A card transaction warning method and device based on AI recognition

Abstract

The present invention discloses a transaction card swiping early warning method and device based on AI recognition, which relates to the field of financial payment technology. The method comprises the following steps: collecting transaction data for preprocessing, and performing feature extraction based on the preprocessed data to generate a feature set; using the generated feature set to train an XGBoost model, and constructing a preliminary classification model for transaction risk identification to generate a basic classification result; introducing the basic classification result into a decision tree model to further optimize and classify edge samples, and fusing the obtained optimized classification result with the basic classification result to generate a transaction risk score; the present invention comprehensively captures high-order relationships in transaction data by combining the multi-dimensional features of nodes and hyperedges, and constructs more accurate features for expression, and based on a graph convolutional network and a dynamic factor adjustment mechanism, optimizes the node feature propagation path layer by layer, thereby ensuring the model's robustness to high-dimensional data and its ability to parse complex associations, thereby making the early warning more accurate and efficient.

Description

Technical Field

[0001] The present invention relates to the field of financial payment technology, and in particular to a transaction card swiping early warning method and device based on AI recognition. Background Art

[0002] With the continuous development of modern payment technology, POS machines have been widely used as an important transaction tool in the retail and service industries. POS machines not only improve transaction efficiency, but also provide users with a fast and secure payment experience. However, with the popularization of POS machines, their security issues have become increasingly prominent.

[0003] Existing early warning methods fail to fully utilize the complex relationships among temporal, spatial, and behavioral features in transaction data, and have limited ability to capture high-order correlations. In addition, during feature extraction and processing, they are usually modeled through simple relationships between nodes, thereby ignoring the correlation with other features, resulting in unstable performance of the model when processing high-dimensional data. Summary of the Invention

[0004] In view of the problems existing in the above-mentioned existing AI-based card transaction warning method and device, the present invention is proposed.

[0005] Therefore, the problem to be solved by the present invention is that the existing early warning methods fail to fully utilize the complex relationship between time, space and behavioral characteristics in transaction data, have limited ability to capture high-order correlations, and in the process of feature extraction and processing, usually modeling is performed through simple relationships between nodes, thereby ignoring the correlation with other features, resulting in unstable performance of the model when processing high-dimensional data.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a transaction card swiping warning method based on AI recognition, which includes:

[0007] Collect transaction data for preprocessing, and extract features based on the preprocessed data to generate feature sets;

[0008] Use the generated feature set to train the XGBoost model, build a preliminary classification model for transaction risk identification, and generate basic classification results;

[0009] The basic classification results are introduced into the decision tree model to further optimize the classification of marginal samples, and the optimized classification results are integrated with the basic classification results to generate a transaction risk score;

[0010] Provide real-time warnings based on transaction risk scores, and store and visualize data.

[0011] As a preferred solution of the AI-based card transaction warning method of the present invention, the pre-processing of collected transaction data refers to collecting real-time transaction data and behavior data through a dedicated API interface, filling missing values in the collected transaction data and behavior data, and performing outlier detection on the filled transaction data and behavior data;

[0012] Use the normalization method to normalize the detected transaction data and behavior data.

[0013] As a preferred solution of the AI-based card transaction warning method of the present invention, the feature set formed by extracting features based on pre-processed data includes:

[0014] Build a hypergraph node set based on the normalized transaction data, and treat each transaction as a node;

[0015] Represent the features of each node with a vector and construct a node feature matrix:

[0016] ,

[0017] Where X represents the node feature matrix, represents the feature vector of the i-th node, and N represents the total number of nodes;

[0018] Extract time and geographic distance information from the normalized behavior data, construct a hyperedge set based on the extracted time and geographic distance information, and use the weighted average algorithm to calculate the feature vector of the hyperedge:

[0019] ,

[0020] Where, represents the eigenvector of the hyperedge e, represents the number of nodes associated with the hyperedge e, represents the set of nodes associated with the hyperedge e, Represents the feature vector of node i;

[0021] Based on the hyperedge feature vector and the node feature vector, the feature similarity is calculated, the association strength between the node and the hyperedge is calculated using the weighted aggregation method, and the association matrix between the node and the hyperedge is constructed:

[0022] ,

[0023] ,

[0024] ,

[0025] Where, Representation node and hyperedge The similarity of features, and Represents nodes respectively and hyperedge The eigenvector of Represents the node feature vector and the hyperedge eigenvector The Euclidean distance of represents the normalized parameter, Representation node With super edge The association strength, m represents the total number of hyperedges involved in the calculation, A represents the association matrix between nodes and hyperedges, N represents the total number of nodes, and K represents the total number of hyperedges;

[0026] Use time series analysis to extract the transaction timestamps of node i and node j, and calculate the time interval based on the transaction timestamps;

[0027] Temporal similarity is obtained by weighting the time intervals using an exponential decay function;

[0028] By extracting node features and , use cosine similarity to calculate the semantic similarity between nodes:

