A transaction anomaly detection method, device, equipment and storage medium for financial system

Abstract

The present invention provides a transaction anomaly detection method, device, equipment and storage medium for a financial system, comprising the following steps: first, obtaining the transaction data of each transaction account in the financial system and establishing a transaction behavior model. Secondly, extracting the transaction features of each account and comparing them with the normal threshold, marking the features that deviate from the threshold as abnormal. Then, analyzing the abnormal features through a clustering algorithm, defining accounts with high abnormality as suspicious accounts. Next, defining the transaction type, account and data as nodes with different weights, respectively, and outputting them to suspicious accounts. After that, initializing the node position and obtaining the sum of associated weights. Iterating and updating the node position through a global optimization algorithm to maximize the sum of associated weights, and finally determining the abnormal detection position. The present invention can effectively identify and locate abnormal transaction behaviors in financial systems, and improve transaction security and risk prevention and control capabilities.

Description

Technical Field

[0001] The present invention relates to the field of financial system transaction technology, and more specifically, to a transaction anomaly detection method, device, equipment and storage medium for a financial system. Background Art

[0002] In modern financial systems, transaction activities are becoming increasingly frequent and complex, and the amount of transaction data is huge. Traditional transaction anomaly detection methods mainly rely on manual review and simple rule engines, which have many shortcomings when facing massive data. Manual review is time-consuming and labor-intensive, and it is difficult to cope with the needs of real-time and large-scale data processing, and it is easy to cause misjudgment due to subjective factors. Although simple rule engines can automatically process some data, their rules are fixed and difficult to adapt to complex changes in transaction patterns, and they are prone to omissions and false positives. In addition, although some existing statistical-based methods can process large-scale data, their definition of abnormal transactions is relatively simple, and it is difficult to accurately capture complex abnormal behavior patterns.

[0003] In the process of implementing the embodiments of the present invention, the inventors found that there are at least the following problems or defects in the prior art: it is unable to effectively cope with the real-time processing requirements of large-scale and complex transaction data, the accuracy and efficiency of identifying abnormal transactions are low, and it is difficult to adapt to changing transaction patterns and risk characteristics. Summary of the invention

[0004] The present invention provides a transaction anomaly detection method, device, equipment and storage medium for a financial system.

[0005] In a first aspect of the present invention, a transaction anomaly detection method for a financial system is provided, comprising:

[0006] Step S1, obtaining transaction data of each transaction account in the financial system, and establishing a transaction behavior model of the transaction account through a preset strategy;

[0007] Step S2, respectively obtaining the transaction features of each transaction account in the transaction behavior model, and comparing the transaction features with a preset normal transaction feature threshold, and marking the transaction features that deviate from the threshold as abnormal transaction features;

[0008] Step S3, performing cluster analysis on the abnormal transaction features by using a clustering algorithm, and defining transaction accounts with a higher degree of abnormality in the clustering results as suspicious transaction accounts;

[0009] Step S4, defining each transaction type as a first node with a first weight, defining each transaction account as a second node with a second weight, and defining each transaction data as a third node with a third weight, and the weight polarities of all first nodes, all second nodes, and all third nodes are the same;

[0010] Step S5, outputting all first nodes, all second nodes, and all third nodes to the suspicious transaction account;

[0011] Step S6, initializing the positions of all first nodes, all second nodes, and all third nodes, and obtaining the sum of the associated weights of all first nodes, all second nodes, and all third nodes;

[0012] Step S7, iteratively updating the real-time positions of all first nodes, all second nodes, and all third nodes through a global optimization algorithm to obtain the maximum value of the sum of the associated weights of all transaction data, and at the same time maximize the sum of the associated weights;

[0013] Step S8, obtaining all real-time positions when the sum of the associated weights reaches the maximum, and defining them as abnormal detection positions for all transaction accounts, all transaction types, and all transaction data.

[0014] Furthermore, in step S3, cluster analysis is performed on the abnormal transaction features by using a clustering algorithm, and transaction accounts with a higher degree of abnormality in the clustering results are defined as suspicious transaction accounts, including:

[0015] Step S31, establishing a feature set in the abnormal transaction features, and assigning a value of 0 to each feature in the feature set, wherein the dimension of each feature is less than or equal to the feature dimension of each transaction account;

[0016] Step S32, determining whether the abnormal transaction feature exists in each feature, and assigning a value of 1 to the feature that has the abnormal transaction feature;

[0017] Step S33, defining the current feature and adjacent features as a feature window, and obtaining the assigned values ​​of all features in each feature window respectively;

[0018] Step S34, determining whether there is a feature in each feature window whose assigned value is 0, if there is a feature in the current feature window whose assigned value is 0, executing step S35;

[0019] Step S35, extracting feature windows with assigned values ​​of 0 and marking them as edge windows;

[0020] Step S36, extracting abnormal transaction features in each edge window and marking them as edge features;

[0021] Step S37, sequentially connecting adjacent edge features to form the clustering result;

[0022] Step S38, determining whether the current clustering result is highly abnormal, if the current clustering result is highly abnormal, executing step S39;

[0023] Step S39, determining that the current clustering result has completed the definition of a suspicious transaction account.

[0024] Further, in step S33, the current feature and the adjacent features are defined as a feature window, and the assigned values ​​of all features in each feature window are obtained respectively, including:

[0025] Step S331, defining the current feature and twenty-six features adjacent to the current feature as a 3×3×3 feature window;

[0026] Step S332, determining whether there is a feature with a value of 0 in each 3×3×3 feature window, if there is no feature with a value of 0 in the current 3×3×3 feature window, executing step S333;

[0027] Step S333, delete the 3×3×3 feature windows with no feature assigned values ​​of 0.

[0028] Furthermore, step S37, sequentially connecting adjacent edge features to form the clustering result, includes:

[0029] Step S371, obtaining the row and column values ​​of each abnormal transaction feature in the current edge window and establishing a to-be-connected dot matrix for each abnormal transaction feature according to the Kruskal algorithm;

[0030] Step S372, obtaining the minimum spanning tree of each to-be-connected point matrix according to the Kruskal algorithm;

[0031] Step S373, extracting abnormal transaction features in all minimum spanning trees and using them as the clustering results.

