Abnormal transaction identification method and device, equipment, storage medium and product

Abstract

The invention discloses an abnormal transaction identification method, device and equipment, a storage medium and a product, and relates to the technical field of artificial intelligence. The method comprises the steps of obtaining transaction activity data in response to triggering of a transaction event, obtaining transaction feature data through feature calculation, obtaining account feature data of a transaction account, inputting the account feature data and the transaction feature data into a preset transaction anomaly recognition operator to obtain an anomaly recognition result, the preset transaction exception recognition operator is a flow calculation operator constructed based on a transaction exception recognition model, and feature items corresponding to the account feature data and the transaction feature data are feature items associated with the exceptional transaction. According to the technical scheme of the invention, the problems of hysteresis and low accuracy of abnormal recognition based on expert rules and historical batch data at present are solved, transactions can be recognized in real time through transaction activity data and historical account data, the accuracy and timeliness of abnormal transaction recognition are improved, and property safety is protected.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of artificial intelligence technology, and in particular, to an abnormal transaction identification method, device, equipment, storage medium and product. Background Art

[0002] In an environment where telecom fraud cases frequently occur, artificial intelligence technology can be used to identify abnormal transaction behaviors in order to improve the security of financial transactions. Usually, abnormal transactions are identified through expert rule models and machine learning models to detect suspicious transactions.

[0003] However, the expert rule model is usually based on a specific transaction model in a specific scenario to summarize and refine the corresponding expert rules. The summarized rules are usually simple and have a large lag, and the anomaly detection effectiveness is low. The machine learning model is also based on the T-1 day (T day is the model batch day) data for batch running, and the model analysis results also have a certain lag. Summary of the invention

[0004] The embodiments of the present invention provide an abnormal transaction identification method, device, equipment, storage medium and product, which are used to solve the problem that the current abnormality identification based on expert rules and historical batch data has a lag and low accuracy.

[0005] In a first aspect, an embodiment of the present invention provides a method for identifying abnormal transactions, comprising:

[0006] In response to the triggering of a transaction event, acquiring transaction activity data of a transaction account associated with the transaction event; wherein the transaction activity data is transaction activity data associated with the transaction event;

[0007] Perform feature calculation on the transaction activity data to obtain transaction feature data corresponding to the transaction event, and obtain account feature data of the transaction account from a preset database;

[0008] Input the account feature data and transaction feature data into the preset transaction anomaly identification operator for calculation and analysis to obtain the anomaly identification result of the transaction event;

[0009] Among them, the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model, and the feature items corresponding to the account feature data and the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on the transaction activity data and account data in historical abnormal transaction events.

[0010] In a second aspect, an embodiment of the present invention further provides an abnormal transaction identification device, the device comprising:

[0011] A data acquisition module, configured to acquire transaction activity data of a transaction account associated with a transaction event in response to a trigger of a transaction event; wherein the transaction activity data is transaction activity data associated with the transaction event;

[0012] A data feature confirmation module is used to perform feature calculation on transaction activity data, obtain transaction feature data corresponding to the transaction event, and obtain account feature data of the transaction account from a preset database;

[0013] The transaction anomaly analysis module is used to input the account feature data and the transaction feature data into the preset transaction anomaly identification operator for calculation and analysis to obtain the anomaly identification result of the transaction event;

[0014] Among them, the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model, and the feature items corresponding to the account feature data and the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on the transaction activity data and account data in historical abnormal transaction events.

[0015] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, an abnormal transaction identification method as described in any one of the embodiments of the present invention is implemented.

[0016] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the abnormal transaction identification method as described in any one of the embodiments of the present invention.

[0017] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the abnormal transaction identification method as described in any one of the embodiments of the present invention.

[0018] In an embodiment of the present invention, by responding to the triggering of a transaction event, the transaction activity data of the transaction account associated with the transaction event is obtained; wherein the transaction activity data is the transaction activity data associated with the transaction event; feature calculation is performed on the transaction activity data to obtain transaction feature data corresponding to the transaction event, and the account feature data of the transaction account is obtained from a preset database; the account feature data and the transaction feature data are input into a preset transaction anomaly recognition operator for calculation and analysis to obtain an abnormal recognition result of the transaction event; wherein the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model, and the feature items corresponding to the account feature data and the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on the transaction activity data and account data in historical abnormal transaction events. The technical solution of the present invention solves the problem that the current abnormal recognition based on expert rules and historical batch data has a lag in recognition and low accuracy, and can identify transactions in real time through transaction activity data and historical account data, improve the accuracy and timeliness of abnormal transaction recognition, and protect property safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 is a flow chart of an abnormal transaction identification method provided by an embodiment of the present invention;

[0021] Figure 2 is a flow chart of an abnormal transaction identification method provided by an embodiment of the present invention;

[0022] Figure 3 is a schematic diagram of an abnormal transaction identification method provided by an embodiment of the present invention;

[0023] Figure 4 is a flow chart of an abnormal transaction identification method provided by an embodiment of the present invention;

[0024] Figure 5 is a schematic diagram of sample data sampling provided by an embodiment of the present invention;

[0025] Figure 6 It is a ROC curve diagram of a LightGBM model provided by an embodiment of the present invention;

[0026] Figure 7 is a flow chart of an abnormal transaction identification method provided by an embodiment of the present invention;

[0027] Figure 8 This is a schematic diagram of an abnormal transaction identification feature library provided by an embodiment of the present invention;

[0028] Fig. 9 It is a structural schematic diagram of an abnormal transaction identification device provided by an embodiment of the present invention;

[0029] Fig.10 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0031] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance. The acquisition, storage, use, processing, etc. of data in the technical solution of this application comply with the relevant provisions of national laws and regulations. It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. The purpose is only to illustrate the feasibility of the implementation of the technical solution of this application, but it does not mean that the applicant has or must use the relevant content of the solution.

