When a payment or a transaction has a high risk, the transaction funds can be automatically frozen, and after freezing the transaction funds or payment funds, the operator can be notified to conduct a manual review. After the manual review is completed, the funds will be unfrozen or returned according to the review results.

[0040] The method for preventing financial fraud provided by the present invention covers a set of intelligent, multi-dimensional and innovative solutions for preventing financial fraud. By combining technologies such as behavioral analysis, path verification, user relationship network graph and zero-knowledge proof, it effectively prevents financial fraud in payment scenarios.

[0041] From the above description, it can be seen that the present disclosure achieves the following technical effects: The method for preventing financial fraud provided by the present disclosure is based on multi-dimensional analysis, machine learning, graph computing and blockchain technology, combined with historical data, behavior patterns and user relationship network graphs, and can dynamically identify potential financial fraud risks; Design a variety of prevention and control mechanisms for different types of fraud, and provide innovative solutions by introducing machine learning and graph computing algorithms; This disclosure effectively prevents financial fraud in payment scenarios by combining technologies such as behavioral analysis, path verification, graph computing and zero-knowledge proof.

[0042] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0043] The present disclosure also provides a device for preventing financial fraud for implementing the above method embodiment, which is applied to payment scenarios, such as Figure 2 As shown, the device 20 for preventing financial fraud includes: An extraction unit 21 is used to extract user behavior features based on the user's daily behavior, vectorize the user behavior features, and obtain the user's historical behavior data; A training unit 22, used to train an anomaly detection model according to the user's historical behavior data to obtain a trained anomaly detection model; The detection unit 23 is used to monitor user behavior in real time and detect abnormal behavior from user behavior in real time using the trained abnormality detection model.

[0044] The specific manner in which each unit in the above device embodiment performs operations has been described in detail in the embodiment of the method, and will not be elaborated on here.

[0045] The present disclosure also provides an electronic device, such as Figure 3 As shown, the electronic device includes one or more processors 31 and a memory 32. Figure 3 A processor 31 is taken as an example.

[0046] The controller may further include: an input device 33 and an output device 34 .

[0047] The processor 31, the memory 32, the input device 33 and the output device 34 may be connected via a bus or other means. Figure 3 The example of connecting through bus is taken in the following.

[0048] The processor 31 may be a central processing unit (CPU), or other general-purpose processors, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips. The general-purpose processor may be a microprocessor or any conventional processor.

[0049] The memory 32 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the control method in the embodiment of the present disclosure. The processor 31 executes various functional applications and data processing of the server by running the non-transitory software programs, instructions and modules stored in the memory 32, that is, the method for preventing financial fraud in the above method embodiment is implemented.

[0050] The memory 32 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of a processing device operated by the server, etc. In addition, the memory 32 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 32 may optionally include a memory remotely arranged relative to the processor 31, and these remote memories may be connected to a network connection device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0051] The input device 33 can receive input digital or character information, and generate key signal input related to user settings and function control of the processing device of the server. The output device 34 can include display devices such as a display screen.

[0052] One or more modules are stored in the memory 32, and when executed by one or more processors 31, the execution is as follows: Figure 1 The method shown.

[0053] Those skilled in the art can understand that the implementation of all or part of the processes in the above method embodiments can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes in the above method embodiments. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (FM), a hard disk (HDD), or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above types of memory.

[0054] Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for preventing financial fraud, characterized in that: Applied to the payment scenario, the method includes: Extracting user behavior features based on the user's daily behavior, vectorizing the user behavior features, and obtaining the user's historical behavior data, wherein the user behavior features include any one or more of the user's login frequency, IP address change, and payment device type; Training an anomaly detection model according to the user's historical behavior data to obtain a trained anomaly detection model, wherein the anomaly detection model is an isolation forest algorithm or a density-based DBSCAN clustering algorithm; Monitor user behaviors in real time, and use the trained anomaly detection model to detect abnormal behaviors from the user behaviors in real time.

2. The method according to claim 1, characterized in that The vectorizing the user behavior features includes: Determine the behavior feature vector B(u) of user u according to the following formula: in, represents the first behavioral feature of user u, represents the i-th behavior feature of user u, represents the mth behavior feature of user u, and m represents the total number of user behavior features.

3. The method according to claim 1, characterized in that The method of detecting abnormal behavior from the user behavior in real time using the trained abnormality detection model includes: The data corresponding to the user behavior is used as user behavior data; Using the isolation forest algorithm, the user behavior data is divided into a plurality of subsets by randomly selecting features and a first threshold, and a split depth of the user behavior data in the isolation tree is determined; Determine the abnormality score of the user behavior data according to the split depth of the user behavior data in the isolation tree; The abnormal score S(x,n) of user behavior data is determined according to the following formula: Where E(h(x)) is the average split depth of user behavior data x in the isolation tree, and c(n) is the adjustment factor of the data set size n; If the abnormality score of the user behavior data is greater than or equal to the first threshold, the user behavior data is marked as abnormal data, and the user behavior corresponding to the user behavior data is marked as abnormal behavior.

