Transaction card swiping early warning method and device based on AI identification

Abstract

The invention discloses a transaction card swiping early warning method and device based on AI identification, and relates to the technical field of financial payment, and the method comprises the steps: collecting transaction data, carrying out the preprocessing, and carrying out the feature extraction according to the preprocessed data, and generating a feature set; training an XGBoost model by using the generated feature set, and generating a basic classification result after constructing a preliminary classification model for transaction risk identification; the basic classification result is introduced into a decision tree model to carry out further optimization classification on the edge sample, and the obtained optimization classification result and the basic classification result are fused to generate a transaction risk score; according to the method, the multi-dimensional features of the nodes and the hyperedges are combined, the high-order relationship in the transaction data is comprehensively captured, more accurate features are constructed for expression, the node feature propagation path is optimized layer by layer based on the graph convolutional network and the dynamic factor adjustment mechanism, and the transaction efficiency is improved. And the robustness of the model to high-dimensional data and the analysis capability of the model to complex association are ensured, so that the early warning is more accurate and efficient.

Description

Technical Field

[0001] The present invention relates to the field of financial payment technology, and in particular to a transaction card swiping early warning method and device based on AI recognition. Background Art

[0002] With the continuous development of modern payment technology, POS machines have been widely used as an important transaction tool in the retail and service industries. POS machines not only improve transaction efficiency, but also provide users with a fast and secure payment experience. However, with the popularization of POS machines, their security issues have become increasingly prominent.

[0003] Existing early warning methods fail to fully utilize the complex relationships among time, space and behavioral features in transaction data, have limited ability to capture high-order correlations, and in the process of feature extraction and processing, usually model them through simple relationships between nodes, thereby ignoring the correlation with other features, resulting in unstable performance of the model when processing high-dimensional data. Summary of the invention

[0004] In view of the problems existing in the above-mentioned existing AI-based card swiping transaction warning method and device, the present invention is proposed.

[0005] Therefore, the problem to be solved by the present invention is that the existing early warning methods fail to fully utilize the complex relationship between time, space and behavioral characteristics in transaction data, have limited ability to capture high-order correlations, and in the process of feature extraction and processing, usually modeling is performed through simple relationships between nodes, thereby ignoring the correlation with other features, resulting in unstable performance of the model when processing high-dimensional data.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a transaction card swiping warning method based on AI recognition, which comprises:

[0007] Collect transaction data for preprocessing, and extract features based on the preprocessed data to generate feature sets;

[0008] The generated feature set is used to train the XGBoost model, and a preliminary classification model for transaction risk identification is constructed to generate basic classification results;

[0009] The basic classification results are introduced into the decision tree model to further optimize the classification of marginal samples, and the optimized classification results are integrated with the basic classification results to generate transaction risk scores;

[0010] Provide real-time warnings based on transaction risk scores, and store and visualize data.

[0011] As a preferred solution of the AI-based card swiping transaction warning method of the present invention, the preprocessing of the collected transaction data refers to collecting real-time transaction data and behavior data through a dedicated API interface, filling missing values ​​in the collected transaction data and behavior data, and performing abnormal value detection on the filled transaction data and behavior data;

[0012] Use the normalization method to normalize the detected transaction data and behavior data.

[0013] As a preferred solution of the card swiping transaction warning method based on AI recognition of the present invention, wherein: the feature extraction based on the pre-processed data to form a feature set includes:

[0014] Build a hypergraph node set based on the normalized transaction data, and treat each transaction as a node;

[0015] Represent the features of each node with a vector and construct a node feature matrix:

[0016] ,

[0017] In the formula, X represents the node feature matrix, represents the feature vector of the i-th node, and N represents the total number of nodes;

[0018] Extract time and geographic distance information from the normalized behavior data, build a hyperedge set based on the extracted time and geographic distance information, and use the weighted average algorithm to calculate the feature vector of the hyperedge:

[0019] ,

[0020] In the formula, represents the eigenvector of the hyperedge e, represents the number of nodes associated with hyperedge e, represents the set of nodes associated with hyperedge e, Represents the feature vector of node i;

[0021] Based on the hyperedge feature vector combined with the node feature vector, feature similarity is calculated, the association strength between the node and the hyperedge is calculated using the weighted aggregation method, and the association matrix between the node and the hyperedge is constructed:

[0022] ,

[0023] ,

[0024] ,

[0025] In the formula, Representation Node and super edge The similarity of features, and Respectively represent nodes and super edge The characteristic vector of Represents the node feature vector and the hyperedge eigenvector The Euclidean distance of represents the standardized parameter, Representation Node With super edge The association strength, m represents the total number of hyperedges involved in the calculation, A represents the association matrix between nodes and hyperedges, N represents the total number of nodes, and K represents the total number of hyperedges;

[0026] Use time series analysis to extract the transaction timestamps of nodes i and j, and calculate the time interval based on the transaction timestamps;

[0027] The temporal similarity is obtained by weighting the time intervals using an exponential decay function;

[0028] By extracting node features and , use cosine similarity to calculate the semantic similarity between nodes:

