Abnormal threshold updating method, abnormal transaction identification method, equipment and medium

Abstract

The invention provides an abnormal threshold updating method, an abnormal transaction identification method, equipment and a medium, and the abnormal threshold updating method comprises the steps: obtaining a performance evaluation data set in a transaction data flow; calculating a model performance index based on the performance evaluation data set; and when the model performance index does not meet the performance index threshold requirement, performing iterative updating on the abnormal threshold by using the target function to obtain the updated abnormal threshold. According to the scheme, when the model performance index does not meet the performance index threshold requirement, the target function is utilized to iteratively update the abnormal threshold, so that the abnormal transaction recognition model can dynamically adjust the decision threshold according to the transaction data and the model performance, and the flexibility of the abnormal transaction recognition model is improved; besides, by dynamically updating the decision threshold, the abnormal transaction recognition model can adapt to new abnormal behaviors and transaction modes, and the reliability of the abnormal transaction recognition model can be improved.

Description

Technical Field

[0001] The present application relates to the field of payment security technology, and in particular to an abnormal threshold updating method, an abnormal transaction identification method, a device and a medium. Background Art

[0002] At present, with the maturity of electronic payment business, electronic payment has also become popular. However, along with electronic payment, there are also abnormal behaviors such as fraud, system vulnerabilities, malicious attacks, etc., which lead to abnormal transactions. These abnormal transactions will affect the security and stability of electronic payment business. Therefore, it is necessary to identify abnormal transactions in electronic payment business and deal with them accordingly.

[0003] Related technologies generally use machine learning models with fixed decision thresholds to identify abnormal transactions. However, due to certain differences between transaction patterns of different payment services, machine learning models with fixed decision thresholds are less effective in identifying abnormal transactions in scenarios with multiple transaction patterns. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide an abnormal threshold updating method, an abnormal transaction identification method, a device and a medium, so as to improve the abnormal transaction identification effect of the machine learning model in a scenario with multiple transaction modes.

[0005] In a first aspect, an embodiment of the present application provides a method for updating an abnormality threshold, the method comprising:

[0006] Acquire a performance evaluation data set in the transaction data stream; wherein the performance evaluation data set includes historical input data of the abnormal transaction identification model, model identification results corresponding to the historical input data, and real results;

[0007] Calculating model performance indicators based on the performance evaluation data set;

[0008] When the model performance indicator does not meet the performance indicator threshold requirement, the abnormal threshold is iteratively updated using the objective function to obtain the updated abnormal threshold; wherein the objective function is used to characterize the performance loss of the abnormal transaction identification model; the updated abnormal threshold is used in the abnormal transaction decision process of the abnormal transaction identification model.

[0009] In the implementation process of the above scheme, by obtaining a performance evaluation data set from the transaction data stream, calculating the model performance index based on the performance evaluation data set, and iteratively updating the abnormal threshold using the objective function when the model performance index does not meet the performance index threshold requirement, the updated abnormal threshold is obtained, and the abnormal transaction identification model can make decisions based on the updated abnormal threshold. On the one hand, the above scheme uses the objective function to iteratively update the abnormal threshold when the model performance index does not meet the performance index threshold requirement, so that the abnormal transaction identification model can dynamically adjust the decision threshold according to the transaction data and model performance, which is conducive to improving the flexibility of the abnormal transaction identification model; on the other hand, by dynamically updating the decision threshold, the abnormal transaction identification model can adapt to new abnormal behaviors and transaction patterns, which is conducive to improving the reliability of the abnormal transaction identification model.

[0010] In an implementation of the first aspect, the iterative updating of the abnormality threshold using the objective function includes: based on the model performance indicator, respectively calculating the objective function components in the objective function corresponding to the model performance indicator; wherein the objective function components include a false alarm rate component and a missed alarm rate component; based on the objective function components, obtaining an objective function value; based on the objective function value, updating the abnormality threshold using a gradient descent method.

[0011] In the process of implementing the above scheme, the objective function is constructed using the false alarm rate indicator and the missed alarm rate indicator that can accurately reflect the model classification performance. On the one hand, it can clarify the optimization direction of the abnormal transaction identification model, which is conducive to improving the optimization effect of the abnormal transaction identification model; on the other hand, it enables the abnormal transaction model to pay more attention to the ability to distinguish abnormal transactions from normal transactions, which is conducive to improving the robustness of the abnormal transaction identification model.

[0012] In an implementation of the first aspect, obtaining the objective function value based on the objective function components includes: performing weighted processing on the objective function components based on component weights to obtain the objective function value; wherein the component weights are determined based on the importance of the objective function components in the model performance optimization process.