[0032] In recent years, telecom fraud cases have occurred frequently, causing huge losses to customers and banks. Bank regulatory authorities have also cooperated with relevant departments and shared information to increase the crackdown on telecom fraud. Identifying suspicious accounts and abnormal transactions from massive transaction data has become the key to combating telecom fraud. However, with the popularization of mobile payments, the means of fund transfer by criminals have become more covert and complex, exposing some new characteristics.

[0033] First, the fraudulent methods are complex. The rapid development of mobile Internet technology and the frequent occurrence of information leaks have caused the fraud model to evolve continuously, becoming more disguised and deceptive. In particular, the abnormal fund transfer methods are mostly hidden in normal consumption and living funds, making them difficult to distinguish. Secondly, the abnormal fund transfer is fast, and the process from deposit to withdrawal is usually completed in a very short time. Large amounts of funds are transferred frequently without leaving any balance. Finally, the abnormal transaction patterns are more diversified. When abnormal transaction accounts transfer abnormal funds, in addition to disguising transactions, they also use technologies such as artificial intelligence to study and exploit risk control loopholes of payment institutions to evade supervision.

[0034] In view of the current serious situation of gambling and fraud cases, there is an urgent need to adopt more advanced artificial intelligence technologies to improve the monitoring capabilities and efficiency of fraud-related transactions.

[0035] Figure 1 This is a flow chart of an abnormal transaction identification method provided by an embodiment of the present invention. This embodiment is applicable to the scene of abnormal transaction identification. The method can be executed by an abnormal transaction identification device, which can be implemented by software and / or hardware and integrated into an electronic device with application development function.

[0036] like Figure 1 As shown, the abnormal transaction identification method of this embodiment includes the following steps:

[0037] S110 . In response to triggering of a transaction event, obtain transaction activity data of a transaction account associated with the transaction event.

[0038] A transaction event can be an event involving the transfer of financial assets, specifically, an event involving the transfer of financial assets between accounts in any financial system, such as the transfer time between accounts, the purchase and sale of financial products by accounts, etc. The operator of an account can trigger a transaction event when the transaction account confirms the transfer of financial assets.

[0039] Among them, transaction activity data refers to transaction activity data associated with transaction events. Transaction activity data can be account operation data associated with the progress of transaction events, for example, data generated by operation activities before the triggering of transaction events, specifically account interaction data within a preset time period before the transaction event is triggered. These data will be updated in real time in the corresponding data warehouse to record the progress of the account's transaction events. Transaction activity data can include the following subcategories, namely real-time transaction data, such as transaction amount, transaction frequency and transaction time, etc.; tracking behavior data, such as click data and query data in account operations obtained through program tracking; channel login data, such as account login IP information, MAC information or operating system data.

[0040] For example, transaction activity data can be obtained by backtracking, such as backtracking the data values ​​of transaction activity data within a preset time period before the transaction event triggering time point. The length of the preset time period can be set according to actual needs, such as 30 minutes.

[0041] S120: Perform feature calculation on the transaction activity data to obtain transaction feature data corresponding to the transaction event, and obtain account feature data of the transaction account from a preset database.

[0042] The feature items corresponding to the account feature data and the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on the transaction activity data and account data in historical abnormal transaction events.

[0043] According to the data type or data content of the characteristic items corresponding to each transaction characteristic data, the data value of part of the transaction activity data can be directly determined as the transaction characteristic data, for example, the transaction amount and transaction event can be directly obtained. For data in the transaction activity data that cannot be directly obtained, such as the transaction frequency, it is necessary to perform feature calculation according to, for example, the corresponding calculation formula to obtain the corresponding transaction characteristic data. For example, the transaction frequency is obtained by calculating the ratio of the number of transactions and the length of the preset time period. Feature calculation can also include data processing, such as standardization. In addition, according to the feature calculation requirements, the data value of the transaction activity data can also be standardized, and the data value of the standardized transaction activity data is used as the transaction characteristic data.

[0044] The account characteristic data can be obtained from the preset database by querying the attribute values ​​of the relevant fields of the transaction account in the preset database. The account characteristic data in the preset database can be obtained by processing the historical accumulated account association data of the transaction account, for example, static information such as the age, occupation and education of the user of the transaction account, the total transaction volume and total transaction amount of the card, and the characteristic data of the historical transactions of the account, the historical transaction frequency, the historical transaction time, the historical transaction amount, whether there have been any abnormal transactions, etc.

[0045] S130: Input the account feature data and the transaction feature data into a preset transaction anomaly identification operator for calculation and analysis to obtain an anomaly identification result of the transaction event.

[0046] Among them, the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model. The stream computing operator can be a Flink operator. Flink is an open source stream processing framework that is mainly used for stateful calculations on bounded and unbounded data streams and can monitor and process data in real time. In this embodiment, the account feature data and transaction feature data are calculated and analyzed by the stream computing operator constructed based on the pre-trained transaction anomaly recognition model, and the high throughput, low latency and stateful computing characteristics of the stream computing operator are utilized to improve the efficiency and accuracy of transaction event recognition.

[0047] Historical abnormal transaction events are, for example, historical abnormal transaction events within a specific period of time obtained from relevant departments. In this embodiment, based on the transaction activity data and account data in the historical abnormal transaction events, features that have an important impact on abnormal transaction identification are screened out through feature engineering, that is, features with high significance in abnormal transaction identification, as feature items associated with abnormal transactions, that is, feature items of account feature data and transaction feature data. Among them, feature screening can be carried out by filtering, wrapping, embedding, etc.