[0032] Further, step S7, iteratively updating the real-time positions of all first nodes, all second nodes, and all third nodes through a global optimization algorithm to obtain the maximum value of the sum of the associated weights of all transaction data, and at the same time making the sum of the associated weights the maximum, includes:

[0033] Step S71, according to formula (1), formula (2), and formula (3), at least two first random solutions are assigned to each first node, at least two second random solutions are assigned to each second node, and at least two third random solutions are assigned to each third node, and the result of defining all first random solutions, all second random solutions, and all third random solutions is that the sum of the associated weights of all transaction data reaches the maximum value, and at the same time, all first nodes, all second nodes, and all third nodes are constrained based on the weight balance law;

[0034] Formula (1): ;

[0035] in, are all weighted associated forces received by the a-th first node;

[0036] is the weight-related constant used to adjust the magnitude of the force;

[0037] and are the weights of the n-1th and nth first random solutions of the ath first node respectively;

[0038] is the Euclidean distance between the n-1th and nth first random solutions of the ath first node;

[0039] is the unit vector from the n-1th first random solution to the nth first random solution of the ath first node;

[0040] Formula (2): ;

[0041] in, are all weighted associated forces received by the b-th second node;

[0042] is the weight-related constant used to adjust the magnitude of the force;

[0043] and are the weights of the p-1th and pth second random solutions of the bth second node respectively;

[0044] is the Euclidean distance between the p-1th and pth second random solutions of the bth second node;

[0045] is the unit vector from the p-1th second random solution to the pth second random solution of the bth second node;

[0046] Formula (3): ;

[0047] in, are all weighted associated forces received by the cth third node; is the weight-related constant used to adjust the magnitude of the force; and are the weights of the t-1th and tth third random solutions of the cth third node respectively; is the Euclidean distance between the t-1th and tth third random solutions of the cth third node; is the unit vector from the t-1th third random solution to the tth third random solution of the cth third node;

[0048] Step S72: updating the position and speed of each first random solution, each second random solution, and each third random solution at a preset time interval according to formula (4):

[0049] Formula (4):

[0050] Step S73, iterate a preset number of times according to formula (4) to update each and each ;

[0051] Step S74, determine each Compared with the first difference of the previous iteration, whether it is less than or equal to the first preset adaptation threshold, if so, executing step S75;

[0052] Step S75, determine each Compared with the second difference of the previous iteration, whether it is less than or equal to the second preset adaptation threshold, if so, executing step S76;

[0053] Step S76, determining that the sum of the associated weights of all transaction data reaches the maximum value, and stopping the iteration of formula (4);

[0054] Step S77, obtaining the final positions of all first nodes, all second nodes, and all third nodes after the iteration is completed.

[0055] Further, in step S73, the formula (4) is iterated a preset number of times to update each and each ,include:

[0056] Step S731, optimizing the inertia coefficient once according to formula (5) in each iteration :

[0057] Formula (5): ;

[0058] in: is the inertia coefficient of the jth random solution of the ith node after optimization in the dth step. is the initial inertia coefficient. is the minimum inertia coefficient. is the current iteration number. is the total number of iterations after the iteration is completed.

[0059] Further, step S8, after obtaining all real-time positions when the sum of the associated weights reaches the maximum and defining them as abnormal detection positions of all transaction accounts, all transaction types, and all transaction data, includes:

[0060] Step S10, obtaining the transaction behavior model and performing color fading processing on the area not having the abnormal transaction feature to obtain a highlighted color transaction behavior model;

[0061] Step S20, outputting the abnormal detection positions of all transaction accounts, all transaction types, and all transaction data on the emphasized color transaction behavior model to form a visual anomaly detection model;

[0062] Step S30: output the visual anomaly detection model to an external visualization terminal.

[0063] In a second aspect of the present invention, a transaction anomaly detection device for a financial system is provided, comprising:

[0064] A transaction behavior model building module, used to obtain transaction data of each transaction account in the financial system, and to build a transaction behavior model of the transaction account through a preset strategy;

[0065] An abnormal transaction feature marking module is used to respectively obtain the transaction features of each transaction account in the transaction behavior model, compare the transaction features with a preset normal transaction feature threshold, and mark the transaction features that deviate from the threshold as abnormal transaction features;

[0066] A suspicious transaction account definition module, used to perform cluster analysis on the abnormal transaction features by using a clustering algorithm, and define transaction accounts with a higher degree of abnormality in the clustering results as suspicious transaction accounts;

[0067] A node definition module, used to define each transaction type as a first node with a first weight, define each transaction account as a second node with a second weight, and define each transaction data as a third node with a third weight, and the weight polarity of all first nodes, all second nodes, and all third nodes is the same;

[0068] A node output module, used for outputting all first nodes, all second nodes, and all third nodes to the suspicious transaction account;

[0069] An association weight sum acquisition module, used for initializing the positions of all first nodes, all second nodes, and all third nodes, and acquiring the association weight sum of all first nodes, all second nodes, and all third nodes;

[0070] A real-time location optimization module, used for iteratively updating the real-time locations of all first nodes, all second nodes, and all third nodes through a global optimization algorithm to obtain the maximum value of the sum of associated weights of all transaction data, and at the same time maximize the sum of associated weights;

[0071] The anomaly detection location definition module is used to obtain all real-time locations when the sum of the associated weights reaches the maximum, and define them as anomaly detection locations for all transaction accounts, all transaction types, and all transaction data.

[0072] In a third aspect of the present invention, an electronic device is provided, comprising: at least one processor, a memory and an input-output unit; wherein the memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute any one of the methods described in the first aspect.

[0073] In a fourth aspect of the present invention, a computer-readable storage medium is provided, which includes instructions, and when the instructions are executed on a computer, the computer executes any one of the methods in the first aspect.