4. The method according to claim 1, characterized in that The method further comprises: The payment links in the payment path are regarded as payment nodes. According to the sequence of payment links in the payment path, each payment path is represented as a directed path. ,in, Indicates the starting payment node, represents the i-th payment node, Indicates the end payment node, r is the total number of payment nodes, and payment nodes include user accounts, payment channels, and school accounts; Determine the path score based on the user's historical behavior data and the school's payment requirements; The path score is determined according to the following formula : in, Represents adjacent payment nodes in the payment path and The higher the association weight, the more consistent it is with the historical payment pattern. Starting payment node Historical risk score; If the path score is less than or equal to the second threshold, the corresponding payment path is risky.

5. The method according to claim 1, characterized in that The method further comprises: Each user is regarded as a user node. Based on the relationship between all users, an undirected weighted graph G=(V,E) is used to construct a user relationship network, where V represents the set of user nodes, E represents the set of edges between user nodes, and the weight of the edge represents the strength of the association between two users. Use the PageRank algorithm to determine the risk of the user corresponding to the user node and identify high-risk users; Classify all users into at least one user group by using K-Means clustering algorithm, and mark the user group to which the high-risk user belongs as a high-risk group, wherein the high-risk group includes a potential payment agent and illegal fund transfer group; The risk of the user corresponding to the user node is determined according to the following PageRank formula: in, For user nodes The PageRank value used to measure the user node The risk of, d is the damping factor, the value is 0.85, For user nodes Connected user nodes A collection of For user nodes The PageRank value, For user nodes The number of connected edges; If the PageRank value of the user node is greater than or equal to the third threshold, the user corresponding to the user node is identified as a high-risk user.

6. The method according to claim 1, characterized in that The method further comprises: Generate zero-knowledge proofs using the zk-SNARKs protocol; When a user makes a payment, the zero-knowledge proof is used to prove to a third party that there is no abnormality in the user's behavior, thereby ensuring that the user's payment is compliant and that specific transaction data is not exposed.

7. The method according to claim 1, characterized in that The method further comprises: Using a multi-task machine learning model to learn historical transactions from multiple dimensions, where the machine learning model is XGBoost or random forest, and the multiple dimensions include user account history, payment amount, and time interval; The multi-task machine learning model is used to predict multiple risk probabilities corresponding to multiple risk factors of the current transaction, wherein each task outputs a risk probability corresponding to each risk factor, and the multiple risk factors include payment risk, illegal fund transfer risk, and abnormal list hit probability; Performing a weighted summation on the multiple risk probabilities to generate a comprehensive risk score for the multiple risk factors; Determine whether to refuse to process the current transaction based on the comprehensive risk score; Determine the comprehensive risk score of user u's current transaction t according to the following formula: : in, and They represent the prediction functions for payment on behalf of others, illegal fund transfers, and abnormal list hits, respectively. and They represent the weight coefficients for payment on behalf of others, illegal fund transfer and abnormal list hits respectively; If the comprehensive risk score of the current transaction is greater than or equal to the fourth threshold, the current transaction is determined to be a high-risk transaction and is rejected.

8. The method according to claim 1, characterized in that The method further comprises: Calling an external anti-fraud database through an application program interface to query in real time whether the user is on the abnormal list of the external anti-fraud database. If the user is on the abnormal list, the transaction is automatically rejected; The fraud pattern provided by the external anti-fraud database is used to match the transaction. If the match is successful, the transaction is identified as risky and rejected.

9. The method according to claim 1, characterized in that: The method further comprises: Call the payment channel selected for each payment through the application program interface, and dynamically check whether the payment channel complies with the current national or school regulations to ensure the security of the payment channel; When it is found that the payment channel does not comply with current national or school regulations, or when a payment is judged to be high-risk, the payment funds will be frozen.

10. A device for preventing financial fraud, characterized in that: Applied to the payment scenario, the device includes: An extraction unit, used to extract user behavior features based on the user's daily behavior, vectorize the user behavior features, and obtain the user's historical behavior data; A training unit, used for training an anomaly detection model according to the historical behavior data of the user to obtain a trained anomaly detection model; The detection unit is used to monitor user behavior in real time and detect abnormal behavior from the user behavior in real time using the trained abnormality detection model.

Images