[0029] Adjacency matrix generation method is used to generate temporal similarity and semantic similarity into temporal similarity matrix and semantic similarity matrix respectively;

[0030] The node-to-hyperedge association matrix, temporal similarity matrix, and semantic similarity matrix are normalized by using a normalization method;

[0031] The normalized matrices are fused using the weighted average method to obtain the fused correlation matrix;

[0032] The node feature matrix X is taken as input and the node feature matrix of the lth layer is obtained through iterative calculation of the first layer of graph convolution. ;

[0033] The symmetric normalization method is used to normalize the fusion correlation matrix, and after combining it with the node feature matrix, the standard graph convolution formula is used to calculate the node feature matrix of the next layer:

[0034] ,

[0035] ,

[0036] ,

[0037] Where, represents the degree matrix, () means converting the column vector into a diagonal matrix, A represents the association matrix between nodes and hyperedges, represents a column vector of all ones, represents the fusion correlation matrix, C represents the canonical correlation matrix, represents the inverse square root matrix of the degree matrix, represents the node feature matrix of the l+1th layer, Represents the ReLU activation function;

[0038] Based on the node feature matrix of the next layer, time and space dynamic factors are introduced to adjust the propagation of node features:

[0039] ,

[0040] ,

[0041] ,

[0042] Where, Time dynamic factor, Spatial dynamic factor, represents the time adjustment parameter of time step t, where t represents the time step, represents the spatial adjustment parameter of the lth layer, l represents the number of graph convolution layers, represents the feature matrix of the next layer of nodes, represents the node feature matrix of the lth layer, represents the weight matrix of the lth layer, represents the set of neighbor nodes of node i, Represents the feature vector of neighbor node j in layer l;

[0043] By using the adaptive adjustment mechanism, the next layer of node feature matrix after propagation is weighted and fused, and all node features are spliced using the feature splicing operation method to form a preliminary feature set:

[0044] ,

[0045] Where, represents the preliminary feature set, Represents a splicing operation, Indicates the node characteristics after dynamic adjustment;

[0046] Based on the preliminary feature set, the interaction strength between nodes is calculated to obtain the interaction feature matrix:

[0047] ),

[0048] In the formula, Q represents the interactive feature matrix, G represents the preliminary feature set, Represents the transposed matrix of the feature set;

[0049] The preliminary feature set and the interactive feature matrix are fused by using a nonlinear fusion method to obtain a final feature matrix, and the final feature matrix is normalized using a feature normalization method to obtain a normalized feature matrix to form a feature set.

[0050] As a preferred solution of the AI-based card transaction warning method of the present invention, the method of using the generated feature set to train the XGBoost model and construct a preliminary classification model for transaction risk identification to generate basic classification results includes:

[0051] Based on the generated feature set, the feature set is divided into training set and validation set using random stratified sampling;

[0052] Use the density clustering algorithm to mark the abnormal samples in the training set, and use statistical methods to count the number of samples in the training set. By dividing the total number of abnormal samples by the total number of samples, the proportion of abnormal samples is obtained:

[0053] Define the sample weight according to the obtained sample ratio and construct the cross entropy loss function;

[0054] ,

[0055] Where, represents the cross entropy loss function of the z-th sample, represents the true label of the z-th sample, Represents the predicted value of the zth sample;

[0056] The model is trained using the gradient boosting algorithm to minimize the loss. During iteration, the XGBoost model calculates the residual based on the current model parameters and generates a new decision tree to fit the residual. After iteration, the model parameters are updated based on the newly generated decision tree, and the regularization parameters of the model are adjusted using the hyperparameter optimization algorithm. During the continuous iteration process, when the value of the loss function no longer decreases significantly, the training is stopped and the final XGBoost model is output to complete the optimization.

[0057] The validation set is input into the trained XGBoost model, and the output values of all generated decision trees are gradually accumulated to generate the final prediction value for each sample. After the output values of each tree are superimposed, the prediction probability of the sample is calculated.

[0058] Set the confidence threshold to and , the predicted probability and the threshold Compare and when the predicted probability is greater than the threshold When the predicted probability is less than the threshold, the sample is classified as an abnormal sample. When , the sample is classified as a normal sample. When the predicted probability is less than or equal to the threshold and greater than or equal to , the sample is classified as a marginal sample.

[0059] As a preferred solution of the AI-based card transaction warning method of the present invention, the method further optimizes and classifies edge samples by introducing a decision tree model based on the basic classification results, and generates a transaction risk score by fusing the obtained optimized classification results with the basic classification results.