[0074] The above-mentioned embodiments of the present invention have at least the following beneficial effects: by establishing a transaction behavior model and analyzing transaction characteristics, the present invention can effectively identify abnormal features that deviate from normal transaction patterns, thereby improving the accuracy of abnormal transaction detection. The method uses a clustering algorithm to conduct an in-depth analysis of abnormal features, and can accurately define transaction accounts with a high degree of abnormality as suspicious accounts, thereby providing a reliable basis for subsequent risk prevention and control. In addition, by optimizing the node position through a global optimization algorithm, the sum of the associated weights of the transaction data can be maximized, further improving the efficiency and accuracy of anomaly detection. This method of comprehensively applying multiple technical means can effectively cope with the complex and changeable transaction environment in the financial system and improve the overall security of the system.

[0075] At the same time, the invention also has good scalability and adaptability, and can be flexibly adjusted and optimized according to different financial systems and transaction data. By visualizing the output of the anomaly detection model, the location and characteristics of abnormal transactions can be intuitively displayed, which is convenient for users to analyze and make decisions. This visual display method not only improves the user experience, but also makes the anomaly detection results easier to understand and apply, providing a powerful tool for risk management and decision support of financial systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] The above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, in which:

[0077] Figure 1 A flowchart of a transaction anomaly detection method for a financial system provided by an embodiment of the present invention;

[0078] Figure 2 A schematic diagram of the structure of a transaction anomaly detection device for a financial system provided by an embodiment of the present invention;

[0079] Figure 3 The schematic diagram schematically shows the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0080] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present invention more thorough and complete, and to fully convey the scope of the present invention to those skilled in the art.

[0081] Those skilled in the art know that the embodiments of the present invention can be implemented as a system, device, apparatus, method or computer program product. Therefore, the present invention can be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0082] It should be noted that any number of elements in the drawings is for illustration rather than limitation, and any naming is only for distinction and does not have any limiting meaning.

[0083] Reference below Figure 1 , Figure 1 The flowchart of the transaction anomaly detection method for a financial system provided by one embodiment of the present invention is as follows. Figure 1 As shown, a transaction anomaly detection method 100 for a financial system includes:

[0084] Step S1, obtaining transaction data of each transaction account in the financial system, and establishing a transaction behavior model of the transaction account through a preset strategy;

[0085] Step S2, respectively obtaining the transaction features of each transaction account in the transaction behavior model, and comparing the transaction features with a preset normal transaction feature threshold, and marking the transaction features that deviate from the threshold as abnormal transaction features;

[0086] Step S3, performing cluster analysis on the abnormal transaction features by using a clustering algorithm, and defining transaction accounts with a higher degree of abnormality in the clustering results as suspicious transaction accounts;

[0087] Step S4, defining each transaction type as a first node with a first weight, defining each transaction account as a second node with a second weight, and defining each transaction data as a third node with a third weight, and the weight polarities of all first nodes, all second nodes, and all third nodes are the same;

[0088] Step S5, outputting all first nodes, all second nodes, and all third nodes to the suspicious transaction account;

[0089] Step S6, initializing the positions of all first nodes, all second nodes, and all third nodes, and obtaining the sum of the associated weights of all first nodes, all second nodes, and all third nodes;

[0090] Step S7, iteratively updating the real-time positions of all first nodes, all second nodes, and all third nodes through a global optimization algorithm to obtain the maximum value of the sum of the associated weights of all transaction data, and at the same time maximize the sum of the associated weights;

[0091] Step S8, obtaining all real-time positions when the sum of the associated weights reaches the maximum, and defining them as abnormal detection positions for all transaction accounts, all transaction types, and all transaction data.

[0092] It should be noted that the present invention relates to a transaction anomaly detection method for a financial system. The core of the method is to identify abnormal transaction behaviors by analyzing transaction data, thereby improving the security of the financial system. Transaction accounts refer to various accounts for fund transactions in the financial system, and transaction types include various transaction forms, such as transfers, payments, etc. Transaction data refers to all information related to these transactions, including transaction amounts, time, location, etc. By establishing a transaction behavior model, the normal transaction pattern of each account can be described and predicted, thereby providing a basis for the detection of abnormal transactions.

[0093] Specifically, the establishment of a transaction behavior model can be achieved by analyzing historical transaction data to extract the transaction characteristics of each account, such as transaction frequency, amount range, transaction object, etc. These characteristics can be modeled through statistical methods or machine learning algorithms to form a model that can describe the normal transaction behavior of the account. For example, algorithms such as decision trees and support vector machines can be used to build models. These algorithms can learn the normal transaction patterns of accounts based on historical data and predict future transaction behaviors. Preset strategies refer to specific rules and methods used in the model building process, such as setting thresholds for transaction frequency, ranges for transaction amounts, etc., in order to more accurately identify abnormal transaction characteristics.

[0094] Preferably, in step S2, the comparison between the transaction feature and the preset normal transaction feature threshold can be achieved by setting a specific value range. For example, the normal transaction frequency of an account can be set to no more than 10 times a day, the transaction amount can be set to no more than 1,000 yuan, etc. When the transaction feature of an account exceeds these thresholds, it can be marked as an abnormal transaction feature.

[0095] Furthermore, in step S3, the selection of clustering algorithms can be diversified. In addition to the common K-means algorithm, DBSCAN, hierarchical clustering and other algorithms can also be used to adapt to different data characteristics and requirements. These algorithms can group accounts according to the similarity of transaction characteristics, thereby more accurately identifying suspicious transaction accounts with a high degree of abnormality.

[0096] In some embodiments, step S3, clustering analysis is performed on the abnormal transaction features by using a clustering algorithm, and a transaction account with a higher degree of abnormality in the clustering result is defined as a suspicious transaction account, including:

[0097] Step S31, establishing a feature set in the abnormal transaction features, and assigning a value of 0 to each feature in the feature set, wherein the dimension of each feature is less than or equal to the feature dimension of each transaction account;

[0098] Step S32, determining whether the abnormal transaction feature exists in each feature, and assigning a value of 1 to the feature that has the abnormal transaction feature;

[0099] Step S33, defining the current feature and adjacent features as a feature window, and obtaining the assigned values ​​of all features in each feature window respectively;

[0100] Step S34, determining whether there is a feature in each feature window whose assigned value is 0, if there is a feature in the current feature window whose assigned value is 0, executing step S35;

[0101] Step S35, extracting feature windows with assigned values ​​of 0 and marking them as edge windows;

[0102] Step S36, extracting abnormal transaction features in each edge window and marking them as edge features;

[0103] Step S37, sequentially connecting adjacent edge features to form the clustering result;

[0104] Step S38, determining whether the current clustering result is highly abnormal, if the current clustering result is highly abnormal, executing step S39;

[0105] Step S39, determining that the current clustering result has completed the definition of a suspicious transaction account.