[0013] In the implementation process of the above scheme, the importance of each objective function component is balanced by component weights. On the one hand, the above abnormal threshold updating method can be applied to more application scenarios, which is beneficial to improving the flexibility and adaptability of the above abnormal threshold updating method; on the other hand, the model performance can be accurately tuned by updating the abnormal threshold, which is beneficial to improving the stability of the abnormal transaction identification model.

[0014] In an implementation of the first aspect, the method further includes: obtaining a new performance evaluation data set in the transaction data stream; wherein the new performance evaluation data set includes the historical input data of the new abnormal transaction identification model, the model identification result and the actual result; the new abnormal transaction identification model makes abnormal transaction decisions based on the updated abnormal threshold; based on the new performance evaluation data set, calculating a new model performance indicator; if the new model performance indicator does not meet the performance indicator threshold requirement, adjusting the new abnormal threshold to the original abnormal threshold, or continuing to iteratively update the abnormal threshold using the objective function until the new model performance indicator meets the performance indicator threshold requirement.

[0015] In the implementation process of the above scheme, after the anomaly identification model uses the updated anomaly threshold to make a decision, the updated anomaly threshold is fed back to determine whether the model performance after the anomaly threshold is updated meets expectations, which is conducive to improving the dynamic adaptability and flexibility of the abnormal transaction identification model.

[0016] In an implementation of the first aspect, calculating the model performance index based on the performance evaluation data set includes:

[0017] Based on the performance evaluation data set, at least one model performance indicator among accuracy, recall, F1 score, false alarm rate and false negative rate is calculated.

[0018] In the implementation process of the above scheme, at least one model performance indicator among accuracy, recall rate, F1 score, false alarm rate and missed alarm rate can be calculated based on the performance evaluation data set, so that the model performance indicator can more fully characterize the classification effect and generalization ability of the model, which is conducive to improving the abnormal threshold optimization effect of the above abnormal threshold update method.

[0019] In an implementation of the first aspect, obtaining the performance evaluation data set in the transaction data stream includes: obtaining the performance evaluation data set in the transaction data stream with a preset sliding window size and a preset sliding step size.

[0020] In the implementation process of the above scheme, a sliding window method is adopted to obtain a performance evaluation data set, and the model performance index calculation and abnormal threshold update are performed based on the performance evaluation data set. On the one hand, transaction data within a period of time from the current time is used as the performance evaluation data set, which is conducive to improving the adaptability of the abnormal transaction identification model to transaction patterns and abnormal behaviors; on the other hand, the performance evaluation data set is updated at each preset sliding step, so that the performance evaluation data set can reflect the dynamic changes of transaction data, thereby enabling the abnormal transaction identification model to be sensitive to the transaction environment, which is conducive to improving the dynamic adaptability of the abnormal transaction identification model.

[0021] In a second aspect, an embodiment of the present application provides a method for identifying abnormal transactions, the method comprising:

[0022] Obtaining transaction data of the transaction to be identified;

[0023] Taking the transaction data as input, an abnormal transaction identification result is obtained using a trained abnormal transaction identification model; wherein the abnormal threshold when the abnormal transaction identification model makes an abnormal transaction decision is determined based on the abnormal threshold updating method according to any one of claims 1 to 6.

[0024] In an implementation of the second aspect, the method further includes:

[0025] Regularly calculating the model performance index of the abnormal transaction identification model;

[0026] If the model performance index fails to meet the performance index threshold requirement for a preset number of consecutive times, the abnormal transaction identification model is retrained to obtain the retrained abnormal transaction identification model.

[0027] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory, and a communication bus, wherein the processor and the memory communicate with each other through the communication bus; the memory stores computer program instructions that can be executed by the processor, and when the computer program instructions are read and run by the processor, the method provided by the first aspect or any possible implementation of the first aspect or the second aspect or any possible implementation of the second aspect is executed.

[0028] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are read and executed by a processor, the method provided by the first aspect or any possible implementation of the first aspect or the second aspect or any possible implementation of the second aspect is executed.

[0029] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the embodiments of the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 A flowchart of an abnormality threshold updating method provided in an embodiment of the present application;

[0032] Figure 2 A flowchart of an abnormal transaction identification method provided in an embodiment of the present application;

[0033] Figure 3 A schematic diagram of the structure of an abnormality threshold updating device provided in an embodiment of the present application;

[0034] Figure 4 A schematic diagram of the structure of an abnormal transaction identification device provided in an embodiment of the present application;

[0035] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] The following will describe the technical solutions in the embodiments of the present application in conjunction with the accompanying drawings in the embodiments of the present application. The following embodiments are only used to more clearly illustrate the technical solutions of the present application, and are therefore only used as examples, and cannot be used to limit the scope of protection of the present application.

