Abnormal transaction identification method and device in data transaction and medium

Abstract

The invention discloses an abnormal transaction identification method and device in data transaction and a medium, and relates to the technical field of data transaction. The method comprises the following steps: analyzing order data in a data transaction to determine a feature variable in the order data; performing normalization processing on the characteristic variables through a Z-Score statistical method to determine variable Z-Score values corresponding to the characteristic variables; based on a preset feature variable category table, accumulating the variable Z-Score values of the feature variables of the same category to obtain a feature category accumulated value, and performing normalization processing on the feature category accumulated value through a Z-Score statistical method to obtain a corresponding category Z-Score value; and based on the category Z-Score value, determining whether the data transaction corresponding to the order data is an abnormal transaction through an isolated forest algorithm.

Description

Technical Field

[0001] The present application relates to the technical field of data transaction, and in particular to a method, device and medium for identifying abnormal transactions in data transactions. Background Art

[0002] With the continuous maturity and widespread application of big data technology, data has become a key production factor in today's society, driving innovation and development in all walks of life. Against this background, the data trading market came into being and quickly showed a booming trend. The data trading market has built an efficient trading platform for data providers and data demanders, promoting the circulation and value transformation of data.

[0003] However, the rapid development of the data trading market is also accompanied by a series of challenges and risks. Since data trading involves multiple links and participants, including data providers, data demanders, trading platforms, etc., the information asymmetry and conflicts of interest between these links and participants are becoming increasingly prominent, bringing many uncertainties to data trading. Among them, the frequent occurrence of abnormal situations (such as fraudulent transactions, data leakage, illegal transactions, etc.) poses a serious threat to the security of data transactions.

[0004] In order to cope with these challenges and risks, the industry has begun to actively explore the use of advanced technical means to improve the security and efficiency of data transactions. Traditional abnormal transaction identification methods often rely on manual review and experience judgment, and have problems such as low efficiency and high error rate. Therefore, how to more efficiently and accurately identify abnormal transactions to ensure the security of data transactions has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The embodiments of the present application provide a method, device and medium for identifying abnormal transactions in data transactions, so as to solve the following technical problem: how to identify abnormal transactions more efficiently and accurately to ensure the security of data transactions.

[0006] In a first aspect, an embodiment of the present application provides a method for identifying abnormal transactions in data transactions, characterized in that the method includes: parsing order data in data transactions to determine characteristic variables in the order data; normalizing the characteristic variables by Z-Score statistics to determine variable Z-Score values ​​corresponding to the characteristic variables; based on a preset characteristic variable category table, accumulating variable Z-Score values ​​of characteristic variables of the same category to obtain a characteristic category accumulated value, and normalizing the characteristic category accumulated value by Z-Score statistics to obtain a corresponding category Z-Score value; based on the category Z-Score value, determining whether the data transaction corresponding to the order data is an abnormal transaction by using an isolation forest algorithm.

[0007] In one implementation of the present application, order data in data transactions are parsed to determine characteristic variables in the order data, specifically including: identifying and extracting various field information related to transaction behavior in the order data; based on a preset mapping relationship between field information and characteristic variables, determining the characteristic variables corresponding to the field information.

[0008] In one implementation of the present application, the feature variables are normalized by the Z-Score statistical method to determine the variable Z-Score value corresponding to the feature variable, specifically including: calculating the order data based on the mapping relationship to determine the variable data corresponding to the feature variable; calculating the mean and standard deviation of the feature variable based on the variable data; and using the Z-Score statistical method according to the mean and standard deviation of the feature variable to determine the variable Z-Score value corresponding to the feature variable.

[0009] In one implementation of the present application, based on a preset feature variable category table, variable Z-Score values ​​of feature variables of the same category are accumulated to obtain a feature category accumulated value, specifically including: querying the feature variable category table to determine the feature category to which the feature variable belongs; accumulating the variable Z-Score values ​​of feature variables of the same category to obtain a feature category accumulated value.