[0106] It should be noted that the cluster analysis mentioned in the present invention is a key step for identifying abnormal transaction features. Cluster analysis is an unsupervised learning method that groups objects in a data set according to similarity so that objects in the same group have high similarity, while objects in different groups have low similarity. In the present invention, cluster analysis is used to classify abnormal transaction features, thereby identifying transaction accounts with a high degree of abnormality. A feature set refers to a set of features extracted from transaction data, each feature representing a specific transaction attribute, such as transaction amount, transaction time, transaction frequency, etc. Through cluster analysis, accounts with similar abnormal features can be clustered together, thereby more accurately identifying suspicious transaction accounts.

[0107] Specifically, each feature in the feature set may be assigned an initial value, such as 0, indicating that the feature does not contain abnormal information in the initial state. When a transaction feature is detected to deviate from the normal range, the value of the feature may be updated to 1, indicating that the feature is abnormal.

[0108] More specifically, feature dimension refers to the number of features in a feature set, which is usually determined based on the complexity of the transaction data and the analysis requirements. For example, a simple transaction feature set may only contain two dimensions, transaction amount and transaction frequency, while a more complex feature set may contain more dimensions, such as transaction location, transaction object, etc. The feature window refers to an area where the current feature and its adjacent features are combined for analysis during cluster analysis, and its size can be adjusted according to actual needs.

[0109] Preferably, in step S33, the feature window can be defined in different ways. For example, in addition to the 3×3×3 feature window, feature windows of other shapes and sizes, such as 2×2×2 or 4×4×4, etc., can be selected according to the distribution of actual data and the correlation of features. In addition, in step S37, when connecting adjacent edge features to form clustering results, different algorithms can be used to optimize the clustering effect. For example, in addition to the Kruskal algorithm, the Prim algorithm or other minimum spanning tree algorithms can be used to construct clustering results, thereby improving the accuracy and efficiency of clustering.

[0110] In some embodiments, step S33 defines the current feature and the adjacent features as a feature window, and obtains the assigned values ​​of all features in each feature window respectively, including:

[0111] Step S331, defining the current feature and twenty-six features adjacent to the current feature as a 3×3×3 feature window;

[0112] Step S332, determining whether there is a feature with a value of 0 in each 3×3×3 feature window, if there is no feature with a value of 0 in the current 3×3×3 feature window, executing step S333;

[0113] Step S333, delete the 3×3×3 feature windows with no feature assigned values ​​of 0.

[0114] It should be noted that the definition of the feature window is an important step in cluster analysis, which is used to determine the scope and object of the analysis. In the present invention, the feature window is defined as a 3×3×3 cube structure, which contains the current feature and its 26 adjacent features. This structure can help identify transaction data that are spatially adjacent and have similar features, thereby providing a basis for subsequent cluster analysis. The size and shape of the feature window can be adjusted according to the distribution of actual data and analysis requirements to better capture abnormal patterns in the data.

[0115] Specifically, each feature in the feature window can be a multidimensional vector containing multiple transaction attributes, such as transaction amount, transaction frequency, transaction time, etc. When defining the feature window, the spatial relationship and correlation between features need to be considered. For example, the transaction amount can be used as one dimension of the feature window, the transaction frequency can be used as another dimension, and so on.

[0116] More specifically, the size of the feature window is 3×3×3, which means that in each dimension, the current feature and the two features before and after it are included. In this way, abnormal feature combinations that appear simultaneously in multiple dimensions can be captured, thereby improving the accuracy of clustering analysis.

[0117] Preferably, in step S332, when determining whether there is a feature in the feature window with an assigned value of 0, a more efficient algorithm can be used to increase the calculation speed. For example, parallel computing technology can be used to determine multiple feature windows at the same time, thereby reducing the calculation time.

[0118] Furthermore, in step S333, when deleting feature windows with no feature value of 0, some windows with potential abnormal features may be retained for further verification and analysis in subsequent analysis. This can avoid missing some important abnormal information due to premature deletion of some feature windows.

[0119] In some embodiments, step S37, sequentially connecting adjacent edge features to form the clustering result, includes:

[0120] Step S371, obtaining the row and column values ​​of each abnormal transaction feature in the current edge window and establishing a to-be-connected dot matrix for each abnormal transaction feature according to the Kruskal algorithm;

[0121] Step S372, obtaining the minimum spanning tree of each to-be-connected point matrix according to the Kruskal algorithm;

[0122] Step S373, extracting abnormal transaction features in all minimum spanning trees and using them as the clustering results.

[0123] It should be noted that the Kruskal algorithm mentioned in the present invention is a classic algorithm for constructing a minimum spanning tree. A minimum spanning tree refers to a tree that connects all vertices and has the smallest total weight of edges in a weighted graph. In the context of transaction anomaly detection, the Kruskal algorithm is used to connect adjacent edge features to form a clustering result. Edge features refer to features marked as abnormal in a feature window, and an edge window is a feature window containing these edge features. By constructing a minimum spanning tree, trading accounts with similar abnormal features can be effectively identified, thereby improving the accuracy and efficiency of clustering analysis.

[0124] Specifically, the implementation of the Kruskal algorithm first requires sorting all possible feature connections, usually by the weight or distance of the connection. In transaction anomaly detection, the weight of the connection can be the similarity or distance between transaction features. The algorithm starts with the connection with the smallest weight and gradually adds it to the minimum spanning tree while ensuring that no loops are formed. For example, if the transaction features between two trading accounts have a high similarity, the connection weight between them is smaller and is added to the minimum spanning tree first. In this way, a minimum spanning tree containing all edge features can be gradually constructed to form a clustering result.

