Abnormal transaction detection model processing method and device, equipment and storage medium

Abstract

The invention relates to an abnormal transaction detection model processing method and device, computer equipment, a storage medium and a computer program product. The method comprises the steps of obtaining a transaction sample set; uniformly sampling the transaction sample set to obtain a first input sample; performing inverse sampling on the transaction sample set to obtain a second input sample; performing feature extraction on the first input sample through a first branch network of the abnormal transaction detection model to obtain a first type of features, and performing feature extraction on the second input sample through a second branch network of the abnormal transaction detection model to obtain a second type of features, and constructing a target loss based on a prediction probability which belongs to the abnormal transaction sample and is output after fusing the first type of features and the second type of features, respective sample types of the first input sample and the second input sample and respective transaction values, and updating an abnormal transaction detection model according to the target loss. And the abnormal transaction detection accuracy of the abnormal transaction detection model is improved.

Description

Technical Field

[0001] The present application relates to the field of machine learning technology, and in particular to a method, apparatus, computer equipment, storage medium and computer program product for processing an abnormal transaction detection model. Background Art

[0002] With the development of computer technology, online payment transactions have greatly facilitated people's lives and work. Correspondingly, online payment transactions also involve abnormal transactions. Therefore, in order to ensure the legality and security of transactions, abnormal transactions can be detected through deep learning models to avoid risks in a timely manner. In large-scale online payment transaction systems, the ratio of non-abnormal transactions to abnormal transactions can reach millions, which brings about the problem of class imbalance in the learning of deep learning models.

[0003] In related technologies, in order to solve the problem of imbalanced categories between non-abnormal transaction samples and abnormal transaction samples, the loss function of the corresponding samples is often weighted at the category level or sample level to increase the loss coefficient of the tail category samples to ensure that the model can focus on learning the tail category. However, this method requires knowing the distribution of the test set to improve the accuracy of the model. However, it is difficult to know the distribution of the test set in practice, which leads to inaccurate learning of the tail category and the trained model is difficult to accurately detect abnormal transactions. Summary of the invention

[0004] Based on this, it is necessary to provide a processing method, device, computer equipment, computer-readable storage medium and computer program product for an abnormal transaction detection model that can improve the accuracy of the model in detecting abnormal transactions in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for processing an abnormal transaction detection model. The method comprises:

[0006] Acquire a transaction sample set, wherein the transaction sample set includes abnormal transaction samples and non-abnormal transaction samples, and the number of samples of the abnormal transaction samples is less than the number of samples of the non-abnormal transaction samples;

[0007] Uniformly sampling the transaction sample set to obtain a first input sample; wherein during the uniform sampling, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are equal;

[0008] Performing reverse sampling on the transaction sample set to obtain a second input sample; wherein, when performing reverse sampling, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are positively correlated with the inverse of the number of samples of each in the transaction sample set;

[0009] The first branch network of the abnormal transaction detection model is used to extract features from the first input sample to obtain first-category features, and the second branch network of the abnormal transaction detection model is used to extract features from the second input sample to obtain second-category features. A target loss is constructed based on the predicted probability of the sample belonging to the abnormal transaction output after fusing the first and second features, the sample categories of the first and second input samples, and their respective transaction values, and the abnormal transaction detection model is updated according to the target loss.

[0010] In a second aspect, the present application also provides a processing device for an abnormal transaction detection model. The device comprises:

[0011] A sample set acquisition module, used to acquire a transaction sample set, wherein the transaction sample set includes abnormal transaction samples and non-abnormal transaction samples, and the number of samples of the abnormal transaction samples is less than the number of samples of the non-abnormal transaction samples;

[0012] A first sampling module is used to uniformly sample the transaction sample set to obtain a first input sample; wherein, when performing uniform sampling, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are equal;

[0013] A second sampling module is used to perform reverse sampling on the transaction sample set to obtain a second input sample; wherein the sampling probability of abnormal transaction samples and non-abnormal transaction samples during reverse sampling is positively correlated with the inverse of the number of samples of each in the transaction sample set;

[0014] An updating module is used to extract features of the first input sample through the first branch network of the abnormal transaction detection model to obtain first-category features, and to extract features of the second input sample through the second branch network of the abnormal transaction detection model to obtain second-category features, and to construct a target loss based on the predicted probability of the sample belonging to the abnormal transaction output after fusing the first category of features with the second category of features, the sample categories of the first input sample and the second input sample, and the transaction values ​​of each, and to update the abnormal transaction detection model according to the target loss.

[0015] In some embodiments, the first sampling module is used to determine the total number of samples based on the sample number of the abnormal transaction samples and the sample number of the non-abnormal transaction samples; determine the sampling probability of uniform sampling based on the inverse of the total number of samples, and the sampling probability is positively correlated with the inverse of the total number of samples; and obtain the first input sample from the transaction sample set based on the sampling probability of uniform sampling.

[0016] In some embodiments, the second sampling module is used to determine the sampling probability of abnormal transaction samples and non-abnormal transaction samples respectively according to the sample number of the abnormal transaction samples and the sample number of the non-abnormal transaction samples; and obtain a second input sample from the transaction sample set according to the sampling probability of the abnormal transaction samples and non-abnormal transaction samples respectively.

[0017] In some embodiments, the second sampling module is used to determine the total number of samples based on the sample number of the abnormal transaction samples and the sample number of the non-abnormal transaction samples; use the ratio of the sample number of the non-abnormal transaction samples to the total number of samples as the sampling probability of the abnormal transaction samples; and use the ratio of the sample number of the abnormal transaction samples to the total number of samples as the sampling probability of the non-abnormal transaction samples.

[0018] In some embodiments, the second sampling module is used to perform equal-probability sampling on abnormal transaction samples according to the sampling probability of the abnormal transaction category to obtain abnormal transaction samples, and use the sampled abnormal transaction samples as the second input samples; perform equal-probability sampling on abnormal transaction samples according to the sampling probability of the non-abnormal transaction category to obtain non-abnormal transaction samples, and use the sampled non-transaction samples as the second input samples.

[0019] In some embodiments, the update module is used to input the first input sample into the first branch network of the abnormal transaction detection model; perform feature extraction through the first branch network to obtain first-category features; the update module is used to input the second input sample into the second branch network of the abnormal transaction detection model; perform feature extraction through the second branch network to obtain second-category features.

[0020] In some embodiments, the device also includes a prediction probability output module, which is used to perform weighted fusion of the first category of features and the second category of features according to the weight of the first branch network and the weight of the second branch network to obtain a fusion feature; and output the prediction probability of the sample belonging to an abnormal transaction according to the fusion feature.

[0021] In some embodiments, the update module is used to construct a predicted loss for the first input sample based on the output predicted probability of belonging to the abnormal transaction sample and the sample category of the first input sample if the sample category of the first input sample indicates that the first input sample belongs to an abnormal transaction sample, and weight the predicted loss according to the transaction value of the first input sample to obtain a weighted predicted loss for the first input sample; if the sample category of the second input sample indicates that the second input sample belongs to an abnormal transaction sample, construct a predicted loss for the second input sample based on the output predicted probability of belonging to the abnormal transaction sample and the sample category of the second input sample, and weight the predicted loss according to the transaction value of the second input sample to obtain a weighted predicted loss for the second input sample; and fuse the weighted predicted loss for the first input sample with the weighted predicted loss for the second input sample to obtain a target loss.

[0022] In some embodiments, the update module is also used to construct a predicted loss for the first input sample based on the output predicted probability of belonging to an abnormal transaction sample and the sample category of the first input sample if the sample category of the first input sample indicates that the first input sample belongs to a non-abnormal transaction sample; if the sample category of the second input sample indicates that the second input sample belongs to a non-abnormal transaction sample, construct a predicted loss for the second input sample based on the output predicted probability of belonging to an abnormal transaction sample and the sample category of the second input sample; and fuse the predicted loss for the first input sample with the predicted loss for the second input sample to obtain a target loss.

[0023] In some embodiments, the device also includes a detection module, which is used to generate a transaction to be detected based on transaction data; input the transaction to be detected into a trained abnormal transaction detection model; extract features of the transaction to be detected through a first branch network of the abnormal transaction detection model to obtain a first type of feature, extract features of the transaction to be detected through a second branch network of the abnormal transaction detection model to obtain a second type of feature, and after fusing the first type of feature with the second type of feature, output a predicted probability that the transaction to be detected belongs to the abnormal transaction category; when the predicted probability is greater than a preset threshold, it is determined that the transaction to be detected belongs to the abnormal transaction category.

[0024] In a third aspect, the present application further provides a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned abnormal transaction detection model processing method when executing the computer program.

[0025] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the above-mentioned abnormal transaction detection model processing method when executed by a processor.

[0026] In a fifth aspect, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the processing method of the abnormal transaction detection model are implemented.

[0027] The processing method, device, computer equipment, storage medium and computer program product of the abnormal transaction detection model are as follows: obtaining a transaction sample set, the transaction sample set includes abnormal transaction samples and non-abnormal transaction samples, and the number of abnormal transaction samples is less than the number of non-abnormal transaction samples; uniformly sampling the transaction sample set to obtain a first input sample; wherein, when uniform sampling is performed, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are equal, that is, the first input sample is obtained by assigning equal sampling probabilities to each transaction sample in the transaction sample set. Reverse sampling is performed on the transaction sample set to obtain a second input sample; wherein, when reverse sampling is performed, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are positively correlated with the inverse of the number of samples in each transaction sample set, that is, the sampling probability of abnormal transaction samples is greater than the sampling probability of non-abnormal transactions. At this time, the probability that the second input sample is an abnormal transaction sample is greater than the probability that the non-abnormal transaction sample is a non-abnormal transaction sample, which overcomes the problem of class imbalance between the sample class of non-abnormal transaction samples and the class of abnormal transaction samples. The first branch network of the abnormal transaction detection model extracts features from the first input sample to obtain the first type of features, so that the first branch network can learn the features of the original transaction sample distribution in the transaction sample set. The second branch network of the abnormal transaction detection model extracts features from the second input sample to obtain the second type of features, so that the second branch network can strengthen the learning of the features of the abnormal transaction samples. The target loss is constructed based on the predicted probability of the abnormal transaction sample output after the fusion of the first type of features and the second type of features, the sample categories of the first input sample and the second input sample, and the transaction values ​​of each, and the abnormal transaction detection model is updated according to the target loss. That is, by combining the features learned by the two branch networks to train the model, not only can the features of the original transaction sample distribution be learned, but also the features of the abnormal transaction samples can be strengthened, thereby improving the accuracy of the abnormal transaction detection model in abnormal transaction detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 An application environment diagram of a method for processing an abnormal transaction detection model in one embodiment;