[0037] In the related art, the scheme of using machine learning models to identify abnormal transactions generally uses the transaction data to be identified as the input of the machine learning model, obtains the predicted probability of the transaction to be identified as an abnormal transaction output by the model, and then judges whether the predicted probability is greater than the decision threshold based on the predicted probability and the decision threshold. If it is greater than the decision threshold, it means that the transaction to be identified is an abnormal transaction. The process of making decisions based on the predicted probability and the decision threshold can be expressed as:

[0038]

[0039] in, is the predicted label; ifp is the predicted probability of the model output; θ is the decision threshold.

[0040] Related technologies generally use a fixed decision threshold θ to identify abnormal transactions. However, due to differences in transaction data type, data scale, data distribution, etc. between transaction modes of different payment services, the fixed decision threshold may not be able to adapt to changes in transaction modes, resulting in excessively high false positive rates in some cases and high false negative rates in other cases, resulting in poor abnormal transaction identification results. In addition, even if model performance problems are found, they usually rely on manual settings and adjustments. Manually set decision thresholds are usually based on personal experience, and the threshold settings are not accurate enough, which further deteriorates the abnormal transaction identification results.

[0041] Based on this, an embodiment of the present application provides an abnormal threshold updating method, which obtains a performance evaluation data set in a transaction data stream, calculates a model performance index based on the performance evaluation data set, and iteratively updates the abnormal threshold using an objective function when the model performance index meets the performance index threshold requirement, thereby obtaining an updated abnormal threshold, and the abnormal transaction identification model can make a decision based on the updated abnormal threshold. On the one hand, the above scheme uses an objective function to iteratively update the abnormal threshold when the model performance index does not meet the performance index threshold requirement, so that the abnormal transaction identification model can dynamically adjust the decision threshold according to the transaction data and model performance, thereby helping to improve the flexibility of the abnormal transaction identification model; on the other hand, by dynamically updating the decision threshold, the abnormal transaction identification model can adapt to new abnormal behaviors and transaction patterns, which is conducive to improving the reliability of the abnormal transaction identification model.

[0042] The following is an introduction to the above abnormal threshold update method:

[0043] See also Figure 1 , an embodiment of the present application provides a method for updating an abnormality threshold, the method comprising:

[0044] Step S110: obtaining a performance evaluation data set in the transaction data stream; wherein the performance evaluation data set includes historical input data of the abnormal transaction identification model, model identification results corresponding to the historical input data, and real results;

[0045] Step S120: Calculating model performance indicators based on the performance evaluation data set;

[0046] Step S130: When the model performance index does not meet the performance index threshold requirement, the abnormal threshold is iteratively updated using the objective function to obtain an updated abnormal threshold.

[0047] Among them, the objective function is used to characterize the performance loss of the abnormal transaction identification model; the updated abnormal threshold is used in the abnormal transaction decision process of the abnormal transaction identification model.

[0048] The transaction data stream in the above step S110 refers to a continuous data stream generated in real time and containing transaction information. The transaction data stream is a real-time record of each transaction or part of a transaction occurring in a payment service, and contains transaction information such as transaction amount, transaction time, transaction location, identity information of both parties to the transaction, and transaction type. The transaction data of a transaction in the transaction data stream can be used as the input of the abnormal transaction identification model to obtain the abnormal transaction identification result of the abnormal transaction identification model.

[0049] The above-mentioned performance evaluation data set may include historical input data of the abnormal transaction identification model, model identification results corresponding to the historical input data, and actual results, wherein the actual results can be obtained through manual labeling, payment business feedback, etc.

[0050] Most of the abnormal transaction identification models in related technologies rely on static test data sets, which are often not updated in real time and cannot fully reflect the dynamic changes in the real-time transaction environment. There is a big difference between the performance of the model in the test data set and the performance in the actual application scenario. Especially in the application environment with large transaction volume and complex transaction mode, the static test data set will affect the dynamic adaptability of the model. Based on this, the embodiment of the present application provides the following solution:

[0051] As an optional implementation of the above abnormal threshold updating method, the above step S110 includes: obtaining a performance evaluation data set in the transaction data stream with a preset sliding window size and a preset sliding step size. This implementation is for example:

[0052] The performance evaluation dataset is obtained in the transaction data stream with a preset window size of 30 minutes and a preset sliding step size of 5 minutes.

[0053] It can be understood that the acquired performance evaluation data set includes transaction data within a preset window size before the current time. For example, the preset window size is 30 minutes. At this time, the acquired performance evaluation data set can include transaction data within 30 minutes before the current time. The preset sliding step size can be understood as the sampling interval of the performance evaluation data set. For example, the preset sliding step size is 5 minutes. At this time, the above step S110 can pull the performance evaluation data set from the transaction data stream every 5 minutes.