[0125] Preferably, when using the Kruskal algorithm, the algorithm can be optimized to meet the processing requirements of large-scale data. For example, parallel computing technology can be used to process multiple feature connections at the same time, thereby improving the calculation speed of the algorithm.

[0126] Furthermore, other minimum spanning tree algorithms may be considered as alternatives, such as Prim's algorithm or Boruvka's algorithm, which may have higher efficiency or be more suitable for specific data structures and distribution characteristics in some cases.

[0127] In some embodiments, step S7, iteratively updating the real-time positions of all first nodes, all second nodes, and all third nodes through a global optimization algorithm to obtain the maximum value of the sum of the associated weights of all transaction data, and at the same time maximizing the sum of the associated weights, includes:

[0128] Step S71, according to formula (1), formula (2), and formula (3), at least two first random solutions are assigned to each first node, at least two second random solutions are assigned to each second node, and at least two third random solutions are assigned to each third node, and the result of defining all first random solutions, all second random solutions, and all third random solutions is that the sum of the associated weights of all transaction data reaches the maximum value, and at the same time, all first nodes, all second nodes, and all third nodes are constrained based on the weight balance law;

[0129] Formula (1): ;

[0130] in, are all weighted associated forces received by the a-th first node;

[0131] is the weight-related constant used to adjust the magnitude of the force;

[0132] and are the weights of the n-1th and nth first random solutions of the ath first node respectively;

[0133] is the Euclidean distance between the n-1th and nth first random solutions of the ath first node;

[0134] is the unit vector from the n-1th first random solution to the nth first random solution of the ath first node;

[0135] Formula (2): ;

[0136] in, are all weighted associated forces received by the b-th second node;

[0137] is the weight-related constant used to adjust the magnitude of the force;

[0138] and are the weights of the p-1th and pth second random solutions of the bth second node respectively;

[0139] is the Euclidean distance between the p-1th and pth second random solutions of the bth second node;

[0140] is the unit vector from the p-1th second random solution to the pth second random solution of the bth second node;

[0141] Formula (3): ;

[0142] in, are all weighted associated forces received by the cth third node; is the weight-related constant used to adjust the magnitude of the force; and are the weights of the t-1th and tth third random solutions of the cth third node respectively; is the Euclidean distance between the t-1th and tth third random solutions of the cth third node; is the unit vector from the t-1th third random solution to the tth third random solution of the cth third node;

[0143] Step S72: updating the position and speed of each first random solution, each second random solution, and each third random solution at a preset time interval according to formula (4):

[0144] Formula (4):

[0145] Step S73, iterate a preset number of times according to formula (4) to update each and each ;

[0146] Step S74, determine each Compared with the first difference of the previous iteration, whether it is less than or equal to the first preset adaptation threshold, if so, executing step S75;

[0147] Step S75, determine each Compared with the second difference of the previous iteration, whether it is less than or equal to the second preset adaptation threshold, if so, executing step S76;

[0148] Step S76, determining that the sum of the associated weights of all transaction data reaches the maximum value, and stopping the iteration of formula (4);

[0149] Step S77, obtaining the final positions of all first nodes, all second nodes, and all third nodes after the iteration is completed.

[0150] It should be noted that the global optimization algorithm is used in the present invention to optimize the sum of the associated weights of transaction data to determine the best position for anomaly detection. The global optimization algorithm is an algorithm that can find the optimal solution in the entire solution space, and is usually used to solve complex optimization problems. In transaction anomaly detection, by iteratively updating the transaction type, account, and data node position, the sum of the associated weights can reach the maximum value, thereby more accurately identifying abnormal transactions. Weight association force refers to the interaction force between nodes due to weight differences, and its size is determined by the weight association constant and the weight difference between nodes. The inertia coefficient is used to control the movement speed and direction of the node during the iteration process, and is usually gradually reduced during the iteration process to improve the convergence speed and accuracy of the algorithm.

[0151] Specifically, the implementation of the global optimization algorithm first requires initializing the positions and velocities of all nodes. For example, the initial position of each node can be randomly generated, and an initial velocity can be set. Then, according to the weighted force formula, the force on each node is calculated, and the velocity and position of the node are updated according to these forces. The initial value of the inertia coefficient can be set according to the scale and complexity of the problem, usually between 0.4 and 0.9.

[0152] More specifically, in each iteration, the inertia coefficient is gradually reduced according to the formula to reduce the random movement of the node and make it closer to the optimal solution. In addition, other parameters such as learning factors can be introduced to adjust the speed and direction of the node moving towards the optimal solution.

[0153] Preferably, during the iteration process, the update formula of the inertia coefficient can be optimized to improve the convergence speed and accuracy of the algorithm. For example, a dynamic adjustment strategy can be adopted to flexibly adjust the value of the inertia coefficient according to the current number of iterations and the movement of the node.

[0154] Furthermore, other global optimization algorithms can be considered as alternatives, such as particle swarm optimization algorithm or genetic algorithm, which may have higher efficiency or be more suitable for specific optimization problems in some cases.

[0155] In some embodiments, step S73, iterates a preset number of times according to formula (4) to update each and each ,include:

[0156] Step S731, optimizing the inertia coefficient once according to formula (5) in each iteration :

[0157] Formula (5): ;

[0158] in: is the inertia coefficient of the jth random solution of the ith node after optimization in the dth step. is the initial inertia coefficient. is the minimum inertia coefficient. is the current iteration number. is the total number of iterations after the iteration is completed.

[0159] It should be noted that the optimization of the inertia coefficient during the iteration process is an important part of the global optimization algorithm. The inertia coefficient determines the moving speed and direction of the node in the search space. Its optimization can improve the search efficiency of the algorithm and the quality of the solution. In the present invention, the optimization of the inertia coefficient is achieved through a specific formula, which dynamically adjusts the value of the inertia coefficient according to the current number of iterations and the total number of iterations. The initial inertia coefficient and the minimum inertia coefficient are two key parameters. The initial inertia coefficient is usually set to a larger value so that extensive exploration can be carried out in the early stage of the search, while the minimum inertia coefficient is set to a smaller value to ensure that a detailed search can be carried out in the later stage of the search to find the optimal solution.