[0029] Figure 2A flowchart of a method for processing an abnormal transaction detection model in one embodiment;

[0030] Figure 3 A schematic diagram of a flow chart of a step of determining a sampling probability of a transaction sample in one embodiment;

[0031] Figure 4 A schematic diagram of a process for determining a target loss step in one embodiment;

[0032] Figure 5 A schematic diagram of a flow chart of a step of determining a target loss in another embodiment;

[0033] Figure 6 A schematic diagram of a process flow of abnormal transaction detection in one embodiment;

[0034] Figure 7 A schematic diagram of the model structure of an abnormal transaction detection model in one embodiment;

[0035] Figure 8 A schematic diagram of comparison results between various detection models in one embodiment;

[0036] Fig. 9 is a structural block diagram of a processing device for an abnormal transaction detection model in one embodiment;

[0037] Fig.10 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0039] When facing transactions generated by online payment transaction systems, in order to avoid transaction risks caused by abnormal transactions, it is necessary to detect transactions to be detected through a model for abnormal transaction detection. When training the model for abnormal transaction detection, since the number of samples of abnormal transaction samples is less than the number of samples of non-abnormal transaction samples, in the training process of the abnormal transaction detection model, the category to which the abnormal transaction samples belong belongs to the tail category, that is, the category with a small number of samples. For this reason, when constructing the loss function for model training, the related technology increases the weight of the tail category to ensure that the model can focus on learning the characteristics of abnormal transactions. However, the training method of the related technology requires knowing the distribution of the test set, which is almost impossible to accomplish in real scenarios. Therefore, the model trained by the related technology still cannot accurately predict abnormal transactions.

[0040] In the processing method of the abnormal transaction detection model provided in the embodiment of the present application, a transaction sample set is obtained, the transaction sample set includes abnormal transaction samples and non-abnormal transaction samples, and the number of samples of abnormal transaction samples is less than the number of samples of non-abnormal transaction samples; the transaction sample set is uniformly sampled to obtain a first input sample; wherein, when uniform sampling is performed, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are equal, that is, the first input sample is obtained by giving equal sampling probability to each sample in the transaction sample set. The transaction sample set is reversely sampled to obtain a second input sample; wherein, when reverse sampling is performed, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are positively correlated with the inverse of the number of samples in each transaction sample set, that is, the sampling probability of abnormal transaction samples is greater than the sampling probability of non-abnormal transactions. At this time, the probability that the second input sample is an abnormal transaction sample is greater than the probability of a non-abnormal transaction sample, which overcomes the problem of class imbalance between the sample category of non-abnormal transaction samples and the category of abnormal transaction samples. The first branch network of the abnormal transaction detection model extracts features from the first input sample to obtain the first type of features, so that it can ensure that the first branch network learns the features of the original transaction sample distribution in the transaction sample set. The second branch network of the abnormal transaction detection model extracts features from the second input sample to obtain the second type of features, thus ensuring that the second branch network can strengthen the features of the abnormal transaction samples. The target loss is constructed based on the predicted probability of the abnormal transaction sample output after the fusion of the first and second types of features, the sample categories of the first and second input samples, and the respective transaction values, and the abnormal transaction detection model is updated according to the target loss. That is, by combining the features learned by the two branch networks to train the model, not only can the features of the original transaction sample distribution be learned, but also the features of the abnormal transaction samples can be strengthened, thereby improving the accuracy of the abnormal transaction detection model in detecting abnormal transactions.

[0041] The processing method of the abnormal transaction detection model provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other servers. The terminal 102 and the server 104 can both execute the processing method of the abnormal transaction detection model independently, and the terminal 102 and the server can also execute the processing method of the abnormal transaction model detection model in collaboration.

[0042] In some embodiments, the processing method of the abnormal transaction detection model provided in the embodiment of the present application can be executed by the server 104. The server 104 obtains a transaction sample set, the transaction sample set includes abnormal transaction samples and non-abnormal transaction samples, and the number of samples of the abnormal transaction samples is less than the number of samples of the non-abnormal transaction samples; the server 104 uniformly samples the transaction sample set to obtain a first input sample; wherein, when uniform sampling is performed, the sampling probabilities of the abnormal transaction samples and the non-abnormal transaction samples are equal; the server 104 reversely samples the transaction sample set to obtain a second input sample; wherein, when reverse sampling is performed, the sampling probabilities of the abnormal transaction samples and the non-abnormal transaction samples are positively correlated with the inverse of the number of samples in the transaction sample set; the server 104 extracts features from the first input sample through the first branch network of the abnormal transaction detection model to obtain a first type of feature, extracts features from the second input sample through the second branch network of the abnormal transaction detection model to obtain a second type of feature, constructs a target loss based on the predicted probability of the abnormal transaction sample output after fusing the first type of feature and the second type of feature, the sample categories of the first input sample and the second input sample, and the transaction values ​​of each, and updates the abnormal transaction detection model according to the target loss. Based on this, the server 104 uses the abnormal transaction detection model obtained by the last update as the trained abnormal transaction detection model.

[0043] Optionally, the server 104 sends the trained abnormal transaction detection model to the terminal 102, the terminal 102 deploys the trained abnormal transaction detection model, and the terminal 102 performs abnormal transaction detection on the transaction to be detected according to the trained abnormal transaction detection model.

[0044] Optionally, the server 104 may directly obtain the transaction to be detected, and use the trained abnormal transaction detection model to perform abnormal transaction detection on the transaction to be detected.

[0045] The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart TVs, etc. The portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0046] In one embodiment, Figure 2 As shown, a method for processing an abnormal transaction detection model is provided, and the method is applied to a computer device (which may be Figure 1 The server 104 in may also be Figure 1 The terminal 102 in the example is used as an example to illustrate, and the following steps are included:

[0047] Step S202, obtaining a transaction sample set, the transaction sample set includes abnormal transaction samples and non-abnormal transaction samples, and the number of abnormal transaction samples is less than the number of non-abnormal transaction samples.

[0048] The transaction sample is a sample of online payment, and the transaction sample includes relevant information of online payment. For example, the relevant information includes but is not limited to the transaction value, transaction location, transaction time, etc. of the online payment. Abnormal transactions are transactions with transaction risks, and non-abnormal transactions are transactions without transaction risks, that is, normal transactions, belonging to two different transaction categories.

[0049] Optionally, the computer device obtains a set of transaction samples in an online payment scenario. The online payment scenario may be an application scenario of an online payment application, or a scenario in which a financial service institution conducts a transaction, etc., which is not specifically limited.

[0050] In order to simulate the phenomenon of class imbalance between abnormal transaction samples and non-abnormal transaction samples, the number of samples of abnormal transaction samples is set to be smaller than the number of samples of non-abnormal transaction samples.

[0051] Step S204, uniformly sampling the transaction sample set to obtain a first input sample; wherein, during uniform sampling, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are equal.

[0052] The sampling probability of a transaction sample refers to the probability of the transaction sample being sampled. The greater the sampling probability, the easier it is for the transaction sample to be sampled. Uniform sampling refers to sampling a transaction sample set when the sampling probability of each transaction sample in the transaction sample set is equal. For example, if the transaction sample set includes at least two categories of transaction samples, the sampling probabilities of any two transaction samples of different categories are equal during uniform sampling.

[0053] Optionally, the computer device uses a uniform sampler to uniformly sample the transaction sample set to obtain the first input sample. The uniform sampler is used to assign an equal sampling probability to each transaction sample that is uniformly sampled.

[0054] Exemplarily, the computer device determines the sampling probability of each transaction sample for uniform sampling, and the sampling probability of each transaction sample is the same. According to the sampling probability of each transaction sample, a transaction sample is randomly selected from the transaction sample set as the first input sample.

[0055] Since the number of non-abnormal transaction samples in the transaction sample set is greater than the number of abnormal transaction samples, and the sampling probability between each transaction sample is equal, then if the sampling is repeated multiple times according to the sampling probability, the multiple first input samples obtained by sampling, for example, repeated sampling 100 times, then the distribution of abnormal transaction samples and non-abnormal transaction samples in the 100 first input samples approaches the distribution of abnormal transaction samples and non-abnormal transactions in the transaction sample set. The number of abnormal transaction samples greater than the number of non-abnormal transaction samples is regarded as the first sampling result, and the number of non-abnormal transaction samples greater than the number of abnormal transaction samples is regarded as the second sampling result. Then, in the 100 first input samples, the probability of the first sampling result is less than the probability of the second sampling result.

[0056] In some embodiments, uniform sampling is performed on a set of transaction samples to obtain a first input sample, including: determining the total number of samples based on the number of samples of abnormal transaction samples and the number of samples of non-abnormal transaction samples; determining a sampling probability for uniform sampling based on the inverse of the total number of samples, the sampling probability being positively correlated with the inverse of the total number of samples; and obtaining a first input sample from the set of transaction samples based on the sampling probability for uniform sampling.

[0057] Optionally, the computer device sums the number of samples of abnormal transaction samples and the number of samples of non-abnormal transaction samples to determine the total number of samples. The computer device determines the reciprocal of the total number of samples as the sampling probability for uniform sampling. The sampling probability for uniform sampling is the sampling probability of each abnormal transaction sample and the sampling probability of each non-abnormal transaction sample. The computer device randomly obtains a transaction sample from the transaction sample set according to the sampling probability for uniform sampling, and uses the randomly obtained transaction sample as the first input sample.

[0058] For example, there are 10,000 transaction samples in the transaction sample set, including 9,900 non-abnormal transaction samples and 100 abnormal transaction samples. At this time, the sampling probability of 10,000 transaction samples is 1 / 10,000.

[0059] In this embodiment, the total number of samples is determined by the number of samples of abnormal transaction samples and the number of samples of non-abnormal transaction samples. The sampling probability of uniform sampling is determined according to the reciprocal of the total number of samples, and the sampling probability of uniform sampling is positively correlated with the reciprocal. In this way, it can be ensured that the sampling probability of each transaction sample is equal. At this time, the first input sample is directly obtained based on the sampling probability of uniform sampling. In this way, the distribution characteristics of the overall transaction samples in the transaction sample set can be learned through the first branch network based on the first input sample obtained, and the characteristics of the abnormal transaction samples learned by the second branch network can be combined to accurately train the abnormal transaction detection model to improve the accuracy of abnormal transaction detection.