[0060] Divide the obtained marginal samples into training set and validation set;

[0061] Build a decision tree model, input the training set to train the decision tree model, and calculate the conditional entropy at each split point through the dynamic splitting rule, and find the maximum entropy gain split point:

[0062] ,

[0063] ,

[0064] Where, represents conditional entropy, v represents the value of feature V, represents the probability that the feature V takes the value v under condition E, represents the entropy gain, represents the information entropy of feature V, Represents the conditional entropy of feature V under condition E;

[0065] Set the conditional entropy gain threshold to E, and set the entropy gain Compare with the threshold E, when the entropy gain When the entropy gain is greater than or equal to the threshold E, the node is split and the current split point is selected as the best split point. The samples are further divided into corresponding child nodes. When it is less than the threshold E, the node splitting is stopped and the node is marked as a leaf node;

[0066] The nodes that cannot be further split are embedded in the neural network and the classification probability is output through training:

[0067] ,

[0068] ,

[0069] In the formula, Z represents the linear combination result of the neural network, c represents the number of features, represents the weight of the rth feature, represents the rth eigenvalue, b represents the bias term, and Y represents the classification probability. represents the natural index;

[0070] The cross entropy loss function is used to optimize the neural network. The parameters are updated by gradient descent and the loss function is minimized. During the training process, the parameters are updated iteratively so that the prediction error of the model on the training set is continuously reduced.

[0071] The predicted probability generated by the base and the probability generated by the optimization are fused using a weighted average fusion algorithm to obtain the risk score.

[0072] As a preferred solution of the AI-based card transaction warning method of the present invention, the real-time warning based on transaction risk score includes:

[0073] Set the risk score threshold to B and compare the obtained risk score with threshold B. If the obtained risk score is greater than or equal to threshold B, the transaction is marked as high risk. If the obtained risk score is less than threshold B, the transaction is marked as normal.

[0074] When a transaction is marked as high risk, a data packet containing transaction details, risk score and time is generated and pushed through a message queue.

[0075] As a preferred embodiment of the AI-based card transaction warning method of the present invention, the storage and visualization of data refers to generating a data packet containing transaction details, risk score, and time when a transaction is marked as high-risk, pushing the data through a message queue, and then storing all transaction-related data in a database;

[0076] Build a multi-dimensional data visualization interface to display real-time transaction risks, and provide a statistical analysis interface to use charts to show the overall distribution of transactions, risk score distribution curves, and the proportion of high-risk transactions in different time periods.

[0077] A computer device comprises: a memory and a processor; the memory stores a computer program, and the processor implements the steps of a transaction card swiping warning method based on AI recognition when executing the computer program.

[0078] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a transaction card swiping warning method based on AI recognition.

[0079] The beneficial effects of the present invention are as follows: the present invention comprehensively captures high-order relationships in transaction data by combining the multi-dimensional features of nodes and hyperedges, and constructs more precise features for expression. Moreover, based on the graph convolutional network and the dynamic factor adjustment mechanism, the node feature propagation path is optimized layer by layer, ensuring the model's robustness to high-dimensional data and its ability to parse complex associations, thereby making the early warning more accurate and efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0081] Figure 1 The figure is a flowchart of the card transaction warning method based on AI recognition. DETAILED DESCRIPTION

[0082] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0083] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0084] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it constitute a separate or selective embodiment that is mutually exclusive with other embodiments.

[0085] Example 1

[0086] Reference Figure 1 , which is the first embodiment of the present invention, provides a transaction card swiping early warning method based on AI recognition, and the transaction card swiping early warning method based on AI recognition includes:

[0087] S1. Collect transaction data for preprocessing, and extract features based on the preprocessed data to generate a feature set;

[0088] Specifically, the pre-processing of collected transaction data refers to collecting real-time transaction data and behavior data through a dedicated API interface, filling missing values in the collected transaction data and behavior data, and performing outlier detection on the filled transaction data and behavior data;

[0089] Use the normalization method to normalize the detected transaction data and behavior data.

[0090] Collecting real-time transaction data and behavioral data through a dedicated API interface can ensure efficient data transmission and high reliability, while reducing delays and error probabilities in data collection. For missing values that may exist in transaction data and behavioral data, efficient filling algorithms are used to fill data gaps, ensuring data integrity. In addition, outlier detection can effectively identify risky behaviors in transaction data and behavioral data, such as fraudulent transactions and abnormal operations. The use of normalization operations eliminates feature deviations caused by dimensional differences in transaction data and behavioral data, thereby improving data comparability.

[0091] Furthermore, the extracting features based on the preprocessed data to form a feature set includes:

[0092] A hypergraph node set is constructed based on the normalized transaction data, with each transaction as a node; the node contains the transaction amount, time, location, and device identifier;

[0093] Represent the features of each node with a vector and construct a node feature matrix:

[0094] ,

[0095] Where X represents the node feature matrix, represents the feature vector of the i-th node, and N represents the total number of nodes;

[0096] Extract time and geographic distance information from the normalized behavior data, construct a hyperedge set based on the extracted time and geographic distance information, and use the weighted average algorithm to calculate the feature vector of the hyperedge:

[0097] ,

[0098] Where, represents the eigenvector of the hyperedge e, represents the number of nodes associated with the hyperedge e, represents the set of nodes associated with the hyperedge e, Represents the feature vector of node i;

