A multidimensional data fusion analysis method for financial transaction anomaly detection

Abstract

The present application provides a multi-dimensional data fusion analysis method for detecting anomalies in financial transactions, including: obtaining time series data of open contracts, the time series data of open contracts including date, trading volume, opening price, closing price, contract type and exercise price, pre-processing the time series data to remove noise and outliers, and obtaining cleaned time series data; for frequency sub-bands determined to be high-frequency trading behavior patterns, constructing a classifier based on wavelet transform features, and obtaining a classification model for identifying high-frequency trading behaviors by training the wavelet transform features, which is used for real-time monitoring of trading behaviors.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a multi-dimensional data fusion analysis method for financial transaction anomaly detection. Background Art

[0002] In the detection of financial transaction anomalies, the time series data of open contracts contain important information about trading behavior. These time series data contain periodic components of different frequencies, reflecting the trading patterns and strategies of market participants. However, how to effectively extract valuable features from these complex time series data and accurately identify abnormal trading behaviors is a challenging technical problem. Traditional time domain analysis methods have difficulty capturing multi-scale features in time series data and ignore the interaction and influence between different frequency components. Simply analyzing in the frequency domain cannot fully consider the non-stationary and dynamic change characteristics of time series. How to design a method that can simultaneously utilize time domain and frequency domain information to adaptively extract multi-scale features has become a key technical bottleneck. In addition, the complexity and variability of financial markets lead to the diversification of the manifestations of abnormal trading behaviors. Different types of abnormal trading patterns have different characteristics in time series data, and may even confuse and interfere with each other. In summary, in the detection of financial transaction anomalies, how to extract effective multi-scale and multi-frequency features from the time series data of open contracts is a complex and challenging technical problem that requires in-depth research and exploration of innovative solutions. Summary of the invention

[0003] The present invention provides a multi-dimensional data fusion analysis method for financial transaction anomaly detection, which mainly includes:

[0004] The time series data of open and unclosed contracts are obtained. The time series data of open and unclosed contracts include date, trading volume, opening price, closing price, contract type and exercise price. The time series data are preprocessed to remove noise and outliers to obtain cleaned time series data. For the cleaned time series data, the time series data are decomposed into different frequency sub-bands through wavelet transform. The frequency sub-bands are analyzed separately to extract periodic components reflecting the trading behavior pattern. The periodic components include intraday fluctuation patterns, seasonal effects and market cycles to obtain a set of periodic components on different frequency sub-bands. After obtaining the set of periodic components, the energy characteristics of each frequency sub-band are extracted for the periodic components of each frequency sub-band. The energy size of different frequency sub-bands is obtained by a preset energy calculation method. After obtaining the energy size of different frequency sub-bands, the entropy value of each frequency sub-band is calculated by a preset entropy calculation method to obtain different The entropy value of the same frequency sub-band; if the energy size and entropy value of the frequency sub-band exceed the preset threshold at the same time, the transaction corresponding to the frequency sub-band is determined to be a high-frequency abnormal trading behavior pattern, indicating the existence of short-term speculative behavior. If the energy size or entropy value of the frequency sub-band exceeds the preset threshold, the transaction corresponding to the frequency sub-band is determined to be an abnormal trading behavior pattern; for the frequency sub-band determined to be a high-frequency trading behavior pattern, a classifier based on wavelet transform features is constructed, and by training the wavelet transform features, a classification model for identifying high-frequency trading behavior is obtained, which is used to monitor trading behavior in real time; when there is new time series data of opening and unclosed contracts, the new time series data is preprocessed and periodic components are extracted, and the wavelet transform features are extracted and classified and identified using the trained classification model for identifying high-frequency trading behavior. If the identification result is a high-frequency trading behavior pattern, an early warning is triggered in time, and the corresponding preset risk analysis and disposal are carried out.

[0005] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0006] The present invention discloses a multi-dimensional data fusion analysis method for detecting financial transaction anomalies. The method first obtains the time series data of open contracts, and removes noise and outliers through preprocessing. Then, the data is decomposed into different frequency sub-bands using wavelet transform, and the periodic components reflecting the transaction behavior pattern are extracted. Then, the energy and entropy values ​​of each sub-band are calculated to determine the abnormal transaction behavior. For high-frequency abnormal transactions, a classifier based on wavelet transform features is constructed for real-time monitoring. When there is new data, the trained model is used for identification and early warning is triggered in time. The present invention can effectively identify high-frequency abnormal transaction behaviors in the financial market, realize timely early warning and disposal of risks such as short-term speculation, and improve the efficiency and accuracy of market supervision. Through the analysis of multi-scale features, the ability of the present invention to capture abnormal patterns in complex financial time series has been significantly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 The present invention is a flowchart of a multi-dimensional data fusion analysis method for detecting anomalies in financial transactions.

[0008] Figure 2 It is a schematic diagram of a multi-dimensional data fusion analysis method for financial transaction anomaly detection according to the present invention.

[0009] Figure 3 This is another schematic diagram of a multi-dimensional data fusion analysis method for financial transaction anomaly detection according to the present invention. DETAILED DESCRIPTION

[0010] In order to further understand the content of the present invention, the present invention is described in detail in conjunction with the accompanying drawings and embodiments. The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are only used to explain the relevant inventions, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0011] like Figure 1-3 In this embodiment, a multi-dimensional data fusion analysis method for financial transaction anomaly detection may specifically include:

[0012] S101. Obtain time series data of open contracts, where the time series data of open contracts include date, trading volume, opening price, closing price, contract type and strike price. Preprocess the time series data to remove noise and outliers, and obtain cleaned time series data.