[0060] Step S206, reverse sampling is performed on the transaction sample set to obtain a second input sample; wherein, when reverse sampling is performed, the sampling probability of abnormal transaction samples and non-abnormal transaction samples is positively correlated with the inverse of the number of samples of each in the transaction sample set.

[0061] Among them, reverse sampling refers to sampling in which the sampling probability of a transaction sample is negatively correlated with the number of samples of the sample category to which the transaction sample belongs. Sample categories include non-abnormal transaction categories and abnormal transaction categories. For example, in the transaction sample set, the number of samples belonging to the non-abnormal transaction category is N0, and the number of samples belonging to the abnormal transaction category is N1. When reverse sampling is performed, the more N0, the smaller the sampling probability of non-abnormal transaction samples. Similarly, the more N1, the smaller the sampling probability of abnormal transaction samples. When reverse sampling is performed, the sampling probability of abnormal transaction samples is the sampling probability of the abnormal transaction category, and the sampling probability of non-abnormal transaction samples is the sampling probability of the non-abnormal transaction category. Therefore, when reverse sampling is performed, the sampling probabilities of transaction samples belonging to the same transaction category are the same, and the sampling probabilities of transaction samples of different transaction categories are different.

[0062] Optionally, the computer device uses an inverse sampler to perform inverse sampling on the transaction sample set to obtain a second input sample. The inverse sampler is used to determine the sampling probability of each transaction sample when performing inverse sampling.

[0063] Exemplarily, the computer device determines the sampling probability of non-abnormal transaction categories and the sampling probability of abnormal transaction categories when performing reverse sampling, and obtains a second input sample from the transaction sample set based on the sampling probability of non-abnormal transaction categories and the sampling probability of abnormal transaction categories when performing reverse sampling.

[0064] Step S208, extracting features from the first input sample through the first branch network of the abnormal transaction detection model to obtain first-category features, extracting features from the second input sample through the second branch network of the abnormal transaction detection model to obtain second-category features, constructing a target loss based on the predicted probability of the abnormal transaction sample output after fusing the first-category features with the second-category features, the sample categories of the first input sample and the second input sample, and their respective transaction values, and updating the abnormal transaction detection model according to the target loss.

[0065] Among them, the abnormal transaction detection model is a model to be trained, and the abnormal transaction detection model is used to detect abnormal transactions. The abnormal transaction detection model is a dual-branch network model, that is, it includes a first branch network and a second branch network. The first branch network extracts common features about transactions by learning the features of the distribution of transaction samples in the transaction sample set, that is, the first type of features reflects the common features about transactions, and the input sample of the first branch network is the first input sample. The second branch network extracts the features of abnormal transactions by learning the features of abnormal transaction samples, that is, the second type of features reflects the features of abnormal transactions, and the input sample of the second branch network is the second input sample.

[0066] The sample category refers to the transaction category of the transaction sample, and the sample category includes a non-abnormal transaction category and an abnormal transaction category.

[0067] Optionally, the computer device inputs the first input sample and the second input sample into the first branch network and the second branch network respectively, extracts features of the first input sample through the first branch network to obtain first-type features, and extracts features of the second input sample through the second branch network to obtain second-type features. The computer device fuses the first-type features and the second-type features to obtain the predicted probability of belonging to an abnormal transaction sample.

[0068] If both the first input sample and the second input sample are abnormal transaction samples, the computer device determines the first predicted loss based on the predicted probability of the abnormal transaction sample, the first input sample and the transaction value of the first input sample, and determines the second predicted loss based on the predicted probability of the abnormal transaction sample, the second input sample and the transaction value of the second input sample. The computer device fuses the first predicted loss for the first input sample and the second predicted loss for the second input sample to determine the target loss.

[0069] The computer device iteratively updates the abnormal transaction detection model according to the target loss until a training stop condition is met, and determines the abnormal transaction detection model updated when the training stop condition is met as the trained abnormal transaction detection model.

[0070] The transaction value of the first input sample is negatively correlated with the first predicted loss, and the transaction value of the second input sample is negatively correlated with the second predicted loss.

[0071] Exemplarily, after determining the first prediction loss and the second prediction loss, the computer device superimposes the first prediction loss for the first input sample and the second prediction loss for the second input sample to determine the target loss.

[0072] It should be noted that, in addition to the aforementioned related technologies for solving the problem of category imbalance by weighting the tail categories, there are also related technologies for solving the problem of category imbalance by using the BBN (Bilateral-Branch Network) model. The principle of model training of the BBN model is to conduct two-stage training based on a network structure. In each iteration, the samples used for the first stage are input into the network structure to obtain the corresponding feature 1, and then the samples used for the second stage are input into the network structure to obtain the corresponding feature 2. According to the loss coefficients of feature 1 and feature 2, feature 1 and feature 2 are weighted to obtain the loss of the current iteration. At the beginning of the iteration, that is, when the number of iterations is less than the iteration number threshold, the loss coefficient of feature 1 is greater than the loss coefficient of feature 2, and the BBN network structure is focused on learning the distribution of the original data. Slowly, when the number of iterations is greater than the iteration number threshold, the loss coefficient of feature 1 is less than the loss coefficient of feature 2, and the BBN network structure is focused on learning the distribution of the tail categories. Based on this, the BBN model first learns the common pattern in the data set through the same network structure, and then gradually focuses on the tail data. The BBN model cannot accurately predict tabular data, i.e., statistical data. In contrast, this case involves the collaborative processing of two branch networks, that is, different input samples are input into different branch networks respectively, and the distribution of original data and the characteristics of abnormal transactions are learned at the same time. The abnormal transaction detection model involved in the embodiment of the present application is suitable for scenarios related to statistical data, such as online payment scenarios, and is more accurate in predicting abnormal transactions.

[0073] In the processing method of the above abnormal transaction detection model, by obtaining a transaction sample set, the transaction sample set includes abnormal transaction samples and non-abnormal transaction samples, and the number of samples of abnormal transaction samples is less than the number of samples of non-abnormal transaction samples; uniformly sampling the transaction sample set to obtain a first input sample; wherein, when uniform sampling is performed, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are equal, that is, the first input sample is obtained by giving equal sampling probabilities to each transaction sample in the transaction sample set. The transaction sample set is reversely sampled to obtain a second input sample; wherein, when reverse sampling is performed, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are positively correlated with the inverse of the number of samples in each transaction sample set, that is, the sampling probability of abnormal transaction samples is greater than the sampling probability of non-abnormal transactions. At this time, the probability that the second input sample is an abnormal transaction sample is greater than the probability of a non-abnormal transaction sample, which overcomes the problem of class imbalance between the sample category of non-abnormal transaction samples and the category of abnormal transaction samples. The first branch network of the abnormal transaction detection model extracts features from the first input sample to obtain the first type of features, so that it can ensure that the first branch network learns the features of the original transaction sample distribution in the transaction sample set. The second branch network of the abnormal transaction detection model extracts features from the second input sample to obtain the second type of features, thus ensuring that the second branch network can strengthen the features of the abnormal transaction samples. The target loss is constructed based on the predicted probability of the abnormal transaction sample output after the fusion of the first and second types of features, the sample categories of the first and second input samples, and the respective transaction values, and the abnormal transaction detection model is updated according to the target loss. That is, by combining the features learned by the two branch networks to train the model, not only can the features of the original transaction sample distribution be learned, but also the features of the abnormal transaction samples can be strengthened, thereby improving the accuracy of the abnormal transaction detection model in detecting abnormal transactions.

[0074] In some embodiments, reverse sampling is performed on the transaction sample set to obtain a second input sample, including: determining the sampling probability of the abnormal transaction samples and the non-abnormal transaction samples according to the sample number of the abnormal transaction samples and the sample number of the non-abnormal transaction samples; and obtaining the second input sample from the transaction sample set according to the sampling probability of the abnormal transaction samples and the non-abnormal transaction samples.

[0075] Optionally, the computer device determines the sampling probability of the non-abnormal transaction category and the sampling probability of the abnormal transaction category when reverse sampling is performed according to the sample number of the abnormal transaction samples and the sample number of the non-abnormal transaction samples. According to the sampling probability of the non-abnormal transaction category and the sampling probability of the abnormal transaction category when reverse sampling is performed, the target transaction category is determined, and the second input sample is obtained from the transaction samples belonging to the target transaction category. The sample number of the abnormal transaction samples is negatively correlated with the sampling probability of the abnormal transaction category when reverse sampling is performed, and the sample number of the non-abnormal transaction samples is negatively correlated with the sampling probability of the non-abnormal transaction category when reverse sampling is performed.

[0076] Exemplarily, after determining the target transaction category, the computer device determines the sampling probability of each transaction sample belonging to the target transaction category according to the sampling probability of the target transaction category, and selects a transaction sample from multiple transaction samples belonging to the target transaction category according to the sampling probability of each transaction sample belonging to the target transaction category as the second input sample. The sampling probability of each transaction sample belonging to the target transaction category is equal.

[0077] It should be noted that when reverse sampling is performed, a transaction category is randomly selected from the non-abnormal transaction category and the abnormal transaction category as the target transaction category. Among them, if the sampling probability of the non-abnormal transaction category is not less than the sampling probability of the abnormal transaction category, the probability that the target transaction category is the non-abnormal transaction category is greater than the probability that the target transaction category is the abnormal transaction category. Similarly, if the sampling probability of the non-abnormal transaction category is less than the sampling probability of the abnormal transaction category, the probability that the target transaction category is the non-abnormal transaction category is less than the probability that the target transaction category is the abnormal transaction category.

[0078] In some embodiments, Figure 3 FIG. 1 is a flow chart of a step of determining the sampling probability of transaction samples in one embodiment. According to the number of abnormal transaction samples and the number of non-abnormal transaction samples, the sampling probability of abnormal transaction samples and non-abnormal transaction samples is determined, including:

[0079] Step S302, determining the total number of samples according to the number of samples of abnormal transaction samples and the number of samples of non-abnormal transaction samples.

[0080] Exemplarily, the computer device sums the sample quantity of abnormal transaction samples and the sample quantity of non-abnormal transaction samples to obtain the total sample quantity.

[0081] Step S304: The ratio of the number of samples of non-abnormal transaction samples to the total number of samples is used as the sampling probability of abnormal transaction samples.

[0082] For example, the number of samples of non-abnormal transaction samples is N0, and the total number of samples is N0+N1; N1 is the number of samples of abnormal transaction samples. Based on this, the sampling probability of abnormal transaction samples is N0 / (N0+N1). The more the number of samples of non-abnormal transaction samples is, the greater the sampling probability of abnormal transaction samples is.