[0054] The above scheme adopts a sliding window method to obtain a performance evaluation data set, and calculates model performance indicators and updates abnormal thresholds based on the performance evaluation data set. On the one hand, using transaction data within a period of time from the current time as the performance evaluation data set is conducive to improving the adaptability of the abnormal transaction identification model to transaction patterns and abnormal behaviors; on the other hand, the performance evaluation data set is updated at each preset sliding step, so that the performance evaluation data set can reflect the dynamic changes of transaction data, thereby enabling the abnormal transaction identification model to be sensitive to the transaction environment, which is conducive to improving the dynamic adaptability of the abnormal transaction identification model.

[0055] In addition, it can be understood that the model performance indicator calculation step in step S120 can also be performed periodically, and the regular interval can be set to the above-mentioned sliding step size.

[0056] The following is an introduction to the solution of calculating the model performance index based on the performance evaluation data set in step S120:

[0057] As an optional implementation of the above abnormal threshold updating method, the above step S120 includes:

[0058] Based on the performance evaluation dataset, calculate at least one model performance indicator among precision, recall, F1 score, false positive rate, and false negative rate.

[0059] The above accuracy is used to measure the proportion of samples predicted correctly by the model to the total samples, and the calculation method can be:

[0060]

[0061] Among them, Accuracy is the accuracy rate; TP is the number of true positive examples; TN is the number of true negative examples; FP is the number of false positive examples; FN is the number of false negative examples.

[0062] The recall rate is used to measure the ability of the model to identify positive examples, that is, the proportion of samples that are actually positive examples that are correctly predicted as positive examples. The calculation method can be:

[0063]

[0064] Among them, Recall is the recall rate.

[0065] The above F1 score is the harmonic mean of precision and recall, which is used to comprehensively evaluate the performance of the model. The calculation method can be:

[0066]

[0067]

[0068] Among them, Precision is the accuracy.

[0069] The above false alarm rate refers to the proportion of normal transactions among all samples identified as abnormal transactions by the model. The calculation method can be:

[0070]

[0071] Among them, FPR is the false alarm rate;

[0072] The above-mentioned false negative rate refers to the proportion of all actually abnormal transaction samples that are judged as normal transactions by the model. The calculation method can be:

[0073]

[0074] Among them, FNR is the false negative rate.

[0075] The above scheme can calculate at least one model performance indicator among accuracy, recall, F1 score, false alarm rate and missed alarm rate based on the performance evaluation data set, so that the model performance indicator can more fully characterize the classification effect and generalization ability of the model, and then evaluate the model performance from multiple dimensions, which is conducive to improving the abnormal threshold optimization effect of the above abnormal threshold update method.

[0076] The following is an introduction to the scheme of step S130 for determining whether the model performance index meets the performance index threshold requirement:

[0077] The model performance indicators introduced in the above content may include at least one of the accuracy, recall, F1 score, false alarm rate and missed alarm rate. When the model performance indicators only include one of the above multiple indicators, step S130 can directly determine whether the value of the model performance indicator meets the performance indicator threshold requirement corresponding to the indicator. If not, the abnormal threshold is iteratively updated using the objective function. When the model performance indicator includes one of the above multiple indicators, step S130 can weight the multiple indicators into a comprehensive indicator according to the preset weighted weights, and then based on whether the value of the comprehensive indicator meets the performance indicator threshold requirement corresponding to the comprehensive indicator, if not, the abnormal threshold is iteratively updated using the objective function. Of course, different application scenarios may have different performance emphases. For example, in order to pursue a high recall rate, some scenarios may sacrifice a certain degree of accuracy. Therefore, for scenarios with specific performance goals, it is possible to judge whether the model performance indicators meet the performance indicator threshold requirements only through the performance goals to be pursued. When one indicator, multiple indicators, or all indicators in the performance goals to be pursued meet the corresponding performance indicator threshold requirements, the model performance is judged to meet the performance indicator threshold requirements; otherwise, the model performance indicators are judged to not meet the performance indicator threshold requirements.

[0078] The following is an introduction to the scheme of iteratively updating the abnormal threshold using the objective function in step S130:

[0079] It can be understood that the above objective function can be used to characterize the performance loss of the abnormal transaction identification model. Taking the objective function including the accuracy component as an example, the accuracy component in the objective function can be the inverse of the accuracy. The higher the accuracy, the smaller the objective function value, which means that the performance loss of the abnormal transaction identification model is also smaller.

[0080] The objective function can be expressed as:

[0081] Objective=A1+A2+…+A n

[0082] Among them, Objective is the objective function; A n is the nth objective function component, and the objective function component can be calculated based on the model performance index calculated in the above step S120.