[0048] The pre-trained transaction anomaly recognition model is a neural network model obtained by training the transaction anomaly recognition model based on machine learning. The stream computing operator initializes the pre-trained transaction anomaly recognition model and stores it in the memory to perform calculations and analysis on the input account feature data and transaction feature data to obtain the anomaly recognition result of the transaction event. The anomaly recognition result can be the judgment result of whether it is an abnormal transaction.

[0049] This embodiment combines real-time big data technology, stream computing and artificial intelligence technology to achieve real-time analysis and detection of abnormal probability of transaction events using machine learning models on stream computing. It can capture abnormal transaction behavior in real time, quickly trigger early warning or intervention measures, prevent the spread of risks, and fundamentally improve the monitoring efficiency of accounts associated with abnormal transactions. In addition, this embodiment can analyze data at the moment of transaction and immediately identify abnormal transactions through real-time machine learning models. This immediacy is crucial to preventing abnormal transaction behavior and preventing financial losses. By detecting transactions in real time, the system can take action before abnormal transactions cause actual losses, such as freezing accounts or blocking suspicious transactions, thereby ensuring property safety.

[0050] The technical solution of the embodiment of the present invention obtains the transaction activity data of the transaction account associated with the transaction event by responding to the trigger of the transaction event; wherein the transaction activity data is the transaction activity data associated with the transaction event; performs feature calculation on the transaction activity data to obtain the transaction feature data corresponding to the transaction event, and obtains the account feature data of the transaction account from the preset database; inputs the account feature data and the transaction feature data into the preset transaction anomaly recognition operator for calculation and analysis to obtain the abnormal recognition result of the transaction event; wherein the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model, and the feature items corresponding to the account feature data and the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on the transaction activity data and account data in the historical abnormal transaction event. The technical solution of the present invention solves the problem that the current abnormal recognition based on expert rules and historical batch data has a lag and low accuracy, and can identify transactions in real time through transaction activity data and historical account data, improve the accuracy and timeliness of abnormal transaction recognition, and protect property safety.

[0051] Figure 2 This is a flowchart of an abnormal transaction identification method provided by an embodiment of the present invention. This embodiment and the abnormal transaction identification method in the above embodiment belong to the same inventive concept, and further describes the process of obtaining transaction activity data and account feature data. The method can be executed by an abnormal transaction identification device, which can be implemented by software and / or hardware and integrated into an electronic device with application development function.

[0052] like Figure 2 As shown, the abnormal transaction identification method of this embodiment includes the following steps:

[0053] S210. In response to the triggering of a transaction event, the transaction activity data of the transaction account at the triggering moment of the transaction event and within a preset time period before the triggering moment are obtained from the transaction activity data table in the preset real-time data warehouse.

[0054] The transaction activity data may be transaction activity data associated with a transaction event, and the transaction activity data may include transaction description data, transaction operation record data, and transaction account login data.

[0055] The transaction activity data of the trading account at the triggering moment of the transaction event and the preset time before the triggering moment can be understood as the transaction activity data within the preset time period obtained by taking the triggering moment of the transaction event as the end point of the time period of the preset time period and taking the moment corresponding to the preset time period before the triggering moment of the transaction event as the starting point of the time period. The preset time period can be set according to actual needs, such as 5 minutes, 6 hours or 24 hours.

[0056] The transaction activity data table in the preset real-time data warehouse stores the transaction activity data generated by each transaction event in real time. Transaction description data, such as transaction amount, transaction frequency and transaction time, etc.; transaction operation record data, such as click and query type buried data, which can characterize the data related to the user's click and query operations; transaction account login data, such as IP and MAC indicators. IP data can be the distribution and change frequency of Internet IP addresses, etc. MAC data can be MAC address usage, changes, and other MAC address data related to user usage habits, etc.

[0057] like Figure 3 As shown, in response to the triggering of a transaction event, the transaction activity data of the transaction account at the triggering moment of the transaction event and within a preset time period before the triggering moment is obtained from the transaction activity data table in the preset real-time data warehouse, i.e., the real-time data warehouse.

[0058] S220: Perform feature calculation on the transaction activity data to obtain transaction feature data corresponding to the transaction event, and perform data query based on the row keyword in the feature data table of the transaction account in the preset database to obtain account feature data of the transaction account.

[0059] like Figure 3 As shown, data processing methods such as standardization are performed on transaction activity data to perform feature calculations in the stream computing operator to obtain transaction feature data corresponding to the transaction events.

[0060] The preset database may be an Hbase database, including multiple feature data tables, each of which includes multiple keyword fields. Through Rowkey query, i.e., a method of retrieving data in the feature data table based on a specific row key (Rowkey), i.e., row keyword, the target row data corresponding to the transaction account in the feature data table, i.e., the account feature data corresponding to the transaction account, is obtained. The data in the preset database may be account feature data, i.e., batch data, transferred from a preset batch database.

[0061] In an optional implementation, the account characteristic data is characteristic data that is updated regularly. The updating process of the account characteristic data may be to perform characteristic analysis based on the historical accumulated account-related data of the transaction account according to the preset data updating frequency to obtain the updated account characteristic data. The preset data updating frequency may be to update the characteristic data at every preset updating time. For example, the account characteristic data is updated every 24 hours. At the time of updating the characteristic data, characteristic analysis is performed based on the historical accumulated account-related data of the transaction account newly acquired to obtain the updated account characteristic data.

[0062] The account feature data may include at least one of the user dimension feature data, card dimension feature data and account dimension feature data corresponding to the transaction account. User dimension feature data may include static information such as the user's age, occupation and education level. Card dimension feature data may include card type such as stored-value card, credit card, etc., card level, overdue and overdraft status, total transaction volume and total transaction amount of the card, etc. Account dimension feature data may include feature data of historical transactions of the account, historical transaction frequency, historical transaction time and historical transaction amount, etc.