[0029] Adjacency matrix generation method is used to generate temporal similarity and semantic similarity into temporal similarity matrix and semantic similarity matrix respectively;

[0030] The node-to-hyperedge association matrix, temporal similarity matrix, and semantic similarity matrix are normalized by using a normalization method;

[0031] The normalized matrices are fused using the weighted average method to obtain a fused correlation matrix;

[0032] The node feature matrix X is taken as input, and the node feature matrix of the lth layer is obtained through iterative calculation of the first layer of graph convolution. ;

[0033] The fusion correlation matrix is ​​normalized using the symmetric normalization method, and the node feature matrix is ​​combined with the standard graph convolution formula to calculate the node feature matrix of the next layer:

[0034] ,

[0035] ,

[0036] ,

[0037] In the formula, represents the degree matrix, () represents the conversion of column vector into diagonal matrix, A represents the association matrix between nodes and hyperedges, represents a column vector of all ones, represents the fusion correlation matrix, C represents the canonical correlation matrix, represents the inverse square root matrix of the degree matrix, represents the node feature matrix of the l+1th layer, ReLU activation function.

[0038] Based on the node feature matrix of the next layer, time and space dynamic factors are introduced to adjust the propagation of node features:

[0039] ,

[0040] ,

[0041] ,

[0042] In the formula, Time dynamic factor, Spatial dynamic factor, represents the time adjustment parameter of time step t, t represents the time step, represents the spatial adjustment parameter of the lth layer, l represents the number of graph convolution layers, represents the feature matrix of the next layer of nodes, represents the node feature matrix of the lth layer, represents the weight matrix of the lth layer, represents the set of neighbor nodes of node i, Represents the feature vector of neighbor node j in layer l;

[0043] By using the adaptive adjustment mechanism, the next layer of node feature matrix after propagation is weighted fused, and all node features are spliced ​​using the feature splicing operation method to form a preliminary feature set:

[0044] ,

[0045] In the formula, represents the preliminary feature set, Represents a splicing operation, Indicates the node characteristics after dynamic adjustment;

[0046] Based on the preliminary feature set, the interaction strength between nodes is calculated to obtain the interaction feature matrix:

[0047] ),

[0048] In the formula, Q represents the interactive feature matrix, G represents the preliminary feature set, Represents the transposed matrix of the feature set;

[0049] The preliminary feature set and the interactive feature matrix are fused by using a nonlinear fusion method to obtain a final feature matrix, and the final feature matrix is ​​normalized by using a feature normalization method to obtain a normalized feature matrix to form a feature set.

[0050] As a preferred solution of the AI-based card transaction warning method of the present invention, the method of using the generated feature set to train the XGBoost model and construct a preliminary classification model for transaction risk identification to generate basic classification results includes:

[0051] Based on the generated feature set, the feature set is divided into training set and validation set using random stratified sampling;

[0052] The density clustering algorithm is used to mark the abnormal samples in the training set, and the number of samples in the training set is counted using statistical methods. The proportion of abnormal samples is obtained by dividing the total number of abnormal samples by the total number of samples:

[0053] Define sample weights based on the obtained sample ratios and construct a cross entropy loss function;

[0054] ,

[0055] In the formula, represents the cross entropy loss function of the zth sample, represents the true label of the zth sample, Represents the predicted value of the zth sample;

[0056] Minimize the loss through the gradient boosting algorithm and train the model using the gradient boosting algorithm. During iteration, the XGBoost model calculates the residual based on the current model parameters and generates a new decision tree to fit the residual. After iteration, based on the newly generated decision tree, the model parameters are updated and the regularization parameters of the model are adjusted using the hyperparameter optimization algorithm. During the continuous iteration process, when the value of the loss function no longer decreases significantly, stop training, output the final XGBoost model and complete the optimization.

[0057] The validation set is input into the trained XGBoost model, and the output values ​​are gradually accumulated through all the generated decision trees to generate the final prediction value for each sample. After the output values ​​of each tree are superimposed, the prediction probability of the sample is calculated.

[0058] Set the confidence threshold to and , the predicted probability and the threshold Compare and when the predicted probability is greater than the threshold When , the sample is classified as an abnormal sample. When the predicted probability is less than the threshold When , the sample is classified as a normal sample. When the predicted probability is less than or equal to the threshold and greater than or equal to , the sample is classified as a marginal sample.