[0083] The following is a way to implement the objective function:

[0084] As an optional implementation of the above-mentioned abnormal threshold updating method, the above-mentioned step S130 uses the objective function to iteratively update the abnormal threshold, including: based on the model performance index, respectively calculating the objective function components corresponding to the model performance index in the objective function; wherein the objective function components include a false alarm rate component and a false negative rate component; based on the objective function components, obtaining an objective function value; based on the objective function value, using the gradient descent method to update the abnormal threshold. This implementation is, for example:

[0085] The objective function including the false alarm rate component and the missed alarm rate component is expressed as:

[0086] Objective=FPR+FNR

[0087] The value of the objective function Objective may be calculated based on the FPR and FNR calculated in step S120;

[0088] The anomaly threshold is then updated using an optimization algorithm such as gradient descent to minimize the objective function:

[0089]

[0090] Among them, θ t is the current abnormal threshold; θ t+1 is the updated abnormal threshold; η is the learning rate; is the gradient of the objective function with respect to the anomaly threshold;

[0091] When calculating the gradient, numerical methods such as finite differences or analytical methods can be used. The calculation method of the gradient can be expressed as:

[0092]

[0093] in, is the gradient of the indicator FPR to the abnormal threshold; is the gradient of the indicator FNR to the abnormal threshold.

[0094] The above scheme uses the false alarm rate indicator and the missed alarm rate indicator that can accurately reflect the model classification performance to construct the objective function. On the one hand, it can clarify the optimization direction of the abnormal transaction identification model, which is conducive to improving the optimization effect of the abnormal transaction identification model; on the other hand, it enables the abnormal transaction model to pay more attention to the ability to distinguish abnormal transactions from normal transactions, which is conducive to improving the robustness of the abnormal transaction identification model.

[0095] As an optional implementation of the above abnormal threshold updating method, the above-mentioned obtaining the objective function value based on the objective function component includes: performing weighted processing on the objective function component based on the component weight to obtain the objective function value; wherein the component weight is determined based on the importance of the objective function component in the model performance optimization process. This implementation is for example:

[0096] The component weight of the false alarm rate component is preset as α, and the component weight of the missed alarm rate component is preset as β. The calculation method of the objective function can be expressed as:

[0097] Objective=α·FPR+β·FNR

[0098]

[0099]

[0100] It can be understood that the above-mentioned component weight α and component weight β can be used to balance the importance of false alarm rate and missed alarm rate. The component weight α and component weight β can be fixed weights pre-set based on the scenario, or can be weights that can be adjusted dynamically. For example, when it is found that the false alarm rate of the model is high in a certain time period, the component weight α of the false alarm rate can be appropriately increased to reduce the false alarm rate; conversely, when it is found that the missed alarm rate of the model is high in a certain time period, the component weight β of the missed alarm rate can be appropriately increased to reduce the missed alarm rate. Of course, the component weight α and component weight β can also be adjusted based on the performance requirements in different scenarios. For example, some scenarios focus on the false alarm rate of the model, so the false alarm rate component weight α can be set to a larger value.

[0101] The above scheme balances the importance of each objective function component through component weights. On the one hand, it enables the above anomaly threshold updating method to be applicable to more application scenarios, which is beneficial to improving the flexibility and adaptability of the above anomaly threshold updating method; on the other hand, the model performance can be accurately tuned by updating the anomaly threshold, which is beneficial to improving the stability of the abnormal transaction identification model.

[0102] As an optional implementation of the above-mentioned abnormal threshold updating method, the above-mentioned abnormal threshold updating method also includes: obtaining a new performance evaluation data set in the transaction data stream; wherein the new performance evaluation data set includes the historical input data, the model recognition result and the real result of the new abnormal transaction identification model; the new abnormal transaction identification model makes abnormal transaction decisions based on the updated abnormal threshold; based on the new performance evaluation data set, calculates a new model performance indicator; if the new model performance indicator does not meet the performance indicator threshold requirement, adjusts the new abnormal threshold to the original abnormal threshold, or continues to iteratively update the abnormal threshold using the objective function until the new model performance indicator meets the performance indicator threshold requirement.

[0103] It is understandable that the steps of acquiring the new performance evaluation data set, calculating the model performance index based on the new performance evaluation data set, and updating the updated abnormal threshold value again can be understood as a threshold feedback process. The above content introduces that the above steps S110 to S130 can be performed regularly, and the above threshold feedback process can be performed after a preset time after the abnormal transaction identification model uses the updated abnormal threshold value for decision making, and the preset time can be less than the sliding step size of the above sliding window.

