Neural network-based abnormal water flow detection method, apparatus and device, and medium

Abstract

The invention relates to the field of artificial intelligence, and discloses an abnormal flow detection method and device based on a neural network, equipment and a medium, and the method comprises the steps: obtaining flow data of an order, preprocessing the flow data, carrying out the abnormal flow pre-training of a pre-constructed neural network model, and generating an abnormal flow model; and inputting the running water data into the abnormal running water model, identifying the abnormal running water data by the abnormal running water model, and storing the abnormal running water data into an abnormal running water data table pre-established in a database, thereby solving the problem that abnormal running water often occurs during settlement at present, and the settlement time is shortened. The technical problems of long time consumption and low efficiency caused by manual auditing in the settlement process due to the fact that manual auditing needs to be carried out in the settlement process, such as Japanese pulling, abnormal settlement amount, wrong merchant information and the like, in the prior art are solved.

Description

Technical Field

[0001] The present invention relates to the fields of artificial intelligence technology and financial technology, and in particular to a method, device, equipment and medium for detecting abnormal water flow based on a neural network. Background Art

[0002] Settlement records usually refer to the records of the inflow and outflow of funds in a bank account within a certain period of time. It records in detail the date, amount, account information of both parties of each transaction, etc. In the financial and legal fields, settlement records have different meanings and applications. In the financial field, settlement records are detailed records of daily inflows and outflows of bank accounts, reflecting the flow of funds of account holders, and are an important basis for banks, individuals or other financial institutions to conduct financial analysis and risk assessment. It can help understand the financial strength and liquidity of institutions, reveal business models and operating strategies, and assess risk levels.

[0003] In the mall system, the settlement flow is an important basis for paying suppliers. It records the detailed information of each transaction between merchants and consumers, including transaction amount, time, payment method, etc. The settlement flow involves many aspects, including payment system design and implementation, clearing and settlement process, technical architecture, etc. Payment system design and implementation: The payment system is a core component of the mall. It not only needs to process user payment requests, but also interact with banks or third-party payment platforms to ensure the smooth completion of transactions. The design of the payment system needs to consider performance, security, availability and scalability. Clearing and settlement process: The clearing and settlement process is an important part of the payment system, which includes clearing and settlement. Clearing refers to the calculation of the creditor's rights and debts between the two parties to the transaction, while settlement refers to the actual transfer of funds based on the clearing results. In the mall system, the settlement flow records the clearing information of each transaction and provides a basis for the final settlement of funds. For example, the membership system manages user information, the payment core processes payment requests, the accounting core records accounting data, and the clearing core performs the clearing and settlement of funds. Reconciliation mechanism: In order to ensure the accuracy and consistency of transaction data, the mall system needs to reconcile with the payment channel. The reconciliation mechanism includes collection reconciliation and payment reconciliation to ensure that all transactions are accurately recorded. The automatic reconciliation system can improve the efficiency and accuracy of reconciliation. By connecting with the systems of financial institutions and payment institutions, it can obtain transaction data in real time and automatically compare it with the financial records of the mall system.

[0004] In the mall system, the handling of abnormal settlement transactions is a complex and important process. It not only involves financial accuracy but may also affect the interests of merchants and consumers. Reasons for abnormal transactions: Wool-pulling behavior: Some users may take advantage of system loopholes or promotional activities to conduct false or repeated transactions to obtain improper benefits. Abnormal settlement amount: It may be due to system errors, network delays, or problems with third-party payment platforms, resulting in a mismatch between the actual settlement amount and the expected amount. Incorrect merchant information: Incorrect or untimely updated merchant information may lead to information mismatch during settlement, affecting the settlement process.

[0005] Therefore, based on the above, during settlement, abnormal transactions often occur, such as wool-pulling, abnormal settlement amounts, incorrect merchant information, etc. This requires manual review during settlement, which currently leads to the technical problems of long time consumption and low efficiency. Summary of the Invention

[0006] The present invention provides a method, device, computer device, and medium for detecting abnormal transactions based on a neural network to solve the technical problems of long time consumption and low efficiency caused by the need for manual review during settlement, where abnormal transactions often occur during settlement, such as wool-pulling, abnormal settlement amounts, incorrect merchant information, etc.

[0007] In a first aspect, a method for detecting abnormal transactions based on a neural network is provided, including:

[0008] Obtain the transaction data of an order and preprocess the transaction data;

[0009] Perform pre-training on an abnormal transaction model for a pre-constructed neural network model to generate an abnormal transaction model;

[0010] Input the transaction data into the abnormal transaction model, and have the abnormal transaction model identify abnormal transaction data;

[0011] Store the abnormal transaction data in an abnormal transaction data table pre-established in a database, and output the detection result and the abnormal transaction data.