[0010] In one implementation of the present application, the feature category cumulative values ​​are normalized by the Z-Score statistical method to obtain the corresponding category Z-Score value, specifically including: calculating the mean and standard deviation of the feature category cumulative values ​​based on the variable Z-Score value of the feature variable of the same category corresponding to the feature category cumulative value; using the Z-Score statistical method according to the mean and standard deviation of the feature category cumulative values ​​to obtain the corresponding category Z-Score value.

[0011] In one implementation of the present application, based on the category Z-Score value, an isolation forest algorithm is used to determine whether the data transaction corresponding to the order data is an abnormal transaction, specifically including: constructing an isolation forest model; wherein each isolated tree in the isolation forest model is constructed by randomly selecting feature variables and split points; inputting the category Z-Score value as input data into the isolation forest model; calculating the path length of each input data in the isolation forest, and based on the path length, determining whether the data transaction corresponding to the order data is an abnormal transaction.

[0012] In one implementation of the present application, based on the path length, determining whether the data transaction corresponding to the order data is an abnormal transaction specifically includes: judging whether the path length is less than or equal to a preset path length threshold; when it is determined that the path length is less than or equal to the preset path length threshold, determining that the data transaction corresponding to the order data is an abnormal transaction; when it is determined that the path length is greater than the preset path length threshold, determining that the data transaction corresponding to the order data is a normal transaction.

[0013] In one implementation of the present application, the method also includes: after determining that the data transaction corresponding to the order data is an abnormal transaction, generating an abnormal transaction alarm, and sending the abnormal transaction alarm to a preset administrator account so that the administrator account can manually review the abnormal transaction.

[0014] In a second aspect, an embodiment of the present application also provides an abnormal transaction identification device in data transactions, characterized in that the device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can: parse the order data in the data transaction to determine the characteristic variables in the order data; normalize the characteristic variables by the Z-Score statistical method to determine the variable Z-Score value corresponding to the characteristic variable; based on a preset characteristic variable category table, the variable Z-Score values ​​of the characteristic variables of the same category are accumulated to obtain a characteristic category accumulated value, and the characteristic category accumulated value is normalized by the Z-Score statistical method to obtain a corresponding category Z-Score value; based on the category Z-Score value, determine whether the data transaction corresponding to the order data is an abnormal transaction by the isolation forest algorithm.

[0015] In a third aspect, an embodiment of the present application also provides a non-volatile computer storage medium for identifying abnormal transactions in data transactions, storing computer executable instructions, characterized in that the computer executable instructions are set to: parse order data in data transactions to determine characteristic variables in the order data; normalize the characteristic variables by Z-Score statistics to determine variable Z-Score values ​​corresponding to the characteristic variables; based on a preset characteristic variable category table, accumulate variable Z-Score values ​​of characteristic variables of the same category to obtain a characteristic category accumulated value, and normalize the characteristic category accumulated value by Z-Score statistics to obtain a corresponding category Z-Score value; based on the category Z-Score value, determine whether the data transaction corresponding to the order data is an abnormal transaction by using an isolation forest algorithm.

[0016] An embodiment of the present application provides a method through. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 A flow chart of a method for identifying abnormal transactions in data transactions provided in an embodiment of the present application;

[0019] Figure 2 A schematic diagram of the internal structure of a device for identifying abnormal transactions in data transactions provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0021] The embodiments of the present application provide a method, device and medium for identifying abnormal transactions in data transactions, so as to solve the following technical problem: how to identify abnormal transactions more efficiently and accurately to ensure the security of data transactions.

[0022] The technical solution proposed in the embodiments of the present application is described in detail below with reference to the accompanying drawings.

[0023] Figure 1 This is a flow chart of a method for identifying abnormal transactions in data transactions provided by an embodiment of the present application. Figure 1 As shown, an abnormal transaction identification method in data transaction provided by an embodiment of the present application specifically includes the following steps:

[0024] Step 101: parse order data in data transactions to determine characteristic variables in the order data.

[0025] In one embodiment of the present application, in order to realize abnormal transaction identification in data transactions, it is first necessary to parse the order data in the data transactions to determine the characteristic variables in the order data.

[0026] Specifically, various field information related to transaction behavior in the order data is identified and extracted; based on the preset mapping relationship between the field information and the characteristic variables, the characteristic variables corresponding to the field information are determined.