[0059] As a preferred solution of the AI-based card transaction warning method of the present invention, the decision tree model is introduced based on the basic classification results to further optimize the classification of edge samples, and the transaction risk score is generated by fusing the obtained optimized classification results with the basic classification results, including:

[0060] Divide the obtained marginal samples into training set and validation set;

[0061] Construct a decision tree model, input the training set to train the decision tree model, and calculate the conditional entropy at each split point through the dynamic splitting rule, and find the maximum entropy gain split point:

[0062] ,

[0063] ,

[0064] In the formula, represents conditional entropy, v represents the value of feature V, represents the probability that the feature V takes the value v under condition E, represents the entropy gain, represents the information entropy of feature V, Represents the conditional entropy of feature V under condition E;

[0065] Set the conditional entropy gain threshold to E and set the entropy gain Compared with the threshold E, when the entropy gain When it is greater than or equal to the threshold E, the node is split, and the current split point is selected as the best split point, and the samples are further divided into corresponding child nodes. When it is less than the threshold E, the node splitting is stopped and the node is marked as a leaf node;

[0066] The nodes that cannot be further split are embedded in the neural network, and the classification probability is output through training:

[0067] ,

[0068] ,

[0069] In the formula, Z represents the linear combination result of the neural network, c represents the number of features, represents the weight of the rth feature, represents the rth eigenvalue, b represents the bias term, and Y represents the classification probability. represents the natural index;

[0070] The cross entropy loss function is used to optimize the neural network, and the parameters are updated by the gradient descent method to minimize the loss function. During the training process, the parameters are updated iteratively so that the prediction error of the model on the training set is continuously reduced.

[0071] The predicted probability generated by the base is fused with the probability generated by the optimization using a weighted average fusion algorithm to obtain a risk score.

[0072] As a preferred solution of the AI-based card swiping transaction warning method of the present invention, the real-time warning based on transaction risk score includes:

[0073] Set the risk score threshold to B, compare the obtained risk score with threshold B, and when the obtained risk score is greater than or equal to threshold B, mark the transaction as high risk; when the obtained risk score is less than threshold B, mark the transaction as normal;

[0074] When a transaction is marked as high risk, a data packet including transaction details, risk score and time is generated, and the data packet is pushed through a message queue.

[0075] As a preferred solution of the AI-based card swiping transaction warning method of the present invention, the storage and visual display of data refers to generating a data packet containing transaction details, risk score and time when a transaction is marked as high risk, and after pushing the data through a message queue, storing all transaction-related data in a database;

[0076] Build a multi-dimensional data visualization interface to realize real-time transaction risk display, and provide a statistical analysis interface to use charts to display the overall distribution of transactions, risk score distribution curves, and the proportion of high-risk transactions in different time periods.

[0077] A computer device comprises: a memory and a processor; the memory stores a computer program, and the processor implements the steps of a transaction card swiping warning method based on AI recognition when executing the computer program.

[0078] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a transaction card swiping warning method based on AI recognition.

[0079] The beneficial effects of the present invention are as follows: the present invention comprehensively captures high-order relationships in transaction data by combining the multi-dimensional features of nodes and hyperedges, and constructs more precise features for expression. Moreover, based on the graph convolutional network and the dynamic factor adjustment mechanism, the node feature propagation path is optimized layer by layer, thereby ensuring the model's robustness to high-dimensional data and its ability to parse complex associations, thereby making the early warning more accurate and efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0081] Figure 1 The figure is a flowchart of a card transaction warning method based on AI recognition. DETAILED DESCRIPTION

[0082] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings.

[0083] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0084] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor is it a separate or selective embodiment that is mutually exclusive with other embodiments.

[0085] Example 1

[0086] Reference Figure 1 , which is the first embodiment of the present invention, and provides a transaction card swiping early warning method based on AI recognition, and the transaction card swiping early warning method based on AI recognition includes:

[0087] S1. Collect transaction data for preprocessing, and extract features based on the preprocessed data to generate a feature set;

[0088] Specifically, the preprocessing of the collected transaction data refers to collecting real-time transaction data and behavior data through a dedicated API interface, filling missing values ​​in the collected transaction data and behavior data, and performing outlier detection on the filled transaction data and behavior data;

[0089] Use the normalization method to normalize the detected transaction data and behavior data.

[0090] Collecting real-time transaction data and behavioral data through a dedicated API interface can ensure efficient data transmission and high reliability, while reducing delays and error probabilities in data collection. For missing values ​​that may exist in transaction data and behavioral data, efficient filling algorithms are used to fill data gaps to ensure data integrity. Through outlier detection, risky behaviors in transaction data and behavioral data, such as fraudulent transactions and abnormal operations, can be effectively identified. The use of normalization operations eliminates feature deviations in transaction data and behavioral data caused by dimensional differences, thereby improving data comparability.

[0091] Furthermore, the step of extracting features from the preprocessed data to form a feature set includes:

[0092] A hypergraph node set is constructed based on the normalized transaction data, and each transaction is regarded as a node; the node contains the transaction amount, time, location and device identification;

[0093] Represent the features of each node with a vector and construct a node feature matrix:

[0094] ,

[0095] In the formula, X represents the node feature matrix, represents the feature vector of the i-th node, and N represents the total number of nodes;

[0096] Extract time and geographic distance information from the normalized behavior data, build a hyperedge set based on the extracted time and geographic distance information, and use the weighted average algorithm to calculate the feature vector of the hyperedge:

[0097] ,

[0098] In the formula, represents the eigenvector of the hyperedge e, represents the number of nodes associated with hyperedge e, represents the set of nodes associated with hyperedge e, Represents the feature vector of node i;