[0012] In a second aspect, a device for detecting abnormal transactions based on a neural network is provided, including:

[0013] An obtaining module, configured to obtain the transaction data of an order and preprocess the transaction data;

[0014] An abnormal transaction model module, configured to perform pre-training on an abnormal transaction model for a pre-constructed neural network model to generate an abnormal transaction model;

[0015] An abnormal water flow data module, used for inputting the water flow data into the abnormal water flow model, and allowing the abnormal water flow model to identify the abnormal water flow data;

[0016] A storage module, used for storing the abnormal flow data in an abnormal flow data table pre-established in a database;

[0017] The output module is used to output the detection results and the abnormal flow data.

[0018] In a third aspect, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned abnormal flow detection method based on a neural network when executing the computer program.

[0019] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned abnormal water flow detection method based on a neural network are implemented.

[0020] In the scheme implemented by the above-mentioned abnormal flow detection method, device, computer equipment and storage medium based on neural network, the flow data of the order can be obtained and the flow data can be pre-processed; the pre-constructed neural network model is pre-trained for abnormal flow to generate an abnormal flow model; the flow data is input into the abnormal flow model, and the abnormal flow model identifies the abnormal flow data; the abnormal flow data is stored in an abnormal flow data table pre-established in the database, and the detection result and the abnormal flow data are output, which solves the technical problem that abnormal flow often occurs during settlement, such as wool-pulling, abnormal settlement amount, incorrect merchant information, etc., and manual review is required during settlement, resulting in a long time and low efficiency.

[0021] At the same time, a pooling layer is constructed, and an activation function is used to perform nonlinear processing on the word vector feature values, and the word vector feature values ​​after nonlinear processing are processed by maximum pooling, and the key feature values ​​of the word vector are output, so that the model can learn more complex feature representations, reduce the number of parameters, and extract key features. This helps the generalization ability of the model and improves the accuracy of the final abnormal flow detection.

[0022] Furthermore, the key feature values ​​of the word vector are mapped to the final category space through the constructed fully connected layer, and the corresponding classification feature combination is output. The constructed Softmax layer is used to convert the classification feature combination into the corresponding probability distribution to generate the neural network model. The combination of the fully connected layer and the Softmax layer provides an effective method for deep learning models to deal with classification problems. By learning the nonlinear combination of features and outputting category probabilities, the model can accurately classify the input data, improve the accuracy of the final abnormal flow detection, and greatly reduce the workload of manual review. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0024] Figure 1 It is a schematic diagram of an application environment of an abnormal water flow detection method based on a neural network in one embodiment of the present invention;

[0025] Figure 2 It is a flow chart of an abnormal water flow detection method based on a neural network in one embodiment of the present invention;

[0026] Figure 3 It is a structural schematic diagram of an abnormal water flow detection device based on a neural network in one embodiment of the present invention;

[0027] Figure 4 is a schematic diagram of a structure of a computer device in one embodiment of the present invention;

[0028] Figure 5 It is another structural schematic diagram of a computer device in one embodiment of the present invention. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] The abnormal flow detection method based on neural network provided by the embodiment of the present invention can be applied in the following aspects: Figure 1In an application environment, the client communicates with the server through a network. The server can obtain the order flow data through the client and pre-process the flow data; pre-train the pre-built neural network model for abnormal flow to generate an abnormal flow model; input the flow data into the abnormal flow model, and the abnormal flow model identifies the abnormal flow data; store the abnormal flow data in an abnormal flow data table pre-established in the database, and output the detection results and the abnormal flow data. In the present invention, some common click-through rate prediction models do not fully utilize the contextual information of user decisions in the recommendation or advertising system, so it cannot achieve better performance, and can simultaneously extract explicit and implicit information from the product. Among them, the client can be but not limited to various personal computers, laptops, smart phones, tablet computers and portable wearable devices. The server can be implemented with an independent server or a server cluster consisting of multiple servers. The present invention is described in detail below through specific embodiments.

[0031] See also Figure 2 As shown, Figure 2 A flowchart of a method for detecting abnormal water flow based on a neural network provided by an embodiment of the present invention includes the following steps:

[0032] S10: Obtaining order flow data and preprocessing the flow data;

[0033] In this embodiment, obtaining the order flow data and preprocessing the flow data include:

[0034] Obtaining order flow data and extracting valid field data of the flow data;

[0035] The valid field data is standardized.

[0036] It should be noted that the preprocessing implementation steps include:

[0037] 1. A transaction contains many fields. Select fields that are highly relevant to the target, such as total order amount, order type, settlement amount, etc., and remove useless fields, such as update time, transaction ID, etc.

[0038] 2. Standardize the numbers and English characters in the field.

[0039] The above-mentioned preprocessing can be specifically: Data cleaning: ensure data quality, remove or fill missing values, and handle outliers. Feature extraction: extract useful information from flow fields, such as total order amount, order type, settlement amount, etc. Feature encoding: One-hot encoding or label encoding of categorical data. Data standardization: standardize numerical features to have zero mean and unit variance.

[0040] In one embodiment, in the case of processing historical abnormal flow data, the following are specific steps of data cleaning, feature extraction, feature encoding and data standardization:

[0041] 1. Data cleaning

[0042] Objective: Ensure data quality, remove or fill missing values, and handle outliers.