[0104] The above scheme provides feedback on the updated abnormal threshold after the abnormal identification model uses the updated abnormal threshold to make decisions, so as to determine whether the model performance after the abnormal threshold is updated meets expectations, which is conducive to improving the dynamic adaptability and flexibility of the abnormal transaction identification model.

[0105] See also Figure 2 The present application provides an abnormal transaction identification method, the method comprising:

[0106] Step S210: Acquire transaction data of the transaction to be identified;

[0107] Step S220: using the transaction data as input and using the trained abnormal transaction identification model to obtain abnormal transaction identification results; wherein the abnormal threshold used by the abnormal transaction identification model when making abnormal transaction decisions is determined based on any of the above abnormal threshold updating methods.

[0108] As an optional implementation of the above abnormal transaction identification method, the above abnormal transaction identification method further includes:

[0109] Regularly calculating the model performance index of the abnormal transaction identification model;

[0110] If the model performance index fails to meet the performance index threshold requirement for a preset number of consecutive times, the abnormal transaction identification model is retrained to obtain the retrained abnormal transaction identification model.

[0111] It is understandable that the above abnormal transaction identification model can be constructed based on deep learning model and ensemble learning. The model architecture and ensemble learning method of the abnormal transaction identification model are introduced below:

[0112] (1) Model architecture:

[0113] The abnormal transaction recognition model can be constructed by using neural network models such as fully connected neural network DNN, convolutional neural network CNN and recurrent neural network RNN. Taking the fully connected neural network as an example, the structure of the abnormal transaction recognition model is introduced:

[0114] The abnormal transaction identification model consists of multiple layers, each layer includes several neurons. Assume that the input layer has n neurons, the hidden layer has m neurons, and the output layer has k neurons. The connections between neurons have weight parameters w and bias parameters b. The output of the neuron in the lth layer is a (l) It can be expressed by the following formula:

[0115] z (l) =W (l) a (l-1) +b (l)

[0116] a (l) =σ(Z (l) )

[0117] Where σ is the activation function, which can be ReLU activation function or Sigmoid activation function. The final output Calculated from the output of the last layer:

[0118]

[0119] The loss function of the model can be used to measure the difference between the model's predicted value and the true value, such as the cross entropy loss function:

[0120]

[0121] Among them, m is the number of samples, y (i) is the true label of sample i, is the probability predicted by the model.

[0122] When training the model, the back propagation algorithm and gradient descent method can be used to optimize the weight and bias parameters of the model. The gradient descent update rule can be:

[0123]

[0124]

[0125] Among them, α is the learning rate, and are the gradients of the loss function with respect to weights and biases, respectively.

[0126] (2) Integrated learning method:

[0127] Ensemble learning algorithms improve the accuracy of abnormal transaction detection by combining the prediction results of multiple models. Ensemble learning methods include random forest and gradient boosting tree. Among them, the ensemble learning algorithm based on random forest is as follows:

[0128] A random forest is composed of multiple decision trees. Each tree extracts a random subset from the data set during training and selects the best feature for splitting at each node. The final prediction result is obtained by the voting results of all decision trees.

[0129] When training a decision tree, each tree is trained by recursively selecting the optimal feature split data, and the information gain or Gini impurity is used to evaluate the split effect. Assuming that at node t, the information gain can be expressed as:

[0130]

[0131] Among them, H(D) is the entropy of node t, D i is the sample set of child nodes, and k is the number of child nodes.

[0132] When using random forests to predict results, the final prediction result of random forests is the weighted average of all decision tree prediction results:

[0133]

[0134] Where T is the number of decision trees, is the prediction result of the tth decision tree.

[0135] It can be understood that the abnormal transaction identification model combines deep learning and ensemble learning, and the model is able to identify abnormal transactions more accurately.

[0136] The following describes the specific implementation of the above abnormal transaction identification model in a certain scenario:

[0137] (1) Model parameters:

[0138] A multi-layer fully connected neural network is used. The input layer receives a 200-dimensional feature vector, the first hidden layer has 256 neurons, the second hidden layer has 128 neurons, the third hidden layer has 64 neurons, the output layer has 1 neuron, the activation function is Sigmoid, and the output risk score (0-1) is used. The optimization algorithm uses Adam, with a learning rate of 0.001, beta1 of 0.9, and beta2 of 0.999. Regularization techniques include L2 regularization (coefficient 0.01) and Dropout (discard rate 0.5).

[0139] (2) Feature Engineering:

[0140] Principal component analysis (PCA) was used to reduce the feature dimension from 200 to 50. The ensemble learning part included random forest (100 trees, maximum depth 10) and gradient boosted tree (GBDT) (200 trees, learning rate 0.01, maximum depth 6). Model fusion was performed by weighted averaging, with a weight of 0.6 for the deep learning model and 0.4 for the ensemble learning model.