[0063] S230: Input the account feature data and the transaction feature data into a preset transaction anomaly identification operator for calculation and analysis to obtain an anomaly identification result of the transaction event.

[0064] Among them, the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model, and the feature items corresponding to the account feature data and the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on the transaction activity data and account data in historical abnormal transaction events.

[0065] like Figure 3 As shown, the account feature data and the transaction feature data are merged, and the feature merging result is input into a preset transaction anomaly recognition operator for calculation and analysis to obtain an abnormal recognition result of the transaction event.

[0066] In an optional implementation, the process of obtaining a preset transaction anomaly identification operator may be to convert the description format of the transaction anomaly identification model based on a prediction model markup language to obtain a transaction anomaly identification model file in a target format; and add the transaction anomaly identification model file in the target format as a stream computing operator in a streaming data processing module of a target transaction system.

[0067] The prediction model markup language may be PMML (Predictive Model Markup Language), which is a markup language based on XML and used for describing and sharing prediction models.

[0068] Convert the trained model into PMML, a universal machine learning model deployment format. PMML model files are usually used to transfer machine learning models from one tool or platform to another, making model deployment and integration more convenient. Add the transaction anomaly recognition model file in the standard format as a stream computing operator to the streaming data processing module of the target trading system. This enables real-time recognition of abnormal transactions based on the transaction data in the real-time streaming data.

[0069] The technical solution of the embodiment of the present invention obtains the transaction activity data of the transaction account at the triggering moment of the transaction event and within a preset time period before the triggering moment from the transaction activity data table in the preset real-time data warehouse in response to the triggering of the transaction event; wherein the transaction activity data includes transaction description data, transaction operation record data and transaction account login data; performs feature calculation on the transaction activity data to obtain transaction feature data corresponding to the transaction event, performs data query based on the row keywords in the feature data table of the transaction account in the preset database, and obtains the account feature data of the transaction account; inputs the account feature data and the transaction feature data into the preset transaction anomaly recognition operator for calculation and analysis to obtain the abnormal recognition result of the transaction event; wherein the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model, and the account feature data and the feature items corresponding to the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on the transaction activity data and account data in historical abnormal transaction events. The technical solution of the present invention solves the problem that the current anomaly identification based on expert rules and historical batch data has a lag and low accuracy. Transactions can be identified in real time through transaction activity data and historical account data obtained from a preset real-time data warehouse and a preset database, thereby improving the accuracy and timeliness of abnormal transaction identification and protecting property safety.

[0070] Figure 4 This is a flow chart of an abnormal transaction identification method provided in an embodiment of the present invention. This embodiment and the abnormal transaction identification method in the above embodiment belong to the same inventive concept, and further describes the training process of the transaction abnormality identification model. The method can be executed by an abnormal transaction identification device, which can be implemented by software and / or hardware and integrated into an electronic device with application development function.

[0071] like Figure 4 As shown, the training process of the transaction anomaly identification model in the abnormal transaction identification method of this embodiment includes the following steps:

[0072] S310: Screen sample data in a historical transaction event database according to preset transaction tag information to obtain a model training sample set.

[0073] Among them, the model training sample set includes abnormal transaction event sample data and normal transaction sample data.

[0074] The historical transaction event database may store historical transaction events within a continuous period of time obtained from relevant departments and preset transaction tag information, transaction activity data, and account feature data corresponding to the historical transaction events.

[0075] The preset transaction tag information may be multiple types of tag information that characterize the normal or abnormal state of a transaction. The sample data may be screened by combining multiple different types of preset transaction tag information. Specifically, when the sample data meets all types of tag information in the tag information corresponding to the normal transaction sample data in the preset transaction tag information, the sample data may be determined as the normal transaction sample data, and when the sample data meets all types of tag information in the tag information corresponding to the abnormal transaction sample data in the preset transaction tag information, the sample data may be determined as the abnormal transaction sample data.

[0076] In an optional implementation, based on the preset transaction tag information, sample data is screened in the historical transaction event database to obtain a model training sample set, which may include the following steps S1-S4:

[0077] Step S1: Screening sample data in a historical transaction event database corresponding to an abnormal transaction event according to preset transaction tag information to obtain abnormal transaction event sample data that meets a first set of screening conditions.

[0078] The historical transaction event database corresponding to the abnormal transaction event may be a database of sample data associated with accounts marked as black samples by the anti-fraud center. The process of establishing the historical transaction event database corresponding to the abnormal transaction event may be to determine the accounts marked as black samples by the anti-fraud center, specifically, the accounts marked as black samples by the anti-fraud center within a preset marked account time period, such as Figure 5 As shown, the preset training set sampling marked account time period can be, for example, from February 1, 2024 to February 29, 2024.

[0079] The first set of screening conditions may be to satisfy all types of marking information in the marking information corresponding to the abnormal transaction sample data in the preset transaction marking information, and perform sample data screening in the historical transaction event database corresponding to the abnormal transaction event according to the preset transaction marking information to see whether the sample data satisfies all types of marking information in the marking information corresponding to the abnormal transaction sample data in the preset transaction marking information. If so, the sample data is determined to be abnormal transaction event sample data.

[0080] Step S2: Determine the second sample event quantity of the normal transaction sample data according to the first sample event quantity of the abnormal transaction event sample data and a preset positive-negative sample quantity ratio.

[0081] For example, the number of first sample events of abnormal transaction event sample data is 13200, and the preset positive and negative sample ratio is 100:1, then the number of second sample events of normal transaction samples is 13200×100=1320000.

[0082] Step S3: Screening sample data in a historical transaction event database corresponding to normal transaction events according to preset transaction tag information to obtain normal transaction event sample data that meets a second set of screening conditions and has a quantity equal to second sample event data.