[0083] Step S306: The ratio of the number of samples of abnormal transaction to the total number of samples is used as the sampling probability of non-abnormal transaction samples.

[0084] Exemplarily, the sampling probability of non-abnormal transaction samples is N1 / (N0+N1). The greater the number of abnormal transaction samples, the greater the sampling probability of non-abnormal transaction samples.

[0085] Therefore, when reverse sampling is performed, the sampling probability of abnormal transaction samples is positively correlated with the sample number of non-abnormal transaction samples, and the sampling probability of non-abnormal transaction samples is positively correlated with the sample number of abnormal transaction samples. In addition, since the sample number of abnormal transaction samples is much smaller than the sample number of non-abnormal transaction samples in online payment scenarios, the sampling probability of abnormal transaction samples is much greater than the sampling probability of non-abnormal transaction samples during reverse sampling. Then, after multiple reverse samplings, for example, after repeated sampling 100 times, 100 second input samples are obtained. Among these 100 second input samples, the probability of the first sampling result appearing is much greater than the second sampling result.

[0086] Based on this, when performing reverse sampling, the sampling probability of abnormal transaction samples is determined based on the sample number of non-abnormal transaction samples, and the sampling probability of non-abnormal transactions is determined based on the sample number of abnormal transaction samples. This increases the probability that the second input sample is an abnormal transaction sample. In this way, the second branch network can better learn the characteristics of the abnormal transaction category, effectively avoiding the problem of category imbalance between the abnormal transaction category and the non-abnormal transaction category.

[0087] In some embodiments, a second input sample is obtained from a transaction sample set according to the respective sampling probabilities of abnormal transaction samples and non-abnormal transaction samples, including: performing equal-probability sampling on the abnormal transaction samples according to the sampling probability of the abnormal transaction category to obtain abnormal transaction samples, and using the sampled abnormal transaction samples as the second input sample; performing equal-probability sampling on the abnormal transaction samples according to the sampling probability of the non-abnormal transaction category to obtain non-abnormal transaction samples, and using the sampled non-transaction samples as the second input sample.

[0088] Optionally, the computer device determines the target transaction category according to the sampling probability of the non-abnormal transaction category and the sampling probability of the abnormal transaction category when performing reverse sampling. If the target transaction category is the abnormal transaction category, the computer device determines the sampling probability of the abnormal transaction category as the sampling probability of each abnormal transaction sample when performing reverse sampling, and randomly samples an abnormal transaction sample from multiple abnormal transaction samples based on the sampling probability of each abnormal transaction category sample, and uses the sampled abnormal transaction sample as the second input sample.

[0089] If the target transaction category is a non-abnormal transaction category, the computer device determines the sampling probability of the non-abnormal transaction category as the sampling probability of each non-abnormal transaction sample when performing reverse sampling, and randomly samples a non-abnormal transaction sample from multiple non-abnormal transaction samples based on the sampling probability of each non-abnormal transaction category sample, and uses the sampled non-abnormal transaction sample as the second input sample.

[0090] Exemplarily, when reverse sampling is performed, the sampling probability N0 / (N0+N1) of the abnormal transaction sample is greater than the sampling probability N1 / (N0+N1) of the non-abnormal transaction sample, that is, the sampling probability of the abnormal transaction category is greater than the sampling probability of the non-abnormal transaction category. At this time, the probability that the target transaction category selected from the two transaction categories is the abnormal transaction category is greater. If the target transaction category is the abnormal transaction category, then according to the sampling probability of N0 / (N0+N1), sampling is performed from N1 abnormal transaction samples to obtain a second input sample, and the second input sample is the abnormal transaction sample. If the target transaction category is the non-abnormal transaction category, then according to the sampling probability of N1 / (N0+N1), sampling is performed from N0 non-abnormal transaction samples to obtain a second input sample, and the second input sample is the non-abnormal transaction sample.

[0091] Based on this, in the process of multiple reverse sampling, according to the sampling probability of the abnormal transaction category, multiple abnormal transaction samples are sampled with equal probability to obtain the second input sample. According to the sampling probability of the non-abnormal transaction category, multiple non-abnormal transaction category samples are sampled with equal probability to obtain the second input sample. Since the sampling probability of the abnormal transaction sample is greater than the sampling probability of the non-abnormal transaction, after multiple reverse sampling, more second input samples of the abnormal transaction category can be obtained. In this way, it can ensure that the second branch network strengthens the learning of the characteristics of the abnormal transaction samples and ensures the accuracy of the abnormal transaction detection model.

[0092] In this embodiment, when the number of samples of abnormal transaction samples is less than the number of samples of non-abnormal transaction samples, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are determined according to the number of samples of abnormal transaction samples and the number of samples of non-abnormal transaction samples, so as to ensure that the sampling probability of abnormal transaction samples is greater than the sampling probability of non-abnormal transactions. Based on this, according to the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples, a second input sample is obtained from the transaction sample set, and the probability that the second input sample is an abnormal transaction sample is increased, so that the second branch network can better learn the characteristics of the abnormal transaction category, effectively avoiding the problem of category imbalance between the abnormal transaction category and the non-abnormal transaction category, thereby ensuring the accuracy of the abnormal transaction detection model.

[0093] In some embodiments, extracting features from a first input sample through a first branch network of an abnormal transaction detection model to obtain first-category features includes: inputting the first input sample into the first branch network of the abnormal transaction detection model; and extracting features through the first branch network to obtain first-category features.

[0094] Optionally, the computer device inputs the first input sample into a first branch network of the abnormal transaction detection model, and extracts features of the first input sample through a feature extractor of the first branch network to obtain a first type of feature.

[0095] The first input sample includes transaction data, for example, transaction value, time and place of transaction. The feature extractor is a nonlinear mapper for learning higher-level and more abstract features. Exemplarily, the feature extractor is a multi-layer perceptron network. The first input sample is regarded as a primitive statistical feature, and the corresponding first-class feature is a higher-level and more abstract feature.

[0096] Exemplarily, after the first input sample x1 is input into the first branch network, feature extraction of the first branch network is performed on the first input sample x1 to obtain a corresponding first-category feature f1(x).

[0097] In this embodiment, by inputting the first input sample into the first branch network of the abnormal transaction detection model, the first branch network can learn the characteristics of the transaction sample distribution in the transaction sample set, thereby accurately extracting the corresponding first type of features.

[0098] In some embodiments, feature extraction is performed on the second input sample through the second branch network of the abnormal transaction detection model to obtain the second type of feature, including: inputting the second input sample into the second branch network of the abnormal transaction detection model; and extracting features through the second branch network to obtain the second type of feature.

[0099] Optionally, the computer device inputs the second input sample into the second branch network of the abnormal transaction detection model, and extracts features of the second input sample through a feature extractor of the second branch network to obtain second type features.

[0100] The second input sample contains transaction data, for example, the transaction value, the time and place of the transaction. The feature extractor in the first branch network has the same structure as the feature extractor in the second branch network, and both learn higher-level and more abstract features. If the second input sample is regarded as the original statistical feature, the corresponding second-class feature is a higher-level and more abstract feature.

[0101] Exemplarily, after the second input sample x2 is input into the second branch network, the feature extractor of the second branch network performs feature extraction on the second input sample x2 to obtain the corresponding second type feature f2(x).

[0102] In this embodiment, by inputting the second input sample into the second branch network of the abnormal transaction detection model, the second branch network can learn the characteristics of abnormal transactions, thereby accurately extracting the corresponding second type of features.

[0103] In some embodiments, the method further includes: performing weighted fusion of the first category of features and the second category of features according to the weight of the first branch network and the weight of the second branch network to obtain fused features; and outputting a predicted probability of belonging to an abnormal transaction sample according to the fused features.

[0104] The weight of the first branch network and the weight of the second branch network do not change with the number of iterations of model training.

[0105] Optionally, the computer device obtains the weight of the first branch network and the weight of the second branch network, and performs weighted fusion on the first type of features and the second type of features according to the weight of the first branch network and the weight of the second branch network to obtain a fusion feature. The computer device determines a corresponding score based on the fusion feature, and outputs a predicted probability of belonging to an abnormal transaction sample based on the score. The score includes a predicted probability of belonging to a non-abnormal transaction sample and a predicted probability of belonging to an abnormal transaction sample.

[0106] Exemplarily, the computer device determines the weight of the first branch network and the weight of the second branch network, and performs weighted fusion on the first type of features and the second type of features according to the following formula to obtain a fused feature z:

[0107]

[0108] Among them, w1 and w2 are the weight of the first branch network and the weight of the second branch network respectively. and The transposition of the weights of the first branch network and the transposition of the weights of the second branch network respectively. f1(x1) and f2(x2) are the first and second category features respectively.

[0109] The computer device determines the score s of the first input sample and the second input sample according to the fusion feature through the sigmoid function, as described below:

[0110]

[0111] Among them, exp(.) is an exponential function, and the score s is positively correlated with the fusion feature z.

[0112] In this embodiment, the first type of features and the second type of features are weighted and fused according to the weight of the first branch network and the weight of the second branch network to obtain a fused feature. That is, the features learned by the two branch networks are fused to obtain a fused feature, and based on the fused feature, the predicted probability that the first input sample and the second input sample belong to an abnormal transaction sample is simultaneously evaluated. Based on this, by combining the features learned by the two branch networks to train the model, not only can the characteristics of the original transaction sample distribution be learned, but also the characteristics of the abnormal transaction samples can be strengthened, thereby improving the accuracy of the abnormal transaction detection model in detecting abnormal transactions.

[0113] In some embodiments, Figure 4 The figure is a flow chart of the step of determining the target loss in one embodiment. The target loss is constructed based on the predicted probability of the sample belonging to the abnormal transaction output after fusing the first type of features and the second type of features, the sample categories of the first input sample and the second input sample, and the transaction values ​​of each, including:

[0114] Step S402: If the sample category of the first input sample indicates that the first input sample belongs to an abnormal transaction sample, then according to the output prediction probability of belonging to the abnormal transaction sample and the sample category of the first input sample, construct a predicted loss for the first input sample, and weight the predicted loss according to the transaction value of the first input sample to obtain a weighted predicted loss for the first input sample.

[0115] Among them, the prediction loss is used to evaluate the difference between the prediction probability of the abnormal transaction sample and the input sample. The greater the difference, the greater the corresponding prediction loss. When the input sample is an abnormal transaction sample, the transaction value of the input sample is the abnormal transaction value.