[0099] Based on the hyperedge feature vector and the node feature vector, the feature similarity is calculated, the association strength between the node and the hyperedge is calculated using the weighted aggregation method, and the association matrix between the node and the hyperedge is constructed:

[0100] ,

[0101] ,

[0102] ,

[0103] Where, Representation node and hyperedge The similarity of features, and Represents nodes respectively and hyperedge The eigenvector of Represents the node feature vector and the hyperedge eigenvector The Euclidean distance of represents the normalized parameter, Representation node With super edge The association strength, m represents the total number of hyperedges involved in the calculation, A represents the association matrix between nodes and hyperedges, N represents the total number of nodes, and K represents the total number of hyperedges;

[0104] It can be obtained by the standard deviation of the node feature distribution;

[0105] Use time series analysis to extract the transaction timestamps of node i and node j, and calculate the time interval based on the transaction timestamps:

[0106] ,

[0107] Where, Representation node With node time interval, and Represents node i and node timestamp;

[0108] Temporal similarity is obtained by weighting the time intervals using an exponential decay function:

[0109] ,

[0110] Where, Representation node With node The temporal similarity of represents the time decay factor;

[0111] Can be set through experimentation;

[0112] By extracting node features and , use cosine similarity to calculate the semantic similarity between nodes:

[0113] ,

[0114] Where, Representation node With node The semantic similarity of and Represents the eigenvectors and The model, and Represents nodes respectively With node The eigenvector of

[0115] Adjacency matrix generation method is used to generate temporal similarity and semantic similarity into temporal similarity matrix and semantic similarity matrix respectively;

[0116] The node-to-hyperedge association matrix, temporal similarity matrix, and semantic similarity matrix are normalized by using a normalization method;

[0117] The normalized matrices are fused using the weighted average method to obtain the fused correlation matrix;

[0118] ,

[0119] Where, represents the fusion correlation matrix, 、 、 represents the weighting coefficient, represents the normalized node-hyperedge association matrix, represents the temporal similarity matrix, represents the semantic similarity matrix;

[0120] 、 、 Can be dynamically adjusted through Bayesian optimization;

[0121] The node feature matrix X is taken as input and the node feature matrix of the lth layer is obtained through iterative calculation of the first layer of graph convolution. ;

[0122] The symmetric normalization method is used to normalize the fusion correlation matrix, and after combining it with the node feature matrix, the standard graph convolution formula is used to calculate the node feature matrix of the next layer:

[0123] ,

[0124] ,

[0125] ,

[0126] Where, represents the degree matrix, () means converting the column vector into a diagonal matrix, A represents the association matrix between nodes and hyperedges, represents a column vector of all ones, represents the fusion correlation matrix, C represents the canonical correlation matrix, represents the inverse square root matrix of the degree matrix, represents the node feature matrix of the l+1th layer, Represents the ReLU activation function;

[0127] Based on the node feature matrix of the next layer, time and space dynamic factors are introduced to adjust the propagation of node features:

[0128] ,

[0129] ,

[0130] ,

[0131] Where, Time dynamic factor, Spatial dynamic factor, represents the time adjustment parameter of time step t, where t represents the time step, represents the spatial adjustment parameter of the lth layer, l represents the number of graph convolution layers, represents the feature matrix of the next layer of nodes, represents the node feature matrix of the lth layer, represents the weight matrix of the lth layer, represents the set of neighbor nodes of node i, Represents the feature vector of neighbor node j in layer l;

[0132] It can be determined by grid search method, Can be learned through back-propagation;

[0133] By using the adaptive adjustment mechanism, the next layer of node feature matrix after propagation is weighted and fused, and all node features are spliced using the feature splicing operation method to form a preliminary feature set:

[0134] ,

[0135] Where, represents the preliminary feature set, Represents a splicing operation, Indicates the node characteristics after dynamic adjustment;

[0136] Based on the preliminary feature set, the interaction strength between nodes is calculated to obtain the interaction feature matrix:

[0137] ),

[0138] In the formula, Q represents the interactive feature matrix, G represents the preliminary feature set, Represents the transposed matrix of the feature set;

[0139] The preliminary feature set and the interactive feature matrix are fused by using a nonlinear fusion method to obtain a final feature matrix, and the final feature matrix is normalized using a feature normalization method to obtain a normalized feature matrix to form a feature set.