[0083] The historical transaction event database corresponding to normal transaction events can be a database of sample data associated with accounts marked with white samples by the anti-fraud center. The process of establishing the historical transaction event database corresponding to normal transaction events can be to determine the accounts marked with white samples by the anti-fraud center according to the transaction dates involved in the black samples and the preset black and white sample account ratio. The preset black and white sample account ratio can be 1:100, which can be set according to actual needs.

[0084] The second set of screening conditions may be to satisfy all types of marking information in the marking information corresponding to the normal transaction sample data in the preset transaction marking information, and perform sample data screening in the historical transaction event database corresponding to the normal transaction event according to the preset transaction marking information to see whether the sample data satisfies all types of marking information in the marking information corresponding to the normal transaction sample data in the preset transaction marking information. If so, the sample data is determined to be normal transaction event sample data.

[0085] Step S4: construct a model training sample set based on the abnormal transaction event sample data and the normal transaction event sample data.

[0086] Based on the sample data of abnormal transaction events and the sample data of normal transaction events, a model training sample set is constructed, and black sample accounts of a preset test set sampling mark account time period can be obtained, wherein the preset test set sampling mark account time period is after the preset training set sampling mark account time period, and white sample accounts of a preset number of days within the preset test set sampling mark account time period are randomly selected. A database is constructed based on the transaction data of black sample accounts and white sample accounts and a model test sample set is determined. The method of constructing a database and determining a model test sample set is the same as the method of determining a model training sample set. Figure 5 As shown, the preset test set sampling mark account time period can be March 1, 2024 to March 31, 2024.

[0087] In this embodiment, the model verification sample set can also be determined in the same manner as the model test sample set, and the preset verification set sampling mark account time period can be after the preset test set sampling mark account time period, such as Figure 5 As shown, the preset verification set sampling mark account time period can be April 1, 2024 to April 30, 2024.

[0088] In an optional implementation, the preset transaction mark information includes a transaction direction mark, a transaction amount, an unfamiliar transaction mark, and a transaction account involvement history mark.

[0089] Accordingly, the first set of screening conditions may be a specific transaction direction related to abnormal transactions, a transaction amount greater than a preset abnormal transaction amount threshold, an unfamiliar transaction marked as an unfamiliar transaction, and a transaction subject being an account involved in the case. The second set of screening conditions may be a specific transaction direction related to normal transactions, a transaction amount greater than a preset normal transaction amount threshold, an unfamiliar transaction marked as an unfamiliar transaction, and a transaction subject being an account not involved in the case.

[0090] In an optional implementation, the transaction anomaly recognition model to be trained is a machine learning model or a deep learning model for binary classification.

[0091] The binary classification task of the model refers to the task of determining which of the two categories the input data belongs to. In this embodiment, the binary classification task of the model is used to determine whether the input transaction is an abnormal transaction or a normal transaction. The machine learning model or deep learning model used for binary classification may include, for example, logistic regression, decision tree, random forest, support vector machine, artificial neural network, convolutional neural network, recurrent neural network, etc.

[0092] S320: Train the transaction anomaly recognition model to be trained using the model training sample set and a preset hyperparameter calculation algorithm to obtain a transaction anomaly recognition model.

[0093] The preset hyperparameter calculation algorithm may be, for example, a random search algorithm, a Bayesian optimization algorithm, a grid search algorithm, etc. Through the model training sample set and the preset hyperparameter calculation algorithm, the transaction anomaly recognition model to be trained is iteratively trained, the model parameters of the transaction anomaly recognition model to be trained are updated, and the transaction anomaly recognition model is obtained.

[0094] In an optional embodiment, the machine learning model includes a LightGBM model, and the preset hyperparameter calculation algorithm is the Optuna automated hyperparameter optimization framework.

[0095] LightGBM (Light Gradient Boosting Machine) has achieved good classification and recognition results in most binary classification tasks. In order to train the hyperparameters of LightGBM, a 5-fold cross-validation can be used for the model training sample set. This can ensure the generalization ability of the sample on the sample. In order to effectively explore the hyperparameters in high-dimensional space, you can choose the Optuna automated hyperparameter optimization framework. Optuna supports Bayesian optimization, which can save computing resources and speed up the optimization process. It is especially suitable for large-scale models that are trained for a long time. At the same time, in order to ensure that the final trained model still has a good recognition effect after it goes online, the model can be verified using cross-time (OOT) samples, such as Figure 6 As shown, Figure 6 The figure is the ROC curve (Receiver Operating Characteristic curve) of the LightGBM model. The LightGBM model still achieves better results in the cross-time sample set.

[0096] Table 1

[0097] Statistics Current training samples Current verification samples Cross-period validation samples Bootstrap KS 55.3 54.2 51.6 [44.6,53.8] AR 56.4 55.1 53.1 [51.1,62.9]

[0098] As shown in Table 1, Table 1 is a model performance evaluation table. The KS (Kolmogorov-Smirnov) indicator is an indicator for measuring the ability to distinguish between positive and negative samples. The AR (Accuracy Ratio) indicator is the harmonic mean of accuracy and recall. The Bootstrap result intervals are the 5th and 95th percentiles of multiple verification results of cross-period samples. The LightGBM model has a high accuracy in transaction recognition.

[0099] The technical solution of the embodiment of the present invention obtains a model training sample set by screening sample data in a historical transaction event database according to preset transaction tag information; wherein the model training sample set includes abnormal transaction event sample data and normal transaction sample data; the transaction anomaly recognition model to be trained is trained through the model training sample set and a preset hyperparameter calculation algorithm to obtain a transaction anomaly recognition model. The technical solution of the present invention solves the problem that the current anomaly recognition based on expert rules and historical batch data has a lag and low accuracy. The transaction anomaly recognition model to be trained can be trained through samples of the historical transaction event database to obtain a transaction anomaly recognition model, thereby improving the accuracy and timeliness of abnormal transaction recognition and protecting property safety.