[0013] According to the timestamp, an attribute value sequence including date, trading volume, opening price, closing price, contract type and exercise price is obtained from the original data of the open and unclosed contracts, and the attribute value sequence is aligned with the timestamp for each contract price; for the missing values ​​in the attribute value sequence, a linear interpolation method is used to obtain the filled open and unclosed contract data, and the filled open and unclosed contract data is used to obtain time series segmented data through a moving window method; for the time series segmented data, a multi-scale analysis result is obtained through wavelet decomposition, and the multi-scale analysis result is subjected to fixed threshold denoising to obtain the denoised open and unclosed contract data; for the denoised open and unclosed contract data, a bilateral Kalman filter is used to perform state prediction and update iteration, and the time series data of the open and unclosed contracts after smoothing is obtained by setting a state transfer matrix and an observation matrix.

[0014] Specifically, the original data of open contracts from multiple data sources are collected through a database, and the price sequences of each contract are aligned according to the timestamp for the original data of open contracts, and the attribute values ​​including date, trading volume, opening price, closing price, contract type, and exercise price are obtained from the original data of open contracts. For the missing values ​​in the original data of open contracts, the missing data are filled by linear interpolation method, and the time series of the filled open contracts data are segmented by moving window method. The segmented open contracts data are analyzed at multiple scales according to wavelet decomposition, and the fixed threshold method is used to reduce noise for the wavelet decomposition coefficients, and the open contracts data after noise reduction are obtained by reconstruction. For the open contracts data after noise reduction, the statistical threshold is set to identify abnormal points. If the data at a certain time point deviates from the mean by more than three times the standard deviation, it is determined to be an abnormal point, and the local linear regression method is used to correct the abnormal point. The bilateral Kalman filter is used to smooth the corrected open position data, set the state transfer matrix and observation matrix, and obtain the smoothed open position data through prediction-update iteration. For the smoothed open position data, the kernel density estimation method is used to construct the probability density function, the data distribution characteristics are calculated by the Gaussian kernel function, and the data distribution parameters are obtained from the probability density function. According to the obtained data distribution parameters, the Markov chain Monte Carlo method is used to reconstruct the open position data, and the Gibbs sampling algorithm is used for iterative sampling to obtain the reconstructed open position time series data. The open position data collection obtains basic data from the real-time trading system, including data collected every 5 minutes from 9:30 am to 15:00 pm every day. The data contains fields such as option code, date and time, transaction price, transaction volume, exercise price, etc., and the data time is accurate to seconds. For the option contract with the option code 50ETF purchase 2403A5000, the transaction data obtained on February 15, 2024 showed that the opening price was 0.2315 yuan, the closing price was 0.2298 yuan, the trading volume was 2853 lots, and the exercise price was 5.00 yuan. For the missing values ​​in the original data, the linear interpolation method is used to fill in. Taking an option contract from 10:35 to 10:45 on February 15, 2024 as an example, the price at 10:35 is 0.2315 yuan, the price at 10:45 is 0.2332 yuan, and the data at 10:40 is missing. The price at 10:40 is 0.2324 yuan calculated by linear interpolation. The filled data is segmented into time series using a 30-minute window. Wavelet decomposition is used to process the segmented data. The db4 wavelet basis function is selected to decompose the data into three layers to obtain the approximate coefficients and detail coefficients. Taking the price series within a certain time window as an example, the fluctuation characteristics of different scales are obtained after decomposition. The detail coefficient is soft-thresholded by setting the threshold to 0.05 to remove the high-frequency noise component.The processed data was detected for anomalies, and the mean of the data was calculated to be 0.2315 yuan, the standard deviation was 0.0025 yuan, and three times the standard deviation was set as the threshold. The data point with a price of 0.2395 yuan was identified as an outlier. The local weighted regression method was used to select 5 data points before and after the outlier for fitting, and the correction value was 0.2328 yuan. In the bilateral Kalman filter processing, the state transfer matrix was set to the unit matrix, the observation matrix was [1,0], the state noise covariance was 0.001, and the observation noise covariance was 0.005. The price series was smoothed by predictive update iteration to obtain a more stable price curve. The kernel density estimation uses the Gaussian kernel function, and the bandwidth parameter is set to 0.015. The probability density function of the price distribution is calculated. On this basis, Gibbs sampling is used for data reconstruction, and the sampling steps are set to 1000 times and the burning period is 200 times. Finally, the reconstructed price series is obtained. The statistical characteristics of the reconstructed data are basically consistent with the original data, but the abnormal fluctuations are removed.

[0015] S102. Decompose the cleaned time series data into different frequency sub-bands through wavelet transform. Analyze the frequency sub-bands separately to extract the periodic components reflecting the trading behavior patterns. The periodic components include intraday fluctuation patterns, seasonal effects and market cycles. Obtain a set of periodic components on different frequency sub-bands.

[0016] A discrete wavelet transform is used to perform a multi-scale decomposition operation on the time series data, and high-frequency sub-band coefficients and low-frequency sub-band coefficients are obtained from the multi-scale decomposition operation results; a wavelet packet decomposition operation is performed on the low-frequency sub-band coefficients, and a variance contribution rate sequence is obtained by calculating the variance ratio of each layer of sub-band coefficients obtained by the wavelet packet decomposition operation, and an optimal number of decomposition layers is determined from the variance contribution rate sequence; a wavelet packet decomposition operation is performed on the time series data according to the optimal number of decomposition layers, and important frequency sub-bands are determined by calculating the Shannon entropy value of the sub-band coefficient sequence obtained by the wavelet packet decomposition operation; a spectrum decomposition operation is performed on the coefficient sequence of the important frequency sub-bands by Fourier transform, and a main frequency component is obtained from the amplitude curve of the spectrum decomposition operation result, and a periodic component set is determined by the main frequency component.