[0140] By mapping each transaction as a node in a hypergraph and extracting the transaction amount, time, location and device identification, the constructed node set can efficiently capture the characteristics of transaction data. Compared with the traditional modeling method based on two-dimensional graphs, hypergraphs can significantly improve the ability to mine high-order relationships and provide comprehensive basic data for subsequent association analysis. By extracting time and geographical distance information to define hyperedges and constructing hyperedge feature vectors, it is helpful to characterize the global characteristics of associated nodes. Combining node features with hyperedge features for weighted similarity calculation can accurately quantify the association strength between nodes and hyperedges, providing support for constructing an efficient node and hyperedge association matrix. Time series analysis and cosine similarity are used to generate time similarity matrix and semantic similarity matrix respectively, which can capture the spatiotemporal dynamic characteristics and semantic relationships of transaction behaviors. Through adjacency matrix generation method and normalization operation, the constructed time and language The semantic similarity matrix realizes the unified standardization of data, laying the foundation for subsequent feature fusion, and combines the graph convolution operation with the symmetric normalization method to calculate the node feature matrix layer by layer. At the same time, the time and space dynamic factors are introduced for propagation adjustment, realizing deep learning and dynamic optimization of features. This step effectively solves the problem of high complexity of correlation between transaction features, ensuring the global robustness of the model. In addition, the matrix after feature propagation is weighted and fused, and then the interactive feature matrix is generated by feature splicing and interaction intensity calculation, which fully explores the high-order interactive relationship between nodes. Compared with the traditional linear combination method, this step of the present invention can more effectively capture nonlinear relationships, thereby improving the accuracy of transaction data anomaly detection. The preliminary feature set and the interactive feature matrix are deeply fused through the nonlinear fusion method, and the final feature matrix is normalized to ensure the standardization and consistency of the model input features.

[0141] S2. Use the generated feature set to train the XGBoost model, build a preliminary classification model for transaction risk identification, and generate basic classification results;

[0142] Specifically, the generated feature set is used to train the XGBoost model, and a preliminary classification model for transaction risk identification is constructed to generate basic classification results, including:

[0143] Based on the generated feature set, the feature set is divided into training set and validation set using random stratified sampling;

[0144] Use the density clustering algorithm to mark the abnormal samples in the training set, and use statistical methods to count the number of samples in the training set. By dividing the total number of abnormal samples by the total number of samples, the proportion of abnormal samples is obtained:

[0145] Define the sample weight according to the obtained sample ratio and construct the cross entropy loss function;

[0146] ,

[0147] Where, represents the cross entropy loss function of the z-th sample, represents the true label of the z-th sample, Represents the predicted value of the zth sample;

[0148] Based on the loss function, the gradient and second-order derivative of each sample are calculated:

[0149] ,

[0150] ,

[0151] Where, represents the gradient of the z-th sample, Representation and Sample The corresponding weight coefficient is represents the second-order derivative of the z-th sample;

[0152] The weight of each leaf node is calculated by the obtained gradient and second-order derivative, and the objective function is gradually optimized by combining the regularization term:

[0153] ,

[0154] ,

[0155] Where, represents the weight of leaf node f, represents the sample set contained in the leaf node f, represents the regularization parameter, O represents the objective function, and n represents the number of samples;

[0156] The model is trained using the gradient boosting algorithm to minimize the loss. During iteration, the XGBoost model calculates the residual based on the current model parameters and generates a new decision tree to fit the residual. After iteration, the model parameters are updated based on the newly generated decision tree, and the regularization parameters of the model are adjusted using the hyperparameter optimization algorithm. During the continuous iteration process, when the value of the loss function no longer decreases significantly, the training is stopped and the final XGBoost model is output to complete the optimization.

[0157] The validation set is input into the trained XGBoost model, and the output values of all generated decision trees are gradually accumulated to generate the final prediction value for each sample. After the output values of each tree are superimposed, the prediction probability of the sample is calculated.

[0158] Set the confidence threshold according to sample distribution and business requirements. and , the predicted probability and the threshold Compare and when the predicted probability is greater than the threshold When the predicted probability is less than the threshold, the sample is classified as an abnormal sample. When , the sample is classified as a normal sample. When the predicted probability is less than or equal to the threshold and greater than or equal to , the sample is classified as a marginal sample.

[0159] Random stratified sampling ensures the balance of sample distribution in the data set, while the density clustering algorithm can effectively mark discrete and abnormal samples. The combination of the two not only improves the representativeness of the training set and the validation set, but also enhances the accuracy of anomaly detection. In addition, the dynamic allocation of sample weights according to the proportion of abnormal samples helps to avoid the problem of minority class samples being ignored and improves the performance of the model on unbalanced data sets. In the model training process, the cross entropy loss function is combined with the sample gradient information, which not only accelerates the optimization convergence of the objective function, but also balances the model's prediction ability for different categories through weight adjustment, thereby improving the stability of the classification results. The introduction of the regularization term in While preventing the model from overfitting, the objective function is optimized by adjusting the weights of the leaf nodes, thereby further improving the generalization performance of the model. By calculating the residuals in each iteration to generate a new decision tree and continuously updating the model parameters, the XGBoost model can converge quickly and generate a classification model with excellent performance. Compared with traditional classification methods, the present invention has stronger expressiveness when processing nonlinear and high-dimensional data. The regularization parameters are dynamically adjusted with the help of the hyperparameter optimization algorithm to ensure the optimal performance of the model in complex transaction data. The samples are classified by setting the confidence threshold, so that the model can flexibly adjust the risk detection standards according to business needs.