[0141] See also Figure 3 Based on the same inventive concept, the embodiment of the present application further provides an abnormality threshold updating device 300, which includes:

[0142] The performance evaluation data set acquisition module 310 is used to acquire a performance evaluation data set in the transaction data stream; wherein the performance evaluation data set includes historical input data of the abnormal transaction identification model, model identification results corresponding to the historical input data, and real results;

[0143] A model performance index calculation module 320, used to calculate a model performance index based on the performance evaluation data set;

[0144] The abnormal threshold updating module 330 is used to iteratively update the abnormal threshold using the objective function to obtain the updated abnormal threshold when the model performance indicator does not meet the performance indicator threshold requirement; wherein the objective function is used to characterize the performance loss of the abnormal transaction identification model; the updated abnormal threshold is used in the abnormal transaction decision-making process of the abnormal transaction identification model.

[0145] As an optional implementation of the above-mentioned abnormal threshold updating device, the above-mentioned abnormal threshold updating module 330 is specifically used to: based on the model performance indicator, respectively calculate the objective function components in the objective function corresponding to the model performance indicator; wherein the objective function components include a false alarm rate component and a missed alarm rate component; based on the objective function components, obtain the objective function value; based on the objective function value, use the gradient descent method to update the abnormal threshold.

[0146] As an optional implementation of the above-mentioned abnormal threshold updating device, the above-mentioned abnormal threshold updating module 330 obtains the objective function value based on the objective function component, including: weighting the objective function component based on the component weight to obtain the objective function value; wherein the component weight is determined based on the importance of the objective function component in the model performance optimization process.

[0147] As an optional implementation of the abnormality threshold updating device, the abnormality threshold updating device 300 further includes:

[0148] A feedback module is used to obtain a new performance evaluation data set in the transaction data stream; wherein the new performance evaluation data set includes the historical input data of the new abnormal transaction identification model, the model identification result and the real result; the new abnormal transaction identification model makes abnormal transaction decisions based on the updated abnormal threshold; based on the new performance evaluation data set, a new model performance indicator is calculated; if the new model performance indicator does not meet the performance indicator threshold requirement, the new abnormal threshold is adjusted to the original abnormal threshold, or the abnormal threshold is continuously iteratively updated using the objective function until the new model performance indicator meets the performance indicator threshold requirement.

[0149] As an optional implementation of the above-mentioned abnormal threshold updating device, the above-mentioned model performance indicator calculation module 320 is specifically used to: calculate at least one model performance indicator among accuracy, recall rate, F1 score, false alarm rate and missed alarm rate based on the performance evaluation data set.

[0150] As an optional implementation of the above-mentioned abnormal threshold updating device, the above-mentioned performance evaluation data set acquisition module 310 is specifically used to: acquire the performance evaluation data set in the transaction data stream with a preset sliding window size and a preset sliding step size.

[0151] See also Figure 4 Based on the same inventive concept, the embodiment of the present application further provides an abnormal transaction identification device 400, which includes:

[0152] The transaction data acquisition module 410 is used to acquire the transaction data of the transaction to be identified;

[0153] The abnormal transaction identification module 420 takes the transaction data as input and uses the trained abnormal transaction identification model to obtain abnormal transaction identification results; wherein the abnormal threshold of the abnormal transaction identification model when making abnormal transaction decisions is determined based on any of the above-mentioned abnormal threshold updating methods.

[0154] As an optional implementation of the abnormal transaction identification device, the abnormal transaction identification device 400 further includes:

[0155] The retraining module is used to periodically calculate the model performance index of the abnormal transaction identification model; if the model performance index fails to meet the performance index threshold requirement for a consecutive preset number of times, the abnormal transaction identification model is retrained to obtain the retrained abnormal transaction identification model.

[0156] Figure 5 A schematic diagram of an electronic device provided in an embodiment of the present application. Figure 5 The electronic device 500 includes: a processor 510, a memory 520 and a communication interface 530. These components are interconnected and communicate with each other through a communication bus 540 and / or other forms of connection mechanisms (not shown).

[0157] The memory 520 includes one or more (only one is shown in the figure), which may be, but not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc. The processor 510 and other possible components may access the memory 520 and read and / or write data therein.

[0158] The processor 510 includes one or more (only one is shown in the figure), which can be an integrated circuit chip with signal processing capabilities. The above-mentioned processor 510 can be a general-purpose processor, including a central processing unit (CPU), a micro controller unit (MCU), a network processor (NP) or other conventional processors; it can also be a special-purpose processor, including a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0159] The communication interface 530 includes one or more (only one is shown in the figure), which can be used to communicate directly or indirectly with other devices to exchange data. For example, the communication interface 530 can be an Ethernet interface; it can be a mobile communication network interface, such as an interface of a 3G, 4G, or 5G network; or it can be other types of interfaces with data transceiving functions.