[0160] Specifically, the initial inertia coefficient can be set according to the complexity of the problem and the size of the search space, and the general value range is between 0.8 and 1.2. The minimum inertia coefficient is usually set to a smaller value, such as between 0.2 and 0.4, to ensure that the search range can be gradually reduced in the later stages of the iteration to improve the search accuracy. The current number of iterations refers to the number of iterations that have been completed when the algorithm executes to the current step, and the total number of iterations is the upper limit of the number of iterations predetermined by the algorithm. These two parameters are determined at the beginning of the algorithm. The inertia coefficient calculated by the formula will be used to update the speed and position of the node, thereby guiding the direction and speed of movement of the node in the search space.

[0161] Preferably, the update formula of the inertia coefficient can be further optimized, for example, by introducing a nonlinear adjustment mechanism to make the change of the inertia coefficient smoother and more adaptable. In addition, other forms of inertia coefficient adjustment strategies can be selected according to the characteristics and needs of the actual problem, such as an adjustment strategy based on the fitness value, which dynamically adjusts the inertia coefficient according to the current fitness value of the node to better balance the capabilities of global search and local search. This flexible adjustment method can further improve the performance and adaptability of the algorithm.

[0162] In some embodiments, step S8, after obtaining all real-time positions when the sum of the association weights reaches the maximum and defining them as abnormal detection positions for all transaction accounts, all transaction types, and all transaction data, includes:

[0163] Step S10, obtaining the transaction behavior model and performing color fading processing on the area not having the abnormal transaction feature to obtain a highlighted color transaction behavior model;

[0164] Step S20, outputting the abnormal detection positions of all transaction accounts, all transaction types, and all transaction data on the emphasized color transaction behavior model to form a visual anomaly detection model;

[0165] Step S30: output the visual anomaly detection model to an external visualization terminal.

[0166] It should be noted that obtaining all real-time positions when the sum of associated weights reaches the maximum and defining them as anomaly detection positions is a key step in realizing anomaly detection in the present invention. The sum of associated weights refers to the sum of the associated weights between all nodes in the global optimization algorithm, which reflects the degree of association between transaction data. By maximizing the sum of associated weights, the best detection position for abnormal behavior in transaction data can be found. The anomaly detection position refers to the position of each node in the transaction data when the sum of associated weights reaches the maximum value, and these positions can be used to identify and locate abnormal transaction behavior.

[0167] Specifically, the calculation of the sum of the association weights needs to be performed based on the weight relationship between the nodes. For example, a weight association force formula can be set between each node, and the association weight can be determined by calculating the distance and weight difference between the nodes. During the iteration process of the global optimization algorithm, the position and speed of the nodes are continuously updated to adjust the association weights between the nodes. When the sum of the association weights reaches the maximum value, the real-time positions of all nodes at this time are recorded, and these positions are the anomaly detection positions.

[0168] More specifically, an adaptation threshold may be set to determine whether the sum of the associated weights has reached a maximum value. For example, when the change in the sum of the associated weights in several consecutive iterations is less than a preset threshold, it can be considered that the maximum value has been reached.

[0169] Preferably, after obtaining the abnormal detection position, the transaction behavior model can be further processed to improve the visualization effect and accuracy of the abnormal detection. For example, in step S10, the area of ​​non-abnormal transaction features is faded, and different colors or transparencies can be used to distinguish abnormal and normal transaction features.

[0170] Furthermore, in step S20, when the abnormal detection position is output to the visualization model, different graphics or marks can be used to represent different transaction types and accounts, so that the user can more intuitively identify abnormal transactions. In addition, the visualization abnormality detection model can also be output to an external visualization terminal, such as a computer screen or a mobile device, so that the user can monitor and analyze in real time.

[0171] The above-mentioned embodiments of the present invention have the following beneficial effects: First, by acquiring the transaction data of each transaction account in the financial system and establishing a transaction behavior model, the normal transaction pattern of each account can be accurately captured. Combined with the preset strategy, the method can effectively identify transaction features that deviate from the normal pattern and mark them as abnormal transaction features, thereby providing a reliable basis for subsequent anomaly detection. In addition, by analyzing the abnormal transaction features using a clustering algorithm, transaction accounts with a high degree of abnormality can be accurately defined as suspicious transaction accounts, further improving the accuracy and effectiveness of anomaly detection. In this way, the system can promptly detect potential risk transactions and provide a strong guarantee for the safe operation of the financial system.

[0172] Secondly, the node definition and application of the global optimization algorithm proposed in the claims make the method more efficient and accurate when processing large-scale transaction data. By defining transaction types, accounts, and data as nodes with different weights, and iteratively updating the node positions using the global optimization algorithm, the sum of the associated weights of the transaction data can be maximized, thereby more accurately determining the anomaly detection location. This method not only improves the efficiency of anomaly detection, but also can adapt to complex transaction environments and changing risk characteristics, enhancing the robustness and adaptability of the system. In addition, by visualizing the output of the anomaly detection model, users can intuitively understand the location and characteristics of abnormal transactions, facilitate analysis and decision-making, and further enhance the user experience and application value of the system.

[0173] like Figure 2 As shown, in some embodiments, a transaction anomaly detection device 200 for a financial system includes:

[0174] The transaction behavior model building module 201 is used to obtain the transaction data of each transaction account in the financial system and build a transaction behavior model of the transaction account through a preset strategy;

[0175] The abnormal transaction feature marking module 202 is used to respectively obtain the transaction features of each transaction account in the transaction behavior model, compare the transaction features with a preset normal transaction feature threshold, and mark the transaction features that deviate from the threshold as abnormal transaction features;

[0176] A suspicious transaction account definition module 203 is used to perform cluster analysis on the abnormal transaction features by using a clustering algorithm, and define transaction accounts with a higher degree of abnormality in the clustering results as suspicious transaction accounts;

[0177] A node definition module 204, used to define each transaction type as a first node with a first weight, define each transaction account as a second node with a second weight, and define each transaction data as a third node with a third weight, and the weight polarity of all first nodes, all second nodes, and all third nodes is the same;

[0178] A node output module 205, configured to output all first nodes, all second nodes, and all third nodes to the suspicious transaction account;

[0179] The association weight sum acquisition module 206 is used to initialize the positions of all first nodes, all second nodes, and all third nodes, and acquire the association weight sum of all first nodes, all second nodes, and all third nodes;

[0180] A real-time location optimization module 207, used for iteratively updating the real-time locations of all first nodes, all second nodes, and all third nodes through a global optimization algorithm to obtain the maximum value of the sum of associated weights of all transaction data, and at the same time maximize the sum of associated weights;

[0181] The abnormal detection location definition module 208 is used to obtain all real-time locations when the sum of the associated weights reaches the maximum, and define them as abnormal detection locations for all transaction accounts, all transaction types, and all transaction data.

