Security transaction abnormal behavior detection system based on machine learning

Abstract

The invention specifically relates to a security transaction abnormal behavior detection system based on machine learning, a time window setting module comprises a plurality of time windows, and a user abnormity module is used for receiving and weighting window comprehensive abnormal values and amount influence evaluation values of security users in the time windows. And the judgment module is used for receiving a security transaction comprehensive anomaly value corresponding to the specific security and comparing the security transaction comprehensive anomaly value with a corresponding preset transaction anomaly threshold value. According to the method, multi-dimensional analysis is carried out on transaction behaviors and security market changes, various factors are comprehensively considered in the aspects of transaction times, transaction intervals, transaction amounts, security prices and transaction volumes, transaction abnormal behaviors can be more comprehensively and accurately recognized, corresponding execution signaling is generated according to different situations of user abnormal values and window abnormal total values, and the security market changes can be more accurately recognized. Therefore, abnormal behaviors of different degrees can be processed correspondingly.

Description

Technical Field

[0001] The present invention relates to the technical field of securities trading detection, and in particular to a securities trading abnormal behavior detection system based on machine learning. Background Art

[0002] With the rapid development of the securities market, the amount of transaction data has increased dramatically, and trading behaviors have become increasingly complex. Traditional methods for detecting abnormal securities trading behaviors are difficult to adapt to the complex and changing market environment and diverse trading behaviors. At the same time, existing methods are insufficient in terms of accuracy, timeliness, and comprehensiveness of detection, and are unable to effectively identify potential abnormal trading behaviors. Fixed-rule monitoring lacks flexibility and adaptability, and it is difficult to accurately identify abnormal trading behaviors that are disguised or hidden through complex means.

[0003] Traditional detection methods can also lead to misjudgments and omissions, misjudging normal transactions as abnormal behavior, or failing to detect real abnormal transactions in a timely manner. The lag of manual review and fixed rule monitoring means that regulators often detect abnormal behavior a long time after it occurs, missing the best time to intervene, causing the impact of abnormal behavior to further expand.

[0004] Therefore, a more intelligent and efficient securities trading abnormal behavior detection system is needed to solve the above-mentioned problems. Summary of the invention

[0005] The purpose of the present invention is to propose a securities trading abnormal behavior detection system based on machine learning in order to solve the above-mentioned problems.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions: The securities trading abnormal behavior detection system based on machine learning includes: The time window setting module includes several time windows, and each time window covers a different duration; the transaction analysis module is used to analyze the trading behavior of securities users and the changes of specific securities in the market, and output the trading analysis results of users and the change results of securities; among which, the trading analysis results include the window comprehensive abnormal value and the amount impact assessment value, the change results include the securities transaction comprehensive abnormal value, and the trading behavior includes the number and interval of transactions, and the transaction amount; The user anomaly module is used to receive the window comprehensive anomaly value and amount impact assessment value of the securities user in the time window and perform weighted processing to obtain the user anomaly value corresponding to the time window; The securities anomaly judgment module is used to receive the securities transaction comprehensive abnormality value corresponding to a specific security and compare it with its corresponding preset transaction abnormality threshold. If the securities transaction comprehensive abnormality value is greater than its transaction abnormality threshold, a securities abnormality signal is generated; the securities abnormality signal is used to trigger the analysis of the user abnormality value of the securities user of the characteristic securities to obtain the total window abnormality value; The processing module is used to receive the output results of the securities abnormality judgment module and the user abnormality judgment module, and generate a corresponding execution strategy based on the output results and the corresponding threshold judgment and execute it.

[0007] Preferably, the system also includes a data collection module, which is used to establish a connection with the trading database of the stock exchange to obtain the user's basic account information, trading operation information, and market securities information in real time; wherein the basic account information includes the securities user's account opening time, the trading operation information includes the securities user's trading time, trading amount, and number of transactions; the securities information includes the price and trading volume of specific securities.

[0008] Preferably, the transaction times and intervals in the securities user's transaction behavior are analyzed, and the specific process is as follows: Mark the time period between the securities user's account opening time and the time period before the current time as the account duration time zone; Obtain the number of transactions of the user in any time window of any time window group for a specific security in the time zone of the account existence, calculate the average number of transactions of all time windows in the time window group as the average number of window transactions; perform difference calculation on the number of transactions in the time window and the average number of transactions of the window corresponding to its time window group to obtain the average difference of the number of transactions in the time window; obtain the time interval between the transaction times corresponding to any two adjacent transaction times in the time window as the transaction interval; calculate the standard deviation of the transaction interval in the time window to obtain the cross-interval fluctuation value; divide the duration of the time window by the corresponding number of transactions to obtain the average transaction interval; The average difference of the number of transactions corresponding to the time window, the cross-interval fluctuation value, and the average transaction interval are weighted to obtain the window abnormality assessment value; the abnormal transaction fluctuation allowable range is set, and if the window abnormality assessment value is not within the abnormal transaction fluctuation allowable range, the time window is marked as an abnormal transaction time window; the securities monitoring time zone is set, and the number of abnormal transaction time windows in the time window group within the securities monitoring time zone is obtained and marked as the abnormal transaction value; The window anomaly assessment values ​​of all abnormal trading time windows in the securities monitoring time zone are weighted to obtain the window comprehensive anomaly value.