[0027] In one embodiment, in the data transaction process, the order data needs to be analyzed comprehensively and carefully first. The key to this step is to identify and extract the various field information in the order data that is closely related to the transaction behavior. These field information include but are not limited to transaction time, transaction amount, identity information of both parties to the transaction, type and scale of transaction data, transaction mode (such as real-time transaction, batch transaction, etc.), transaction history records, etc. These field information constitute the basic framework of transaction data and are the basis for subsequent feature variable extraction and abnormal transaction identification.

[0028] After successfully parsing and extracting the relevant field information in the order data, the next step is to map these field information to specific feature variables based on the preset mapping relationship between field information and feature variables. This mapping relationship is based on an in-depth understanding of the data transaction field and the analysis of historical transaction data, and is intended to ensure that each feature variable can accurately reflect a key aspect of the transaction behavior.

[0029] For example, the transaction amount can be mapped to the "transaction scale" feature variable to measure the scale and importance of the transaction; the transaction time can be mapped to the "transaction period" feature variable to analyze whether the transaction occurred within a specific time period; the identity information of the two parties to the transaction can be mapped to the "reputation of the two parties to the transaction" feature variable to evaluate the reliability and integrity of the two parties to the transaction; the type and scale of the transaction data can be mapped to the "data type and scale" feature variable to judge the value and potential risks of the transaction data; the transaction method can be mapped to the "transaction mode" feature variable to analyze whether the transaction is regular or abnormal; the transaction history record can be mapped to the "transaction behavior pattern" feature variable to identify whether the transaction presents a certain behavior pattern or trend.

[0030] Step 102: normalize the characteristic variables using the Z-Score statistical method to determine the variable Z-Score value corresponding to the characteristic variable.

[0031] In one embodiment of the present application, after determining the characteristic variables in the order data, the characteristic variables are normalized using the Z-Score statistical method to determine the variable Z-Score value corresponding to the characteristic variable.

[0032] Specifically, the order data is calculated based on the mapping relationship to determine the variable data corresponding to the characteristic variable; based on the variable data, the mean and standard deviation of the characteristic variable are calculated; according to the mean and standard deviation of the characteristic variable, the Z-Score statistical method is used to determine the variable Z-Score value corresponding to the characteristic variable.

[0033] In one embodiment, after determining the characteristic variables in the order data, it is necessary to calculate the order data based on the preset mapping relationship to extract the variable data corresponding to each characteristic variable. These variable data are the basis for subsequent normalization processing, and their accuracy and completeness directly affect the effect of normalization processing and the accuracy of abnormal transaction identification. After extracting the variable data corresponding to the characteristic variables, it is necessary to perform statistical analysis on the variable data of each characteristic variable to calculate its mean and standard deviation. The mean reflects the average level of the characteristic variable, while the standard deviation reflects the degree of dispersion of the characteristic variable. These two statistics play a vital role in the Z-Score statistical method, and they jointly determine the normalization processing method of the characteristic variable data. After obtaining the mean and standard deviation of the characteristic variables, the variable data of each characteristic variable is normalized using the Z-Score statistical method. Specifically, the variable data of each characteristic variable is subtracted from its mean and divided by the standard deviation to obtain the variable Z-Score value corresponding to the characteristic variable. This Z-Score value reflects the degree of deviation between the variable data and the average level of the characteristic variable. The larger the value, the greater the deviation between the variable data and the average level; conversely, the smaller the deviation.

[0034] Step 103: Based on a preset feature variable category table, the variable Z-Score values ​​of the feature variables of the same category are accumulated to obtain a feature category accumulated value, and the feature category accumulated value is normalized by a Z-Score statistical method to obtain a corresponding category Z-Score value.

[0035] In one embodiment of the present application, after determining the variable Z-Score value corresponding to the feature variable, firstly, based on a preset feature variable category table, the variable Z-Score values ​​of the feature variables of the same category are accumulated to obtain a feature category accumulated value.

[0036] Specifically, the feature variable category table is queried to determine the feature category to which the feature variable belongs; and the variable Z-Score values ​​of the feature variables of the same category are accumulated to obtain the feature category accumulated value.