[0043] Missing value handling: Check for missing values ​​in a dataset and decide whether to delete records with missing values ​​or fill them in. Filling can be done in a variety of ways, such as using the mean, median, mode, or a predictive model based on other variables to fill in missing values.

[0044] Outlier handling: Identify outliers in the data, which can be done through box plots, standard deviation methods, or IQR (interquartile range) methods. Then decide whether to remove these outliers or perform a transformation.

[0045] 2. Feature extraction

[0046] Objective: Extract useful information from stream fields.

[0047] Extract statistical information: Calculate the total amount, order type, settlement amount, and other statistical information for each order. Create new features: Depending on the business logic, you may need to derive new features from existing data.

[0048] 3. Feature Encoding

[0049] Objective: One-hot encode or label encode categorical data.

[0050] One-hot encoding: One-hot encoding of non-numeric features.

[0051] Label Encoding: Encode the labels of the target variable, especially if the target variable is categorical.

[0052] 4. Data Standardization

[0053] Objective: To normalize numerical features.

[0054] Standardization: Use StandardScaler or MinMaxScaler to standardize or normalize the data.

[0055] In practice, these steps may need to be adjusted based on the specific circumstances of the dataset and business needs. For example, if the dataset contains timestamp information, you may also need to extract time-related features such as hours, days of the week, etc. In addition, if the dataset contains text information, you may also need to apply text preprocessing and feature extraction techniques such as TF-IDF or Word Embeddings.

[0056] S11, performing abnormal flow pre-training on the pre-built neural network model to generate an abnormal flow model;

[0057] In this embodiment, the pre-built neural network model is pre-trained for abnormal flow.

[0058] Construct a word vector embedding layer to convert the valid field data of the pipeline data into word vectors;

[0059] Construct a convolution layer, perform convolution calculation on the word vector and a preset convolution kernel, and output the word vector feature value;

[0060] Construct a pooling layer, use an activation function to perform nonlinear processing on the word vector feature value, perform maximum pooling on the word vector feature value after nonlinear processing, and output the key feature value of the word vector;

[0061] Construct an output layer, classify and map the key feature values ​​of the word vector, and convert them into corresponding probability distributions, and generate the neural network model according to the word vector embedding layer, the convolution layer, the pooling layer, and the output layer.

[0062] It should be noted that

[0063] The key feature values ​​of the word vector are classified and mapped and converted into corresponding probability distributions, and the neural network model is generated according to the word vector embedding layer, the convolution layer, the pooling layer, and the output layer, including:

[0064] Constructing a fully connected layer in the constructed output layer, mapping the key feature values ​​of the word vector to the final category space, and outputting the corresponding classification feature combination;

[0065] In the output layer, the constructed Softmax layer is used to convert the classification feature combination into a corresponding probability distribution, and the neural network model is generated according to the word vector embedding layer, the convolution layer, the pooling layer, and the output layer.

[0066] In one embodiment, the generation of a convolutional neural network model:

[0067] 1. Construct a word vector embedding layer to convert the characters of the pipeline field into vector representation;

[0068] 2. Construct a convolution layer to convolve the transformed vector based on the scale of the convolution to obtain the convolution result corresponding to each convolution kernel;

[0069] 3. Construct a ReLu activation layer to perform nonlinear processing on each convolution result;

[0070] 4. Construct a pooling layer to perform maximum pooling on the nonlinear processing results;

[0071] 5. Construct a fully connected layer and a Softmax layer to input the value processed by the maximum pooling into the Softmax layer for classification through the fully connected layer

[0072] The convolutional neural network model constructed through the above steps can set different numbers of fields and different convolution scales. For example, the number of pipeline fields is 10. The scale of the convolution layer is set to (3,4), so the relationship between fields with a span of 3 or 4 can be known. In addition, 10 filters are set for each convolution scale, with 3*10 filters. The nonlinear function ReLu function is set. The maximum value pooling is used in the pooling layer, that is, the maximum value in the result vector returned by a filter is taken as the output result of the pooling layer.

[0073] Specifically, the word vector training can be:

[0074] Using pre-trained word embeddings, such as Word2Vec or GloVe, these models are able to map vocabulary to vector space and capture the semantic relationship between vocabulary. For example, Word2Vec maps each word to a fixed-length vector space by training a two-layer neural network, including CBOW (Continuous Bag-of-Words) and Skip-gram models. It is also possible to self-learn word vectors through training data. This usually involves using a neural network language model (such as NNLM) to learn the vector representation of vocabulary. This method allows the model to learn the contextual information of the vocabulary, thereby generating richer word vector representations.

[0075] Embedding layer construction:

[0076] Add an embedding layer to the model, whose input dimension is the vocabulary size and whose output dimension is the word vector dimension. For example, in TensorFlow or PyTorch, you can use tf.keras.layers.Embedding or torch.nn.Embedding to create an embedding layer. The weight matrix of the embedding layer is usually learned during training, but it can also be initialized to pre-trained word vectors and fine-tuned during training.