[0099] Based on the hyperedge feature vector combined with the node feature vector, feature similarity is calculated, the association strength between the node and the hyperedge is calculated using the weighted aggregation method, and the association matrix between the node and the hyperedge is constructed:

[0100] ,

[0101] ,

[0102] ,

[0103] In the formula, Representation Node and super edge The similarity of features, and Respectively represent nodes and super edge The characteristic vector of Represents the node feature vector and the hyperedge eigenvector The Euclidean distance of represents the standardized parameter, Representation Node With super edge The association strength, m represents the total number of hyperedges involved in the calculation, A represents the association matrix between nodes and hyperedges, N represents the total number of nodes, and K represents the total number of hyperedges;

[0104] It can be obtained through the standard deviation of node feature distribution;

[0105] Use time series analysis to extract the transaction timestamps of nodes i and j, and calculate the time interval based on the transaction timestamps:

[0106] ,

[0107] In the formula, Representation Node With Node The time interval and Represents node i and node timestamp;

[0108] The temporal similarity is obtained by weighting the time intervals using an exponential decay function:

[0109] ,

[0110] In the formula, Representation Node With Node The temporal similarity of represents the time decay factor;

[0111] Can be set by experiment;

[0112] By extracting node features and , use cosine similarity to calculate the semantic similarity between nodes:

[0113] ,

[0114] In the formula, Representation Node With Node The semantic similarity of and Represents the eigenvectors and The model, and Respectively represent nodes With Node The eigenvector of

[0115] Adjacency matrix generation method is used to generate temporal similarity and semantic similarity into temporal similarity matrix and semantic similarity matrix respectively;

[0116] The node-to-hyperedge association matrix, temporal similarity matrix, and semantic similarity matrix are normalized by using a normalization method;

[0117] The normalized matrices are fused using the weighted average method to obtain a fused correlation matrix;

[0118] ,

[0119] In the formula, represents the fusion correlation matrix, , , represents the weighting coefficient, represents the normalized node-hyperedge association matrix, represents the temporal similarity matrix, represents the semantic similarity matrix;

[0120] , , Can be dynamically adjusted through Bayesian optimization;

[0121] The node feature matrix X is taken as input, and the node feature matrix of the lth layer is obtained through iterative calculation of the first layer of graph convolution. ;

[0122] The fusion correlation matrix is ​​normalized using the symmetric normalization method, and the node feature matrix is ​​combined with the standard graph convolution formula to calculate the node feature matrix of the next layer:

[0123] ,

[0124] ,

[0125] ,

[0126] In the formula, represents the degree matrix, () represents the conversion of column vector into diagonal matrix, A represents the association matrix between nodes and hyperedges, represents a column vector of all ones, represents the fusion correlation matrix, C represents the canonical correlation matrix, represents the inverse square root matrix of the degree matrix, represents the node feature matrix of the l+1th layer, ReLU activation function.

[0127] Based on the node feature matrix of the next layer, time and space dynamic factors are introduced to adjust the propagation of node features:

[0128] ,

[0129] ,

[0130] ,

[0131] In the formula, Time dynamic factor, Spatial dynamic factor, represents the time adjustment parameter of time step t, t represents the time step, represents the spatial adjustment parameter of the lth layer, l represents the number of graph convolution layers, represents the feature matrix of the next layer of nodes, represents the node feature matrix of the lth layer, represents the weight matrix of the lth layer, represents the set of neighbor nodes of node i, Represents the feature vector of neighbor node j in layer l;

[0132] It can be determined by grid search method, Can be learned through back-propagation;

[0133] By using the adaptive adjustment mechanism, the next layer of node feature matrix after propagation is weighted fused, and all node features are spliced ​​using the feature splicing operation method to form a preliminary feature set:

[0134] ,

[0135] In the formula, represents the preliminary feature set, Represents a splicing operation, Indicates the node characteristics after dynamic adjustment;

[0136] Based on the preliminary feature set, the interaction strength between nodes is calculated to obtain the interaction feature matrix:

[0137] ),

[0138] In the formula, Q represents the interactive feature matrix, G represents the preliminary feature set, Represents the transposed matrix of the feature set;

[0139] The preliminary feature set and the interactive feature matrix are fused by using a nonlinear fusion method to obtain a final feature matrix, and the final feature matrix is ​​normalized by using a feature normalization method to obtain a normalized feature matrix to form a feature set.