[0116] Optionally, the computer device determines the sample category of each of the first input sample and the second input sample. If the sample category of the first input sample is an abnormal transaction category, the first input sample is determined to belong to an abnormal transaction sample, and a cross entropy loss for the first input sample is constructed based on the output prediction probability of belonging to an abnormal transaction sample and the sample category of the first input sample, and the cross entropy loss for the first input sample is determined as the prediction loss for the first input sample. The computer device obtains the transaction value of the first input sample, and weights the prediction loss for the first input sample by the transaction value of the first input sample to obtain a weighted prediction loss for the first input sample.

[0117] It should be noted that the cross entropy loss L is as follows:

[0118] L = -[ylog(s)+(1-y)log(1-s)]

[0119] Among them, y is the label of the sample, s is the predicted score of the sample, and the score is the predicted probability that the sample belongs to the abnormal transaction sample. The more similar the predicted score is to the label, the smaller the corresponding cross entropy loss is. On this basis, in order to simplify the loss calculation process in this embodiment, the label of the transaction sample belonging to the abnormal transaction category is set to the value 1, that is, y=1 indicates that the label of the transaction sample is the abnormal transaction category, then y=0 indicates that the label of the transaction sample is the non-abnormal transaction category. Therefore, in the case where the sample category of the input sample is the abnormal transaction category, the prediction loss of the input sample can be simplified as:

[0120] L0=-log(s)

[0121] At this time, the prediction loss L for the first input sample is 11 For: L 11 = -log(s1); where s1 is a score determined based on the first input sample of the abnormal transaction category and the second input sample of the abnormal transaction category. The weighted prediction loss L for the first input sample 12 For: L 12 = -A1 log(s1), that is, the product of the transaction value A1 of the first input sample and the prediction loss -log(s1) for the first input sample is determined as the weighted prediction loss for the first input sample. In the above weighted prediction loss, A1 is the transaction value of the first input sample.

[0122] Step S404: If the sample category of the second input sample indicates that the second input sample belongs to an abnormal transaction sample, then according to the output prediction probability of belonging to the abnormal transaction sample and the sample category of the second input sample, construct the predicted loss for the second input sample, and weight the predicted loss according to the transaction value of the second input sample to obtain the weighted predicted loss for the second input sample.

[0123] Optionally, if the sample category of the second input sample is an abnormal transaction category, the computer device determines that the second input sample belongs to an abnormal transaction sample, and constructs a cross entropy loss for the second input sample based on the output prediction probability of belonging to an abnormal transaction sample and the sample category of the second input sample, and determines the cross entropy loss for the second input sample as the prediction loss for the second input sample. The computer device obtains the transaction value of the second input sample, and weights the prediction loss for the second input sample by the transaction value of the second input sample to obtain a weighted prediction loss for the second input sample.

[0124] For example, if the sample category of the second input sample is an abnormal transaction category, the prediction loss for the second input sample is: L 21 For: L 21 = -log(s1). Weighted prediction loss L for the second input sample 22 For: L 22 =-A2 log(s1), that is, the product of the transaction value A2 of the second input sample and the predicted loss -log(s2) for the second input sample is determined as the weighted predicted loss for the second input sample.

[0125] Step S406: The weighted prediction loss for the first input sample and the weighted prediction loss for the second input sample are fused to obtain a target loss.

[0126] Optionally, the computer device determines the weighted prediction weights of the weighted prediction loss regarding the first input sample and the weighted prediction loss regarding the second input sample, and weights the weighted prediction loss regarding the first input sample and the weighted prediction loss regarding the second input sample according to the weighted prediction weights of the respective input samples to determine the target loss.

[0127] Among them, the weighted prediction weights of the weighted prediction loss regarding the first input sample and the weighted prediction loss regarding the first input sample may be equal or different.

[0128] For example, to ensure the consistency of the accuracy of feature extraction in the two branch networks, the weighted prediction weights of the weighted prediction loss for the first input sample and the weighted prediction loss for the first input sample can be equal; for example, the weighted prediction weights of each are both 1, at this time, the target loss L M As described below:

[0129]

[0130] in, The weighted prediction loss of the first input sample considering the transaction value is L mentioned in the above example.12 ; The weighted prediction loss of the second input sample considering the transaction value is L mentioned in the above example. 22 .

[0131] In this embodiment, when it is verified that the sample categories of the first input sample and the second input sample are both abnormal transaction categories, the predicted loss for the first input sample is constructed according to the output predicted probability of belonging to the abnormal transaction sample and the sample category of the first input sample. Similarly, the predicted loss for the second input sample is constructed according to the output predicted probability of belonging to the abnormal transaction sample and the sample category of the second input sample. At this time, in order to improve the accuracy of the abnormal transaction detection model for the recall rate of transaction values, the predicted loss for the first input sample and the predicted loss for the second input sample are weighted by using the transaction values ​​of the first input sample and the second input sample, respectively, to obtain the weighted predicted loss for the first input sample and the weighted predicted loss for the second input sample. At this time, the target loss is determined by fusing the weighted predicted loss for the first input sample and the weighted predicted loss for the second input sample. In this way, the model is trained according to the target loss, the characteristics of the original transaction sample distribution are learned and the characteristics of the abnormal transaction sample are strengthened, the accuracy of the abnormal transaction detection model for abnormal transaction detection is improved, and the recall rate of transaction values ​​is improved.

[0132] In some embodiments, Figure 5 FIG. 1 is a flow chart of a step of determining a target loss in another embodiment, wherein the method further includes:

[0133] Step S502: If the sample category of the first input sample indicates that the first input sample belongs to a non-abnormal transaction sample, a predicted loss for the first input sample is constructed according to the output predicted probability of belonging to an abnormal transaction sample and the sample category of the first input sample.

[0134] Optionally, the computer device determines the sample category of each of the first input sample and the second input sample. If the sample category of the first input sample is a non-abnormal transaction category, the first input sample is determined to belong to a non-abnormal transaction sample, and a cross entropy loss for the first input sample is constructed based on the output prediction probability of belonging to an abnormal transaction sample and the sample category of the first input sample, and the cross entropy loss for the first input sample is determined as the prediction loss for the first input sample.

[0135] As mentioned above, the first input sample is a non-abnormal transaction sample, then y = 0. At this time, the prediction loss L for the first input sample is 11 For: L 11 =-log(1-s1).

[0136] Step S504: if the sample category of the second input sample indicates that the second input sample belongs to a non-abnormal transaction sample, a predicted loss for the second input sample is constructed according to the output predicted probability of belonging to an abnormal transaction sample and the sample category of the second input sample.

[0137] Optionally, if the sample category of the second input sample is a non-abnormal transaction category, the computer device determines that the second input sample belongs to a non-abnormal transaction sample, and constructs a cross entropy loss about the second input sample based on the output prediction probability of belonging to the non-abnormal transaction sample and the sample category of the second input sample, and determines the cross entropy loss about the second input sample as the prediction loss about the second input sample.

[0138] For example, if the sample category of the second input sample is a non-abnormal transaction category, the prediction loss for the second input sample is L 21 For: L 21 =-log(1-s1).

[0139] Step S506: The prediction loss for the first input sample and the prediction loss for the second input sample are integrated to obtain a target loss.

[0140] Optionally, the computer device weights the prediction loss regarding the first input sample and the prediction loss regarding the second input sample according to the prediction weights of the respective input samples to determine the target loss.

[0141] Exemplarily, the prediction weights corresponding to the first input sample and the second input sample are equal, for example, both are 1, then the target loss is as follows:

[0142] L M =L 11 +L 21 = -log(1-s1)-log(1-s1)

[0143] In this embodiment, when it is verified that the sample categories of the first input sample and the second input sample are both non-abnormal transaction categories, the predicted loss for the first input sample is constructed based on the output predicted probability of belonging to the abnormal transaction sample and the sample category of the first input sample. The predicted loss for the second input sample is constructed based on the output predicted probability of belonging to the abnormal transaction sample and the sample category of the second input sample. At this time, the predicted loss for the first input sample and the predicted loss for the second input sample are directly fused to determine the target loss. In this way, the model is trained based on the target loss, the characteristics of the original transaction sample distribution are learned and the characteristics of the abnormal transaction samples are strengthened, thereby improving the accuracy of the abnormal transaction detection model in detecting abnormal transactions.

[0144] In some embodiments, the method further includes: if it is verified that the sample categories of the first input sample and the second input sample are different, a predicted loss for the first input sample is constructed based on the output predicted probability of belonging to an abnormal transaction sample and the sample category of the first input sample. A predicted loss for the second input sample is constructed based on the output predicted probability of belonging to an abnormal transaction sample and the sample category of the second input sample. The predicted loss corresponding to the input sample of the abnormal transaction category is weighted with the corresponding transaction value to obtain a weighted predicted loss of the input sample of the abnormal transaction category. The weighted predicted loss of the input sample of the abnormal transaction category and the predicted loss of the input sample of the non-abnormal transaction category are integrated to determine the target loss.

[0145] Optionally, if the sample category of the first input sample indicates that the first input sample belongs to an abnormal transaction sample, then according to the output prediction probability of belonging to the abnormal transaction sample and the sample category of the first input sample, a prediction loss for the first input sample is constructed, and the prediction loss is weighted according to the transaction value of the first input sample to obtain a weighted prediction loss for the first input sample; if the sample category of the second input sample indicates that the second input sample belongs to a non-abnormal transaction sample, then according to the output prediction probability of belonging to the abnormal transaction sample and the sample category of the second input sample, a prediction loss for the second input sample is constructed; the weighted prediction loss for the first input sample and the prediction loss for the second input sample are fused to obtain the target loss.

[0146] Of course, in other embodiments, the method also includes: if the sample category of the first input sample indicates that the first input sample belongs to a non-abnormal transaction sample, then according to the output prediction probability of belonging to an abnormal transaction sample and the sample category of the first input sample, construct a predicted loss for the first input sample; if the sample category of the second input sample indicates that the second input sample belongs to an abnormal transaction sample, then according to the output prediction probability of belonging to an abnormal transaction sample and the sample category of the second input sample, construct a predicted loss for the second input sample, weight the predicted loss according to the transaction value of the second input sample, and obtain a weighted predicted loss for the second input sample; the predicted loss for the first input sample and the weighted predicted loss for the second input sample are integrated to obtain the target loss.

[0147] In this embodiment, if it is verified that the sample categories of the first input sample and the second input sample are different, after determining the prediction losses of the two input samples, the prediction losses corresponding to the input samples of the abnormal transaction samples and the corresponding transaction values ​​are weighted to obtain the weighted prediction losses. Based on this, the target loss is determined by combining the weighted prediction losses of the input samples of the abnormal transaction category and the weighted prediction losses of the input samples of the non-abnormal transaction category. In this way, the model is trained according to the target loss, the characteristics of the original transaction sample distribution are learned and the characteristics of the abnormal transaction samples are strengthened, thereby improving the accuracy of the abnormal transaction detection model in detecting abnormal transactions and improving the recall rate of transaction values.

