Multi-level bank transaction fraud detection method and device
Through a multi-level detection method combining rule detection, unsupervised learning and deep learning, the problem of insufficient single-level detection of existing bank transaction fraud detection methods is solved, and efficient detection and accurate judgment of complex fraud behaviors are achieved.
Patent Information
- Application Number
- CN202411413603.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-11
- Publication Date
- 2025-02-07
AI Technical Summary
The existing bank transaction fraud detection methods have problems such as the single-level detection system being too simple, the rule engine maintenance cost, and the lack of adaptability, making it difficult to effectively deal with complex fraud models and new types of fraud.
Using a multi-level bank transaction fraud detection method, combining rule detection model, unsupervised learning detection model and deep learning detection model, by obtaining transaction data and user behavior data, extracting feature vectors and constructing input vectors, performing multiple detection levels of analysis and Score, and finally output a comprehensive risk score to judge transaction fraud.
It realizes flexible, comprehensive and efficient detection of complex transaction models and new frauds, reduces the cost of rule maintenance, and improves the system's adaptability and detection accuracy.
Smart Images
Figure CN119398778A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of bank transaction risk control, and in particular to a multi-level bank transaction fraud detection method and device. Background Art
[0002] With the rapid development of financial technology, the amount of bank transaction data has increased dramatically, and transaction fraud has become increasingly complex and changeable, bringing unprecedented challenges to banks' risk management. Existing bank transaction fraud detection methods mainly include manual review and analysis, machine automated review, and hybrid discrimination methods combining manual and automated methods. Although these methods have achieved certain results in their respective application scenarios, they still have many problems and shortcomings.
[0003] There are still the following problems in the existing scheme:
[0004] 1. Single-level detection systems are too simple: Many traditional fraud detection systems are based on single-level rule engines or machine learning models, relying on preset static rules (such as transaction amount limits, specific area blocking, etc.). This approach cannot cope with complex fraud patterns, especially those that are carefully disguised.
[0005] 2. High maintenance cost of rule engine: Rule-based detection system relies on manual formulation and maintenance of rules. Every time a new fraud pattern is added or the rules are changed, they need to be manually updated. This not only increases maintenance costs, but also causes the problem of delayed rule updates.
[0006] 3. Lack of adaptive capabilities: Many existing systems lack adaptive capabilities and are unable to self-adjust and learn based on new fraud patterns or transaction behaviors. They often rely on fixed models or manual parameter adjustment. When new fraud behaviors emerge, the system cannot detect them in time, resulting in reduced detection efficiency. Summary of the invention
[0007] The purpose of the present invention is to provide a more flexible, comprehensive and efficient banking transaction fraud detection solution to address the deficiencies in the prior art, thereby overcoming multiple defects in the prior art and improving the adaptability and accuracy to complex transaction patterns in the financial field.
[0008] To achieve the above objectives, in a first aspect, the present invention provides a multi-level banking transaction fraud detection method, comprising:
[0009] Acquire transaction data and user behavior data, and extract transaction feature vectors X from the transaction data and user behavior data respectively t and the behavioral feature vector B t , and construct the input vector I t =[X t ,B t ];
[0010] Receive the input vector I t , and the input vector I t The input is into the pre-built rule detection model, unsupervised learning detection model and deep learning detection model, and the rule detection model is used to determine the output result R of the i-th rule. i (I t ), then weighted calculation and output of the first risk score for:
[0011]
[0012] Among them, ω i is the weight of the ith rule, k is the total number of rules in the rule detection model;
[0013] The unsupervised learning detection model is used to calculate the input vector I t The distance d to the nearest cluster center t for:
[0014]
[0015] Among them, μ j is the characteristic vector of the jth cluster center, min is the minimum function, ‖.‖ takes the absolute value sign, N j is the number of input vectors in the jth cluster, C j represents the jth cluster;
[0016] The unsupervised learning detection model simultaneously processes the input vector I through an encoder and a decoder. t Processing to generate reconstruction results And calculate the input vector I t And the reconstruction results The error between t for:
[0017]
[0018] The unsupervised learning detection model calculates and outputs a second risk score for:
[0019]
[0020] Among them, α1 and α2 both represent weights, 1(.) is an indicator function, and its value is 1 when the condition is met;
[0021] The deep learning detection model is used to generate and output a third risk score of the current transaction using the feature vectors of the most recent n transactions for:
[0022]
[0023] h t =σ(W h h t-1 +W x I t )
[0024] Among them, h t is the hidden state at the current moment, h t-1 is the hidden state at the previous moment, W h , W x , W o are all weight matrices, σ is the activation function, b o is the bias term;
[0025] Calculate the comprehensive risk score S(I t )for:
[0026]
[0027] Among them, β1, β2, and β3 are the weights of the first risk score, the second risk score, and the third risk score, respectively.