[0009] Preferably, the transaction amount in the transaction behavior of the securities user is analyzed, and the specific process is as follows: Based on the user's account type, a transaction limit threshold is set. If the transaction amount is greater than the transaction limit threshold, the transaction is marked as a large transaction. Conversely, if the transaction amount is less than or equal to the transaction limit threshold, the transaction is marked as a small transaction. Analyze the large transactions within the time window, obtain the transaction amounts of all large transactions within the time window, sum them up to get the total large transaction amount in the window, divide the transaction amount of large transactions within the time window by the total large transaction amount in the window to get the large transaction ratio; calculate the difference between the maximum and minimum large transaction ratios within the time window to get the large transaction extreme difference; Obtain the generation time of all large transactions within the time window, calculate the time difference between the generation times of adjacent large transactions to obtain the large adjacent time difference; when the number of large transactions within the time window is greater than two, calculate the standard deviation of the large adjacent time difference within the time window to obtain the large adjacent difference fluctuation value; obtain the number of large transactions within the time window, recorded as the number of large transactions; divide the number of large transactions by the total number of transactions in the time window to obtain the ratio of the number of large transactions; perform weighted calculation on the large transaction extreme difference value, the large adjacent difference fluctuation value, and the ratio of the number of large transactions to obtain the large transaction evaluation value corresponding to the time window; Mark the large transaction extreme difference value, large adjacent difference fluctuation value, large transaction frequency ratio, and large transaction evaluation value as large transaction evaluation information; Similarly, based on the analysis process of large transactions within the time window, small transactions within the time window are analyzed to obtain small transaction evaluation information and small transaction evaluation values; The ratio of the large-amount transaction evaluation value to the small-amount transaction evaluation value in the time window is marked as an outlier in the ratio of large to small amounts; The outliers of the large and small amount ratios, large transaction assessment values, and small transaction assessment values ​​corresponding to the time window are fused to obtain the amount impact assessment value.

[0010] Preferably, the specific process of analyzing the changes of specific securities in the market is as follows: Obtaining securities prices at adjacent moments within any time window of the user account, and sorting the obtained securities prices according to the order of the acquisition moments; bringing the securities prices and the acquisition moments into the first line graph, marking the points of the securities prices in the line graph as price points, connecting two adjacent price points to obtain a price line, and calculating the slope of the price line; establishing an allowable range of the slope of the price line, and marking a price line that is not within the allowable range of the slope of the price line as an abnormal price line; Identify the time mark of the center position of the two price points corresponding to the abnormal price line as the abnormal moment; calculate the time interval between two adjacent abnormal moments and mark it as the abnormal adjacent time length, number the abnormal price lines in the order of acquisition time, and bring the acquisition time number of the abnormal price line and the abnormal adjacent time length into the second line graph; mark the point of the abnormal adjacent time length in the second line graph as an abnormal wave point, connect two adjacent abnormal wave points to obtain an abnormal wave line, and calculate the slope of the abnormal wave line; establish an abnormal wave line slope allowable range, and record the abnormal wave line whose slope is not within the abnormal wave line slope allowable range as the abnormal wave line rate; The abnormal wave line rate with a positive slope among the abnormal wave line rates is recorded as slope one, and the abnormal wave line rate with a negative slope among the abnormal wave line rates is recorded as slope two after taking the absolute value; Slope 1 and slope 2 in the time window are summed up to obtain the total value of slope 1 and the total value of slope 2, and the total value of slope 1 and the total value of slope 2 are weighted to obtain the abnormal slope fluctuation value; Analyze the differences before and after the securities transactions in the time window to obtain the total abnormal value of the window transactions and the transaction extreme value; The abnormal slope fluctuation value, the total abnormal transaction value, and the transaction range value are weighted to obtain the comprehensive abnormal value of securities transactions.