[0140] By mapping each transaction as a node in a hypergraph and extracting the transaction amount, time, location, and device identification, the constructed node set can efficiently capture the characteristics of transaction data. Compared with traditional modeling methods based on two-dimensional graphs, hypergraphs can significantly improve the ability to mine high-order relationships and provide comprehensive basic data for subsequent association analysis. By extracting time and geographic distance information to define hyperedges and constructing hyperedge feature vectors, it is helpful to characterize the global characteristics of associated nodes. In addition, by combining node features with hyperedge features for weighted similarity calculation, the association strength between nodes and hyperedges can be accurately quantified, providing support for the construction of an efficient node and hyperedge association matrix. The time series analysis method and cosine similarity are used to generate the time similarity matrix and the semantic similarity matrix respectively, which can capture the spatiotemporal dynamic characteristics and semantic relationships of transaction behaviors. The time and semantic relationships constructed by the adjacency matrix generation method and normalization operation are The similarity matrix realizes the unified standardization of data, laying the foundation for subsequent feature fusion, and combines the graph convolution operation with the symmetric normalization method to calculate the node feature matrix layer by layer. At the same time, the time and space dynamic factors are introduced for propagation adjustment, realizing the deep learning and dynamic optimization of features. This step effectively solves the problem of high complexity of correlation between transaction features, ensures the global robustness of the model, and performs weighted fusion on the matrix after feature propagation, and then uses feature splicing and interaction intensity calculation to generate the interactive feature matrix, which fully mines the high-order interactive relationship between nodes. Compared with the traditional linear combination method, this step of the present invention can more effectively capture nonlinear relationships, thereby improving the accuracy of transaction data anomaly detection. The preliminary feature set is deeply fused with the interactive feature matrix through the nonlinear fusion method, and the final feature matrix is ​​normalized to ensure the standardization and consistency of the model input features.

[0141] S2. Use the generated feature set to train the XGBoost model, build a preliminary classification model for transaction risk identification, and generate basic classification results;

[0142] Specifically, the generated feature set is used to train the XGBoost model, and a preliminary classification model for transaction risk identification is constructed to generate basic classification results, including:

[0143] Based on the generated feature set, the feature set is divided into training set and validation set using random stratified sampling;

[0144] The density clustering algorithm is used to mark the abnormal samples in the training set, and the number of samples in the training set is counted using statistical methods. The proportion of abnormal samples is obtained by dividing the total number of abnormal samples by the total number of samples:

[0145] Define sample weights based on the obtained sample ratios and construct a cross entropy loss function;

[0146] ,

[0147] In the formula, represents the cross entropy loss function of the zth sample, represents the true label of the zth sample, Represents the predicted value of the zth sample;

[0148] Based on the loss function, the gradient and second-order derivative of each sample are calculated:

[0149] ,

[0150] ,

[0151] In the formula, represents the gradient of the zth sample, Representation and Sample The corresponding weight coefficient is, represents the second-order derivative of the zth sample;

[0152] The weight of each leaf node is calculated by the obtained gradient and second-order derivative, and the objective function is gradually optimized by combining the regularization term:

[0153] ,

[0154] ,

[0155] In the formula, represents the weight of leaf node f, represents the sample set contained in the leaf node f, represents the regularization parameter, O represents the objective function, and n represents the number of samples;

[0156] Minimize the loss through the gradient boosting algorithm and train the model using the gradient boosting algorithm. During iteration, the XGBoost model calculates the residual based on the current model parameters and generates a new decision tree to fit the residual. After iteration, based on the newly generated decision tree, the model parameters are updated and the regularization parameters of the model are adjusted using the hyperparameter optimization algorithm. During the continuous iteration process, when the value of the loss function no longer decreases significantly, stop training, output the final XGBoost model and complete the optimization.

[0157] The validation set is input into the trained XGBoost model, and the output values ​​are gradually accumulated through all the generated decision trees to generate the final prediction value for each sample. After the output values ​​of each tree are superimposed, the prediction probability of the sample is calculated.

[0158] Set the confidence threshold according to sample distribution and business requirements. and , the predicted probability and the threshold Compare and when the predicted probability is greater than the threshold When , the sample is classified as an abnormal sample. When the predicted probability is less than the threshold When , the sample is classified as a normal sample. When the predicted probability is less than or equal to the threshold and greater than or equal to , the sample is classified as a marginal sample.

[0159] The random stratified sampling ensures the balanced distribution of data set samples, while the density clustering algorithm can effectively mark discrete and abnormal samples. The combination of the two not only improves the representativeness of the training set and the validation set, but also enhances the accuracy of anomaly detection. The dynamic allocation of sample weights according to the proportion of abnormal samples helps to avoid the problem of minority class samples being ignored and improves the performance of the model on unbalanced data sets. In the model training process, the cross entropy loss function is combined with the sample gradient information, which not only accelerates the optimization convergence of the objective function, but also balances the model's prediction ability for different categories through weight adjustment, thereby improving the stability of the classification results. The introduction of the regularization term While preventing the model from overfitting, the objective function is optimized by adjusting the weights of the leaf nodes, thereby further improving the generalization performance of the model. By calculating the residuals in each iteration and generating a new decision tree, and continuously updating the model parameters, the XGBoost model can converge quickly and generate a classification model with excellent performance. Compared with traditional classification methods, the present invention has stronger expressiveness when processing nonlinear and high-dimensional data. The regularization parameters are dynamically adjusted with the help of a hyperparameter optimization algorithm to ensure the optimal performance of the model in complex transaction data. Samples are classified by setting confidence thresholds, so that the model can flexibly adjust risk detection standards according to business needs.