[0037] Furthermore, the feature category cumulative values ​​are normalized by Z-Score statistical method to obtain the corresponding category Z-Score value.

[0038] Specifically, based on the variable Z-Score value of the feature variable of the same category corresponding to the feature category cumulative value, the mean and standard deviation of the feature category cumulative value are calculated; according to the mean and standard deviation of the feature category cumulative value, the Z-Score statistical method is used to obtain the corresponding category Z-Score value.

[0039] In one embodiment, after determining the variable Z-Score value corresponding to the feature variable, it is first necessary to determine the feature category to which each feature variable belongs based on a preset feature variable category table. This feature variable category table is a pre-defined mapping relationship that records the category information to which each feature variable belongs. Next, the variable Z-Score values ​​of the feature variables of the same category are accumulated to obtain the accumulated value of the feature category. This accumulation process is carried out according to the feature category, that is, for the feature variables of the same category, the corresponding Z-Score values ​​are added to obtain the accumulated value of the feature category. This accumulated value reflects the overall performance of the feature category in data transactions.

[0040] After obtaining the cumulative values ​​of the feature categories, these cumulative values ​​need to be normalized to obtain the corresponding category Z-Score values. This normalization process also uses the Z-Score statistical method. First, based on the variable Z-Score value of the feature variable of the same category corresponding to the feature category cumulative value, the mean and standard deviation of the feature category cumulative value are calculated. This mean reflects the average level of the feature category cumulative value, while the standard deviation reflects the degree of dispersion of the feature category cumulative value. Then, using the Z-Score statistical method, the category Z-Score value of each feature category is calculated based on the mean and standard deviation of the feature category cumulative value. This category Z-Score value reflects the degree of deviation between the feature category cumulative value and the average level. The larger the value, the greater the deviation between the feature category cumulative value and the average level; conversely, the smaller the deviation.

[0041] Step 104: Based on the category Z-Score value, determine whether the data transaction corresponding to the order data is an abnormal transaction by using the isolation forest algorithm.

[0042] In one embodiment of the present application, after obtaining the corresponding category Z-Score value, based on the category Z-Score value, an isolation forest algorithm is used to determine whether the data transaction corresponding to the order data is an abnormal transaction.

[0043] Specifically, an isolation forest model is constructed; wherein each isolated tree in the isolation forest model is constructed by randomly selecting feature variables and split points; the category Z-Score value is used as input data and input into the isolation forest model; the path length of each input data in the isolation forest is calculated, and based on the path length, it is determined whether the data transaction corresponding to the order data is an abnormal transaction.

[0044] In one embodiment of the present application, based on the path length, determining whether the data transaction corresponding to the order data is an abnormal transaction specifically includes: judging whether the path length is less than or equal to a preset path length threshold; when it is determined that the path length is less than or equal to the preset path length threshold, determining that the data transaction corresponding to the order data is an abnormal transaction; when it is determined that the path length is greater than the preset path length threshold, determining that the data transaction corresponding to the order data is a normal transaction.

[0045] In one embodiment, after obtaining the category Z-Score value of the feature category, an isolation forest model is first constructed. Isolation forest is a tree-based anomaly detection algorithm that constructs multiple isolated trees by randomly selecting feature variables and split points to form a forest structure. Each isolated tree is a binary tree, in which each node is either an internal node (representing a split point) or a leaf node (representing a data point). When constructing an isolated tree, a feature variable and a split point are randomly selected, and the data points under the current node are divided into two left and right subspaces according to the value of the feature variable, and each subspace is recursively divided until the stopping condition is met (such as each subspace contains only one data point or reaches a preset maximum depth). In this way, an isolation tree is obtained. By constructing multiple such isolated trees, we obtain an isolation forest model.

[0046] Next, the category Z-Score value of the feature category is used as input data and input into the isolation forest model. For each input data (i.e., the category Z-Score value of each feature category), its path length in the isolation forest is calculated. The path length refers to the number of edges passed from the root node to the leaf node containing the input data. Since the construction process of the isolation forest is based on random selection, abnormal data points (i.e., data points that are significantly different from most data points) tend to be divided into leaf nodes earlier, thus having a shorter path length. On the contrary, normal data points usually require more divisions to be divided into leaf nodes, so they have a longer path length.