[0100] Figure 7This is a flowchart of an abnormal transaction identification method provided in an embodiment of the present invention. This embodiment and the abnormal transaction identification method in the above embodiment belong to the same inventive concept, and further describes the process of intervening in transactions and optimizing and updating models after the identification result is determined. The method can be executed by an abnormal transaction identification device, which can be implemented by software and / or hardware and integrated into an electronic device with application development function.

[0101] like Figure 7 As shown, the abnormal transaction identification method of this embodiment includes the following steps:

[0102] S410: In response to triggering of a transaction event, obtain transaction activity data of a transaction account associated with the transaction event.

[0103] Among them, the transaction activity data is the transaction activity data associated with the transaction event.

[0104] S420: Perform feature calculation on the transaction activity data to obtain transaction feature data corresponding to the transaction event, and obtain account feature data of the transaction account from a preset database.

[0105] S430: Input the account feature data and the transaction feature data into a preset transaction anomaly identification operator for calculation and analysis to obtain an anomaly identification result of the transaction event.

[0106] Among them, the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model, and the feature items corresponding to the account feature data and the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on the transaction activity data and account data in historical abnormal transaction events.

[0107] S440: When the probability that the transaction event corresponding to the abnormal identification result is an abnormal transaction is greater than or equal to a preset probability threshold, intercept the transaction event and / or issue a risk warning.

[0108] The abnormal identification result is the probability that the transaction event is an abnormal transaction. For transactions with a probability greater than or equal to the preset probability threshold, any one or a combination of risk warning, control interception and gray list monitoring can be implemented. For transactions with a probability less than the preset probability threshold, they are released, that is, no special control is performed.

[0109] S450: Use transaction events and anomaly recognition results as samples for model tuning.

[0110] The transaction events in the transaction anomaly recognition model application and the anomaly recognition results output by the transaction anomaly recognition model are used as model tuning samples.

[0111] S460. Update the transaction anomaly recognition model according to the model tuning sample.

[0112] The model parameters of the transaction anomaly recognition model, such as the weight value of the model, are updated according to the model tuning sample to obtain an updated transaction anomaly recognition model.

[0113] This embodiment can improve prediction accuracy through a real-time transaction anomaly identification model, and can be adjusted and optimized according to the latest transaction data and transaction behavior patterns, so that the model always maintains efficient and accurate detection capabilities.

[0114] The technical solution of the embodiment of the present invention obtains transaction activity data of a transaction account associated with a transaction event in response to a trigger of a transaction event; wherein the transaction activity data is transaction activity data associated with the transaction event; performs feature calculation on the transaction activity data to obtain transaction feature data corresponding to the transaction event, and obtains account feature data of the transaction account from a preset database; inputs the account feature data and the transaction feature data into a preset transaction anomaly recognition operator for calculation and analysis to obtain an abnormal recognition result of the transaction event; wherein the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model, and the feature items corresponding to the account feature data and the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on transaction activity data and account data in historical abnormal transaction events; when the probability that the transaction event corresponding to the abnormal recognition result is an abnormal transaction is greater than or equal to a preset probability threshold, intercepts the transaction event and / or issues a risk warning; uses the transaction event and the abnormal recognition result as a model tuning sample; and updates the transaction anomaly recognition model according to the model tuning sample. The technical solution of the present invention solves the problem that the current anomaly identification based on expert rules and historical batch data has a lag in identification and is not accurate. Transactions can be identified in real time through transaction activity data and historical account data, improving the accuracy and timeliness of abnormal transaction identification. Transaction events can be processed after the abnormal transaction identification results are output, and the model can be adjusted according to transaction events and abnormal identification results to ensure that the model maintains a good identification effect, learn the transaction characteristics of abnormal transactions, improve identification accuracy, and protect property safety.

[0115] In a preferred embodiment of the present invention, the process of determining the feature items corresponding to the account feature data and the transaction feature data of the abnormal transaction identification method can be to analyze the fraudulent patterns of the fraudulent accounts, mine the typical risk features of the fraudulent transactions, build an abnormal transaction identification feature pool from the two dimensions of real-time features and static features, and then combine feature engineering technology to screen the feature variables with higher significance, and finally form an abnormal transaction identification feature library. Figure 8As shown, the feature items in the real-time features in the abnormal transaction identification feature library are the feature items of the transaction feature data, and the feature items in the static features in the abnormal transaction identification feature library are the feature items corresponding to the account feature data. This embodiment combines real-time data and historical data to enable the model to more accurately distinguish normal transactions from abnormal transactions, thereby reducing the false alarm rate and avoiding interference with normal transactions of legitimate users.

[0116] Fig. 9 The schematic diagram of the structure of an abnormal transaction identification device provided by an embodiment of the present invention is applicable to the scene of abnormal transaction identification. The abnormal transaction identification device can be implemented by software and / or hardware and integrated into a computer terminal device with application development function.

[0117] like Fig. 9 As shown, the abnormal transaction identification device includes: a data acquisition module 510, a data feature confirmation module 520 and a transaction abnormality analysis module 530.

[0118] Among them, the data acquisition module 510 is used to obtain the transaction activity data of the transaction account associated with the transaction event in response to the triggering of the transaction event; wherein the transaction activity data is the transaction activity data associated with the transaction event; the data feature confirmation module 520 is used to perform feature calculation on the transaction activity data to obtain the transaction feature data corresponding to the transaction event, and obtain the account feature data of the transaction account from the preset database; the transaction anomaly analysis module 530 is used to input the account feature data and the transaction feature data into the preset transaction anomaly recognition operator for calculation and analysis to obtain the abnormal recognition result of the transaction event; wherein the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model, and the feature items corresponding to the account feature data and the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on the transaction activity data and the account data in the historical abnormal transaction events.