[0160] S3. Introducing the basic classification results into the decision tree model to further optimize the classification of edge samples, and integrating the obtained optimized classification results with the basic classification results to generate a transaction risk score;

[0161] Specifically, the decision tree model is introduced based on the basic classification results to further optimize the classification of edge samples, and the transaction risk score is generated by fusing the obtained optimized classification results with the basic classification results, including:

[0162] Divide the obtained marginal samples into training set and validation set;

[0163] Construct a decision tree model, input the training set to train the decision tree model, and calculate the conditional entropy at each split point through the dynamic splitting rule, and find the maximum entropy gain split point:

[0164] ,

[0165] ,

[0166] In the formula, represents conditional entropy, v represents the value of feature V, represents the probability that the feature V takes the value v under condition E, represents the entropy gain, represents the information entropy of feature V, Represents the conditional entropy of feature V under condition E;

[0167] According to the classification accuracy requirement of the target task, the conditional entropy gain threshold is set to E, and the entropy gain Compared with the threshold E, when the entropy gain When it is greater than or equal to the threshold E, the node is split, and the current split point is selected as the best split point, and the samples are further divided into corresponding child nodes. When it is less than the threshold E, the node splitting is stopped and the node is marked as a leaf node;

[0168] The nodes that cannot be further split are embedded in the neural network, and the classification probability is output through training:

[0169] ,

[0170] ,

[0171] In the formula, Z represents the linear combination result of the neural network, c represents the number of features, represents the weight of the rth feature, represents the rth eigenvalue, b represents the bias term, and Y represents the classification probability. represents the natural index;

[0172] The cross entropy loss function is used to optimize the neural network, and the parameters are updated by the gradient descent method to minimize the loss function. During the training process, the parameters are updated iteratively so that the prediction error of the model on the training set is continuously reduced.

[0173] The predicted probability generated by the base is fused with the probability generated by the optimization using a weighted average fusion algorithm to obtain a risk score.

[0174] The decision tree model can dynamically adjust the splitting path according to the importance of the features, and further fine-tune the classification of edge samples. In each splitting process, the conditional entropy and entropy gain can be used to find the feature with the largest information gain as the basis for splitting, thereby maximizing the reduction of the uncertainty of the child nodes, making the decision tree model of the present invention more efficient, avoiding the interference of redundant features, and ensuring that each step of splitting can significantly improve the classification effect. By setting the entropy gain threshold E, the depth and complexity of the node splitting can be controlled to avoid the risk of overfitting. This strategy can also reduce redundant splitting, improve the model training efficiency, and achieve higher accuracy in node splitting and stopping conditions. For leaf nodes that cannot be further split, they are trained by embedding neural networks, making full use of their nonlinear feature extraction capabilities, and can classify complex edge samples with higher accuracy. By weighted averaging the basic classification results and the optimized classification results, a more robust transaction risk score is generated. The fusion algorithm can balance the prediction weight of the model, reduce the limitations of a single model, and ensure that the generated risk score is more stable and accurate.

[0175] S4. Provide real-time warning based on transaction risk scores, and store and visualize data;

[0176] Specifically, the real-time warning based on transaction risk score includes:

[0177] According to historical data analysis and actual application scenarios, the risk score threshold is set to B, and the obtained risk score is compared with threshold B. When the obtained risk score is greater than or equal to threshold B, the transaction is marked as high risk, and when the obtained risk score is less than threshold B, the transaction is marked as normal;

[0178] When a transaction is marked as high risk, a data packet including transaction details, risk score and time is generated, and the data packet is pushed through a message queue.

[0179] By combining the analysis of historical data with actual application scenarios, the risk score threshold can be dynamically set to enhance the adaptability of the system. By comparing the risk score with the threshold, transactions can be quickly classified as high-risk or normal transactions, which can reduce the calculation complexity of the system and provide a clear decision-making basis for subsequent processing. The generated data packet contains information such as transaction details, risk score and time, which is convenient for subsequent risk response and processing. In addition, pushing high-risk transaction data packets through the message queue mechanism can effectively reduce the delay problem in real-time communication and improve the response speed of the system. The high fault tolerance and reliability of the message queue also ensure the complete transmission of data.

[0180] Furthermore, the storing and visualizing of data means that when a transaction is marked as high risk, a data packet containing transaction details, risk score and time is generated, and after the data is pushed through a message queue, all transaction-related data is stored in a database;

[0181] Build a multi-dimensional data visualization interface to realize real-time transaction risk display, and provide a statistical analysis interface to use charts to display the overall distribution of transactions, risk score distribution curves, and the proportion of high-risk transactions in different time periods.