[0017] Specifically, the discrete wavelet transform is used to perform multi-scale decomposition on the cleaned time series data, and the convolution operation is performed on the time series data by selecting the Haar wavelet basis function, and the first-layer high-frequency sub-band coefficients and low-frequency sub-band coefficients are obtained from the convolution operation results. The wavelet packet decomposition method is used to further decompose the first-layer low-frequency sub-band coefficients, and the variance contribution rate is obtained by calculating the variance ratio of the sub-band coefficients of each layer, and the optimal decomposition layer number is obtained from the variance contribution rate sequence. The time series data is decomposed by wavelet packets according to the optimal decomposition layer number, and the Shannon entropy is calculated for the sub-band coefficient sequence of different frequency intervals to obtain the amount of information, and the importance of the frequency sub-band is determined from the information value. The autocorrelation function is used to perform periodic analysis on the important frequency sub-band coefficients, and the significant correlation points are identified by setting the autocorrelation coefficient threshold, and the intraday volatility characteristics are obtained from the significant correlation point sequence.

[0018]

[0019] Rxx(k) represents the autocorrelation function, N represents the signal length, k represents the time delay, and x(n) represents the time series data. This formula is used to calculate the autocorrelation of the signal. Fourier transform is used to perform spectrum decomposition on the sequence of significant correlation points. The main frequency components are extracted by analyzing the spectrum amplitude curve, and the seasonal fluctuation characteristics are obtained from the main frequency components. The instantaneous phase of the main frequency components is extracted by Hilbert transform, and the periodic change characteristics are obtained by calculating the phase increment sequence. The market cycle components are determined from the periodic change characteristics. The market cycle components are decomposed according to the singular spectrum analysis method, the embedding dimension and time delay parameters are set, and the periodic component set is obtained by calculating the singular value decomposition of the trajectory matrix. The discrete wavelet transform decomposes the time series through the Haar wavelet basis function. Taking the 5-minute price data of an option contract from 9:30 to 15:00 as an example, it contains 210 sampling points. The first-level decomposition obtains 105 high-frequency coefficients and 105 low-frequency coefficients. The high-frequency coefficients reflect the short-term fluctuations of the price, and the low-frequency coefficients reflect the overall trend of the price. Wavelet packet decomposition further decomposes the low-frequency coefficients and calculates the variance ratio of each layer of sub-band coefficients. The variance contribution rate of the first layer is 0.85, the second layer is 0.12, and the third layer is 0.03. When the variance contribution rate is less than 0.05, the decomposition is stopped, and the optimal number of decomposition layers is determined to be 2. According to the optimal number of layers, wavelet packet decomposition is performed to obtain 4 frequency sub-bands, which correspond to the price fluctuation characteristics of different time scales within the day. The Shannon entropy of each sub-band coefficient sequence is calculated. The entropy value of the first sub-band is 2.85, the second sub-band is 1.92, the third sub-band is 0.95, and the fourth sub-band is 0.43. The larger the entropy value, the greater the amount of information. The sub-band with an entropy value greater than 1 is selected as the important frequency sub-band. The autocorrelation function is calculated for the coefficients of the important frequency sub-bands, and the autocorrelation coefficient threshold is set to 0.6. A significant correlation occurs when the lag period is 42 sampling points, indicating that the price has an intraday fluctuation cycle of 210 minutes. The frequency spectrum of the sequence of significant correlation points is analyzed by Fourier transform. The amplitude peaks appear at frequencies of 0.0048 and 0.0024, corresponding to the periodic components of 210 minutes and 420 minutes, respectively. The instantaneous phase of the main frequency component is extracted by Hilbert transform, and the phase difference of adjacent sampling points is calculated to obtain the phase increment sequence. The mean of the phase increment is 0.03 radians and the standard deviation is 0.005 radians, indicating that the market cycle is relatively stable. The embedding dimension is set to 20 and the time delay is 5. The trajectory matrix is ​​constructed and the singular value decomposition is performed. The first three singular values ​​are 845.6, 425.3 and 198.7, respectively. The corresponding eigenvectors reflect the periodic change patterns of different time scales. The periodic components corresponding to the first three eigenvectors reflect the volatility characteristics of the opening, midday and end of the intraday trading period, respectively. The volatility is large in the opening stage, tends to be stable in the midday stage, and large fluctuations occur again in the end stage. This periodic change pattern is closely related to the trading behavior of market participants in different trading periods, reflecting the micro-structural characteristics of the market.

[0020] S103. After obtaining a set of periodic components, extract the energy characteristics of each frequency subband for the periodic components of each frequency subband, obtain the energy sizes of different frequency subbands through a preset energy calculation method, and after obtaining the energy sizes of different frequency subbands, calculate the entropy value of each frequency subband through a preset entropy calculation method to obtain the entropy values ​​of different frequency subbands.

[0021] For the frequency subband sequence in the periodic component set, the absolute energy value of the frequency subband is obtained by calculating the sum of the squares of the subband sequence amplitudes; a cumulative energy distribution curve is constructed according to the absolute energy value of the frequency subband, and an energy increment sequence is obtained by calculating the energy difference between adjacent frequency bands; a probability density estimation is performed on the energy increment sequence, and a probability distribution function is obtained by establishing a histogram statistics of the frequency subband; if the probability distribution function meets the sampling requirements, the Shannon entropy formula is used to calculate the probability density value of the frequency subband, and the information entropy of the frequency subband is obtained by the negative logarithmic expected value of the probability density value, and the entropy value of the frequency subband is obtained from the information entropy sequence.