[0011] Preferably, the differences before and after the securities transactions in the time window are analyzed to obtain the total abnormal transaction value and the transaction extreme difference value of the window. The specific analysis is as follows: Obtain the securities trading volume at any time in the time window, select any time in the time window as the first time, calculate the difference between the securities trading volume at the next time and the securities trading volume at the first time, and then calculate the ratio with the securities trading volume at the first time to obtain the ratio before and after the transaction; set the allowable range of the ratio before and after the transaction, obtain all the ratios before and after the transaction in the time window, and record the ratio before and after the transaction that is not within the allowable range as an abnormal transaction ratio; sum up all the abnormal transaction ratios in the time window to obtain the total abnormal value of the window transaction; Calculate the difference between the maximum and minimum securities trading volumes within the time window to obtain the transaction range value.

[0012] Preferably, the analysis of user abnormal values ​​of securities users of characteristic securities comprises the following specific steps: Obtain the user outlier values ​​of all users corresponding to a specific security within a time window, set a user outlier value threshold, and calculate the difference between the user outlier value and the user outlier threshold to obtain an outlier difference; An abnormal deviation range group is established, including several abnormal deviation ranges, the abnormal difference of the user is matched with the abnormal deviation range group, and the users whose abnormal difference is within the same abnormal deviation range are marked as users in the same group; The abnormal difference values ​​of users in the same group are summed up to get the total abnormal difference value of the window ; Calculate the mean of the abnormal differences of users in the same group to get the mean of the abnormal differences in the window ; Obtain the user abnormal value of any user in the same group of users within the time window, and calculate the standard deviation of the user abnormal value within the time window to obtain the abnormal fluctuation value of the window user ; The total value of window abnormal difference, the mean value of window abnormal difference and the window abnormal fluctuation value of all users in the same group of users are weighted and calculated using the formula: ; Get the total value of window anomalies ;in , Respectively represent the number and quantity of securities users in the same group of users, , are the weights corresponding to the total value of window abnormal difference and the mean value of window abnormal difference, respectively. , Represents securities users in the same group The abnormal fluctuation value of the window and its corresponding weight.

[0013] Preferably, the output results of the receiving securities abnormality judgment module and the user abnormality judgment module are judged by comparing the output results with the corresponding threshold values ​​to generate corresponding execution signaling and execute the signaling. The specific process is as follows: Match the user's abnormal value with the user transaction status strategy group to generate the corresponding user transaction status signaling; the user transaction status signaling group includes user transaction normal status signaling, personal monitoring signaling, risk warning signaling, transaction restriction signaling, and account blocking signaling; Match the total window abnormality value with the value range of the abnormal strategy group of the same group of users to generate corresponding signaling; wherein the abnormal strategy group of the same group of users includes group monitoring signaling, risk warning signaling, and transaction restriction signaling; When generating the normal status signaling of user transactions, the user's transaction records are sorted and archived according to the preset time period and marked as transaction operation information in accordance with the normal business process; When generating a personal monitoring signaling, switching the data collection frequency time zone; wherein the data collection frequency time zone includes a first collection frequency time zone and a second collection frequency time zone; switching the data collection frequency originally in the first collection frequency time zone to the second collection frequency time zone, wherein the data collection frequency in the second collection frequency time zone is higher than the first collection frequency time zone; When generating risk warning signaling, the user abnormal value of the user is matched with the risk warning level group to generate a corresponding risk warning signal; the risk warning level group includes mild risk warning, moderate risk warning and severe risk warning levels; When generating a transaction restriction signaling, the securities user's securities trading account permissions are restricted so that the user cannot perform trading operations within the set short-term ban period; When an account blocking signal is generated, the user's securities trading account is blocked for a long period of time, making it impossible for the user to conduct trading operations within the set blocking period, and prohibiting the user from accessing his trading account in any way; When group monitoring signaling, the data collection frequency of any user in the same group of users corresponding to the signaling is adjusted, and the data collection frequency originally in the first collection frequency time zone is switched to the second collection frequency time zone.

[0014] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are: 1. The present invention can more comprehensively and accurately identify abnormal transaction behaviors through multi-dimensional analysis of transaction behaviors and securities market changes, including transaction times and intervals, transaction amounts, securities prices and trading volumes, and comprehensive consideration of various factors. According to different situations of user abnormal values ​​and window abnormal total values, corresponding execution signals are generated, thereby correspondingly handling abnormal behaviors of different degrees.

[0015] 2. The present invention conducts in-depth analysis on the changes of specific securities in the market, such as calculating the slope of the price line, abnormal slope fluctuation value, abnormal total value of window transactions, transaction range value, etc. These indicators can reflect the fluctuation of securities prices and abnormal changes in transaction volume, and help identify trading behaviors that are inconsistent with normal market trends. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Further details, features and advantages of the present application are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which: Figure 1 It is the system principle diagram of the present invention; DETAILED DESCRIPTION

[0017] Several embodiments of the present application will be described in more detail below with reference to the accompanying drawings so that those skilled in the art can implement the present application. The present application can be embodied in many different forms and purposes and should not be limited to the embodiments described herein. These embodiments are provided to make the present application comprehensive and complete, and to fully convey the scope of the present application to those skilled in the art. The embodiments do not limit the present application.