[0077] Specific examples:

[0078] Suppose we have a vocabulary size of 10,000, and we want the dimension of each word vector to be 128. The embedding layer can be constructed like this: To use the embedding layer in the model, the input data needs to be a sequence of integers, where each integer represents a word in the vocabulary. The output of the embedding layer, embedded_inputs, will be a tensor of shape (batch_size, sequence_length, 128), where each integer sequence is converted to a corresponding sequence of word vectors. Data standardization: Before inputting the data into the embedding layer, it is usually necessary to preprocess the data, including removing or filling missing values, handling outliers and other data cleaning steps. For numerical features, standardization is performed to make them have zero mean and unit variance, which helps the training effect of the model. Through the above steps, an embedding layer for processing text data can be constructed, which can map vocabulary to vector space and is used in the model to capture semantic relationships between vocabulary.

[0079] When processing text data, convolutional neural networks (CNNs) can be used to extract local features. In this case, the convolutional layer can be used to process a sequence of word vectors, where each word vector can be seen as a pixel in two-dimensional data. The following are specific examples and technical implementation steps for building a convolutional layer:

[0080] Convolution kernel definition:

[0081] Depending on the number of pipeline fields (e.g., assuming there are 10 different fields) and the convolution scale (e.g., 3 and 4), multiple convolution kernels are defined.

[0082] Each convolution kernel covers a certain number of fields and captures local features at different scales.

[0083] Construct a convolutional layer:

[0084] Use a deep learning framework such as TensorFlow or PyTorch to build convolutional layers.

[0085] In PyTorch, you can use torch.nn.Conv1d to create a one-dimensional convolutional layer, because text data is usually serialized one-dimensional data.

[0086] Specific examples:

[0087] Suppose we have a sequence of word vectors, each with a dimension of 128, and we need to use convolution kernels of size 3 and 4 to extract features.

[0088] First, we need to define the convolution layer and specify parameters such as the number of input channels, the number of output channels, and the size of the convolution kernel.

[0089] Convolution operation:

[0090] Each convolution kernel slides on the input word vector sequence, calculates the dot product of the convolution kernel and the input data, and generates a feature map.

[0091] By stacking multiple convolution kernels, features of different scales can be extracted, and each convolution kernel outputs a feature map.

[0092] Furthermore, it is understandable that:

[0093] Adding a ReLU (Rectified Linear Unit) activation function after the convolutional layer introduces nonlinearity, enabling the model to learn more complex features.

[0094] Construct pooling layer: Use the maximum pooling layer to pool the output of the ReLU layer to reduce the number of parameters and extract key features.

[0095] Specific examples:

[0096] Suppose there is a stream text dataset, each text sequence is converted into a word vector sequence, the dimension of the word vector is 128, and the sequence length is 100. CNN is used to extract text features, which are then used for text classification tasks.

[0097] A TextCNN class is defined, which contains an embedding layer, a convolutional layer, a ReLU activation function, a max pooling layer, and a fully connected layer. Two convolution kernels of different sizes (3 and 4) are used, which allows the model to capture local features of different scales. The ReLU activation function is applied to the output of each convolutional layer to introduce nonlinearity. Then, a max pooling layer is applied to the output of the ReLU layer to reduce the number of parameters and extract key features. Finally, a fully connected layer is used for the classification task.

[0098] This model can be used for text classification tasks, where the input is a sequence of word vectors and the output is a classification result. In this way, the model can learn to extract useful features from text data and perform effective classification.

[0099] It should be noted that the aforementioned fully connected layer (also called dense layer) and Softmax layer are usually used to map the high-level features of the feature map to the final category space and output the probability of each category.

[0100] The fully connected layer maps the output of the pooling layer (usually a flattened vector of multiple feature maps) to the category space. This usually involves one or more fully connected layers in order to learn non-linear combinations of features.

[0101] The Softmax layer is used for multi-classification problems. It converts the output of the fully connected layer into a probability distribution so that each category has a probability value and the sum of the probabilities of all categories is 1.

[0102] Specific examples:

[0103] Suppose there is an image dataset, and each image needs to be classified into one of 10 categories. We use CNN to extract image features, and then use fully connected layers and Softmax layers for classification. The same can be applied to settlement pipeline data. An ImageClassifierCNN class is defined, which contains two convolutional layers, a maximum pooling layer, two fully connected layers and a Softmax layer. The convolutional layer is used to extract local features of the image, the pooling layer is used to reduce the spatial size of the feature map, and the fully connected layer is used to map the feature map to the category space. Finally, the Softmax layer converts the output of the fully connected layer into a probability distribution.

[0104] This model can be used for image classification tasks, where the input is image data and the output is a logarithmic probability distribution, representing the probability of each category. In this way, the model is able to learn to extract useful features from image data and perform effective classification.