[0119] The technical solution of the embodiment of the present invention obtains the transaction activity data of the transaction account associated with the transaction event by responding to the trigger of the transaction event; wherein the transaction activity data is the transaction activity data associated with the transaction event; performs feature calculation on the transaction activity data to obtain the transaction feature data corresponding to the transaction event, and obtains the account feature data of the transaction account from the preset database; inputs the account feature data and the transaction feature data into the preset transaction anomaly recognition operator for calculation and analysis to obtain the abnormal recognition result of the transaction event; wherein the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model, and the feature items corresponding to the account feature data and the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on the transaction activity data and account data in the historical abnormal transaction event. The technical solution of the present invention solves the problem that the current abnormal recognition based on expert rules and historical batch data has a lag and low accuracy, and can identify transactions in real time through transaction activity data and historical account data, improve the accuracy and timeliness of abnormal transaction recognition, and protect property safety.

[0120] In an optional implementation, the data acquisition module 510 is specifically used for:

[0121] The transaction activity data of the transaction account at the triggering time of the transaction event and within a preset time period before the triggering time are obtained from the transaction activity data table in the preset real-time data warehouse; wherein the transaction activity data includes transaction description data, transaction operation record data and transaction account login data.

[0122] In an optional implementation, the account characteristic data is characteristic data that is regularly updated, and the device further includes:

[0123] The account characteristic data updating module is used to perform characteristic analysis based on the historical accumulated account association data of the transaction account according to the preset data updating frequency to obtain updated account characteristic data; wherein the account characteristic data includes at least one of the user dimension characteristic data, card dimension characteristic data and account dimension characteristic data corresponding to the transaction account.

[0124] In an optional implementation, the data feature confirmation module 520 is specifically used to:

[0125] Data query is performed based on the row keywords in the characteristic data table of the trading account in the preset database to obtain the account characteristic data of the trading account.

[0126] In an optional embodiment, the device further comprises:

[0127] A preset transaction anomaly identification operator acquisition module is used to convert the description format of the transaction anomaly identification model based on the prediction model markup language to obtain the transaction anomaly identification model file in the target format; the transaction anomaly identification model file in the target format is added as a stream computing operator in the streaming data processing module of the target transaction system.

[0128] In an optional embodiment, the device further comprises:

[0129] The model training module is used to screen sample data in the historical transaction event database according to preset transaction tag information to obtain a model training sample set; wherein the model training sample set includes abnormal transaction event sample data and normal transaction sample data; through the model training sample set and the preset hyperparameter calculation algorithm, the transaction anomaly recognition model to be trained is trained to obtain a transaction anomaly recognition model.

[0130] In an optional implementation, the model training module is specifically used to:

[0131] Sample data is screened in a historical transaction event database corresponding to the abnormal transaction event according to preset transaction marking information to obtain sample data of abnormal transaction events that meet a first set of screening conditions; the number of second sample events of normal transaction sample data is determined according to the number of first sample events of the abnormal transaction event sample data and a preset ratio of the number of positive and negative samples; sample data is screened in a historical transaction event database corresponding to the normal transaction event according to the preset transaction marking information to obtain sample data of normal transaction events that meet a second set of screening conditions and whose number is the second sample event data; a model training sample set is constructed based on the abnormal transaction event sample data and the normal transaction event sample data.

[0132] In an optional implementation, the preset transaction mark information includes a transaction direction mark, a transaction amount, an unfamiliar transaction mark, and a transaction account involvement history mark.

[0133] In an optional implementation, the transaction anomaly recognition model to be trained is a machine learning model or a deep learning model for binary classification.

[0134] In an optional embodiment, the machine learning model includes a LightGBM model, and the preset hyperparameter calculation algorithm is the Optuna automated hyperparameter optimization framework.

[0135] In an optional embodiment, the device further comprises:

[0136] The abnormal transaction processing module is used to intercept the transaction event and / or issue a risk warning when the probability that the transaction event corresponding to the abnormal identification result is an abnormal transaction is greater than or equal to a preset probability threshold.

[0137] In an optional implementation, the model training module is further used to:

[0138] Use transaction events and anomaly recognition results as model tuning samples; update the transaction anomaly recognition model based on the model tuning samples.

[0139] The abnormal transaction identification device provided in the embodiment of the present invention can execute the abnormal transaction identification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0140] Fig.10 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. Fig.10 , which shows an electronic device (eg, Fig.10 The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.10 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0141] like Fig.10 As shown, the electronic device 700 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 700 are also stored. The processing device 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An edit / output (I / O) interface 705 is also connected to the bus 705.

[0142] Typically, the following devices may be connected to the I / O interface 705: an input device 706 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 707 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 708 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 709. The communication device 709 may allow the electronic device 700 to communicate with other devices wirelessly or by wire to exchange data. Although Fig.10 The electronic device 700 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0143] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 709, or installed from a storage device 708, or installed from a ROM 702. When the computer program is executed by the processing device 701, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0144] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0145] The electronic device provided in the embodiment of the present disclosure and the abnormal transaction identification method provided in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0146] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the abnormal transaction identification method provided by any embodiment of the present invention is implemented. The method includes:

[0147] In response to the triggering of a transaction event, acquiring transaction activity data of a transaction account associated with the transaction event; wherein the transaction activity data is transaction activity data associated with the transaction event;

[0148] Perform feature calculation on the transaction activity data to obtain transaction feature data corresponding to the transaction event, and obtain account feature data of the transaction account from a preset database;

[0149] Input the account feature data and transaction feature data into the preset transaction anomaly identification operator for calculation and analysis to obtain the anomaly identification result of the transaction event;

[0150] Among them, the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model, and the feature items corresponding to the account feature data and the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on the transaction activity data and account data in historical abnormal transaction events.