[0028] Further, it also includes: according to the comprehensive risk score S(I t ) and the threshold value T s Output the transaction fraud judgment results, as follows:
[0029]
[0030] Among them, Decision t When it is 1, it means there is transaction fraud. t When it is 0, it means there is no transaction fraud.
[0031] Furthermore, the transaction feature vector X t Including transaction time, transaction amount, transaction type, transaction counterparty information and transaction location.
[0032] Furthermore, the behavior feature vector B t Includes the user's login device, the last login time interval and the transaction frequency.
[0033] Furthermore, the σ is a ReLU function.
[0034] In a second aspect, the present invention provides a multi-level banking transaction fraud detection device, comprising:
[0035] Data acquisition module, used to obtain transaction data and user behavior data;
[0036] A data processing module is used to extract transaction feature vectors X from the transaction data and user behavior data respectively. t and the behavioral feature vector B t , and construct the input vector I t =[X t ,B t ];
[0037] A fraud detection module, configured to receive the input vector I t , and the input vector I t The input is into the pre-built rule detection model, unsupervised learning detection model and deep learning detection model, and the rule detection model is used to determine the output result R of the i-th rule. i (I t ), then weighted calculation and output of the first risk score for:
[0038]
[0039] Among them, ω i is the weight of the ith rule, k is the total number of rules in the rule detection model;
[0040] The unsupervised learning detection model is used to calculate the input vector I t The distance d to the nearest cluster center t for:
[0041]
[0042] Among them, μ j is the characteristic vector of the jth cluster center, min is the minimum function, ‖.‖ takes the absolute value sign, N j is the number of input vectors in the jth cluster, C j represents the jth cluster;
[0043] The unsupervised learning detection model simultaneously processes the input vector I through an encoder and a decoder. t Processing to generate reconstruction results And calculate the input vector I t And the reconstruction results The error between t for:
[0044]
[0045] The unsupervised learning detection model calculates and outputs a second risk score for:
[0046]
[0047] Among them, α1 and α2 both represent weights, 1(.) is an indicator function, and its value is 1 when the condition is met;
[0048] The deep learning detection model is used to generate and output a third risk score of the current transaction using the feature vectors of the most recent n transactions for:
[0049]
[0050] h t =σ(W h h t-1 +W x I t )
[0051] Among them, h t is the hidden state at the current moment, h t-1 is the hidden state at the previous moment, W h , W x , W o are all weight matrices, σ is the activation function, b o is the bias term;
[0052] Output module, used to calculate the comprehensive risk score S(I t )for:
[0053]
[0054] Among them, β1, β2, and β3 are the weights of the first risk score, the second risk score, and the third risk score, respectively.
[0055] Furthermore, the output module is also used to output the risk score S(I t ) and the threshold value T s Output the transaction fraud judgment results, as follows:
[0056]
[0057] Among them, Decision t When it is 1, it means there is transaction fraud. t When it is 0, it means there is no transaction fraud.
[0058] Furthermore, the transaction feature vector X t Including transaction time, transaction amount, transaction type, transaction counterparty information and transaction location.
[0059] Furthermore, the behavior feature vector B t Includes the user's login device, the last login time interval and the transaction frequency.
[0060] Furthermore, the σ is a ReLU function.
[0061] Beneficial effects: 1. The present invention combines multiple detection levels such as rule engine, unsupervised learning, and deep learning. Each level analyzes different fraud patterns. Through the combination of multiple detection dimensions, it can cover fraud behaviors from simple to complex, as well as new types of fraud behaviors, avoiding blind spots that may be caused by single-level detection.
[0062] 2. The present invention combines a rule engine with a machine learning model. The rule engine is used to quickly process simple and known fraudulent behaviors, while the machine learning model can dynamically detect complex behavior patterns. The automatically updated machine learning model can reduce the burden of manual maintenance and ensure that the rule engine remains flexible.
[0063] 3. The present invention performs adaptive learning through a continuous feedback mechanism. The machine learning model can be continuously updated based on the latest transaction data and fraudulent behavior. The system can automatically adjust the model parameters and rule thresholds to improve the accuracy and flexibility of detection. BRIEF DESCRIPTION OF THE DRAWINGS
[0064] Figure 1 It is a flow chart of a multi-level bank transaction fraud detection method according to an embodiment of the present invention;
[0065] Figure 2 Schematic diagram of a multi-level bank transaction fraud detection device according to an embodiment of the present invention. DETAILED DESCRIPTION
[0066] The present invention is further explained below in conjunction with the accompanying drawings and specific embodiments. The embodiments are implemented based on the technical solution of the present invention. It should be understood that these embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention.