[0105] The aforementioned abnormal flow pre-training of the pre-built neural network model to generate an abnormal flow model includes:

[0106] Divide historical flow data into training samples and test samples according to a preset ratio;

[0107] The abnormal water flow pre-training is performed on the neural network model through a preset loss function and the training samples to generate the abnormal water flow model.

[0108] Further, it should be noted that the abnormal flow pre-training of the neural network model is performed by using a preset loss function and the training samples to generate the abnormal flow model, including:

[0109] Determine the loss function during model training through the weights and cross entropy function of the neural network model;

[0110] Using the loss function and the training samples to perform abnormal flow pre-training on the neural network model;

[0111] The test sample is used to evaluate the abnormal water flow pre-training result. If the abnormal water flow pre-training result meets the abnormal water flow ratio threshold, the abnormal water flow model is generated by the neural network model after abnormal water flow pre-training.

[0112] In one embodiment, the pre-trained convolutional neural network model may be generated by the following steps:

[0113] 1. Choose a common model, such as VGG

[0114] 2. Determine the loss function during model training through weight initialization and cross entropy function. The loss function loss can be expressed as loss = tf.reduce_mean(loss1) + λ*l2_loss. Among them, l2_loss adds a parameter regularization term to prevent parameter overfitting. This regularization term acts on the weight of the fully connected layer before softmax. Loss1 is the cross entropy loss function. λ is a constant term that does not need to be learned. The value of λ can be adjusted based on experience and the learning effect of the convolutional neural network model.

[0115] It can be understood that the aforementioned tf.reduce_mean is a function in the TensorFlow framework that calculates the average value of the elements of the input tensor along the specified axis. If the axis is not specified, the global average of all elements is calculated. Specifically, tf.reduce_mean adds the values ​​of all elements and then divides them by the total number of elements to get the average value. This operation is very common in machine learning, especially when calculating the loss function, it is often necessary to average a certain loss value in order to obtain a scalar loss value for model optimization.

[0116] For example, suppose there is a tensor losses of loss values, whose shape is [32, 1], indicating the loss values ​​of 32 samples in a batch, you can use tf.reduce_mean to calculate the average of all loss values. tf.reduce_mean will add all elements in the losses tensor and then divide it by 32 (the total number of elements) to get the average loss value mean_loss.

[0117] If you want to calculate the average along a specific axis, you can specify it through the axis parameter. For example, if you have a tensor of shape [32, 10], and you want to calculate the average loss value of each sample along the second dimension (axis = 1), then tf.reduce_mean will calculate the average along the second dimension (i.e. each sample) and get a tensor of shape

[32] , which contains the average loss value of each sample.

[0118] 3. Collect multiple historical abnormal flow and construct training samples and test samples based on these historical abnormal flow;

[0119] 4. Train the convolutional neural network model using the above loss function, training samples, and test samples.

[0120] Get a certain amount of flow, and manually mark it as normal or abnormal. 90% of the flow can be used as training samples and 10% as test samples for model training. This ratio can be adjusted by yourself. After training the convolutional neural network model parameters, you can classify the flow in production.

[0121] It should be noted that the model is trained using training samples, and the model parameters are updated through optimization methods such as back propagation algorithm and gradient descent. During the training process, data enhancement technology can be used to increase the diversity of data and improve the generalization ability of the model.

[0122] Model evaluation and testing: Use test samples to evaluate the trained model. Evaluation indicators may include accuracy, recall, F1 score, etc. Based on the evaluation results, the model structure or hyperparameters can be further adjusted to improve the performance of the model.

[0123] When building a convolutional neural network (CNN) model, the preparation of training samples and test samples, model training, and the application of data enhancement techniques are crucial. For example, first, historical abnormal flow data needs to be collected and marked as normal or abnormal. These data will be used to construct training samples and test samples. Usually, 90% of the data can be used as training samples, and the remaining 10% as test samples. In the model definition stage, you can use a pre-trained model (such as VGG) as a basis and make necessary modifications according to the task requirements. For example, the last few layers of the model can be replaced to adapt to our classification task. This includes adding one or more fully connected layers, and a Softmax layer for multi-classification problems. When training the model, optimization methods such as backpropagation algorithms and gradient descent are used to update the model parameters. This process involves forward propagation (calculating predicted values ​​and losses), backpropagation (calculating gradients), and parameter updates (using gradient descent). Data enhancement techniques can increase the diversity of data and improve the generalization ability of the model. In this case, the following data enhancement techniques can be used: Random flip: randomly flip the image horizontally and vertically. Random rotation: randomly rotate the image by a certain angle. Color transformation: changing the brightness, contrast, etc. of an image. These techniques can be implemented using the data augmentation API in deep learning frameworks such as TensorFlow or PyTorch.

[0124] Using test samples to evaluate the trained model is a key step. This process involves multiple evaluation indicators, among which accuracy, recall, precision and F1 score are the most common ones.

[0125] Accuracy: measures the proportion of samples that the model predicts correctly to the total number of samples. It intuitively reflects the overall prediction ability of the model. The calculation formula for accuracy is: Accuracy = (True Positive Examples + True Negative Examples) / Total Number of Samples. Accuracy is an intuitive indicator, but it may be misleading in a dataset with imbalanced categories.