[0182] It is understandable that the modules described in the transaction anomaly detection device 200 for a financial system are similar to those described in the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the transaction anomaly detection method for a financial system are also applicable to the transaction anomaly detection device 200 for a financial system and the modules contained therein, and will not be described in detail here.

[0183] Reference below Figure 3 , which shows a schematic diagram of a structure 300 of an electronic device suitable for implementing some embodiments of the present invention. The electronic devices in some embodiments of the present invention may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0184] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 to a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0185] Typically, the following devices may be connected to the I / O interface 305: an input device 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 308 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 309. The communication device 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0186] Furthermore, the storage medium of the embodiment of the present application stores program instructions that can implement all the above methods, wherein the program instructions can be stored in the above storage medium in the form of a software product, including several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or terminal devices such as a computer, a server, a mobile phone, and a tablet.

[0187] The above descriptions are only some preferred embodiments of the present invention and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present invention is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above inventive concept. For example, the above features are replaced with (but not limited to) technical features with similar functions disclosed in the embodiments of the present invention.

Claims

1. A transaction anomaly detection method for a financial system, wherein the financial system includes a plurality of transaction accounts, a plurality of transaction types, and a plurality of transaction data, characterized in that: The detection method comprises: Step S1, obtaining transaction data of each transaction account in the financial system, and establishing a transaction behavior model of the transaction account through a preset strategy; Step S2, respectively obtaining the transaction features of each transaction account in the transaction behavior model, and comparing the transaction features with a preset normal transaction feature threshold, and marking the transaction features that deviate from the threshold as abnormal transaction features; Step S3, performing cluster analysis on the abnormal transaction features by using a clustering algorithm; comprising: Step S31, establishing a feature set in the abnormal transaction features, and assigning a value of 0 to each feature in the feature set, wherein the dimension of each feature is less than or equal to the feature dimension of each transaction account; Step S32, determining whether the abnormal transaction feature exists in each feature, and assigning a value of 1 to the feature that has the abnormal transaction feature; Step S33, defining the current feature and the adjacent features as a feature window, and obtaining the assigned values ​​of all features in each feature window respectively; including: Step S331, defining the current feature and twenty-six features adjacent to the current feature as a 3×3×3 feature window; Step S332, determining whether there is a feature with a value of 0 in each 3×3×3 feature window, if there is no feature with a value of 0 in the current 3×3×3 feature window, executing step S333; Step S333, deleting the 3×3×3 feature window with no feature and assigned a value of 0; Step S34, determining whether there is a feature in each feature window whose assigned value is 0, if there is a feature in the current feature window whose assigned value is 0, executing step S35; Step S35, extracting feature windows with assigned values ​​of 0 and marking them as edge windows; Step S36, extracting abnormal transaction features in each edge window and marking them as edge features; Step S37, sequentially connecting adjacent edge features to form a clustering result; Step S38, determining whether the current clustering result is highly abnormal, if the current clustering result is highly abnormal, executing step S39; Step S39, determining that the current clustering result has completed the definition of a suspicious transaction account; Step S4, defining each transaction type as a first node with a first weight, defining each transaction account as a second node with a second weight, and defining each transaction data as a third node with a third weight, and the weight polarities of all first nodes, all second nodes, and all third nodes are the same; Step S5, outputting all first nodes, all second nodes, and all third nodes to the suspicious transaction account; Step S6, initializing the positions of all first nodes, all second nodes, and all third nodes, and obtaining the sum of the associated weights of all first nodes, all second nodes, and all third nodes; Step S7, iteratively updating the real-time positions of all first nodes, all second nodes, and all third nodes through a global optimization algorithm to obtain the maximum value of the sum of the associated weights of all transaction data, and at the same time maximize the sum of the associated weights; Step S8, obtaining all real-time positions when the sum of the associated weights reaches the maximum, and defining them as abnormal detection positions for all transaction accounts, all transaction types, and all transaction data.

2. The detection method according to claim 1, characterized in that: Step S37, sequentially connecting adjacent edge features to form the clustering result, includes: Step S371, obtaining the row and column values ​​of each abnormal transaction feature in the current edge window and establishing a to-be-connected dot matrix for each abnormal transaction feature according to the Kruskal algorithm; Step S372, obtaining the minimum spanning tree of each to-be-connected point matrix according to the Kruskal algorithm; Step S373, extracting abnormal transaction features in all minimum spanning trees and using them as the clustering results.