[0182] By generating a data packet containing detailed information for high-risk transactions and pushing it in real time, the present invention can provide accurate and comprehensive transaction information to relevant personnel at the first time, support rapid response and decision-making, store all transaction-related data in the database, realize long-term preservation and management of historical data, and provide data support for subsequent model training, transaction tracing and abnormal behavior pattern analysis. By constructing a multi-dimensional data visualization interface, complex data relationships can be displayed through intuitive charts, helping users to understand the intrinsic connection between data more quickly and improve the efficiency and accuracy of decision-making. By displaying the overall distribution of transactions, users can intuitively perceive the scale of transactions within the monitoring range of the system and its distribution characteristics in different time periods or geographical areas. In addition, by displaying the distribution curve of risk scores, users can understand the risk level distribution of transactions, clarify the proportion and distribution law of high-risk transactions, and by counting the proportion of high-risk transactions in different time periods, users can grasp the time change trend of risks, clarify the risk concentration period, and optimize the allocation of risk prevention and control resources.

[0183] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0184] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0185] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0186] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit with a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit with a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0187] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should be included in the scope of the claims of the present invention.

Claims

1. A card transaction warning method based on AI recognition, characterized by: include, Collect transaction data for preprocessing, and extract features based on the preprocessed data to generate feature sets; The generated feature set is used to train the XGBoost model, and a preliminary classification model for transaction risk identification is constructed to generate basic classification results; The basic classification results are introduced into the decision tree model to further optimize the classification of marginal samples, and the optimized classification results are integrated with the basic classification results to generate transaction risk scores; Provide real-time warnings based on transaction risk scores, and store and visualize data.

2. The card transaction warning method based on AI recognition as claimed in claim 1, characterized in that: The preprocessing of collected transaction data refers to collecting real-time transaction data and behavior data through a dedicated API interface, filling missing values ​​in the collected transaction data and behavior data, and performing outlier detection on the filled transaction data and behavior data; Use the normalization method to normalize the detected transaction data and behavior data.

3. The card transaction warning method based on AI recognition as claimed in claim 2, characterized in that: The extracting features according to the preprocessed data to form a feature set comprises: Build a hypergraph node set based on the normalized transaction data, and treat each transaction as a node; Represent the features of each node with a vector and construct a node feature matrix: ， In the formula, X represents the node feature matrix, represents the feature vector of the i-th node, and N represents the total number of nodes; Extract time and geographic distance information from the normalized behavior data, build a hyperedge set based on the extracted time and geographic distance information, and use the weighted average algorithm to calculate the feature vector of the hyperedge: ， In the formula, represents the eigenvector of the hyperedge e, represents the number of nodes associated with hyperedge e, represents the set of nodes associated with hyperedge e, Represents the feature vector of node i; Based on the hyperedge feature vector combined with the node feature vector, feature similarity is calculated, the association strength between the node and the hyperedge is calculated using the weighted aggregation method, and the association matrix between the node and the hyperedge is constructed: ， ， ， In the formula, Representation Node and super edge The similarity of features, and Respectively represent nodes and super edge The characteristic vector of Represents the node feature vector and the hyperedge eigenvector The Euclidean distance of represents the standardized parameter, Representation Node With super edge The association strength, m represents the total number of hyperedges involved in the calculation, A represents the association matrix between nodes and hyperedges, N represents the total number of nodes, and K represents the total number of hyperedges; Use time series analysis to extract the transaction timestamps of nodes i and j, and calculate the time interval based on the transaction timestamps: The temporal similarity is obtained by weighting the time intervals using an exponential decay function: By extracting node features and , use cosine similarity to calculate the semantic similarity between nodes: Adjacency matrix generation method is used to generate temporal similarity and semantic similarity into temporal similarity matrix and semantic similarity matrix respectively; The node-to-hyperedge association matrix, temporal similarity matrix, and semantic similarity matrix are normalized by using a normalization method; The normalized matrices are fused using the weighted average method to obtain a fused correlation matrix; The node feature matrix X is taken as input, and the node feature matrix of the lth layer is obtained through iterative calculation of the first layer of graph convolution. ; The fusion correlation matrix is ​​normalized using the symmetric normalization method, and the node feature matrix is ​​combined with the standard graph convolution formula to calculate the node feature matrix of the next layer: ， ， ， In the formula, represents the degree matrix, () represents the conversion of column vector into diagonal matrix, A represents the association matrix between nodes and hyperedges, represents a column vector of all ones, represents the fusion correlation matrix, C represents the canonical correlation matrix, represents the inverse square root matrix of the degree matrix, represents the node feature matrix of the l+1th layer, ReLU activation function. Based on the node feature matrix of the next layer, time and space dynamic factors are introduced to adjust the propagation of node features: ， ， ， In the formula, Time dynamic factor, Spatial dynamic factor, represents the time adjustment parameter of time step t, t represents the time step, represents the spatial adjustment parameter of the lth layer, l represents the number of graph convolution layers, represents the feature matrix of the next layer of nodes, represents the node feature matrix of the lth layer, represents the weight matrix of the lth layer, represents the set of neighbor nodes of node i, Represents the feature vector of neighbor node j in layer l; By using the adaptive adjustment mechanism, the next layer of node feature matrix after propagation is weighted fused, and all node features are spliced ​​using the feature splicing operation method to form a preliminary feature set: ， In the formula, represents the preliminary feature set, Represents a splicing operation, Indicates the node characteristics after dynamic adjustment; Based on the preliminary feature set, the interaction strength between nodes is calculated to obtain the interaction feature matrix: )， In the formula, Q represents the interactive feature matrix, G represents the preliminary feature set, Represents the transposed matrix of the feature set; The preliminary feature set and the interactive feature matrix are fused by using a nonlinear fusion method to obtain a final feature matrix, and the final feature matrix is ​​normalized by using a feature normalization method to obtain a normalized feature matrix to form a feature set.