[0022] Specifically, for each frequency subband sequence in the periodic component set, the absolute energy value of the frequency subband is obtained by calculating the sum of the squares of the subband sequence amplitudes, and the frequency band energy characteristics are obtained from the absolute energy values ​​of the frequency subbands. A cumulative energy distribution curve is constructed according to the frequency band energy characteristic sequence, and an energy increment sequence is obtained by calculating the energy difference between adjacent frequency bands, and the relative energy value of the frequency subband is obtained from the energy increment sequence. Probability density estimation is performed on the relative energy value sequence, and a probability distribution function is obtained by establishing a histogram statistic of the frequency subband, and the probability density value of the frequency subband is calculated from the probability distribution function. The probability density value of the frequency subband is calculated using the Shannon entropy formula, and the information entropy of the frequency subband is obtained by the negative logarithmic expected value of the probability density value, and the entropy value of the frequency subband is obtained from the information entropy sequence. A joint probability distribution of adjacent subbands is constructed for the entropy value sequence of the frequency subband, and the conditional entropy between subbands is obtained by calculating the marginal probability and conditional probability, and the information correlation between subbands is determined from the conditional entropy sequence. The frequency sub-bands are combined according to the information correlation between the sub-bands, and the information redundancy sequence is obtained by calculating the mutual information of the combined sub-bands. The information dependency of the frequency sub-bands is obtained from the information redundancy sequence. The energy calculation of the frequency sub-band sequence adopts the method of the sum of square amplitudes. Taking the price fluctuation of a certain option intraday transaction as an example, the trading day is divided into four frequency sub-bands, corresponding to the time scales of 5 minutes, 15 minutes, 30 minutes and 60 minutes, respectively. The calculated absolute energy values ​​are 256.8, 185.4, 142.3 and 98.6, respectively, reflecting the price fluctuation intensity on different time scales. By constructing the cumulative energy distribution curve and calculating the energy difference of adjacent frequency bands, the energy increment sequence is 71.4, 43.1 and 43.7, and the relative energy values ​​between adjacent frequency bands are 0.278, 0.232 and 0.307, indicating that the energy change between the 5-minute and 15-minute frequency bands is the largest, reflecting that the short-term price fluctuation is more intense. The probability density of the relative energy value sequence is estimated, the value interval is divided into 10 equally spaced intervals, the sample frequency of each interval is counted, and the probability distribution function is calculated. The maximum probability density of the 5-minute frequency band is 0.285, which appears in the range of 0.25-0.30, indicating that the energy distribution of this frequency band is relatively concentrated. Using the Shannon entropy formula The information entropy of each frequency band is calculated, where p(x) is the probability density value. The entropy values ​​of the 5-minute, 15-minute, 30-minute, and 60-minute frequency bands are 2.85, 2.42, 2.13, and 1.86, respectively. The entropy value decreases with the increase of the time scale, indicating that the shorter time scale contains more information. The conditional entropy between adjacent frequency bands is calculated.

[0023] , where p(x,y) is the joint probability and p(y|x) is the conditional probability. The conditional entropies of the 5-15, 15-30 and 30-60 minute bands are 0.95, 0.85 and 0.72 respectively. The smaller the conditional entropy value, the stronger the information association between adjacent bands. The bands are combined based on the conditional entropy value, and the mutual information between the combined bands is calculated as I(X;Y)=H(X)+H(Y)-H(X,Y), where H(X,Y) is the joint entropy. The mutual information of the 5-15 minute band combination is 1.25, the 15-30 minute band combination is 1.08, and the 30-60 minute band combination is 0.95. The larger the mutual information, the higher the information redundancy between the bands, and the corresponding price fluctuation patterns have stronger similarities. Energy characteristics and entropy analysis reveal the fluctuation characteristics of option prices on different time scales. Frequency bands with shorter time scales have higher energy and information content, and there is a significant information correlation between adjacent frequency bands. This multi-scale energy distribution and information structure reflects the behavioral patterns of market participants in different trading cycles.

[0024] S104. If the energy size and entropy value of the frequency sub-band exceed the preset threshold value at the same time, the transaction corresponding to the frequency sub-band is determined to be a high-frequency abnormal trading behavior pattern, indicating the existence of short-term speculative behavior. If the energy size or entropy value of the frequency sub-band exceeds the preset threshold value, the transaction corresponding to the frequency sub-band is determined to be an abnormal trading behavior pattern.

[0025] The energy mean and standard deviation of the frequency sub-band are calculated according to the historical transaction data, the frequency sub-band energy is standardized by calculating the z value, and a normalized energy sequence is obtained from the standardized processing; an upper limit threshold is set for the normalized energy sequence using the principle of three times the standard deviation, and the energy fluctuation boundary value of the frequency sub-band is obtained from the upper limit threshold; the statistical distribution of the entropy value sequence is calculated using a quartile-based method, and the entropy value upper limit threshold is obtained from the statistical distribution, wherein the entropy value upper limit threshold is determined by the 75th percentile value and the interquartile range; if the normalized energy value exceeds the energy fluctuation boundary value and the entropy value exceeds the entropy value upper limit threshold, it is judged from the transaction volume and the position that the frequency sub-band contains abnormal transaction characteristics, and based on the abnormal transaction characteristics, it is judged that the transaction corresponding to the frequency sub-band is an abnormal transaction behavior pattern.