[0126] Recall: Also known as the recall rate, it refers to the proportion of samples that are actually positive examples that are correctly predicted as positive examples by the model. The calculation formula for recall is: Recall = True Positive Examples / (True Positive Examples + False Negative Examples). Recall is particularly important for scenarios where "it is better to kill a thousand by mistake than to let one go", such as disease screening and safety testing.

[0127] Precision: measures the proportion of samples that are actually positive among those predicted by the model. The calculation formula for precision is: Precision = True Positives / (True Positives + False Positives). Precision focuses on the accuracy of the model's prediction of positive examples.

[0128] F1 Score: It is the harmonic mean of precision and recall, and is used to comprehensively evaluate the precision and recall of the model. The calculation formula of F1 score is: F1 = 2*(precision*recall) / (precision+recall). The higher the F1 score, the better the model performance.

[0129] In practical applications, these indicators can comprehensively evaluate the performance of the model. For example, in the CNN model training case on the CIFAR-10 dataset, the accuracy, precision, recall and F1 score of the model can be obtained through evaluation on the test set, so as to conduct a comprehensive analysis of the performance of the model. In addition, data enhancement techniques such as random flipping and random cropping can improve the generalization ability of the model and reduce the risk of overfitting.

[0130] When evaluating a model, in addition to the above indicators, you can also use the ROC curve and AUC value to evaluate the performance of the model. The ROC curve shows the relationship between the true positive rate (TPR) and the false positive rate (FPR) at different thresholds, while the AUC value is the area under the ROC curve. The larger the AUC value, the better the model performance.

[0131] In summary, by using test samples to evaluate the trained model and combining multiple evaluation indicators such as accuracy, recall, precision, F1 score, etc., we can fully understand the performance of the model and adjust the model structure or hyperparameters according to the needs of specific tasks to improve the performance of the model.

[0132] S12, inputting the water flow data into the abnormal water flow model, and using the abnormal water flow model to identify abnormal water flow data;

[0133] Inputting the water flow data into the abnormal water flow model, classifying the water flow data through a preset classifier, and identifying the abnormal water flow data to be confirmed;

[0134] The abnormal water flow data to be confirmed is subjected to a preset abnormality detection algorithm (such as setting a threshold, etc.), and the abnormal water flow data is output.

[0135] Anomaly detection algorithms can also be:

[0136] Clustering-based methods: such as K-means clustering, can classify data points into normal and abnormal categories. Abnormal data usually belong to small clusters or do not belong to any cluster.

[0137] Statistical-based methods: Assume that the data follows a certain distribution and use statistical tests to identify outliers. For example, assuming that the data is normally distributed, you can test whether a data point is more than one standard deviation away from the mean.

[0138] Deep learning-based methods: Use Autoencoder neural network to identify anomalies through reconstruction errors. Autoencoder can learn the normal pattern of data, and abnormal data usually leads to large reconstruction errors.

[0139] Proximity-based methods, such as the Local Outlier Factor (LOF), identify anomalies by evaluating the neighbor density of data points. Anomalies usually have a low neighbor density.

[0140] Isolation Forest: This is a tree-based anomaly detection method that isolates outliers by randomly partitioning the data space. Isolation Forest is very effective for high-dimensional data and is computationally efficient.

[0141] S13, storing the abnormal water flow data in an abnormal water flow data table pre-established in a database, and outputting the detection result and the abnormal water flow data.

[0142] In this embodiment, if the transaction flow is abnormal, it will be recorded in the database and finally sent to the auditor for manual processing.

[0143] Finally, the AI ​​audit opinions and abnormal order flow are sent to the auditor, who will review again whether the flow is abnormal and can make a quick judgment based on the audit opinions, thereby improving audit efficiency, reducing manpower and improving audit accuracy.

[0144] The abnormal flow detection method based on neural network provided in this embodiment can be

[0145] The flow data of the order is obtained, and the flow data is pre-processed; the pre-built neural network model is pre-trained for abnormal flow to generate an abnormal flow model; the flow data is input into the abnormal flow model, and the abnormal flow model identifies the abnormal flow data; the abnormal flow data is stored in an abnormal flow data table pre-established in the database, and the detection result and the abnormal flow data are output, which solves the technical problem that abnormal flow often occurs during settlement, such as wool-pulling, abnormal settlement amount, wrong merchant information, etc., and manual review is required during settlement, which leads to a long time and low efficiency.

[0146] At the same time, a pooling layer is constructed, and an activation function is used to perform nonlinear processing on the word vector feature values, and the word vector feature values ​​after nonlinear processing are processed by maximum pooling, and the key feature values ​​of the word vector are output, so that the model can learn more complex feature representations, reduce the number of parameters, and extract key features. This helps the generalization ability of the model and improves the accuracy of the final abnormal flow detection.