[0148] Of course, when training the model according to the target loss, the transaction value of the abnormal transaction sample may not be considered. Therefore, in some embodiments, after executing step S206, the method further includes: extracting features of the first input sample through the first branch network of the abnormal transaction detection model to obtain the first type of features, extracting features of the second input sample through the second branch network of the abnormal transaction detection model to obtain the second type of features, constructing the target loss based on the predicted probability of the abnormal transaction sample output after fusing the first type of features and the second type of features, and the sample categories of the first input sample and the second input sample, and updating the abnormal transaction detection model according to the target loss.

[0149] Optionally, the computer device inputs the first input sample into the first branch network of the abnormal transaction detection model; performs feature extraction through the first branch network to obtain first-category features; inputs the second input sample into the second branch network of the abnormal transaction detection model; performs feature extraction through the second branch network to obtain second-category features.

[0150] The computer device constructs a predicted loss for the first input sample based on the output predicted probability of the sample belonging to an abnormal transaction and the sample category of the first input sample. The computer device constructs a predicted loss for the second input sample based on the output predicted probability of the sample belonging to an abnormal transaction and the sample category of the second input sample. The predicted loss for the first input sample and the predicted loss for the second input sample are integrated to obtain a target loss.

[0151] Exemplarily, after determining the score s2, the prediction loss L for the first input sample is ′ 11 as follows:

[0152] L ′ 11 =-[y1 log(s2)+(1-y1)log(1-s2)

[0153] Wherein, y1 is the sample category of the first input sample. If it is a non-abnormal transaction category, y1=0; if it is an abnormal transaction category, y1=1.

[0154] The prediction loss L for the second input sample ′ 21 as follows:

[0155] L ′ 21 =-[y2 log(s2)+(1-y2)log(1-s2)

[0156] Wherein, y2 is the sample category of the second input sample. If it is a non-abnormal transaction category, y2=0; if it is an abnormal transaction category, y2=1.

[0157] Based on this, the target loss L M 'for:

[0158] L M '=L ′ 11 +L ′ 21

[0159] In this embodiment, the first branch network of the abnormal transaction detection model extracts features from the first input sample to obtain the first type of features, so that the first branch network can learn the features of the original transaction sample distribution in the transaction sample set. The second branch network of the abnormal transaction detection model extracts features from the second input sample to obtain the second type of features, so that the second branch network can strengthen the learning of the features of the abnormal transaction samples. Based on the predicted probability of the abnormal transaction sample output after the fusion of the first type of features and the second type of features, the target loss is constructed based on the sample categories of the first input sample and the second input sample, and the abnormal transaction detection model is updated according to the target loss. That is, by combining the features learned by the two branch networks to perform model training, not only can the features of the original transaction sample distribution be learned, but also the features of the abnormal transaction samples can be strengthened, thereby improving the accuracy of the abnormal transaction detection model in abnormal transaction detection.

[0160] In some embodiments, Figure 6 FIG. 1 is a flow chart of steps for detecting abnormal transactions in an embodiment. The method further includes:

[0161] Step S602: Generate a transaction to be detected according to the transaction data.

[0162] Among them, transaction data refers to the data generated after the online payment transaction is completed, including but not limited to the time and place of the transaction, the products involved in the transaction, the transaction value, the account information of the initiator of the transaction and the account information of the recipient of the transaction value. The transaction to be detected includes the transaction data. The transaction to be detected refers to the transaction to be detected for abnormal transactions.

[0163] Optionally, the computer device obtains transaction data generated in an online payment scenario, and generates a transaction to be detected based on the verification data.

[0164] Step S604: input the transaction to be detected into the trained abnormal transaction detection model.

[0165] Optionally, the computer device inputs the to-be-detected verification into the first branch network and the second branch network of the trained abnormal transaction detection model respectively.

[0166] Step S606, extracting features of the transaction to be detected by the first branch network of the abnormal transaction detection model to obtain first-category features, extracting features of the transaction to be detected by the second branch network of the abnormal transaction detection model to obtain second-category features, fusing the first-category features with the second-category features, and outputting a predicted probability that the transaction to be detected belongs to the abnormal transaction category.

[0167] Optionally, the computer device extracts features of the transaction to be detected through the first branch network of the trained abnormal transaction detection model to obtain the first type of features. Also, the computer device extracts features of the verification to be detected through the second branch network of the trained abnormal transaction detection model to obtain the second type of features.

[0168] The computer device performs weighted fusion on the first and second features according to the weight of the first branch network and the weight of the second branch network to obtain a fusion feature corresponding to the transaction to be detected. The computer device determines the predicted probability that the transaction to be detected belongs to an abnormal transaction category according to the fusion feature corresponding to the transaction to be detected.

[0169] Step S608: When the predicted probability is greater than a preset threshold, it is determined that the transaction to be detected belongs to the category of abnormal transaction.

[0170] Optionally, the computer device compares the predicted probability that the transaction to be detected belongs to the abnormal transaction category with a preset threshold, and when the predicted probability is greater than the preset threshold, the computer device determines that the transaction to be detected belongs to the abnormal transaction category. When the predicted probability is not greater than the preset threshold, the computer device determines that the transaction to be detected belongs to the non-abnormal transaction category.

[0171] In this embodiment, the transaction to be detected is generated through transaction data, and the transaction to be detected is input into the two branch networks of the trained abnormal transaction detection model, and the first branch network is used to extract the first type of features, and the second type of features are extracted by the second branch network. The first type of features and the second type of features are combined to obtain fusion features, which further enhances the amount of detailed information of the abnormal transaction category, and is conducive to more accurate identification of whether the transaction to be detected is an abnormal transaction. Based on this, the predicted probability of belonging to the abnormal transaction category can be accurately determined. When the predicted probability is greater than the preset threshold, the transaction to be detected can be quickly and accurately determined to be an abnormal transaction category, thereby improving the accuracy of abnormal transaction detection.

[0172] The present application also provides an application scenario, which applies the processing method of the above-mentioned abnormal transaction detection model. Specifically, the application of the processing method of the abnormal transaction detection model in the application scenario is as follows: In the payment application scenario, for the target payment application, the user completes the online payment transaction by using the target payment application. In order to timely and accurately detect abnormal transactions in the target payment application, the processing method of the abnormal transaction detection model provided by the present application can be used to obtain a highly accurate trained abnormal transaction detection model. Specifically, the method is as follows: obtaining a transaction sample set, the transaction sample set includes abnormal transaction samples and non-abnormal transaction samples, and the number of abnormal transaction samples is less than the number of non-abnormal transaction samples; uniformly sampling the transaction sample set to obtain a first input sample; wherein the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are equal when uniform sampling is performed; reverse sampling is performed on the transaction sample set to obtain a second input sample; wherein the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples when reverse sampling is performed are positively correlated with the inverse of the number of samples in the transaction sample set; extracting features from the first input sample through the first branch network of the abnormal transaction detection model to obtain a first type of feature, extracting features from the second input sample through the second branch network of the abnormal transaction detection model to obtain a second type of feature, constructing a target loss based on the predicted probability of belonging to the abnormal transaction sample output after fusing the first type of feature and the second type of feature, the sample categories of the first input sample and the second input sample, and the transaction values ​​of the first input sample and the second input sample, and updating the abnormal transaction detection model according to the target loss. At this time, the computer device performs abnormality detection on the transaction to be detected according to the trained abnormal transaction detection model.

[0173] Of course, it is not limited to this. The processing method of the abnormal transaction detection model provided by this application can also be applied in other application scenarios. For example, in the scenario where a financial service institution stores and transfers resources, users or groups store the resources to be stored to the financial service institution, or transfer the resources to be transferred out of the financial service institution. At this time, the financial service institution needs to call the trained abnormal transaction detection model to detect abnormalities in the transaction in order to ensure the legality and security of the transaction. At this time, the processing method of the abnormal transaction detection model provided by this application can be used to obtain the trained abnormal transaction detection model.

[0174] The above application scenarios are merely illustrative descriptions. It is to be understood that the application of the processing methods of the abnormal transaction detection models provided in the embodiments of the present application is not limited to the above scenarios.

[0175] In a specific embodiment, the present application provides a processing method for an abnormal transaction detection model, which is executed by a computer device. The abnormal transaction detection model involved in the embodiment of the present application is a dual-branch collaborative model, such as Figure 7 FIG. 1 is a schematic diagram of a model structure of an abnormal transaction detection model in an embodiment. The abnormal transaction detection model includes an upper branch network and a lower branch network. The specific steps are as follows:

[0176] Step 1: The computer device obtains a transaction sample set, which includes abnormal transaction samples and non-abnormal transaction samples, and the number of abnormal transaction samples is less than the number of non-abnormal transaction samples.

[0177] Step 2: The computer device determines the total number of samples based on the sample number of abnormal transaction samples and the sample number of non-abnormal transaction samples; determines the sampling probability of uniform sampling based on the reciprocal of the total number of samples, and the sampling probability is positively correlated with the reciprocal of the total number of samples; obtains the first input sample from the transaction sample set based on the sampling probability of uniform sampling.

[0178] Step 3: The computer equipment determines the total number of samples based on the sample number of abnormal transaction samples and the sample number of non-abnormal transaction samples; takes the ratio of the sample number of non-abnormal transaction samples to the total number of samples as the sampling probability of abnormal transaction samples; takes the ratio of the sample number of abnormal transaction samples to the total number of samples as the sampling probability of non-abnormal transaction samples.

[0179] The computer device performs equal-probability sampling on the abnormal transaction samples according to the sampling probability of the abnormal transaction category to obtain abnormal transaction samples, and uses the sampled abnormal transaction samples as the second input samples; and performs equal-probability sampling on the abnormal transaction samples according to the sampling probability of the non-abnormal transaction category to obtain non-abnormal transaction samples, and uses the sampled non-transaction samples as the second input samples.

[0180] Figure 7 Middle straight square Figure 1 It is shown in Figure 2 that when the first input sample is obtained, the sampling probability of the non-abnormal transaction sample is greater than the sampling probability of the abnormal transaction sample. Figure 7 Middle straight square Figure 2 It is shown in Figure 2 that when obtaining the second input sample, the sampling probability of the non-abnormal transaction sample is less than the sampling probability of the abnormal transaction sample.