[0026] Specifically, the energy mean μ and standard deviation σ of the frequency sub-band are calculated based on historical trading data, and the frequency sub-band energy is standardized by calculating the z value = (x-μ) / σ. The normalized energy sequence with a mean of 0 and a standard deviation of 1 is obtained from the standardized sub-band energy data. The triple standard deviation principle is adopted for the normalized energy sequence, and the energy anomaly judgment threshold is determined by setting the upper limit threshold to 3σ, and the energy fluctuation boundary value of the frequency sub-band is obtained from the energy anomaly judgment threshold. The statistical distribution of the entropy value sequence is calculated by the quartile-based method, and the upper limit threshold Q3+1.5IQR of the entropy value is determined by calculating the 75th percentile value Q3 and the interquartile range IQR, and the entropy value anomaly judgment standard is obtained from the upper limit threshold of the entropy value. The normalized energy value and entropy value of the frequency sub-band are jointly judged by double thresholds. If both the energy fluctuation boundary value and the entropy value anomaly judgment standard are exceeded at the same time, it is judged from the trading volume and position data that the frequency sub-band contains high-frequency trading characteristics. A single threshold judgment is made based on the normalized energy value and entropy value of the frequency sub-band. If the energy fluctuation boundary value or the entropy value abnormal judgment standard is exceeded, the frequency sub-band is judged to contain abnormal trading characteristics from the transaction price sequence. Based on the judgment result, the abnormal trading mark sequence of the frequency sub-band is constructed. The time series characteristics of abnormal transactions are obtained by recording the time point and duration of the abnormality, and the fluctuation law of trading behavior is obtained from the time series characteristic data. The standardization process is normalized by calculating the statistical characteristics of the frequency sub-band energy. Taking the 5-minute frequency sub-band of an option contract as an example, the energy data of 20 trading days are counted, and the energy mean μ=256.8 and the standard deviation σ=45.3 are calculated. For the energy value x=385.2 of the frequency sub-band on the current trading day, the standardized value z=(385.2-256.8) / 45.3=2.83 is calculated by the standardized value calculation formula z=(x-μ) / σ, indicating that the current energy value deviates from the historical mean by nearly 3 standard deviations. The energy anomaly threshold is set based on the principle of three times the standard deviation. When the standardized energy value z>3, it is judged as an abnormal fluctuation. The upper limit of the corresponding original energy value is 256.8+3×45.3=392.7. Combined with the actual data analysis, it is found that the energy value of this frequency sub-band is 385.2, which is close to but does not exceed the abnormal threshold. The entropy value sequence uses the quartile method to determine the anomaly. The first quartile Q1=1.85, the third quartile Q3=2.85, and the interquartile range IQR=1.00 are calculated. The upper limit threshold of the entropy value is set to Q3+1.5×IQR=4.35. The entropy value of the current frequency sub-band is 4.52, which exceeds the upper limit threshold, indicating that the amount of information is abnormally high. In the dual threshold judgment, the standardized energy value of 2.83 of this frequency sub-band did not exceed the energy threshold of 3, but the entropy value of 4.52 exceeded the entropy threshold of 4.35. By checking the trading data of the corresponding period, it was found that the trading volume within 5 minutes was 2853 lots, which was a significant increase from the average trading volume of 1256 lots in the same period of the previous 20 trading days, but the position did not change much, only increasing by 385 lots.The single threshold judgment shows that only the entropy value of this frequency sub-band exceeds the threshold. From the transaction price sequence, the price fluctuated from 0.2315 yuan to 0.2485 yuan within 5 minutes, and then fell back to 0.2332 yuan. The price fluctuation range reached 7.35%, which was significantly higher than the fluctuation level during normal trading hours. When constructing the abnormal transaction mark sequence, it was recorded that the abnormal transaction occurred between 10:30 and 10:35 in the morning, lasting for 5 minutes. During this period, a total of 58 transactions occurred, with an average transaction volume of 49.19 lots, the largest single transaction volume of 386 lots, and the smallest single transaction volume of 5 lots. The distribution of transaction scale was extremely uneven. Through the analysis of the abnormal characteristics of this frequency sub-band, it was found that although the energy index did not meet the judgment standard of high-frequency trading, the abnormal increase in entropy value reflected the increase in the disorder of trading behavior. Combined with the characteristics of a surge in trading volume but a small change in position volume, it indicates that there may be short-term speculative trading behavior. This trading pattern is often accompanied by drastic price fluctuations, which has an adverse impact on the stability of the market. The temporal characteristics of the abnormal transaction mark sequence also show that similar trading behaviors frequently occur within 1 hour after the opening, reflecting that some market participants take advantage of the high volatility in the early trading to engage in speculative trading.

[0027] S105. For the frequency sub-bands determined to be high-frequency trading behavior patterns, a classifier based on wavelet transform features is constructed. By training the wavelet transform features, a classification model for identifying high-frequency trading behaviors is obtained, which is used for real-time monitoring of trading behaviors.

[0028] Wavelet packet transform is used to extract features from high-frequency trading data. Statistical features are obtained by calculating the mean, variance, skewness and kurtosis of wavelet coefficients, and frequency domain features are obtained from the energy distribution and entropy distribution of wavelet coefficients. Features are sorted according to the importance scoring method of the statistical features and frequency domain features, and feature subsets are obtained by setting importance thresholds. A training data matrix is ​​constructed for the feature subset, and the optimal parameter values ​​of the random forest classifier are determined from the training data matrix using a cross-validation method. Feature vectors are extracted from real-time trading data according to a fixed time window, and normalized values ​​are calculated from the feature vectors to obtain standardized feature sequences, and high-frequency trading behavior is judged based on the standardized feature sequences.