4. The card transaction warning method based on AI recognition as claimed in claim 3, characterized in that: The generated feature set is used to train the XGBoost model, and a preliminary classification model for transaction risk identification is constructed to generate basic classification results, including: Based on the generated feature set, the feature set is divided into training set and validation set using random stratified sampling; The density clustering algorithm is used to mark the abnormal samples in the training set, and the number of samples in the training set is counted using statistical methods. The proportion of abnormal samples is obtained by dividing the total number of abnormal samples by the total number of samples: Define sample weights based on the obtained sample ratios and construct a cross entropy loss function; ， In the formula, represents the cross entropy loss function of the zth sample, represents the true label of the zth sample, Represents the predicted value of the zth sample; Minimize the loss through the gradient boosting algorithm and train the model using the gradient boosting algorithm. During iteration, the XGBoost model calculates the residual based on the current model parameters and generates a new decision tree to fit the residual. After iteration, based on the newly generated decision tree, the model parameters are updated and the regularization parameters of the model are adjusted using the hyperparameter optimization algorithm. During the continuous iteration process, when the value of the loss function no longer decreases significantly, stop training, output the final XGBoost model and complete the optimization. The validation set is input into the trained XGBoost model, and the output values ​​are gradually accumulated through all the generated decision trees to generate the final prediction value for each sample. After the output values ​​of each tree are superimposed, the prediction probability of the sample is calculated. Set the confidence threshold to and , the predicted probability and the threshold Compare and when the predicted probability is greater than the threshold When , the sample is classified as an abnormal sample. When the predicted probability is less than the threshold When , the sample is classified as a normal sample. When the predicted probability is less than or equal to the threshold and greater than or equal to , the sample is classified as a marginal sample.

5. The card transaction warning method based on AI recognition as claimed in claim 4, characterized in that: The decision tree model is introduced based on the basic classification results to further optimize the classification of edge samples, and the transaction risk score is generated by fusing the obtained optimized classification results with the basic classification results, including: Divide the obtained marginal samples into training set and validation set; Construct a decision tree model, input the training set to train the decision tree model, and calculate the conditional entropy at each split point through the dynamic splitting rule, and find the maximum entropy gain split point: ， ， In the formula, represents conditional entropy, v represents the value of feature V, represents the probability that the feature V takes the value v under condition E, represents the entropy gain, represents the information entropy of feature V, Represents the conditional entropy of feature V under condition E; Set the conditional entropy gain threshold to E and set the entropy gain Compared with the threshold E, when the entropy gain When it is greater than or equal to the threshold E, the node is split, and the current split point is selected as the best split point, and the samples are further divided into corresponding child nodes. When it is less than the threshold E, the node splitting is stopped and the node is marked as a leaf node; The nodes that cannot be further split are embedded in the neural network, and the classification probability is output through training: ， ， In the formula, Z represents the linear combination result of the neural network, c represents the number of features, represents the weight of the rth feature, represents the rth eigenvalue, b represents the bias term, and Y represents the classification probability. represents the natural index; The cross entropy loss function is used to optimize the neural network, and the parameters are updated by the gradient descent method to minimize the loss function. During the training process, the parameters are updated iteratively so that the prediction error of the model on the training set is continuously reduced. The predicted probability generated by the base is fused with the probability generated by the optimization using a weighted average fusion algorithm to obtain a risk score.

6. The card transaction warning method based on AI recognition as claimed in claim 5, characterized in that: The real-time early warning based on transaction risk score includes: Set the risk score threshold to B, compare the obtained risk score with threshold B, and when the obtained risk score is greater than or equal to threshold B, mark the transaction as high risk; when the obtained risk score is less than threshold B, mark the transaction as normal; When a transaction is marked as high risk, a data packet including transaction details, risk score and time is generated, and the data packet is pushed through a message queue.

7. The card transaction warning method based on AI recognition as claimed in claim 6, characterized in that: The storing and visualizing of data means generating a data packet containing transaction details, risk score and time when a transaction is marked as high risk, and after pushing the data through a message queue, storing all transaction-related data in a database; Build a multi-dimensional data visualization interface to realize real-time transaction risk display, and provide a statistical analysis interface to use charts to display the overall distribution of transactions, risk score distribution curves, and the proportion of high-risk transactions in different time periods.

8. A computer device comprising: A memory and a processor; the memory stores a computer program, characterized in that: when the processor executes the computer program, the steps of the transaction card swiping warning method based on AI recognition as described in any one of claims 1 to 7 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the transaction card swiping warning method based on AI recognition described in any one of claims 1 to 7 are implemented.

Images