[0160] S3. Introducing the basic classification results into the decision tree model to further optimize the classification of marginal samples, and fusing the optimized classification results with the basic classification results to generate a transaction risk score;

[0161] Specifically, the decision tree model is introduced based on the basic classification results to further optimize the classification of edge samples, and the transaction risk score is generated by fusing the obtained optimized classification results with the basic classification results.

[0162] Divide the obtained marginal samples into training set and validation set;

[0163] Build a decision tree model, input the training set to train the decision tree model, and calculate the conditional entropy at each split point through the dynamic splitting rule, and find the maximum entropy gain split point:

[0164] ,

[0165] ,

[0166] Where, represents conditional entropy, v represents the value of feature V, represents the probability that the feature V takes the value v under condition E, represents the entropy gain, represents the information entropy of feature V, Represents the conditional entropy of feature V under condition E;

[0167] According to the classification accuracy requirement of the target task, the conditional entropy gain threshold is set to E, and the entropy gain is Compare with the threshold E, when the entropy gain When the entropy gain is greater than or equal to the threshold E, the node is split and the current split point is selected as the best split point. The samples are further divided into corresponding child nodes. When it is less than the threshold E, the node splitting is stopped and the node is marked as a leaf node;

[0168] The nodes that cannot be further split are embedded in the neural network and the classification probability is output through training:

[0169] ,

[0170] ,

[0171] In the formula, Z represents the linear combination result of the neural network, c represents the number of features, represents the weight of the rth feature, represents the rth eigenvalue, b represents the bias term, and Y represents the classification probability. represents the natural index;

[0172] The cross entropy loss function is used to optimize the neural network. The parameters are updated by gradient descent and the loss function is minimized. During the training process, the parameters are updated iteratively so that the prediction error of the model on the training set is continuously reduced.

[0173] The predicted probability generated by the base and the probability generated by the optimization are fused using a weighted average fusion algorithm to obtain the risk score.

[0174] The decision tree model can dynamically adjust the splitting path according to the importance of the features, and further refine the classification of edge samples. In each splitting process, the conditional entropy and entropy gain can be used to find the feature with the largest information gain as the basis for splitting, thereby maximizing the reduction of the uncertainty of the child node, making the decision tree model of the present invention more efficient, avoiding the interference of redundant features, and ensuring that each step of splitting can significantly improve the classification effect. By setting the entropy gain threshold E, the depth and complexity of the node splitting can be controlled to avoid the risk of overfitting. This strategy can also reduce redundant splitting, improve model training efficiency, and achieve higher accuracy in node splitting and stopping conditions. For leaf nodes that cannot be further split, they are trained by embedding neural networks, making full use of their nonlinear feature extraction capabilities, and can classify complex edge samples with higher accuracy. By performing weighted averaging fusion of the basic classification results and the optimized classification results, a more robust transaction risk score is generated. The fusion algorithm can balance the prediction weight of the model, reduce the limitations of a single model, and ensure that the generated risk score is more stable and accurate.

[0175] S4. Provide real-time warnings based on transaction risk scores, and store and visualize data;

[0176] Specifically, the real-time warning based on transaction risk score includes:

[0177] Based on historical data analysis and actual application scenarios, a risk score threshold of B is set. The resulting risk score is compared with threshold B. If the resulting risk score is greater than or equal to threshold B, the transaction is marked as high risk. If the resulting risk score is less than threshold B, the transaction is marked as normal.

[0178] When a transaction is marked as high risk, a data packet containing transaction details, risk score and time is generated and pushed through a message queue.

[0179] By combining historical data analysis with actual application scenarios, dynamically setting risk score thresholds can enhance the system's adaptability. By comparing risk scores with thresholds, transactions can be quickly classified as high-risk or normal transactions, which can reduce the system's computational complexity and provide a clear decision-making basis for subsequent processing. The generated data packet contains information such as transaction details, risk score, and time, which facilitates subsequent risk response and processing. In addition, pushing high-risk transaction data packets through the message queue mechanism can effectively reduce delays in real-time communications and improve the system's response speed. The high fault tolerance and reliability of the message queue also ensure the complete transmission of data.

[0180] Furthermore, the storing and visualizing of data means generating a data packet containing transaction details, risk score, and time when a transaction is marked as high risk, pushing the data through a message queue, and storing all transaction-related data in a database;

[0181] Build a multi-dimensional data visualization interface to display real-time transaction risks, and provide a statistical analysis interface to use charts to show the overall distribution of transactions, risk score distribution curves, and the proportion of high-risk transactions in different time periods.