[0181] Step 4: The computer device inputs the first input sample into the first branch network of the abnormal transaction detection model; extracts features through the first branch network to obtain first-class features. The second input sample is input into the second branch network of the abnormal transaction detection model; extracts features through the second branch network to obtain second-class features.

[0182] Step 5: The computer device performs weighted fusion on the first type of features and the second type of features according to the weight of the first branch network and the weight of the second branch network to obtain fused features; and outputs the predicted probability of the sample belonging to the abnormal transaction according to the fused features.

[0183] Step 6: If the sample category of the first input sample indicates that the first input sample belongs to an abnormal transaction sample, the computer device constructs a prediction loss for the first input sample according to the output prediction probability of belonging to the abnormal transaction sample and the sample category of the first input sample, and weights the prediction loss according to the transaction value of the first input sample to obtain a weighted prediction loss for the first input sample; if the sample category of the second input sample indicates that the second input sample belongs to an abnormal transaction sample, the computer device constructs a prediction loss for the second input sample according to the output prediction probability of belonging to the abnormal transaction sample and the sample category of the second input sample, and weights the prediction loss according to the transaction value of the second input sample to obtain a weighted prediction loss for the second input sample; the weighted prediction loss for the first input sample and the weighted prediction loss for the second input sample are integrated to obtain the target loss.

[0184] Of course, if the sample category of the first input sample indicates that the first input sample belongs to a non-abnormal transaction sample, the computer device constructs a predicted loss for the first input sample based on the output predicted probability of belonging to an abnormal transaction sample and the sample category of the first input sample; if the sample category of the second input sample indicates that the second input sample belongs to a non-abnormal transaction sample, the computer device constructs a predicted loss for the second input sample based on the output predicted probability of belonging to an abnormal transaction sample and the sample category of the second input sample; the predicted loss for the first input sample and the predicted loss for the second input sample are integrated to obtain the target loss.

[0185] The computer device updates the abnormal transaction detection model according to the target loss to obtain a trained abnormal transaction detection model.

[0186] In order to further evaluate the detection effect of the trained abnormal transaction detection model, the test set is used for evaluation. For any transaction test sample i in , to determine the label of transaction test sample i, the classifier c(x;θ) is used to determine it. For each transaction test sample i, the classifier is used to determine the corresponding transaction test sample t(K) with the top K scores (i.e., the transaction test sample of the abnormal transaction category):

[0187]

[0188] Among them, transaction test sample i can be expressed as (a i ,y i ,m i ). Among them, a i y is the transaction data of the test transaction, i is the label of the transaction test sample, m i This is the abnormal transaction value. The score is integrated at the Kth score. The number of abnormal transaction test samples and the number of non-abnormal transaction test samples in the test set satisfy the following relationship:

[0189]

[0190] in, is the indicator function, y i = 0 means that the label of the transaction test sample is a non-abnormal transaction category, y i =1 indicates that the label of the transaction test sample is an abnormal transaction category. The above relationship representation means that the number of abnormal transaction test samples in the test set is much smaller than the number of non-abnormal transaction test samples.

[0191] At this time, each transaction test sample is input into the two branch networks of the trained abnormal transaction detection model, and the predicted probability of belonging to the abnormal transaction sample is output. Based on the output predicted probability, the transaction category of each transaction test sample is predicted. At this time, the recall rate P is calculated by the following formulas respectively. k And transaction value recall rate P A :

[0192]

[0193]

[0194] The above recall rate P k The numerator in the formula is the sum of the labels that belong to the abnormal transaction category and are predicted to be abnormal transaction categories, and the denominator is the sum of the labels that belong to the abnormal transaction category. AThe numerator is the sum of the transaction values ​​that are labeled as positive samples and predicted as positive samples; the denominator is the sum of the transaction values ​​that are labeled as positive samples.

[0195] Based on this, the detection effects of the trained abnormal transaction detection model and the models involved in different related technologies are compared. Figure 8 The figure is a schematic diagram of the comparison results between the detection models in one embodiment. Figure 8 The models involved in 10 related technologies are provided in this paper. Each related technology corresponds to two models, namely Model 1 and Model 2. The loss function of Model 1 does not involve the transaction value of abnormal transaction samples, while the loss function of Model 2 involves the transaction value of abnormal transaction samples. The models involved in these related technologies are Model 1 (Cross Entropy) based on cross entropy loss, Model 2 (Cross Entropy-A) based on cross entropy loss, Model 1 (FocalLoss) based on focal loss, Model 2 (Focal Loss-A), Model 1 based on hybrid technology (Mixup), Model 2 based on hybrid technology (Mixup-A), Model 1 based on delayed class balanced resampling with cross entropy loss (CE-DRS), Model 2 based on delayed class balanced resampling with cross entropy loss (CE-DRS-A), Model 1 based on cross entropy loss and balanced sampling (CE-DRW), Model 2 based on cross entropy loss and balanced sampling (CE-DRW-A), Model 1 based on label distribution aware boundary loss (LDAM), Model 2 based on label distribution aware boundary loss Model 2 (LDAM-A), Model 1 based on reweighting method (LDAM-DRW), Model 2 based on reweighting method (LDAM-DRW-A), Model 1 based on category balance loss and cross entropy loss (CB-CE), Model 2 based on category balance loss and cross entropy loss (CB-CE-A), Model 1 based on category balance loss and focal loss (CB-Focal), Model 2 based on category balance loss and focal loss (CB-Focal-A), bilateral branch network model 1 (BBN), bilateral branch network model 2 (BBN-A). For the embodiments of the present application, the model of the target loss of the transaction value that does not involve the abnormal transaction sample is regarded as the abnormal transaction detection model 1, and the model of the transaction value that involves the abnormal transaction sample is regarded as the abnormal transaction detection model 2.

[0196] When the number of transaction samples is in the tens of millions, for the top 20,000 scores, determine the recall rate P of each model. 20000 And transaction value recall rate A 20000, for the top 50,000 scores, determine the recall rate P of each model 50000 And transaction value recall rate A 50000 Based on this, according to Figure 8 It can be seen that the overall effect of the abnormal transaction detection model provided in the embodiment of the present application is better.

[0197] In this embodiment, by obtaining a transaction sample set, the transaction sample set includes abnormal transaction samples and non-abnormal transaction samples, and the number of samples of abnormal transaction samples is less than the number of samples of non-abnormal transaction samples; uniformly sampling the transaction sample set to obtain a first input sample; wherein, when uniform sampling is performed, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are equal, that is, the first input sample is obtained by assigning equal sampling probabilities to each transaction sample in the transaction sample set. The transaction sample set is reversely sampled to obtain a second input sample; wherein, when reverse sampling is performed, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are positively correlated with the inverse of the number of samples in each transaction sample set, that is, the sampling probability of abnormal transaction samples is greater than the sampling probability of non-abnormal transactions. At this time, the probability that the second input sample is an abnormal transaction sample is greater than the probability of a non-abnormal transaction sample, which overcomes the problem of class imbalance between the sample class of non-abnormal transaction samples and the class of abnormal transaction samples. The first branch network of the abnormal transaction detection model extracts features from the first input sample to obtain the first type of features, so that it can ensure that the first branch network learns the features of the original transaction sample distribution in the transaction sample set. The second branch network of the abnormal transaction detection model extracts features from the second input sample to obtain the second type of features, thus ensuring that the second branch network can strengthen the features of the abnormal transaction samples. The target loss is constructed based on the predicted probability of the abnormal transaction sample output after the fusion of the first and second types of features, the sample categories of the first and second input samples, and the respective transaction values, and the abnormal transaction detection model is updated according to the target loss. That is, by combining the features learned by the two branch networks to train the model, not only can the features of the original transaction sample distribution be learned, but also the features of the abnormal transaction samples can be strengthened, thereby improving the accuracy of the abnormal transaction detection model in detecting abnormal transactions.

[0198] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0199] Based on the same inventive concept, the embodiment of the present application also provides a processing device for an abnormal transaction detection model for implementing the processing method of the abnormal transaction detection model involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the processing device for one or more abnormal transaction detection models provided below can refer to the limitations of the processing method for the abnormal transaction detection model above, and will not be repeated here.

[0200] In one embodiment, Fig. 9 As shown, a processing device 900 for an abnormal transaction detection model is provided, comprising: a sample set acquisition module 902, a first sampling module 904, a second sampling module 906 and an updating module 908, wherein:

[0201] The sample set acquisition module 902 is used to acquire a transaction sample set, where the transaction sample set includes abnormal transaction samples and non-abnormal transaction samples, and the number of abnormal transaction samples is less than the number of non-abnormal transaction samples;

[0202] The first sampling module 904 is used to uniformly sample the transaction sample set to obtain a first input sample; wherein, when performing uniform sampling, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are equal;

[0203] The second sampling module 906 is used to perform reverse sampling on the transaction sample set to obtain a second input sample; wherein the sampling probability of the abnormal transaction sample and the non-abnormal transaction sample during reverse sampling is positively correlated with the inverse of the number of samples of each in the transaction sample set;

[0204] An updating module 908 is used to extract features from the first input sample through the first branch network of the abnormal transaction detection model to obtain first-category features, and to extract features from the second input sample through the second branch network of the abnormal transaction detection model to obtain second-category features, and to construct a target loss based on the predicted probability of the abnormal transaction sample output after fusing the first-category features with the second-category features, the sample categories of the first input sample and the second input sample, and the transaction values ​​of each, and to update the abnormal transaction detection model according to the target loss.

[0205] In some embodiments, the first sampling module 904 is used to determine the total number of samples based on the sample number of abnormal transaction samples and the sample number of non-abnormal transaction samples; determine the sampling probability of uniform sampling based on the inverse of the total number of samples, and the sampling probability is positively correlated with the inverse of the total number of samples; and obtain the first input sample from the transaction sample set based on the sampling probability of uniform sampling.

[0206] In some embodiments, the second sampling module 906 is used to determine the sampling probability of abnormal transaction samples and non-abnormal transaction samples based on the sample number of abnormal transaction samples and the sample number of non-abnormal transaction samples; and obtain a second input sample from the transaction sample set based on the sampling probability of abnormal transaction samples and non-abnormal transaction samples.

[0207] In some embodiments, the second sampling module 906 is used to determine the total number of samples based on the sample number of abnormal transaction samples and the sample number of non-abnormal transaction samples; use the ratio of the sample number of non-abnormal transaction samples to the total number of samples as the sampling probability of abnormal transaction samples; and use the ratio of the sample number of abnormal transaction samples to the total number of samples as the sampling probability of non-abnormal transaction samples.