[0067] like Figure 1 As shown, the embodiment of the present invention provides a multi-level banking transaction fraud detection method, including:
[0068] Acquire transaction data and user behavior data, and extract transaction feature vectors X from the transaction data and user behavior data respectively t and the behavioral feature vector B t , and construct the input vector I t =[X t ,B t Specifically, the transaction feature vector X t Including transaction time, transaction amount, transaction type, transaction counterparty information and transaction location, etc. The above behavior feature vector B tIncluding the user's transaction login device, the last login time interval and transaction frequency, etc. Input vector I t It can be specifically expressed as [x1,x2,…,x n ,b1,b2,…,b m ], where x1,x2,…,x n Represents the transaction feature vector X t All features in b1, b2, …, b m Represents the behavior feature vector B t All features of .
[0069] Receive input vector I t , and the input vector I t The input is sent to the pre-built rule detection model, unsupervised learning detection model and deep learning detection model. The rule detection model uses pre-defined rules to detect simple fraud patterns. These rules can be set based on expert experience or historical data, such as the transaction amount exceeds the set threshold, the transaction location is not in the user's usual area, the device information does not match the historical transaction device, etc. Define the rule as R i , the rule detection model determines the output result R of the i-th rule i (I t ), each rule outputs a binary result of 0 or 1, indicating whether the rule is violated. Then the weighted calculation is performed and the first risk score is output for:
[0070]
[0071] Among them, ω i is the weight of the ith rule, and k is the total number of rules in the rule detection model.
[0072] The unsupervised learning detection model is mainly used to detect fraud types that have not appeared in historical data. It is implemented using clustering algorithms and autoencoders. First, in the clustering algorithm, normal transaction data is clustered and analyzed. During training, normal transactions are divided into K cluster centers to form a characteristic vector μ for each center. j for:
[0073]
[0074] Among them, N j is the number of input vectors in the jth cluster, C j represents the jth cluster.
[0075] For the input vector I t , the unsupervised learning detection model calculates the input vector I t The distance d to the nearest cluster center t for:
[0076]
[0077] Among them, min is the minimum function, and ‖.‖ takes the absolute value sign. If the distance d t If it exceeds the preset threshold T1, the transaction is considered abnormal.
[0078] The unsupervised learning detection model simultaneously uses the encoder and decoder to process the input vector I t Processing to generate the reconstructed Encoder represents encoding processing, Decoder represents decoding processing, and calculates the input vector I t And the reconstruction results The error between t for:
[0079]
[0080] When the reconstruction error s t If the threshold T2 is exceeded, the transaction is considered abnormal. The unsupervised learning detection model calculates and outputs the second risk score for:
[0081]
[0082] Among them, α1 and α2 both represent weights, 1(.) is an indicator function, and its value is 1 when the condition is met.
[0083] The deep learning detection model is used to generate and output the third risk score of the current transaction using the feature vectors of the most recent n transactions. for:
[0084]
[0085] h t =σ(W h h t-1 +W x I t )
[0086] Among them, h t is the hidden state at the current moment, h t-1 is the hidden state at the previous moment, W h , W x , W o are all weight matrices, σ is the activation function, preferably the ReLU function, b o is the bias term. t Indicates the risk score of the current transaction. A higher value indicates a higher possibility of fraud in the current transaction.
[0087] Finally, by integrating the output results of the rule detection model, the unsupervised learning detection model, and the deep learning detection model, the comprehensive risk score S(I t )for:
[0088]
[0089] Among them, β1, β2, and β3 are the weights of the first risk score, the second risk score, and the third risk score, respectively.
[0090] It can also be based on the comprehensive risk score S(I t ) and the threshold value T s Output the transaction fraud judgment results, as follows:
[0091]
[0092] Among them, Decision t When it is 1, it means there is transaction fraud. In this case, the transaction can be marked as suspicious and corresponding automated measures can be taken. t When it is 0, it means there is no transaction fraud and the normal transaction process can be carried out.
[0093] See also Figure 2 Based on the above embodiments, those skilled in the art can easily understand that the present invention also provides a multi-level bank transaction fraud detection device, including a data acquisition module 1, a data processing module 2, and an output module 4.
[0094] The data acquisition module 1 is used to acquire transaction data and user behavior data.