[0018] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art to which this application belongs. It will be further understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the relevant art and / or the context of this specification, and will not be interpreted in an idealized or overly formal sense unless explicitly defined as such herein.

[0019] See also Figure 1 As shown, the present invention provides a technical solution: The securities trading abnormal behavior detection system based on machine learning includes: Data collection module, which is used to establish a connection with the trading database of the stock exchange to obtain the user's basic account information, trading operation information, and market securities information in real time; the basic account information includes the securities user's account opening time, the trading operation information includes the securities user's trading time, trading amount, and number of transactions; the securities information includes the price and trading volume of specific securities; The time window setting module includes several time windows, and each time window covers a different duration; the transaction analysis module is used to analyze the trading behavior of securities users and the changes of specific securities in the market, and output the trading analysis results of users and the change results of securities; among which, the trading analysis results include the window comprehensive abnormal value and the amount impact assessment value, the change results include the securities transaction comprehensive abnormal value, and the trading behavior includes the number and interval of transactions, and the transaction amount; The transaction times and intervals in the securities users' trading behaviors are analyzed. The specific process is as follows: Mark the time period between the securities user's account opening time and the time period before the current time as the account duration time zone; Get the number of transactions of a user in any time window of a specific security in any time window group in the account existence time zone, average the number of transactions of all time windows in the time window group to calculate the average number of window transactions; calculate the difference between the number of transactions in the time window and the window transaction average corresponding to its time window group to obtain the average difference of the number of transactions in the time window ; Obtain the time interval between any two adjacent transaction times in the time window and mark it as the transaction interval; Calculate the standard deviation of the transaction interval in the time window to obtain the cross-interval fluctuation value ; Divide the duration of the time window by the corresponding number of transactions to get the average transaction interval ; The average difference of the number of transactions corresponding to the time window, the cross-interval fluctuation value, and the average transaction interval are weighted and calculated using the formula: ; Get the window anomaly evaluation value , among which , , They are the weight factors corresponding to the average difference of transaction times, the cross-interval fluctuation value, and the average transaction interval; Set the allowable range of abnormal trading fluctuations. If the window abnormal evaluation value is not within the allowable range of abnormal trading fluctuations, mark the time window as an abnormal trading time window; set the securities monitoring time zone, obtain the number of abnormal trading time windows in the time window group within the securities monitoring time zone and mark it as the abnormal trading times value; The window anomaly evaluation values ​​of all abnormal trading time windows in the securities monitoring time zone are weighted using the formula: ; Get the window comprehensive outlier value ,in Indicates the number of the time window, , Indicates the number in the time window The corresponding abnormal impact value and its corresponding weight; The transaction amount in the transaction behavior of securities users is analyzed. The specific process is as follows: Based on the user's account type, a transaction limit threshold is set. If the transaction amount is greater than the transaction limit threshold, the transaction is marked as a large transaction. Conversely, if the transaction amount is less than or equal to the transaction limit threshold, the transaction is marked as a small transaction. Analyze the large transactions within the time window, obtain the transaction amounts of all large transactions within the time window, sum them up to get the total large transaction amount in the window, divide the transaction amount of large transactions in the time window by the total large transaction amount in the window to get the large transaction ratio; calculate the difference between the maximum and minimum large transaction ratios in the time window to get the large transaction extreme difference value ; Get the generation time of all large transactions in the time window, calculate the time difference between the generation times of adjacent large transactions to get the large adjacent time difference; when the number of large transactions in the time window is greater than two, calculate the standard deviation of the large adjacent time difference in the time window to get the large adjacent difference fluctuation value ; Get the number of large transactions in the time window, recorded as the number of large transactions; divide the number of large transactions by the total number of transactions in the time window to get the ratio of large transactions ; Weighted calculation is performed on the large transaction extreme value, large adjacent difference fluctuation value, and large transaction frequency ratio, using the formula: ; Get the large transaction evaluation value corresponding to the time window ,in , , They are the weight factors corresponding to the large transaction extreme value, large adjacent difference fluctuation value, and large transaction frequency ratio; Mark the large transaction extreme difference value, large adjacent difference fluctuation value, large transaction frequency ratio, and large transaction evaluation value as large transaction evaluation information; Similarly, based on the analysis process of large transactions within the time window, small transactions within the time window are analyzed to obtain small transaction evaluation information and small transaction evaluation value. ; The small transaction evaluation information includes small transaction extreme value, small transaction fluctuation value, small transaction frequency ratio, and small transaction evaluation value; The ratio of the large transaction evaluation value to the small transaction evaluation value in the time window is marked as the outlier of the large and small transaction ratio. ; The outliers of the proportion of large and small amounts, the evaluation value of large transactions, and the evaluation value of small transactions corresponding to the time window are weighted using the formula: ; Get the amount of impact assessment ,in , , They are the weight factors corresponding to the different values ​​of the proportion of large and small amounts, the evaluation value of large transactions, and the evaluation value of small transactions; Analyze the changes of a specific security in the market. The specific process is as follows: Obtaining securities prices at adjacent moments within any time window of the user account, and sorting the obtained securities prices according to the order of the acquisition moments; bringing the securities prices and the acquisition moments into the first line graph, marking the points of the securities prices in the line graph as price points, connecting two adjacent price points to obtain a price line, and calculating the slope of the price line; establishing an allowable range of the slope of the price line, and marking a price line that is not within the allowable range of the slope of the price line as an abnormal price line; Identify the time mark of the center position of the two price points corresponding to the abnormal price line as the abnormal moment; calculate the time interval between two adjacent abnormal moments and mark it as the abnormal adjacent time length, number the abnormal price lines in the order of acquisition time, and bring the acquisition time number of the abnormal price line and the abnormal adjacent time length into the second line graph; mark the point of the abnormal adjacent time length in the second line graph as an abnormal wave point, connect two adjacent abnormal wave