[0160] One or more computer program instructions may be stored in the memory 520 , and the processor 510 may read and execute these computer program instructions to implement the abnormal threshold updating method, abnormal transaction identification method and other desired functions provided in the embodiments of the present application.

[0161] Understandably, Figure 5 The structure shown is for illustration only. The electronic device 500 may also include Figure 5 More or fewer components as shown, or with Figure 5 Different configurations are shown. Figure 5 Each component shown in the figure can be implemented by hardware, software or a combination thereof. For example, the electronic device 500 can be a single server (or other device with computing processing capabilities), a combination of multiple servers, a cluster of a large number of servers, etc., and can be both a physical device and a virtual device.

[0162] The present application also provides a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are read and executed by a computer processor, the abnormal threshold updating method and abnormal transaction identification method provided in the present application are executed. For example, the computer-readable storage medium can be implemented as Figure 5 The memory 520 in the electronic device 500.

[0163] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0164] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0165] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0166] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0167] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0168] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0169] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for updating an abnormal threshold, characterized in that: The method comprises: Acquire a performance evaluation data set in the transaction data stream; wherein the performance evaluation data set includes historical input data of the abnormal transaction identification model, model identification results corresponding to the historical input data, and real results; Calculating model performance indicators based on the performance evaluation data set; When the model performance indicator does not meet the performance indicator threshold requirement, the abnormal threshold is iteratively updated using the objective function to obtain the updated abnormal threshold; wherein the objective function is used to characterize the performance loss of the abnormal transaction identification model; the updated abnormal threshold is used in the abnormal transaction decision process of the abnormal transaction identification model.

2. The abnormality threshold updating method according to claim 1, characterized in that: The iterative updating of the abnormal threshold using the objective function includes: Based on the model performance index, respectively calculating the objective function components corresponding to the model performance index in the objective function; wherein the objective function components include a false alarm rate component and a false negative rate component; Based on the objective function components, obtaining an objective function value; Based on the objective function value, the abnormal threshold is updated using the gradient descent method.

3. The abnormality threshold updating method according to claim 2, characterized in that: The obtaining of the objective function value based on the objective function component comprises: The objective function components are weighted based on component weights to obtain an objective function value; wherein the component weights are determined based on the importance of the objective function components in the model performance optimization process.

4. The abnormality threshold updating method according to claim 1, characterized in that: The method further comprises: Acquire the new performance evaluation data set in the transaction data stream; wherein the new performance evaluation data set includes the historical input data of the new abnormal transaction identification model, the model identification result and the real result; the new abnormal transaction identification model makes abnormal transaction decisions based on the updated abnormal threshold; Based on the new performance evaluation data set, calculating a new model performance index; If the new model performance indicator does not meet the performance indicator threshold requirement, the new abnormal threshold is adjusted to the original abnormal threshold, or the abnormal threshold is iteratively updated using the objective function until the new model performance indicator meets the performance indicator threshold requirement.

5. The abnormality threshold updating method according to any one of claims 1 to 4, characterized in that: The calculating of the model performance index based on the performance evaluation data set includes: Based on the performance evaluation data set, at least one model performance indicator among accuracy, recall, F1 score, false alarm rate and false negative rate is calculated.

6. The abnormality threshold updating method according to any one of claims 1 to 4, characterized in that: The step of obtaining a performance evaluation data set from a transaction data stream includes: A performance evaluation dataset is obtained in the transaction data stream with a preset sliding window size and a preset sliding step size.

7. A method for identifying abnormal transactions, characterized in that: The method comprises: Obtaining transaction data of the transaction to be identified; Taking the transaction data as input, an abnormal transaction identification result is obtained using a trained abnormal transaction identification model; wherein the abnormal threshold when the abnormal transaction identification model makes an abnormal transaction decision is determined based on the abnormal threshold updating method according to any one of claims 1 to 6.

8. The abnormal transaction identification method according to claim 7, characterized in that: The method further comprises: Regularly calculating the model performance index of the abnormal transaction identification model; If the model performance index fails to meet the performance index threshold requirement for a preset number of consecutive times, the abnormal transaction identification model is retrained to obtain the retrained abnormal transaction identification model.

9. An electronic device, characterized in that: include: A processor, a memory and a communication bus, wherein the processor and the memory communicate with each other via the communication bus; The memory stores program instructions executable by the processor, and the processor can execute the method according to any one of claims 1 to 8 by calling the program instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a computer, the computer is caused to perform the method according to any one of claims 1 to 8.

Images