[0095] The data processing module 2 is used to extract transaction feature vectors X from the transaction data and user behavior data respectively. t and the behavioral feature vector B t , and construct the input vector I t =[X t ,B t Specifically, the transaction feature vector X t Including transaction time, transaction amount, transaction type, transaction counterparty information and transaction location, etc. The above behavior feature vector B t Including the user's transaction login device, the last login time interval and transaction frequency, etc. Input vector I t It can be specifically expressed as [x1,x2,…,x n ,b1,b2,…,b m ], where x1,x2,…,x n Represents the transaction feature vector X t All features in b1, b2, …, b m Represents the behavior feature vector Bt All features of .
[0096] The fraud detection module 3 is used to receive the input vector I t , and the input vector I t Input into the pre-built rule detection model, unsupervised learning detection model and deep learning detection model. Among them, the rule detection model uses predefined rules to detect simple fraud patterns. These rules can be set based on expert experience or historical data, such as the transaction amount exceeds the set threshold, the transaction location is not in the user's common area, the device information does not match the historical transaction device, etc. Define the rule as R i , the rule detection model determines the output result R of the i-th rule i (I t ), each rule outputs a binary result of 0 or 1, indicating whether the rule is violated. Then the weighted calculation is performed and the first risk score is output for:
[0097]
[0098] Among them, ω i is the weight of the ith rule, and k is the total number of rules in the rule detection model.
[0099] The unsupervised learning detection model is mainly used to detect fraud types that have not appeared in historical data. It is implemented using clustering algorithms and autoencoders. First, in the clustering algorithm, normal transaction data is clustered and analyzed. During training, normal transactions are divided into K cluster centers to form a characteristic vector μ for each center. j for:
[0100]
[0101] Among them, N j is the number of input vectors in the jth cluster, C j represents the jth cluster.
[0102] For the input vector I t , the unsupervised learning detection model calculates the input vector I t The distance d to the nearest cluster center t for:
[0103]
[0104] Among them, min is the minimum function, and ‖.‖ takes the absolute value sign. If the distance d t If it exceeds the preset threshold T1, the transaction is considered abnormal.
[0105] The unsupervised learning detection model simultaneously uses the encoder and decoder to process the input vector I tProcessing to generate the reconstructed Encoder represents encoding processing, Decoder represents decoding processing, and calculates the input vector I t And the reconstruction results The error between t for:
[0106]
[0107] When the reconstruction error s t If the threshold T2 is exceeded, the transaction is considered abnormal. The unsupervised learning detection model calculates and outputs the second risk score for:
[0108]
[0109] Among them, α1 and α2 both represent weights, 1(.) is an indicator function, and its value is 1 when the condition is met.
[0110] The deep learning detection model is used to generate and output the third risk score of the current transaction using the feature vectors of the most recent n transactions. for:
[0111]
[0112] h t =σ(W h h t-1 +W x I t )
[0113] Among them, h t is the hidden state at the current moment, h t-1 is the hidden state at the previous moment, W h , W x , W o are all weight matrices, σ is the activation function, preferably the ReLU function, b o is the bias term. t Indicates the risk score of the current transaction. A higher value indicates a higher possibility of fraud in the current transaction.
[0114] Finally, the output module 4 integrates the output results of the rule detection model, the unsupervised learning detection model and the deep learning detection model to obtain the comprehensive risk score S(I t )for:
[0115]
[0116] Among them, β1, β2, and β3 are the weights of the first risk score, the second risk score, and the third risk score, respectively.
[0117] The output module 4 can also be used to calculate the risk score S(I t ) and the threshold value T s Output the transaction fraud judgment results, as follows:
[0118]
[0119] Among them, Decision t When it is 1, it means there is transaction fraud. In this case, the transaction can be marked as suspicious and corresponding automated measures can be taken. t When it is 0, it means there is no transaction fraud and the normal transaction process can be carried out.
[0120] The above is only a preferred embodiment of the present invention. It should be noted that for ordinary technicians in this technical field, other parts not specifically described belong to the prior art or common knowledge. Several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered as the protection scope of the present invention.