3. The detection method according to claim 1, characterized in that: Step S7, iteratively updating the real-time positions of all first nodes, all second nodes, and all third nodes through a global optimization algorithm to obtain the maximum value of the sum of the associated weights of all transaction data, and at the same time making the sum of the associated weights the maximum, including: Step S71, according to formula (1), formula (2), and formula (3), at least two first random solutions are assigned to each first node, at least two second random solutions are assigned to each second node, and at least two third random solutions are assigned to each third node, and the result of defining all first random solutions, all second random solutions, and all third random solutions is that the sum of the associated weights of all transaction data reaches the maximum value, and at the same time, all first nodes, all second nodes, and all third nodes are constrained based on the weight balance law; Formula (1): ; in, are all weighted associated forces received by the a-th first node; is the weight-related constant used to adjust the magnitude of the force; and are the weights of the n-1th and nth first random solutions of the ath first node respectively; is the Euclidean distance between the n-1th and nth first random solutions of the ath first node; is the unit vector from the n-1th first random solution to the nth first random solution of the ath first node; Formula (2): ; in, are all weighted associated forces received by the b-th second node; is the weight-related constant used to adjust the magnitude of the force; and are the weights of the p-1th and pth second random solutions of the bth second node respectively; is the Euclidean distance between the p-1th and pth second random solutions of the bth second node; is the unit vector from the p-1th second random solution to the pth second random solution of the bth second node; Formula (3): ; in, are all weighted associated forces received by the cth third node; is the weight-related constant used to adjust the magnitude of the force; and are the weights of the t-1th and tth third random solutions of the cth third node respectively; is the Euclidean distance between the t-1th and tth third random solutions of the cth third node; is the unit vector from the t-1th third random solution to the tth third random solution of the cth third node; Step S72: updating the position and speed of each first random solution, each second random solution, and each third random solution at a preset time interval according to formula (4): Formula (4): ; in, is the position of the node at the dth iteration for the i-th transaction type, the j-th transaction account; is the position of the node at the d-1th iteration for the i-th transaction type, the j-th transaction account; is the speed of the node at the d-1th iteration for the i-th transaction type, the j-th transaction account; , is the acceleration constant; is the individual optimal position of the i-th transaction type and the j-th trading account; is the current position of the jth trading account for the i-th trading type; is the global optimal position of the i-th transaction type and the j-th transaction account; is the coefficient of inertia; Step S73, iterate a preset number of times according to formula (4) to update each and each ; Step S74, determine each Compared with the first difference of the previous iteration, whether it is less than or equal to the first preset adaptation threshold, if so, executing step S75; Step S75, determine each Compared with the second difference of the previous iteration, whether it is less than or equal to the second preset adaptation threshold, if so, executing step S76; Step S76, determining that the sum of the associated weights of all transaction data reaches the maximum value, and stopping the iteration of formula (4); Step S77, obtaining the final positions of all first nodes, all second nodes, and all third nodes after the iteration is completed.

4. The detection method according to claim 3, characterized in that: Step S73, iterate a preset number of times according to formula (4) to update each and each ,include: Step S731, optimize the inertia coefficient once according to formula (5) in each iteration : Formula (5): ; in: is the inertia coefficient of the jth random solution of the ith node after optimization in the dth step, is the initial inertia coefficient, is the minimum inertia coefficient, is the current iteration number, is the total number of iterations after the iteration is completed.

5. The detection method according to claim 1, characterized in that: Step S8, after obtaining all real-time positions when the sum of the associated weights reaches the maximum and defining them as abnormal detection positions of all transaction accounts, all transaction types, and all transaction data, includes: Step S10, obtaining the transaction behavior model and performing color fading processing on the area not having the abnormal transaction feature to obtain a highlighted color transaction behavior model; Step S20, outputting the abnormal detection positions of all transaction accounts, all transaction types, and all transaction data on the emphasized color transaction behavior model to form a visual anomaly detection model; Step S30: output the visual anomaly detection model to an external visualization terminal.

6. A transaction anomaly detection device for a financial system, the detection device being applied to the detection method according to any one of claims 1 to 5, characterized in that: The detection device comprises: A transaction behavior model building module, used to obtain transaction data of each transaction account in the financial system, and to build a transaction behavior model of the transaction account through a preset strategy; An abnormal transaction feature marking module is used to respectively obtain the transaction features of each transaction account in the transaction behavior model, compare the transaction features with a preset normal transaction feature threshold, and mark the transaction features that deviate from the threshold as abnormal transaction features; A suspicious transaction account definition module, used for performing cluster analysis on the abnormal transaction features by using a clustering algorithm; include: Step S31, establishing a feature set in the abnormal transaction features, and assigning a value of 0 to each feature in the feature set, wherein the dimension of each feature is less than or equal to the feature dimension of each transaction account; Step S32, determining whether the abnormal transaction feature exists in each feature, and assigning a value of 1 to the feature that has the abnormal transaction feature; Step S33, defining the current feature and the adjacent features as a feature window, and obtaining the assigned values ​​of all features in each feature window respectively; including: Step S331, defining the current feature and twenty-six features adjacent to the current feature as a 3×3×3 feature window; Step S332, determining whether there is a feature with a value of 0 in each 3×3×3 feature window, if there is no feature with a value of 0 in the current 3×3×3 feature window, executing step S333; Step S333, deleting the 3×3×3 feature window with no feature and assigned a value of 0; Step S34, determining whether there is a feature in each feature window whose assigned value is 0, if there is a feature in the current feature window whose assigned value is 0, executing step S35; Step S35, extracting feature windows with assigned values ​​of 0 and marking them as edge windows; Step S36, extracting abnormal transaction features in each edge window and marking them as edge features; Step S37, sequentially connecting adjacent edge features to form the clustering result; Step S38, determining whether the current clustering result is highly abnormal, if the current clustering result is highly abnormal, executing step S39; Step S39, determining that the current clustering result has completed the definition of a suspicious transaction account; A node definition module, used to define each transaction type as a first node with a first weight, define each transaction account as a second node with a second weight, and define each transaction data as a third node with a third weight, and the weight polarity of all first nodes, all second nodes, and all third nodes is the same; A node output module, used for outputting all first nodes, all second nodes, and all third nodes to the suspicious transaction account; An association weight sum acquisition module, used for initializing the positions of all first nodes, all second nodes, and all third nodes, and acquiring the association weight sum of all first nodes, all second nodes, and all third nodes; A real-time location optimization module, used for iteratively updating the real-time locations of all first nodes, all second nodes, and all third nodes through a global optimization algorithm to obtain the maximum value of the sum of associated weights of all transaction data, and at the same time maximize the sum of associated weights; The anomaly detection location definition module is used to obtain all real-time locations when the sum of the associated weights reaches the maximum, and define them as anomaly detection locations for all transaction accounts, all transaction types, and all transaction data.

7. An electronic device, characterized in that: It includes a processor and a memory coupled to the processor, wherein the memory stores program instructions that can be executed by the processor; when the processor executes the program instructions stored in the memory, the detection method according to any one of claims 1 to 5 is implemented.

8. A storage medium, characterized in that: The storage medium stores program instructions, and when the program instructions are executed by the processor, the detection method according to any one of claims 1 to 5 can be implemented.

Images