[0047] After obtaining the path length of each input data, it is determined whether the data transaction corresponding to the order data is an abnormal transaction based on the path length. Specifically, a path length threshold is preset, and then it is determined whether the path length of each input data is less than or equal to the threshold. If the path length of a certain input data is less than or equal to the preset path length threshold, the feature category corresponding to the input data is significantly different from most feature categories, so the corresponding order data is judged as an abnormal transaction. This is because abnormal transactions often show different characteristics from normal transactions in certain feature categories, resulting in a shorter path length. On the contrary, if the path length of a certain input data is greater than the preset path length threshold, the feature category corresponding to the input data is similar to most feature categories, so the corresponding order data is judged as a normal transaction.

[0048] In one embodiment of the present application, after determining that the data transaction corresponding to the order data is an abnormal transaction, an abnormal transaction alarm is generated and sent to a preset administrator account so that the administrator account can manually review the abnormal transaction.

[0049] The above is an embodiment of the method proposed in this application. Based on the same inventive concept, this embodiment of the application also provides an abnormal transaction identification device in data transactions, and its structure is as follows: Figure 2 shown.

[0050] Figure 2 This is a schematic diagram of the internal structure of an abnormal transaction identification device in data transactions provided by an embodiment of the present application. Figure 2 As shown, the device includes:

[0051] at least one processor 201;

[0052] and, a memory 202 communicatively connected to the at least one processor;

[0053] The memory 202 stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor 201 to enable at least one processor 201 to:

[0054] Parse the order data in the data transaction to determine the characteristic variables in the order data;

[0055] The characteristic variables are normalized by using the Z-Score statistical method to determine the variable Z-Score value corresponding to the characteristic variable;

[0056] Based on the preset feature variable category table, the variable Z-Score values ​​of the feature variables of the same category are accumulated to obtain the feature category accumulated value, and the feature category accumulated value is normalized by the Z-Score statistical method to obtain the corresponding category Z-Score value;

[0057] Based on the category Z-Score value, the isolation forest algorithm is used to determine whether the data transaction corresponding to the order data is an abnormal transaction.

[0058] Some embodiments of the present application provide corresponding Figure 1 A non-volatile computer storage medium for identifying abnormal transactions in data transactions stores computer executable instructions, wherein the computer executable instructions are set to:

[0059] Parse order data in data transactions to determine characteristic variables in the order data;

[0060] The characteristic variables are normalized by the Z-Score statistical method to determine the variable Z-Score value corresponding to the characteristic variable;

[0061] Based on the preset feature variable category table, the variable Z-Score values ​​of the feature variables of the same category are accumulated to obtain the feature category accumulated value, and the feature category accumulated value is normalized by the Z-Score statistical method to obtain the corresponding category Z-Score value;

[0062] Based on the category Z-Score value, the isolation forest algorithm is used to determine whether the data transaction corresponding to the order data is an abnormal transaction.

[0063] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the IoT device and medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0064] The system and medium provided in the embodiments of the present application correspond one-to-one to the method. Therefore, the system and medium also have similar beneficial technical effects to the corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the system and medium will not be repeated here.

[0065] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0066] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0067] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0068] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0069] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0070] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0071] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0072] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0073] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for identifying abnormal transactions in data transactions, characterized in that: The method comprises: Parsing order data in a data transaction to determine characteristic variables in the order data; Normalizing the characteristic variable by using the Z-Score statistical method to determine the variable Z-Score value corresponding to the characteristic variable; Based on a preset feature variable category table, the variable Z-Score values ​​of the feature variables of the same category are accumulated to obtain a feature category accumulated value, and the feature category accumulated value is normalized by the Z-Score statistical method to obtain a corresponding category Z-Score value; Based on the category Z-Score value, an isolation forest algorithm is used to determine whether the data transaction corresponding to the order data is an abnormal transaction.

2. The method for identifying abnormal transactions in data transactions according to claim 1, characterized in that: Parsing order data in data transactions to determine characteristic variables in the order data, specifically including: Identify and extract various field information related to transaction behavior in the order data; Based on a preset mapping relationship between field information and feature variables, the feature variables corresponding to the field information are determined.