[0029] Specifically, wavelet packet transform is used to extract features from high-frequency trading data. Statistical features are obtained by calculating the mean, variance, skewness, and kurtosis of wavelet coefficients, and frequency domain features are obtained from the energy distribution and entropy distribution of wavelet coefficients. The extracted features are sorted according to the feature importance scoring method, feature subsets are screened by setting importance thresholds, and training data matrix and validation data matrix are constructed from feature subsets. The training data matrix is ​​divided into training set and test set according to the ratio of 7:3, the random forest parameters are optimized by the five-fold cross-validation method, and the classification performance index is calculated from the test set data. The grid search method is used to find the optimal parameter combination in the interval of the number of decision trees and the maximum depth interval, and the optimal parameter value is obtained by calculating the classification accuracy on the validation set. The random forest classifier is trained according to the optimal parameters, and the confusion matrix is ​​calculated for the validation data matrix. The classification accuracy, precision, and recall are obtained from the confusion matrix. Feature extraction is performed on real-time trading data according to a fixed time window, and the standardized feature sequence is obtained by calculating the normalized value of the feature vector, and the high-frequency trading behavior is judged from the standardized feature sequence. According to the judgment results, a warning signal sequence is constructed. The monitoring log is obtained by recording the warning trigger time and duration, and the high-frequency trading warning notification is output from the monitoring log. Wavelet packet transform is used to extract features from high-frequency trading data. Taking the 5-minute frequency sub-band of an option contract as an example, the statistical characteristics of the wavelet coefficients are calculated, with a mean of 0.2315, a variance of 0.0025, a skewness of 1.856, and a kurtosis of 6.324, reflecting the central trend and distribution form of price fluctuations. At the same time, the energy distribution characteristics of the sub-band are calculated, with an energy value of 385.2 and an entropy value of 4.52, which characterize the volatility intensity and complexity of trading behavior. The feature importance score shows that the kurtosis and entropy values ​​have the highest importance scores, which are 0.285 and 0.253 respectively, followed by the energy value and skewness, which are 0.186 and 0.165, and the variance and mean scores are relatively low, which are 0.062 and 0.049. The importance threshold is set to 0.1, and 4 features with scores greater than the threshold are selected to construct a feature subset. The data set is divided in a ratio of 7:3. 700 samples are randomly selected from 1000 samples as training sets and 300 samples are randomly selected as test sets. In the five-fold cross validation, the training set is divided into 5 parts, 4 parts are used for training and 1 part is used for validation each time, and the average classification accuracy is calculated. The parameter space of the grid search is set as follows: the number of decision trees is between 50 and 200, the step length is 50; the maximum depth is between 5 and 15, and the step length is 2. By traversing all parameter combinations, it is found that when the number of decision trees is 150 and the maximum depth is 9, the classification accuracy on the validation set reaches the highest, which is 92.5%. The random forest classifier is trained with the optimal parameters, and the confusion matrix is ​​calculated on the validation data matrix, in which there are 142 true positives, 12 false positives, 10 false negatives, and 136 true negatives. Based on this calculation, the classification accuracy is 92.67%, the precision is 92.21%, and the recall is 93.42%.In real-time monitoring, a fixed time window of 5 minutes is used to extract features. For the trading data between 10:30 and 10:35, the standardized feature vector is calculated: kurtosis 6.324 (z value 2.85), entropy 4.52 (z value 3.15), energy 385.2 (z value 2.83), skewness 1.856 (z value 2.42). The feature vector is input into the trained random forest classifier to determine whether there is high-frequency trading behavior in this time window. The warning signal sequence record shows that 3 high-frequency trading warnings were triggered during the morning trading period, which occurred at 9:35-9:40, 10:30-10:35 and 11:25-11:30, and lasted for 5 minutes. Among them, the warning signal during 10:30-10:35 was the strongest, and the abnormality of the feature value was the highest, accompanied by large price fluctuations and increased trading volume. This high-frequency trading behavior often manifests itself as intensive trading in a short period of time, and the price difference profit is obtained by quickly opening and closing positions. The monitoring system calculates the characteristic values ​​in real time and compares them with the preset thresholds to promptly detect abnormal trading patterns.

[0030] S106. When there is new time series data of open contracts, the new time series data is preprocessed and periodic components are extracted. The wavelet transform features are extracted and classified using the trained classification model for identifying high-frequency trading behaviors. If the identification result is a high-frequency trading behavior pattern, an early warning is triggered in time, and the corresponding preset risk analysis and disposal are carried out.

[0031] A sliding time window is used to collect the data of open and unclosed contracts in real time, and the cleaned data sequence is obtained by calculating the mean and standard deviation of the price sequence in the time window; the cleaned data sequence is decomposed by wavelet transform, and the standardized feature sequence is obtained by extracting the statistical moment and energy distribution characteristics of the wavelet transform coefficients; the pre-trained random forest classifier is input according to the standardized feature sequence, and the transaction behavior attributes are judged by calculating the feature sequence score value. If the score value exceeds the preset threshold, a high-frequency trading mark sequence is obtained; the position concentration index is calculated for the high-frequency trading mark sequence, and the position distribution sequence is obtained by calculating the ratio of the position of a single trader to the total position. A risk propagation matrix is ​​constructed according to the position distribution sequence, and the risk propagation path is obtained by calculating the dependency structure of different contracts, and the risk impact range is judged from the risk propagation path. A risk level threshold is set for the risk impact range, and a risk assessment report is constructed by comparing the current risk metric value with the historical quantile, and a risk disposal plan is output from the risk assessment report.