[0151] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0152] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0153] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0154] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, Python, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0155] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the abnormal transaction identification method provided in any embodiment of the present application.

[0156] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0157] It should be understood by those skilled in the art that the modules or steps of the present invention described above can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0158] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for identifying abnormal transactions, characterized in that: include: In response to the triggering of a transaction event, acquiring transaction activity data of a transaction account associated with the transaction event; wherein the transaction activity data is transaction activity data associated with the transaction event; Performing feature calculation on the transaction activity data to obtain transaction feature data corresponding to the transaction event, and acquiring account feature data of the transaction account from a preset database; Inputting the account feature data and the transaction feature data into a preset transaction anomaly identification operator for calculation and analysis to obtain an anomaly identification result of the transaction event; Among them, the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model, and the account feature data and the feature items corresponding to the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on transaction activity data and account data in historical abnormal transaction events.

2. The method according to claim 1, characterized in that The obtaining of the transaction activity data of the transaction account associated with the transaction event includes: Acquiring the transaction activity data of the transaction account at the triggering time of the transaction event and within a preset time period before the triggering time from the transaction activity data table in the preset real-time data warehouse; The transaction activity data includes transaction description data, transaction operation record data and transaction account login data.

3. The method according to claim 1, characterized in that The account characteristic data is characteristic data that is updated regularly. The updating process of the account characteristic data includes: According to the preset data update frequency, feature analysis is performed based on the historical accumulated account association data of the transaction account to obtain updated account feature data; The account characteristic data includes at least one of user dimension characteristic data, card dimension characteristic data and account dimension characteristic data corresponding to the transaction account.

4. The method according to claim 1, characterized in that: The acquiring the account characteristic data of the transaction account from a preset database comprises: A data query is performed based on a row keyword of the transaction account in the characteristic data table of the preset database to obtain the account characteristic data of the transaction account.

5. The method according to claim 1, characterized in that The process of obtaining the preset transaction anomaly identification operator includes: Based on the prediction model markup language, the description format of the transaction anomaly identification model is converted to obtain a transaction anomaly identification model file in a target format; The transaction anomaly identification model file in the target format is added as a stream computing operator in the stream data processing module of the target transaction system.

6. The method according to any one of claims 1 to 5, characterized in that: The training process of the transaction anomaly recognition model includes: According to the preset transaction tag information, sample data is screened in the historical transaction event database to obtain a model training sample set; wherein the model training sample set includes abnormal transaction event sample data and normal transaction sample data; The transaction anomaly recognition model to be trained is trained by using the model training sample set and a preset hyperparameter calculation algorithm to obtain the transaction anomaly recognition model.

7. The method according to claim 6, characterized in that The method of screening sample data in the historical transaction event database according to the preset transaction tag information to obtain a model training sample set includes: Screening sample data in a historical transaction event database corresponding to the abnormal transaction event according to preset transaction tag information to obtain sample data of the abnormal transaction event that meets the first set of screening conditions; Determining the second sample event quantity of the normal transaction sample data according to the first sample event quantity of the abnormal transaction event sample data and a preset positive and negative sample quantity ratio; Screening sample data in a historical transaction event database corresponding to normal transaction events according to the preset transaction tag information to obtain normal transaction event sample data that meets a second set of screening conditions and has a quantity equal to the second sample event data; The model training sample set is formed based on the abnormal transaction event sample data and the normal transaction event sample data.

8. The method according to claim 7, characterized in that The preset transaction mark information includes a transaction direction mark, a transaction amount, an unfamiliar transaction mark, and a transaction account involvement history mark.

9. The method according to claim 6, characterized in that The transaction anomaly recognition model to be trained is a machine learning model or a deep learning model for binary classification.

10. The method according to claim 9, characterized in that The machine learning model includes a LightGBM model, and the preset hyperparameter calculation algorithm is the Optuna automated hyperparameter optimization framework.

11. The method according to claim 1, characterized in that: After obtaining the abnormality identification result, the method further includes: When the probability that the transaction event corresponding to the abnormal identification result is an abnormal transaction is greater than or equal to a preset probability threshold, the transaction event is intercepted and / or a risk warning is issued.

12. The method according to claim 1, characterized in that The method further comprises: Using the transaction event and the anomaly recognition result as a model tuning sample; The transaction anomaly identification model is updated according to the model tuning sample.

13. An abnormal transaction identification device, characterized in that: include: A data acquisition module, configured to acquire, in response to a triggering of a transaction event, transaction activity data of a transaction account associated with the transaction event; wherein the transaction activity data is transaction activity data associated with the transaction event; A data feature confirmation module, configured to perform feature calculation on the transaction activity data, obtain transaction feature data corresponding to the transaction event, and obtain account feature data of the transaction account from a preset database; A transaction anomaly analysis module, used for inputting the account feature data and the transaction feature data into a preset transaction anomaly identification operator for calculation and analysis to obtain an anomaly identification result of the transaction event; Among them, the preset transaction anomaly recognition operator is a stream computing operator constructed based on a pre-trained transaction anomaly recognition model, and the account feature data and the feature items corresponding to the transaction feature data are feature items associated with abnormal transactions determined by feature engineering based on transaction activity data and account data in historical abnormal transaction events.

14. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the abnormal transaction identification method as described in any one of claims 1 to 12 when executing the computer program.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the abnormal transaction identification method as described in any one of claims 1-12 is implemented.

16. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the abnormal transaction identification method according to any one of claims 1 to 12.

Images