points to obtain an abnormal wave line, and calculate the slope of the abnormal wave line; establish an abnormal wave line slope allowable range, and record the abnormal wave line whose slope is not within the abnormal wave line slope allowable range as the abnormal wave line rate; The abnormal wave line rate with a positive slope among the abnormal wave line rates is recorded as slope one, and the abnormal wave line rate with a negative slope among the abnormal wave line rates is recorded as slope two after taking the absolute value; Sum the slope 1 and slope 2 in the time window to get the total value of slope 1 and the total value of slope 2, and weight the total value of slope 1 and slope 2 to get the abnormal slope fluctuation value. ; Analyze the differences before and after securities transactions within the time window to obtain the total abnormal value of window transactions , Transaction Range ; The abnormal slope fluctuation value, the abnormal total transaction value, and the transaction range value are weighted and calculated using the formula: ; Get the stock trading average ,in , , They are the weight factors corresponding to the abnormal slope fluctuation value, the abnormal total transaction value, and the transaction range value; The differences before and after the securities transactions in the time window are analyzed to obtain the abnormal total value of the window transactions and the transaction range value. The specific analysis is as follows: Obtain the securities trading volume at any time in the time window, select any time in the time window as the first time, calculate the difference between the securities trading volume at the next time and the securities trading volume at the first time, and then calculate the ratio with the securities trading volume at the first time to obtain the ratio before and after the transaction; set the allowable range of the ratio before and after the transaction, obtain all the ratios before and after the transaction in the time window, and record the ratio before and after the transaction that is not within the allowable range as an abnormal transaction ratio; sum up all the abnormal transaction ratios in the time window to obtain the total abnormal value of the window transaction; Calculate the difference between the maximum and minimum securities trading volumes within the time window to obtain the trading range value; The user anomaly module is used to receive the window comprehensive anomaly value and amount impact assessment value of the securities user in the time window and perform weighted processing to obtain the user anomaly value corresponding to the time window; The user outliers of the securities users of the characteristic securities are analyzed. The specific steps are as follows: Obtain the user outlier values ​​of all users corresponding to a specific security within a time window, set a user outlier value threshold, and calculate the difference between the user outlier value and the user outlier threshold to obtain an outlier difference; An abnormal deviation range group is established, including several abnormal deviation ranges, the abnormal difference of the user is matched with the abnormal deviation range group, and the users whose abnormal difference is within the same abnormal deviation range are marked as users in the same group; The abnormal difference values ​​of users in the same group are summed up to get the total abnormal difference value of the window ; Calculate the mean of the abnormal differences of users in the same group to get the mean of the abnormal differences in the window ; Obtain the user abnormal value of any user in the same group of users within the time window, and calculate the standard deviation of the user abnormal value within the time window to obtain the abnormal fluctuation value of the window user ; The total value of window abnormal difference, the mean value of window abnormal difference and the window abnormal fluctuation value of all users in the same group of users are weighted and calculated using the formula: ; Get the total value of window anomalies ;in , Respectively represent the number and quantity of securities users in the same group of users, , are the weights corresponding to the total value of window abnormal difference and the mean value of window abnormal difference, respectively. , Represents securities users in the same group The window abnormal fluctuation value and its corresponding weight The securities anomaly judgment module is used to receive the securities transaction comprehensive abnormality value corresponding to a specific security and compare it with its corresponding preset transaction abnormality threshold. If the securities transaction comprehensive abnormality value is greater than its transaction abnormality threshold, a securities abnormality signal is generated; the securities abnormality signal is used to trigger the analysis of the user abnormality value of the securities user of the characteristic securities to obtain the total window abnormality value; A processing module is used to receive the output results of the securities abnormality judgment module and the user abnormality judgment module, and generate a corresponding execution strategy based on the output results and the corresponding threshold judgment and execute it; Receive the output results of the securities abnormality judgment module and the user abnormality judgment module, and use the output results and the corresponding threshold judgment to generate the corresponding execution signaling and execute it. The specific process is as follows: Match the user's abnormal value with the user transaction status strategy group to generate the corresponding user transaction status signaling; the user transaction status signaling group includes user transaction normal status signaling, personal monitoring signaling, risk warning signaling, transaction restriction signaling, and account blocking signaling; Match the total window abnormality value with the value range of the abnormal strategy group of the same group of users to generate corresponding signaling; wherein the abnormal strategy group of the same group of users includes group monitoring signaling, risk warning signaling, and transaction restriction signaling; When generating the normal status signaling of user transactions, the user's transaction records are sorted and archived according to the preset time period and marked as transaction operation information in accordance with the normal business process; When generating a personal monitoring signaling, switching the data collection frequency time zone; wherein the data collection frequency time zone includes a first collection frequency time zone and a second collection frequency time zone; switching the data collection frequency originally in the first collection frequency time zone to the second collection frequency time zone, wherein the data collection frequency in the second collection frequency time zone is higher than the first collection frequency time zone; When generating risk warning signaling, the user abnormal value of the user is matched with the risk warning level group to generate a corresponding risk warning signal; the risk warning level group includes mild risk warning, moderate risk warning and severe risk warning levels; for mild risk warning, a mild warning notification is pushed on the trading platform corresponding to the specific securities; For moderate risk warning, a moderate warning notification is sent to the corresponding email address or SMS of the securities user. The moderate warning notification includes the user's abnormal information, which includes the user's transaction analysis results and user abnormal values; For severe risk warning levels, some trading permissions of users are restricted, including prohibiting transactions exceeding the set large amount or transactions of specific high-risk securities; When generating a transaction restriction signaling, the securities user's securities trading account permissions are restricted so that the user cannot perform trading operations within the set short-term ban period; When an account blocking signal is generated, the user's securities trading account is blocked for a long period of time, making it impossible for the user to conduct trading operations within the set blocking period, and prohibiting the user from accessing his trading account in any way; When group monitoring signaling, the data collection frequency of any user in the same group of users corresponding to the signaling is adjusted, and the data collection frequency originally in the first collection frequency time zone is switched to the second collection frequency time zone.