[0182] By generating data packets containing detailed information for high-risk transactions and pushing them in real time, the present invention can provide accurate and comprehensive transaction information to relevant personnel at the first time, support rapid response and decision-making, store all transaction-related data in the database, realize long-term preservation and management of historical data, and provide data support for subsequent model training, transaction tracing and abnormal behavior pattern analysis. By constructing a multi-dimensional data visualization interface, complex data relationships can be displayed through intuitive charts, helping users to understand the intrinsic connections between data more quickly and improve the efficiency and accuracy of decision-making. By displaying the overall distribution of transactions, users can intuitively perceive the scale of transactions within the monitoring range of the system and its distribution characteristics in different time periods or geographical areas, and displaying the distribution curve of risk scores, it can help users understand the risk level distribution of transactions, clarify the proportion and distribution pattern of high-risk transactions, and by counting the proportion of high-risk transactions in different time periods, it can help users grasp the time change trend of risks, clarify the risk concentration period, and optimize the allocation of risk prevention and control resources.

[0183] If the functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage media include various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0184] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0185] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, and then editing, interpreting, or processing in another suitable manner as necessary, and then storing it in a computer memory.

[0186] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having logic gate circuits for implementing logic functions on data signals, an application-specific integrated circuit having suitable combinational logic gate circuits, a programmable gate array (PGA), a field-programmable gate array (FPGA), etc.

[0187] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A card transaction warning method based on AI recognition, characterized by: include, Collect transaction data for preprocessing, and extract features based on the preprocessed data to generate feature sets; The pre-processing of collected transaction data refers to collecting real-time transaction data and behavior data through a dedicated API interface, filling missing values in the collected transaction data and behavior data, and performing outlier detection on the filled transaction data and behavior data. Use normalization methods to normalize the transaction data and behavior data after detection. The feature extraction based on the preprocessed data to form a feature set includes constructing a hypergraph node set based on the normalized transaction data, treating each transaction as a node, representing the features of each node with a vector, and constructing a node feature matrix: , where X represents the node feature matrix, represents the feature vector of the i-th node, N represents the total number of nodes, Extract time and geographic distance information from the normalized behavior data, construct a hyperedge set based on the extracted time and geographic distance information, and use the weighted average algorithm to calculate the feature vector of the hyperedge: , where represents the eigenvector of the hyperedge e, represents the number of nodes associated with the hyperedge e, represents the set of nodes associated with the hyperedge e, represents the feature vector of node i, Based on the hyperedge feature vector and the node feature vector, the feature similarity is calculated, the association strength between the node and the hyperedge is calculated using the weighted aggregation method, and the association matrix between the node and the hyperedge is constructed: , , , where Representation node and hyperedge The similarity of features, and Represents nodes respectively and hyperedge The eigenvector of Represents the node feature vector and the hyperedge eigenvector The Euclidean distance of represents the normalized parameter, Representation node With super edge The association strength is m, m represents the total number of hyperedges involved in the calculation, A represents the association matrix between nodes and hyperedges, N represents the total number of nodes, K represents the total number of hyperedges, and time series analysis is used to extract the transaction timestamps of nodes i and j, and the time interval is calculated based on the transaction timestamps. The temporal similarity is obtained by weighting the time intervals using an exponential decay function, By extracting node features and , using cosine similarity to calculate the semantic similarity between nodes, Adjacency matrix generation method is used to generate temporal similarity and semantic similarity into temporal similarity matrix and semantic similarity matrix respectively. By using the normalization method to normalize the node-hyperedge association matrix, temporal similarity matrix and semantic similarity matrix, The normalized matrices are fused using the weighted average method to obtain the fused correlation matrix. The node feature matrix X is taken as input and the node feature matrix of the lth layer is obtained through iterative calculation of the first layer of graph convolution. , The symmetric normalization method is used to normalize the fusion correlation matrix, and after combining it with the node feature matrix, the standard graph convolution formula is used to calculate the node feature matrix of the next layer: Where, represents the degree matrix, Indicates converting the column vector into a diagonal matrix, A represents the association matrix between nodes and hyperedges, represents a column vector of all ones, represents the fusion correlation matrix, C represents the canonical correlation matrix, represents the inverse square root matrix of the degree matrix, represents the node feature matrix of the l+1th layer, represents the ReLU activation function, Based on the node feature matrix of the next layer, time and space dynamic factors are introduced to adjust the propagation of node features: , , , where Time dynamic factor, Spatial dynamic factor, represents the time adjustment parameter of time step t, where t represents the time step, represents the spatial adjustment parameter of the lth layer, l represents the number of graph convolution layers, represents the feature matrix of the next layer of nodes, represents the node feature matrix of the lth layer, represents the weight matrix of the lth layer, represents the set of neighbor nodes of node i, represents the feature vector of neighbor node j in layer l, By using the adaptive adjustment mechanism, the next layer of node feature matrix after propagation is weighted and fused, and all node features are spliced using the feature splicing operation method to form a preliminary feature set: , where represents the preliminary feature set, Represents a splicing operation, Represents the node features after dynamic adjustment, Based on the preliminary feature set, the interaction strength between nodes is calculated to obtain the interaction feature matrix: , where Q represents the interactive feature matrix, G represents the preliminary feature set, represents the transposed matrix of the feature set, The preliminary feature set and the interactive feature matrix are fused by using a nonlinear fusion method to obtain a final feature matrix, and the final feature matrix is normalized by using a feature normalization method to obtain a normalized feature matrix to form a feature set; Use the generated feature set to train the XGBoost model, build a preliminary classification model for transaction risk identification, and generate basic classification results; The basic classification results are introduced into the decision tree model to further optimize the classification of marginal samples, and the optimized classification results are integrated with the basic classification results to generate a transaction risk score; Provide real-time warnings based on transaction risk scores, and store and visualize data.