[0032] Specifically, a 5-minute sliding window is used for real-time data collection based on the data of open contracts. The outliers are removed by calculating the mean and standard deviation of the price sequence in the window, and the periodic component sequence is extracted from the cleaned data. The wavelet transform eigenvalue is calculated for the periodic component sequence, and the feature vector is constructed by extracting the statistical moment and energy distribution characteristics of the wavelet coefficients, and the standardized feature sequence is obtained from the feature vector. The pre-trained random forest classifier is used to identify trading behaviors based on the standardized feature sequence, and the trading behavior attributes are judged by calculating the score value of the feature sequence, and the high-frequency trading tag sequence is obtained from the trading behavior attributes. Continuity detection is performed on the high-frequency trading tag sequence, and the abnormal persistence is judged by setting the minimum duration threshold, and the early warning trigger signal is obtained from the continuity detection result. The position concentration index of the contract is calculated based on the early warning trigger signal, and the position distribution sequence is constructed by calculating the ratio of the position of a single trader to the total position, and the market participant structure is obtained from the position distribution sequence. The price volatility index is calculated for the position distribution sequence, and the volatility sequence is constructed by calculating the standard deviation of the logarithmic return, and the market risk measurement value is obtained from the volatility sequence. The Copula function is used to construct a risk propagation matrix. The risk propagation path is obtained by calculating the dependency structure between different contracts, and the risk impact range is determined from the risk propagation path. The risk level threshold is set for the risk impact range, and a risk assessment report is constructed by comparing the current risk measurement value with the historical quantile. The risk disposal plan is output from the risk assessment report. Taking the real-time monitoring of an option contract as an example, a 5-minute sliding window is used for data collection. From 9:30 to 9:35, 60 price sampling points are recorded, and the calculated price mean is 0.2315 yuan and the standard deviation is 0.0025 yuan. After eliminating the data points that deviate from the mean by more than 3 times the standard deviation, the periodic fluctuation characteristics are extracted. The wavelet transform features of the cleaned data sequence were calculated, and the four statistical moments of the wavelet coefficients were extracted: mean 0.2315, variance 0.0025, skewness 1.856, kurtosis 6.324. At the same time, the energy eigenvalue 385.2 and entropy value 4.52 were calculated, and the 6-dimensional feature vector was constructed and standardized, and the z scores were 0.85, 1.24, 2.85, 3.15, 2.83, and 2.42 respectively. The standardized feature sequence was input into the pre-trained random forest classifier, and the abnormal transaction probability was calculated to be 0.925, which exceeded the preset threshold of 0.8 and was marked as abnormal transaction. Continuous monitoring showed that the abnormal state lasted for 3 time windows from 9:30 to 9:45, meeting the minimum duration threshold and triggering the warning signal. The contract position concentration was calculated. The maximum position of a single trader was 2853 lots, the total position was 28530 lots, and the position concentration was 10%. Statistics show that the cumulative holdings of the top 5 holders account for 35%, and the cumulative holdings of the top 10 holders account for 52%, and the holdings are relatively concentrated.The price volatility is calculated using the logarithmic rate of return method. The standard deviation of the 5-minute rate of return is 0.0285, and the annualized volatility is 52.3%, which is significantly higher than the average level of 45.8% in the previous 20 trading days. At the same time, the volatility of adjacent contracts has also increased. The volatility of the call options of the 50ETF options expiring in September has generally increased by 15% to 25%. The risk propagation matrix is ​​constructed by the Copula function, and the taildependence coefficient (tail correlation coefficient) between this contract and the adjacent strike price contract is calculated to be 0.65, indicating that the risk resonance is strong under extreme market conditions. The risk propagation path shows that price shocks may affect other contracts on the option chain through Delta hedging and volatility spillover effects. The quantile distribution of risk metrics is calculated based on historical data. The current position concentration, volatility and risk propagation coefficient are at the 95%, 90% and 85% quantile levels respectively. After comprehensive evaluation, the risk level is determined to be high, and it is recommended to take measures such as restricting new positions and increasing the margin ratio. The abnormal trading behavior of this contract is highly correlated with market microstructure indicators, reflecting a significant increase in speculative trading activities in the short term. Through real-time monitoring and multi-dimensional risk assessment, a complete closed loop from abnormal behavior identification to risk control has been built.

[0033] The above contents are merely examples and explanations of the structure of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

Claims

1. A multi-dimensional data fusion analysis method for financial transaction anomaly detection, characterized in that: The method comprises: The time series data of open and unclosed contracts are obtained. The time series data of open and unclosed contracts include date, trading volume, opening price, closing price, contract type and exercise price. The time series data are preprocessed to remove noise and outliers to obtain cleaned time series data. For the cleaned time series data, the time series data are decomposed into different frequency sub-bands through wavelet transform. The frequency sub-bands are analyzed separately to extract periodic components reflecting the trading behavior pattern. The periodic components include intraday fluctuation patterns, seasonal effects and market cycles to obtain a set of periodic components on different frequency sub-bands. After obtaining the set of periodic components, the energy characteristics of each frequency sub-band are extracted for the periodic components of each frequency sub-band. The energy size of different frequency sub-bands is obtained by a preset energy calculation method. After obtaining the energy size of different frequency sub-bands, the entropy value of each frequency sub-band is calculated by a preset entropy calculation method to obtain different The entropy value of the same frequency sub-band; if the energy size and entropy value of the frequency sub-band exceed the preset threshold at the same time, the transaction corresponding to the frequency sub-band is determined to be a high-frequency abnormal trading behavior pattern, indicating the existence of short-term speculative behavior. If the energy size or entropy value of the frequency sub-band exceeds the preset threshold, the transaction corresponding to the frequency sub-band is determined to be an abnormal trading behavior pattern; for the frequency sub-band determined to be a high-frequency trading behavior pattern, a classifier based on wavelet transform features is constructed, and by training the wavelet transform features, a classification model for identifying high-frequency trading behavior is obtained, which is used to monitor trading behavior in real time; when there is new time series data of opening and unclosed contracts, the new time series data is preprocessed and periodic components are extracted, and the wavelet transform features are extracted and classified and identified using the trained classification model for identifying high-frequency trading behavior. If the identification result is a high-frequency trading behavior pattern, an early warning is triggered in time, and the corresponding preset risk analysis and disposal are carried out.

2. The method according to claim 1, characterized in that The time series data of the open contracts are obtained, and the time series data of the open contracts include date, trading volume, opening price, closing price, contract type and exercise price. The time series data is preprocessed to remove noise and outliers to obtain cleaned time series data, including: Obtaining a sequence of attribute values ​​including date, trading volume, opening price, closing price, contract type and strike price from the original data of open contracts according to the timestamp, wherein the attribute value sequence is aligned with the prices of each contract through the timestamp; For the missing values ​​in the attribute value sequence, a linear interpolation method is used to obtain the filled open position contract data, and the filled open position contract data is used to obtain time series segmented data through a moving window method; For the time series segmented data, a multi-scale analysis result is obtained by wavelet decomposition, and the multi-scale analysis result is subjected to fixed threshold denoising to obtain denoised opening open position data; For the noise-reduced opening and unclosed contract data, a bilateral Kalman filter is used to perform state prediction and update iteration, and the time series data of the opening and unclosed contracts after smoothing is obtained by setting the state transfer matrix and the observation matrix.