[0020] The above formulas are obtained by collecting a large amount of data and performing software simulation, and a formula close to the actual value is selected. The influencing weight factor and specific coefficient value in the formula are set by technical personnel in this field according to actual conditions, and can be adjusted and modified later.

[0021] The above description of the embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. The securities trading abnormal behavior detection system based on machine learning is characterized by: include: The time window setting module includes several time windows, and each time window covers a different duration; The transaction analysis module is used to analyze the transaction behavior of securities users and the changes of specific securities in the market, and output the transaction analysis results of users and the change results of securities; among which, the transaction analysis results include the window comprehensive abnormal value and the amount impact assessment value, the change results include the securities transaction comprehensive abnormal value, and the transaction behavior includes the number and interval of transactions, and the transaction amount; The user anomaly module is used to receive the window comprehensive anomaly value and amount impact assessment value of the securities user in the time window and perform weighted processing to obtain the user anomaly value corresponding to the time window; The securities anomaly judgment module is used to receive the securities transaction comprehensive abnormality value corresponding to a specific security and compare it with its corresponding preset transaction abnormality threshold. If the securities transaction comprehensive abnormality value is greater than its transaction abnormality threshold, a securities abnormality signal is generated; the securities abnormality signal is used to trigger the analysis of the user abnormality value of the securities user of the characteristic securities to obtain the total window abnormality value; The processing module is used to receive the output results of the securities abnormality judgment module and the user abnormality judgment module, and generate a corresponding execution strategy based on the output results and the corresponding threshold judgment and execute it.

2. The securities trading abnormal behavior detection system based on machine learning according to claim 1 is characterized in that: The system also includes a data acquisition module, which is used to establish a connection with the trading database of the stock exchange to obtain the user's basic account information, trading operation information, and market securities information in real time; wherein the basic account information includes the securities user's account opening time, the trading operation information includes the securities user's trading time, transaction amount, and number of transactions; the securities information includes the price and trading volume of specific securities.