3. The method for identifying abnormal transactions in data transactions according to claim 2, characterized in that: The characteristic variable is normalized by the Z-Score statistical method to determine the variable Z-Score value corresponding to the characteristic variable, specifically including: Calculating the order data based on the mapping relationship to determine variable data corresponding to the feature variable; Based on the variable data, calculating the mean and standard deviation of the characteristic variable; According to the mean and standard deviation of the characteristic variable, the Z-Score statistical method is used to determine the variable Z-Score value corresponding to the characteristic variable.

4. The method for identifying abnormal transactions in data transactions according to claim 1, characterized in that: Based on the preset feature variable category table, the variable Z-Score values ​​of the feature variables of the same category are accumulated to obtain the feature category cumulative value, specifically including: Querying the feature variable category table to determine the feature category to which the feature variable belongs; The variable Z-Score values ​​of feature variables of the same category are accumulated to obtain the feature category cumulative value.

5. The method for identifying abnormal transactions in data transactions according to claim 1, characterized in that: The feature category cumulative value is normalized by the Z-Score statistical method to obtain the corresponding category Z-Score value, specifically including: Calculate the mean and standard deviation of the feature category cumulative value based on the variable Z-Score value of the feature variable of the same category corresponding to the feature category cumulative value; According to the mean and standard deviation of the feature category cumulative values, the Z-Score statistical method is used to obtain the corresponding category Z-Score value.

6. The method for identifying abnormal transactions in data transactions according to claim 1, characterized in that: Based on the Z-Score value of the category, determining whether the data transaction corresponding to the order data is an abnormal transaction through the isolation forest algorithm includes: Constructing an isolation forest model; wherein each isolated tree in the isolation forest model is constructed by randomly selecting feature variables and split points; Input the category Z-Score value as input data into the isolation forest model; The path length of each input data in the isolation forest is calculated, and based on the path length, it is determined whether the data transaction corresponding to the order data is an abnormal transaction.

7. A method for identifying abnormal transactions in data transactions according to claim 6, characterized in that: Determining whether the data transaction corresponding to the order data is an abnormal transaction based on the path length specifically includes: Determining whether the path length is less than or equal to a preset path length threshold; When it is determined that the path length is less than or equal to a preset path length threshold, determining that the data transaction corresponding to the order data is an abnormal transaction; When it is determined that the path length is greater than a preset path length threshold, it is determined that the data transaction corresponding to the order data is a normal transaction.

8. The method for identifying abnormal transactions in data transactions according to claim 1, characterized in that: The method further comprises: After determining that the data transaction corresponding to the order data is an abnormal transaction, an abnormal transaction alarm is generated, and the abnormal transaction alarm is sent to a preset administrator account so that the administrator account can manually review the abnormal transaction.

9. A device for identifying abnormal transactions in data transactions, characterized in that: The device comprises: at least one processor; and, a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to: Parsing order data in a data transaction to determine characteristic variables in the order data; Normalizing the characteristic variable by using the Z-Score statistical method to determine the variable Z-Score value corresponding to the characteristic variable; Based on a preset feature variable category table, the variable Z-Score values ​​of the feature variables of the same category are accumulated to obtain a feature category accumulated value, and the feature category accumulated value is normalized by the Z-Score statistical method to obtain a corresponding category Z-Score value; Based on the category Z-Score value, an isolation forest algorithm is used to determine whether the data transaction corresponding to the order data is an abnormal transaction.

10. A non-volatile computer storage medium for identifying abnormal transactions in data transactions, storing computer executable instructions, characterized in that: The computer executable instructions are configured to: Parsing order data in a data transaction to determine characteristic variables in the order data; Normalizing the characteristic variable by using the Z-Score statistical method to determine the variable Z-Score value corresponding to the characteristic variable; Based on a preset feature variable category table, the variable Z-Score values ​​of the feature variables of the same category are accumulated to obtain a feature category accumulated value, and the feature category accumulated value is normalized by the Z-Score statistical method to obtain a corresponding category Z-Score value; Based on the category Z-Score value, an isolation forest algorithm is used to determine whether the data transaction corresponding to the order data is an abnormal transaction.

Images