Claims
1. A multi-level banking transaction fraud detection method, characterized in that: include: Acquire transaction data and user behavior data, and extract transaction feature vectors X from the transaction data and user behavior data respectively t and the behavioral feature vector B t , and construct the input vector I t =[X t ,B t ]; Receive the input vector I t , and the input vector I t The input is into the pre-built rule detection model, unsupervised learning detection model and deep learning detection model, and the rule detection model is used to determine the output result R of the i-th rule. i (I t ), then weighted calculation and output of the first risk score for: Among them, ω i is the weight of the ith rule, k is the total number of rules in the rule detection model; The unsupervised learning detection model is used to calculate the input vector I t The distance d to the nearest cluster center t for: Among them, μ j is the characteristic vector of the jth cluster center, min is the minimum function, ‖.‖ takes the absolute value sign, N j is the number of input vectors in the jth cluster, C j represents the jth cluster; The unsupervised learning detection model simultaneously processes the input vector I through an encoder and a decoder. t Processing to generate reconstruction results And calculate the input vector I t And the reconstruction results The error between t for: The unsupervised learning detection model calculates and outputs a second risk score for: Among them, α1 and α2 both represent weights, 1(.) is an indicator function, and its value is 1 when the condition is met; The deep learning detection model is used to generate and output a third risk score of the current transaction using the feature vectors of the most recent n transactions for: h t =σ(W h h t-1 +W x I t ) Among them, h t is the hidden state at the current moment, h t-1 is the hidden state at the previous moment, W h , W x , W o are all weight matrices, σ is the activation function, b o is the bias term; Calculate the comprehensive risk score S(I t )for: Among them, β1, β2, and β3 are the weights of the first risk score, the second risk score, and the third risk score, respectively.
2. A multi-level banking transaction fraud detection method according to claim 1, characterized in that: Also includes: According to the comprehensive risk score S(I t ) and the threshold value T s Output the transaction fraud judgment results, as follows: Among them, Decision t When it is 1, it means there is transaction fraud. t When it is 0, it means there is no transaction fraud.
3. A multi-level banking transaction fraud detection method according to claim 1, characterized in that: The transaction feature vector X t Including transaction time, transaction amount, transaction type, transaction counterparty information and transaction location.
4. A multi-level banking transaction fraud detection method according to claim 1, characterized in that: The behavior feature vector B t Includes the user's login device, the last login time interval and the transaction frequency.
5. A multi-level banking transaction fraud detection method according to claim 1, characterized in that: The σ is a ReLU function.
6. A multi-level banking transaction fraud detection device, characterized in that: include: Data acquisition module, used to obtain transaction data and user behavior data; A data processing module is used to extract transaction feature vectors X from the transaction data and user behavior data respectively. t and the behavioral feature vector B t , and construct the input vector I t =[X t ,B t ]; A fraud detection module, configured to receive the input vector I t , and the input vector I t The input is into the pre-built rule detection model, unsupervised learning detection model and deep learning detection model, and the rule detection model is used to determine the output result R of the i-th rule. i (I t ), then weighted calculation and output of the first risk score for: Among them, ω i is the weight of the ith rule, k is the total number of rules in the rule detection model; The unsupervised learning detection model is used to calculate the input vector I t The distance d to the nearest cluster center t for: Among them, μ j is the characteristic vector of the jth cluster center, min is the minimum function, ‖.‖ takes the absolute value sign, N j is the number of input vectors in the jth cluster, C j represents the jth cluster; The unsupervised learning detection model simultaneously processes the input vector I through an encoder and a decoder. t Processing to generate reconstruction results And calculate the input vector I t And the reconstruction results The error between t for: The unsupervised learning detection model calculates and outputs a second risk score for: Among them, α1 and α2 both represent weights, 1(.) is an indicator function, and its value is 1 when the condition is met; The deep learning detection model is used to generate and output a third risk score of the current transaction using the feature vectors of the most recent n transactions for: h t =σ(W h h t-1 +W x I t ) Among them, h t is the hidden state at the current moment, h t-1 is the hidden state at the previous moment, W h , W x , W o are all weight matrices, σ is the activation function, b o is the bias term; Output module, used to calculate the comprehensive risk score S(I t )for: Among them, β1, β2, and β3 are the weights of the first risk score, the second risk score, and the third risk score, respectively.
7. A multi-level banking transaction fraud detection device according to claim 6, characterized in that: The output module is also used to calculate the risk score S(I t ) and the threshold value T s Output the transaction fraud judgment results, as follows: Among them, Decision t When it is 1, it means there is transaction fraud. t When it is 0, it means there is no transaction fraud.
8. A multi-level banking transaction fraud detection device according to claim 6, characterized in that: The transaction feature vector X t Including transaction time, transaction amount, transaction type, transaction counterparty information and transaction location.
9. A multi-level banking transaction fraud detection device according to claim 6, characterized in that: The behavior feature vector B t Includes the user's login device, the last login time interval and the transaction frequency.
10. A multi-level banking transaction fraud detection device according to claim 6, characterized in that: The σ is a ReLU function.