3. The securities trading abnormal behavior detection system based on machine learning according to claim 1 is characterized in that: The transaction times and intervals in the securities users' trading behaviors are analyzed. The specific process is as follows: Mark the time period between the securities user's account opening time and the time period before the current time as the account duration time zone; Obtain the number of transactions of a user in any time window of a time window group for a specific security in the time zone of the account existence, calculate the average number of transactions of all time windows in the time window group as the average number of window transactions; perform difference calculation between the number of transactions in the time window and the average number of transactions of the window corresponding to its time window group to obtain the average difference of the number of transactions in the time window; obtain the time interval between the transaction times corresponding to any two adjacent transaction times in the time window as the transaction interval; calculate the standard deviation of the transaction interval in the time window to obtain the cross-interval fluctuation value; divide the duration of the time window by the corresponding number of transactions to obtain the average transaction interval; The average difference of the number of transactions corresponding to the time window, the cross-interval fluctuation value, and the average transaction interval are weighted to obtain the window abnormality assessment value; the abnormal transaction fluctuation allowable range is set, and if the window abnormality assessment value is not within the abnormal transaction fluctuation allowable range, the time window is marked as an abnormal transaction time window; the securities monitoring time zone is set, and the number of abnormal transaction time windows in the time window group within the securities monitoring time zone is obtained and marked as the abnormal transaction value; The window anomaly assessment values ​​of all abnormal trading time windows in the securities monitoring time zone are weighted to obtain the window comprehensive anomaly value.

4. The securities trading abnormal behavior detection system based on machine learning according to claim 1 is characterized in that: The transaction amount in the transaction behavior of securities users is analyzed. The specific process is as follows: Based on the user's account type, a transaction limit threshold is set. If the transaction amount is greater than the transaction limit threshold, the transaction is marked as a large transaction. Conversely, if the transaction amount is less than or equal to the transaction limit threshold, the transaction is marked as a small transaction. Analyze the large transactions within the time window, obtain the transaction amounts of all large transactions within the time window, sum them up to get the total large transaction amount in the window, divide the transaction amount of large transactions within the time window by the total large transaction amount in the window to get the large transaction ratio; calculate the difference between the maximum and minimum large transaction ratios within the time window to get the large transaction extreme difference; Obtain the generation time of all large transactions within the time window, calculate the time difference between the generation times of adjacent large transactions to obtain the large adjacent time difference; when the number of large transactions within the time window is greater than two, calculate the standard deviation of the large adjacent time difference within the time window to obtain the large adjacent difference fluctuation value; obtain the number of large transactions within the time window, recorded as the number of large transactions; divide the number of large transactions by the total number of transactions in the time window to obtain the ratio of the number of large transactions; perform weighted calculation on the large transaction extreme difference value, the large adjacent difference fluctuation value, and the ratio of the number of large transactions to obtain the large transaction evaluation value corresponding to the time window; Mark the large transaction extreme difference value, large adjacent difference fluctuation value, large transaction frequency ratio, and large transaction evaluation value as large transaction evaluation information; Similarly, based on the analysis process of large transactions within the time window, small transactions within the time window are analyzed to obtain small transaction evaluation information and small transaction evaluation values; The ratio of the large-amount transaction evaluation value to the small-amount transaction evaluation value in the time window is marked as an outlier in the ratio of large to small amounts; The outliers of the large and small amount ratios, large transaction assessment values, and small transaction assessment values ​​corresponding to the time window are fused to obtain the amount impact assessment value.

5. The securities trading abnormal behavior detection system based on machine learning according to claim 1 is characterized in that: The specific process of analyzing the changes of specific securities in the market is as follows: Obtaining securities prices at adjacent moments within any time window of the user account, and sorting the obtained securities prices according to the order of the acquisition moments; bringing the securities prices and the acquisition moments into the first line graph, marking the points of the securities prices in the line graph as price points, connecting two adjacent price points to obtain a price line, and calculating the slope of the price line; establishing an allowable range of the slope of the price line, and marking a price line that is not within the allowable range of the slope of the price line as an abnormal price line; Identify the time mark of the center position of the two price points corresponding to the abnormal price line as the abnormal moment; calculate the time interval between two adjacent abnormal moments and mark it as the abnormal adjacent time length, number the abnormal price lines in the order of acquisition time, and bring the acquisition time number of the abnormal price line and the abnormal adjacent time length into the second line graph; mark the point of the abnormal adjacent time length in the second line graph as an abnormal wave point, connect two adjacent abnormal wave points to obtain an abnormal wave line, and calculate the slope of the abnormal wave line; establish an abnormal wave line slope allowable range, and record the abnormal wave line whose slope is not within the abnormal wave line slope allowable range as the abnormal wave line rate; The abnormal wave line rate with a positive slope among the abnormal wave line rates is recorded as slope one, and the abnormal wave line rate with a negative slope among the abnormal wave line rates is recorded as slope two after taking the absolute value; Slope 1 and slope 2 in the time window are summed up to obtain the total value of slope 1 and the total value of slope 2, and the total value of slope 1 and the total value of slope 2 are weighted to obtain the abnormal slope fluctuation value; Analyze the differences before and after the securities transactions in the time window to obtain the total abnormal value of the window transactions and the transaction extreme value; The abnormal slope fluctuation value, the total abnormal transaction value, and the transaction range value are weighted to obtain the comprehensive abnormal value of securities transactions.