[0147] Furthermore, the key feature values ​​of the word vector are mapped to the final category space through the constructed fully connected layer, and the corresponding classification feature combination is output. The constructed Softmax layer is used to convert the classification feature combination into the corresponding probability distribution to generate the neural network model. The combination of the fully connected layer and the Softmax layer provides an effective method for deep learning models to deal with classification problems. By learning the nonlinear combination of features and outputting category probabilities, the model can accurately classify the input data, improve the accuracy of the final abnormal flow detection, and greatly reduce the workload of manual review.

[0148] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0149] In one embodiment, a neural network-based abnormal water flow detection device is provided, and the neural network-based abnormal water flow detection device corresponds to the neural network-based abnormal water flow detection method in the above embodiment. Figure 3 As shown, the abnormal water flow detection device based on neural network includes an acquisition module 101, an abnormal water flow model module 102, an abnormal water flow data module 103, a storage module 104, and an output module 105. The detailed description of each functional module is as follows:

[0150] The acquisition module 101 is used to acquire the order flow data and pre-process the flow data;

[0151] In one embodiment, the acquisition module 101 is specifically used for the following steps:

[0152] Obtaining order flow data and extracting valid field data of the flow data;

[0153] The valid field data is standardized.

[0154] The abnormal flow model module 102 is used to perform abnormal flow pre-training on the pre-built neural network model to generate an abnormal flow model;

[0155] In one embodiment, a model building module is further included, including:

[0156] An embedding layer unit, used to construct a word vector embedding layer to convert the valid field data of the pipeline data into a word vector;

[0157] A convolutional layer unit, used to construct a convolutional layer to calculate the word vector in a preset convolution manner and output a word vector feature value;

[0158] The activation layer and pooling layer unit are used to perform nonlinear processing on the word vector feature value by using an activation function, and perform maximum pooling processing on the word vector feature value after the nonlinear processing, and output the key feature value of the word vector;

[0159] A generation unit is used to classify and map the key feature values ​​of the word vector and convert them into corresponding probability distributions, and generate the neural network model according to the word vector embedding layer, the convolution layer, the pooling layer, and the output layer.

[0160] In one embodiment, the generating unit is specifically used for the following steps:

[0161] Constructing a fully connected layer in the constructed output layer, mapping the key feature values ​​of the word vector to the final category space, and outputting the corresponding classification feature combination;

[0162] In the output layer, the constructed Softmax layer is used to convert the classification feature combination into a corresponding probability distribution, and the neural network model is generated according to the word vector embedding layer, the convolution layer, the pooling layer, and the output layer.

[0163] In one embodiment, the abnormal flow model module 102 includes:

[0164] The training sample and test sample unit is used to divide the historical flow data into training samples and test samples according to a preset ratio;

[0165] A pre-training unit is used to perform abnormal flow pre-training on the neural network model through a preset loss function and the training samples to generate the abnormal flow model.

[0166] In one embodiment, the pre-training unit is specifically used for the following steps:

[0167] Determine the loss function during model training through the weights and cross entropy function of the neural network model;

[0168] Using the loss function and the training samples to perform abnormal flow pre-training on the neural network model;

[0169] The test sample is used to evaluate the abnormal water flow pre-training result. If the abnormal water flow pre-training result meets the abnormal water flow ratio threshold, the abnormal water flow model is generated by the neural network model after abnormal water flow pre-training.

[0170] The abnormal flow data module 103 is used to input the flow data into the abnormal flow model, and the abnormal flow model identifies the abnormal flow data;

[0171] In one embodiment, the abnormal flow data module 103 is specifically used for the following steps:

[0172] Inputting the water flow data into the abnormal water flow model, classifying the water flow data through a preset classifier, and identifying the abnormal water flow data to be confirmed;

[0173] The abnormal flow data to be confirmed is subjected to a preset abnormality detection algorithm to output the abnormal flow data.

[0174] Storage module 104, used for storing the abnormal water flow data into the abnormal water flow data table pre-established in the database;

[0175] The output module 105 is used to output the detection result and the abnormal flow data.

[0176] The abnormal water flow detection device based on neural network provided in this embodiment can be

[0177] The flow data of the order is obtained, and the flow data is pre-processed; the pre-built neural network model is pre-trained for abnormal flow to generate an abnormal flow model; the flow data is input into the abnormal flow model, and the abnormal flow model identifies the abnormal flow data; the abnormal flow data is stored in an abnormal flow data table pre-established in the database, and the detection result and the abnormal flow data are output, which solves the technical problem that abnormal flow often occurs during settlement, such as wool-pulling, abnormal settlement amount, wrong merchant information, etc., and manual review is required during settlement, which leads to a long time and low efficiency.

[0178] At the same time, a pooling layer is constructed, and an activation function is used to perform nonlinear processing on the word vector feature values, and the word vector feature values ​​after nonlinear processing are processed by maximum pooling, and the key feature values ​​of the word vector are output, so that the model can learn more complex feature representations, reduce the number of parameters, and extract key features. This helps the generalization ability of the model and improves the accuracy of the final abnormal flow detection.