2. The AI-based card transaction warning method according to claim 1, characterized in that: The generated feature set is used to train the XGBoost model, and a preliminary classification model for transaction risk identification is constructed to generate basic classification results, including: Based on the generated feature set, the feature set is divided into training set and validation set using random stratified sampling; Use the density clustering algorithm to mark the abnormal samples in the training set, and use statistical methods to count the number of samples in the training set. By dividing the total number of abnormal samples by the total number of samples, the proportion of abnormal samples is obtained: Define the sample weight according to the obtained sample ratio and construct the cross entropy loss function; ， Where, represents the cross entropy loss function of the z-th sample, represents the true label of the z-th sample, Represents the predicted value of the zth sample; The model is trained using the gradient boosting algorithm to minimize the loss. During iteration, the XGBoost model calculates the residual based on the current model parameters and generates a new decision tree to fit the residual. After iteration, the model parameters are updated based on the newly generated decision tree, and the regularization parameters of the model are adjusted using the hyperparameter optimization algorithm. During the continuous iteration process, when the value of the loss function no longer decreases significantly, the training is stopped and the final XGBoost model is output to complete the optimization. The validation set is input into the trained XGBoost model, and the output values of all generated decision trees are gradually accumulated to generate the final prediction value for each sample. After the output values of each tree are superimposed, the prediction probability of the sample is calculated. Set the confidence threshold to and , the predicted probability and the threshold Compare and when the predicted probability is greater than the threshold When the predicted probability is less than the threshold, the sample is classified as an abnormal sample. When , the sample is classified as a normal sample. When the predicted probability is less than or equal to the threshold and greater than or equal to , the sample is classified as a marginal sample.

3. The AI-based card transaction warning method according to claim 2, characterized in that: The method of introducing the basic classification results into the decision tree model to further optimize the classification of edge samples and fusing the obtained optimized classification results with the basic classification results to generate a transaction risk score includes: Divide the obtained marginal samples into training set and validation set; Build a decision tree model, input the training set to train the decision tree model, and calculate the conditional entropy at each split point through the dynamic splitting rule, and find the maximum entropy gain split point: , where represents conditional entropy, v represents the value of feature V, represents the probability that the feature V takes the value v under condition E, represents the entropy gain, represents the information entropy of feature V, Represents the conditional entropy of feature V under condition E; Set the conditional entropy gain threshold to E, and set the entropy gain Compare with the threshold E, when the entropy gain When the entropy gain is greater than or equal to the threshold E, the node is split and the current split point is selected as the best split point. The samples are further divided into corresponding child nodes. When it is less than the threshold E, the node splitting is stopped and the node is marked as a leaf node; The nodes that cannot be further split are embedded in the neural network and the classification probability is output through training: , , where Z represents the linear combination result of the neural network, c represents the number of features, represents the weight of the rth feature, represents the rth eigenvalue, b represents the bias term, and Y represents the classification probability. represents the natural index; The cross entropy loss function is used to optimize the neural network. The parameters are updated by gradient descent and the loss function is minimized. During the training process, the parameters are updated iteratively so that the prediction error of the model on the training set is continuously reduced. The predicted probability generated by the base and the probability generated by the optimization are fused using a weighted average fusion algorithm to obtain the risk score.

4. The AI-based card transaction warning method according to claim 3, characterized in that: The real-time warning based on the transaction risk score includes setting a risk score threshold value as B, comparing the obtained risk score with the threshold value B, and marking the transaction as high risk when the obtained risk score is greater than or equal to the threshold value B; and marking the transaction as normal when the obtained risk score is less than the threshold value B; When a transaction is marked as high risk, a data packet containing transaction details, risk score and time is generated and pushed through a message queue.

5. The AI-based card transaction warning method according to claim 4, characterized in that: Storing and visualizing data means generating a data packet containing transaction details, risk score, and time when a transaction is marked as high risk, pushing the data through a message queue, and storing all transaction-related data in a database; Build a multi-dimensional data visualization interface to display real-time transaction risks, and provide a statistical analysis interface to use charts to display data such as the overall distribution of transactions, risk score distribution curves, and the proportion of high-risk transactions in different time periods.

6. A computer device comprising: A memory and a processor; the memory stores a computer program, characterized in that: when the processor executes the computer program, the steps of the transaction card swiping warning method based on AI recognition according to any one of claims 1 to 5 are implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the AI-recognition-based card transaction warning method according to any one of claims 1 to 5 are implemented.

Images