[0208] In some embodiments, the second sampling module 906 is used to perform equal-probability sampling on abnormal transaction samples according to the sampling probability of abnormal transaction categories to obtain abnormal transaction samples, and use the sampled abnormal transaction samples as the second input samples; perform equal-probability sampling on abnormal transaction samples according to the sampling probability of non-abnormal transaction categories to obtain non-abnormal transaction samples, and use the sampled non-transaction samples as the second input samples.

[0209] In some embodiments, the update module 908 is used to input the first input sample into the first branch network of the abnormal transaction detection model; perform feature extraction through the first branch network to obtain the first type of feature; the update module 908 is used to input the second input sample into the second branch network of the abnormal transaction detection model; perform feature extraction through the second branch network to obtain the second type of feature.

[0210] In some embodiments, the device also includes a prediction probability output module, which is used to perform weighted fusion of the first type of features and the second type of features according to the weight of the first branch network and the weight of the second branch network to obtain fused features; and output the predicted probability of belonging to an abnormal transaction sample based on the fused features.

[0211] In some embodiments, the update module 908 is used to construct a predicted loss for the first input sample based on the output predicted probability of belonging to the abnormal transaction sample and the sample category of the first input sample if the sample category of the first input sample indicates that the first input sample belongs to an abnormal transaction sample, and weight the predicted loss according to the transaction value of the first input sample to obtain a weighted predicted loss for the first input sample; if the sample category of the second input sample indicates that the second input sample belongs to an abnormal transaction sample, then construct a predicted loss for the second input sample based on the output predicted probability of belonging to the abnormal transaction sample and the sample category of the second input sample, and weight the predicted loss according to the transaction value of the second input sample to obtain a weighted predicted loss for the second input sample; and fuse the weighted predicted loss for the first input sample with the weighted predicted loss for the second input sample to obtain the target loss.

[0212] In some embodiments, the update module 908 is also used to construct a predicted loss for the first input sample based on the output predicted probability of belonging to an abnormal transaction sample and the sample category of the first input sample if the sample category of the first input sample indicates that the first input sample belongs to a non-abnormal transaction sample; if the sample category of the second input sample indicates that the second input sample belongs to a non-abnormal transaction sample, construct a predicted loss for the second input sample based on the output predicted probability of belonging to an abnormal transaction sample and the sample category of the second input sample; and fuse the predicted loss for the first input sample with the predicted loss for the second input sample to obtain the target loss.

[0213] In some embodiments, the device also includes a detection module, which is used to generate a transaction to be detected based on transaction data; input the transaction to be detected into a trained abnormal transaction detection model; extract features of the transaction to be detected through a first branch network of the abnormal transaction detection model to obtain a first type of feature, and extract features of the transaction to be detected through a second branch network of the abnormal transaction detection model to obtain a second type of feature, and after fusing the first type of feature with the second type of feature, output a predicted probability that the transaction to be detected belongs to the abnormal transaction category; when the predicted probability is greater than a preset threshold, it is determined that the transaction to be detected belongs to the abnormal transaction category.

[0214] Each module in the processing device of the above abnormal transaction detection model can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0215] In one embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Fig.10 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a processing method for an abnormal transaction detection model is implemented.

[0216] Those skilled in the art will understand that Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0217] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0218] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0219] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0220] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0221] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0222] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0223] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A processing method for an abnormal transaction detection model, characterized in that: The method comprises: Acquire a transaction sample set, wherein the transaction sample set includes abnormal transaction samples and non-abnormal transaction samples, and the number of samples of the abnormal transaction samples is less than the number of samples of the non-abnormal transaction samples; Uniformly sampling the transaction sample set to obtain a first input sample; wherein during the uniform sampling, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are equal; Performing reverse sampling on the transaction sample set to obtain a second input sample; wherein, when performing reverse sampling, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are positively correlated with the inverse of the number of samples of each in the transaction sample set; The first branch network of the abnormal transaction detection model is used to extract features from the first input sample to obtain first-category features, and the second branch network of the abnormal transaction detection model is used to extract features from the second input sample to obtain second-category features. A target loss is constructed based on the predicted probability of the sample belonging to the abnormal transaction output after fusing the first and second features, the sample categories of the first and second input samples, and their respective transaction values, and the abnormal transaction detection model is updated according to the target loss.

2. The method according to claim 1, characterized in that The uniformly sampling the transaction sample set to obtain a first input sample includes: Determining the total number of samples according to the number of samples of the abnormal transaction samples and the number of samples of the non-abnormal transaction samples; Determine a sampling probability for uniform sampling according to the reciprocal of the total number of samples, wherein the sampling probability is positively correlated with the reciprocal of the total number of samples; According to the sampling probability of uniform sampling, a first input sample is obtained from the transaction sample set.

3. The method according to claim 1, characterized in that The step of performing reverse sampling on the transaction sample set to obtain a second input sample includes: Determine the sampling probability of the abnormal transaction samples and the sampling probability of the non-abnormal transaction samples according to the sample number of the abnormal transaction samples and the sample number of the non-abnormal transaction samples; According to the respective sampling probabilities of the abnormal transaction samples and the non-abnormal transaction samples, a second input sample is obtained from the transaction sample set.

4. The method according to claim 3, characterized in that The determining, according to the sample quantity of the abnormal transaction samples and the sample quantity of the non-abnormal transaction samples, the sampling probability of the abnormal transaction samples and the non-abnormal transaction samples respectively comprises: Determining the total number of samples according to the number of samples of the abnormal transaction samples and the number of samples of the non-abnormal transaction samples; The ratio of the number of samples of the non-abnormal transaction samples to the total number of samples is used as the sampling probability of the abnormal transaction samples; The ratio of the number of samples of the abnormal transaction samples to the total number of samples is used as the sampling probability of the non-abnormal transaction samples.

5. The method according to claim 3, characterized in that: The acquiring a second input sample from the transaction sample set according to the sampling probabilities of the abnormal transaction sample and the non-abnormal transaction sample respectively includes: Performing equal-probability sampling on abnormal transaction samples according to the sampling probability of the abnormal transaction category to obtain abnormal transaction samples, and using the sampled abnormal transaction samples as the second input samples; The abnormal transaction samples are sampled with equal probability according to the sampling probability of the non-abnormal transaction category to obtain non-abnormal transaction samples, and the non-transaction samples obtained by sampling are used as the second input samples.

6. The method according to claim 1, characterized in that The extracting features of the first input sample by the first branch network of the abnormal transaction detection model to obtain the first type of features includes: Inputting the first input sample into the first branch network of the abnormal transaction detection model; Extract features through the first branch network to obtain first-category features; The extracting features of the second input sample by the second branch network of the abnormal transaction detection model to obtain the second type of features includes: Inputting the second input sample into the second branch network of the abnormal transaction detection model; Feature extraction is performed through the second branch network to obtain second-category features.

7. The method according to claim 1, characterized in that The method further comprises: According to the weight of the first branch network and the weight of the second branch network, weighted fusion is performed on the first type of features and the second type of features to obtain a fused feature; The predicted probability of the sample belonging to abnormal transaction is output according to the fusion feature.

8. The method according to claim 1, characterized in that: The method of constructing a target loss based on the predicted probability of an abnormal transaction sample output after fusing the first type of features with the second type of features, the sample categories of the first input sample and the second input sample, and the transaction values ​​of the first input sample and the second input sample includes: If the sample category of the first input sample indicates that the first input sample belongs to an abnormal transaction sample, construct a predicted loss for the first input sample according to the output predicted probability of belonging to an abnormal transaction sample and the sample category of the first input sample, and weight the predicted loss according to the transaction value of the first input sample to obtain a weighted predicted loss for the first input sample; If the sample category of the second input sample indicates that the second input sample belongs to an abnormal transaction sample, construct a predicted loss for the second input sample according to the output predicted probability of belonging to an abnormal transaction sample and the sample category of the second input sample, and weight the predicted loss according to the transaction value of the second input sample to obtain a weighted predicted loss for the second input sample; The weighted prediction loss for the first input sample and the weighted prediction loss for the second input sample are combined to obtain a target loss.

9. The method according to claim 8, characterized in that The method further comprises: If the sample category of the first input sample indicates that the first input sample belongs to a non-abnormal transaction sample, constructing a predicted loss for the first input sample according to the output predicted probability of belonging to an abnormal transaction sample and the sample category of the first input sample; If the sample category of the second input sample indicates that the second input sample belongs to a non-abnormal transaction sample, constructing a predicted loss for the second input sample according to the output predicted probability of belonging to an abnormal transaction sample and the sample category of the second input sample; The prediction loss about the first input sample and the prediction loss about the second input sample are fused to obtain a target loss.

10. The method according to any one of claims 1 to 9, characterized in that: The method further comprises: Generate transactions to be tested according to transaction data; Inputting the transaction to be detected into a trained abnormal transaction detection model; Extracting features of the transaction to be detected by the first branch network of the abnormal transaction detection model to obtain first-category features, extracting features of the transaction to be detected by the second branch network of the abnormal transaction detection model to obtain second-category features, fusing the first-category features with the second-category features, and outputting a predicted probability that the transaction to be detected belongs to an abnormal transaction category; When the predicted probability is greater than a preset threshold, it is determined that the transaction to be detected belongs to the category of abnormal transactions.

11. A processing device for an abnormal transaction detection model, characterized in that: The device comprises: A sample set acquisition module, used to acquire a transaction sample set, wherein the transaction sample set includes abnormal transaction samples and non-abnormal transaction samples, and the number of samples of the abnormal transaction samples is less than the number of samples of the non-abnormal transaction samples; A first sampling module is used to uniformly sample the transaction sample set to obtain a first input sample; wherein, when performing uniform sampling, the sampling probabilities of abnormal transaction samples and non-abnormal transaction samples are equal; A second sampling module is used to perform reverse sampling on the transaction sample set to obtain a second input sample; wherein the sampling probability of abnormal transaction samples and non-abnormal transaction samples during reverse sampling is positively correlated with the inverse of the number of samples of each in the transaction sample set; An updating module is used to extract features from the first input sample through the first branch network of the abnormal transaction detection model to obtain first-category features, and to extract features from the second input sample through the second branch network of the abnormal transaction detection model to obtain second-category features, and to construct a target loss based on the predicted probability of the sample belonging to the abnormal transaction output after fusing the first and second features, the sample categories of the first and second input samples, and their respective transaction values, and to update the abnormal transaction detection model according to the target loss.

12. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 10 are implemented.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images