6. The securities trading abnormal behavior detection system based on machine learning according to claim 5 is characterized in that: The differences before and after the securities transactions in the time window are analyzed to obtain the abnormal total value of the window transactions and the transaction extreme difference value. The specific analysis is as follows: Obtain the securities trading volume at any time in the time window, select any time in the time window as the first time, calculate the difference between the securities trading volume at the next time and the securities trading volume at the first time, and then calculate the ratio with the securities trading volume at the first time to obtain the ratio before and after the transaction; set the allowable range of the ratio before and after the transaction, obtain all the ratios before and after the transaction in the time window, and record the ratio before and after the transaction that is not within the allowable range as an abnormal transaction ratio; sum up all the abnormal transaction ratios in the time window to obtain the total abnormal value of the window transaction; Calculate the difference between the maximum and minimum securities trading volumes within the time window to obtain the transaction range value.

7. The securities trading abnormal behavior detection system based on machine learning according to claim 1 is characterized in that: The specific steps of analyzing the user abnormal values ​​of the securities users of the characteristic securities are as follows: Obtain the user outlier values ​​of all users corresponding to a specific security within a time window, set a user outlier value threshold, and calculate the difference between the user outlier value and the user outlier threshold to obtain an outlier difference; An abnormal deviation range group is established, including several abnormal deviation ranges, the abnormal difference of the user is matched with the abnormal deviation range group, and the users whose abnormal difference values ​​are within the same abnormal deviation range are marked as users in the same group; The abnormal difference values ​​of users in the same group are summed up to get the total abnormal difference value of the window ; The abnormal differences of users in the same group are averaged to obtain the window abnormal difference mean ; Obtain the user abnormal value of any user in the same group of users within the time window, and calculate the standard deviation of the user abnormal value within the time window to obtain the abnormal fluctuation value of the window user ; The total value of window abnormal difference, the mean value of window abnormal difference and the window abnormal fluctuation value of all users in the same group of users are weighted and calculated using the formula: ; Get the total value of window anomalies ;in , Respectively represent the number and quantity of securities users in the same group of users, , are the weights corresponding to the total value of window abnormal difference and the mean value of window abnormal difference, respectively. , Represents securities users in the same group The abnormal fluctuation value of the window and its corresponding weight.

8. The securities trading abnormal behavior detection system based on machine learning according to claim 1 is characterized in that: Receive the output results of the securities abnormality judgment module and the user abnormality judgment module, and use the output results and the corresponding threshold judgment to generate the corresponding execution signaling and execute it. The specific process is as follows: Match the user's abnormal value with the user transaction status strategy group to generate the corresponding user transaction status signaling; the user transaction status signaling group includes user transaction normal status signaling, personal monitoring signaling, risk warning signaling, transaction restriction signaling, and account blocking signaling; Match the total window abnormality value with the value range of the abnormal strategy group of the same group of users to generate corresponding signaling; wherein the abnormal strategy group of the same group of users includes group monitoring signaling, risk warning signaling, and transaction restriction signaling; When generating the normal status signaling of user transactions, the user's transaction records are sorted and archived according to the preset time period and marked as transaction operation information in accordance with the normal business process; When generating a personal monitoring signaling, switching the data collection frequency time zone; wherein the data collection frequency time zone includes a first collection frequency time zone and a second collection frequency time zone; switching the data collection frequency originally in the first collection frequency time zone to the second collection frequency time zone, wherein the data collection frequency in the second collection frequency time zone is higher than the first collection frequency time zone; When generating risk warning signaling, the user abnormal value of the user is matched with the risk warning level group to generate a corresponding risk warning signal; the risk warning level group includes mild risk warning, moderate risk warning and severe risk warning levels; When generating a transaction restriction signaling, the securities user's securities trading account permissions are restricted so that the user cannot perform trading operations within the set short-term ban period; When an account blocking signal is generated, the user's securities trading account is blocked for a long period of time, making it impossible for the user to conduct trading operations within the set blocking period, and prohibiting the user from accessing his trading account in any way; When group monitoring signaling, the data collection frequency of any user in the same group of users corresponding to the signaling is adjusted, and the data collection frequency originally in the first collection frequency time zone is switched to the second collection frequency time zone.

Images