3. The method according to claim 1, characterized in that The cleaned time series data is decomposed into different frequency sub-bands by wavelet transform, and the periodic components reflecting the trading behavior patterns are extracted by analyzing the frequency sub-bands respectively. The periodic components include intraday fluctuation patterns, seasonal effects and market cycles, and a set of periodic components on different frequency sub-bands is obtained, including: Performing a multi-scale decomposition operation on the time series data using discrete wavelet transform, and obtaining high-frequency sub-band coefficients and low-frequency sub-band coefficients from the multi-scale decomposition operation result; Performing a wavelet packet decomposition operation on the low-frequency sub-band coefficients, obtaining a variance contribution rate sequence by calculating the variance ratio of each layer of sub-band coefficients obtained by the wavelet packet decomposition operation, and determining an optimal number of decomposition layers from the variance contribution rate sequence; Performing a wavelet packet decomposition operation on the time series data according to the optimal decomposition layer number, and determining an important frequency sub-band by calculating the Shannon entropy value of the sub-band coefficient sequence obtained by the wavelet packet decomposition operation; Fourier transform is used to perform spectrum decomposition operation on the coefficient sequence of the important frequency subband, main frequency components are obtained from the amplitude curve of the spectrum decomposition operation result, and a set of periodic components is determined through the main frequency components.

4. The method according to claim 1, characterized in that: After obtaining the periodic component set, for the periodic component of each frequency sub-band, extracting the energy feature of each frequency sub-band, obtaining the energy size of different frequency sub-bands by a preset energy calculation method, and after obtaining the energy size of different frequency sub-bands, calculating the entropy value of each frequency sub-band by a preset entropy calculation method, obtaining the entropy value size of different frequency sub-bands, including: For a frequency subband sequence in the periodic component set, obtaining an absolute energy value of the frequency subband by calculating a sum of squares of amplitudes of the subband sequence; constructing a cumulative energy distribution curve according to the absolute energy values ​​of the frequency sub-bands, and obtaining an energy increment sequence by calculating energy differences between adjacent frequency bands; Performing probability density estimation on the energy increment sequence, and obtaining a probability distribution function by establishing histogram statistics of the frequency sub-band; If the probability distribution function meets the sampling requirements, the Shannon entropy formula is used to calculate the probability density value of the frequency subband, the information entropy of the frequency subband is obtained by the negative logarithmic expected value of the probability density value, and the entropy value of the frequency subband is obtained from the information entropy sequence.

5. The method according to claim 1, characterized in that If the energy size and entropy value of the frequency sub-band both exceed the preset threshold, the transaction corresponding to the frequency sub-band is determined to be a high-frequency abnormal transaction behavior pattern, indicating the existence of short-term speculative behavior; if the energy size or entropy value of the frequency sub-band exceeds the preset threshold, the transaction corresponding to the frequency sub-band is determined to be an abnormal transaction behavior pattern, including: Calculate the energy mean μ and standard deviation σ of the frequency sub-band according to the historical transaction data, perform normalization processing on the frequency sub-band energy by calculating z value = (x-μ) / σ, and obtain a normalized energy sequence from the normalization processing, where x is the energy value of the frequency sub-band; An upper threshold is set for the normalized energy sequence using the principle of three times the standard deviation, and an energy fluctuation boundary value of the frequency sub-band is obtained from the upper threshold; Calculate the statistical distribution of the entropy value sequence using a quartile-based method, and obtain an entropy value upper limit threshold from the statistical distribution, wherein the entropy value upper limit threshold is determined by the 75th percentile value and the interquartile range; If the normalized energy value exceeds the energy fluctuation boundary value or the entropy value exceeds the entropy value upper limit threshold, it is judged from the trading volume and the position that the frequency sub-band contains abnormal trading characteristics, and based on the abnormal trading characteristics, it is determined that the transaction corresponding to the frequency sub-band is an abnormal trading behavior pattern.

6. The method according to claim 1, characterized in that The method constructs a classifier based on wavelet transform features for the frequency subbands determined to be high-frequency trading behavior patterns, and obtains a classification model for identifying high-frequency trading behaviors by training the wavelet transform features, which is used to monitor trading behaviors in real time, including: Wavelet packet transform is used to extract features from high-frequency trading data. The statistical features are obtained by calculating the mean, variance, skewness and kurtosis of the wavelet coefficients, and the frequency domain features are obtained from the energy distribution and entropy distribution of the wavelet coefficients. The statistical features and the frequency domain features are sorted according to the importance scoring method of the statistical features and the frequency domain features, and a feature subset is obtained by screening by setting an importance threshold; Constructing a training data matrix for the feature subset, and determining optimal parameter values ​​of a random forest classifier using a cross-validation method from the training data matrix; Feature vectors are extracted from real-time trading data according to a fixed time window, normalized values ​​are calculated from the feature vectors to obtain standardized feature sequences, and high-frequency trading behaviors are determined based on the standardized feature sequences.

7. The method according to claim 1, characterized in that When there is new time series data of open contracts, the new time series data is preprocessed and periodic components are extracted. The wavelet transform features are extracted and classified and identified using the trained classification model for identifying high-frequency trading behaviors. If the identification result is a high-frequency trading behavior pattern, an early warning is triggered in time, and corresponding preset risk analysis and disposal are carried out, including: A sliding time window is used to collect the data of open contracts in real time, and the cleaned data sequence is obtained by calculating the mean and standard deviation of the price sequence within the time window; Performing wavelet transform decomposition on the cleaned data sequence, and obtaining a standardized feature sequence by extracting statistical moments and energy distribution characteristics of wavelet transform coefficients; According to the standardized feature sequence, a pre-trained random forest classifier is input, and the transaction behavior attribute is judged by calculating the feature sequence score value. If the score value exceeds a preset threshold, a high-frequency transaction mark sequence is obtained; Calculate the position concentration index for the high-frequency trading mark sequence, obtain the position distribution sequence by calculating the ratio of the position of a single trader to the total position, construct a risk propagation matrix based on the position distribution sequence, obtain the risk propagation path by calculating the dependency structure of different contracts, and judge the risk impact range from the risk propagation path; Set risk level thresholds based on the risk impact scope, build a risk assessment report by comparing the current risk measurement value with the historical quantile, and output the risk disposal plan from the risk assessment report.

Images