[0179] Furthermore, the key feature values ​​of the word vector are mapped to the final category space through the constructed fully connected layer, and the corresponding classification feature combination is output. The constructed Softmax layer is used to convert the classification feature combination into the corresponding probability distribution to generate the neural network model. The combination of the fully connected layer and the Softmax layer provides an effective method for deep learning models to deal with classification problems. By learning the nonlinear combination of features and outputting category probabilities, the model can accurately classify the input data, improve the accuracy of the final abnormal flow detection, and greatly reduce the workload of manual review.

[0180] For the specific definition of the abnormal water flow detection device based on neural network, please refer to the definition of the abnormal water flow detection method based on neural network in the above text, which will not be repeated here. Each module in the above abnormal water flow detection device based on neural network can be implemented in whole or in part by software, hardware and their combination. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0181] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external client via a network connection. When the computer program is executed by the processor, it realizes the functions or steps on the service side of a neural network-based abnormal flow detection method.

[0182] In one embodiment, a computer device is provided. The computer device may be a client, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external server through a network connection. When the computer program is executed by the processor, it realizes the functions or steps on the client side of a method for detecting abnormal water flow based on a neural network.

[0183] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0184] Obtaining order flow data and preprocessing the flow data;

[0185] Perform abnormal flow pre-training on the pre-built neural network model to generate an abnormal flow model;

[0186] Inputting the water flow data into the abnormal water flow model, and using the abnormal water flow model to identify abnormal water flow data;

[0187] The abnormal flow data is saved in an abnormal flow data table pre-established in the database.

[0188] The computer device provided in this embodiment can be

[0189] The flow data of the order is obtained, and the flow data is pre-processed; the pre-built neural network model is pre-trained for abnormal flow to generate an abnormal flow model; the flow data is input into the abnormal flow model, and the abnormal flow model identifies the abnormal flow data; the abnormal flow data is stored in an abnormal flow data table pre-established in the database, and the detection result and the abnormal flow data are output, which solves the technical problem that abnormal flow often occurs during settlement, such as wool-pulling, abnormal settlement amount, wrong merchant information, etc., and manual review is required during settlement, which leads to a long time and low efficiency.

[0190] At the same time, a pooling layer is constructed, and an activation function is used to perform nonlinear processing on the word vector feature values, and the word vector feature values ​​after nonlinear processing are processed by maximum pooling, and the key feature values ​​of the word vector are output, so that the model can learn more complex feature representations, reduce the number of parameters, and extract key features. This helps the generalization ability of the model and improves the accuracy of the final abnormal flow detection.

[0191] Furthermore, the key feature values ​​of the word vector are mapped to the final category space through the constructed fully connected layer, and the corresponding classification feature combination is output. The constructed Softmax layer is used to convert the classification feature combination into the corresponding probability distribution to generate the neural network model. The combination of the fully connected layer and the Softmax layer provides an effective method for deep learning models to deal with classification problems. By learning the nonlinear combination of features and outputting category probabilities, the model can accurately classify the input data, improve the accuracy of the final abnormal flow detection, and greatly reduce the workload of manual review.

[0192] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0193] Obtaining order flow data and preprocessing the flow data;

[0194] Perform abnormal flow pre-training on the pre-built neural network model to generate an abnormal flow model;

[0195] Inputting the water flow data into the abnormal water flow model, and using the abnormal water flow model to identify abnormal water flow data;

[0196] The abnormal flow data is saved in an abnormal flow data table pre-established in the database.

[0197] The computer-readable storage medium provided in this embodiment can be

[0198] The flow data of the order is obtained, and the flow data is pre-processed; the pre-built neural network model is pre-trained for abnormal flow to generate an abnormal flow model; the flow data is input into the abnormal flow model, and the abnormal flow model identifies the abnormal flow data; the abnormal flow data is stored in an abnormal flow data table pre-established in the database, and the detection result and the abnormal flow data are output, which solves the technical problem that abnormal flow often occurs during settlement, such as wool-pulling, abnormal settlement amount, wrong merchant information, etc., and manual review is required during settlement, which leads to a long time and low efficiency.

[0199] At the same time, a pooling layer is constructed, and an activation function is used to perform nonlinear processing on the word vector feature values, and the word vector feature values ​​after nonlinear processing are processed by maximum pooling, and the key feature values ​​of the word vector are output, so that the model can learn more complex feature representations, reduce the number of parameters, and extract key features. This helps the generalization ability of the model and improves the accuracy of the final abnormal flow detection.

[0200] Furthermore, the key feature values ​​of the word vector are mapped to the final category space through the constructed fully connected layer, and the corresponding classification feature combination is output. The constructed Softmax layer is used to convert the classification feature combination into the corresponding probability distribution to generate the neural network model. The combination of the fully connected layer and the Softmax layer provides an effective method for deep learning models to deal with classification problems. By learning the nonlinear combination of features and outputting category probabilities, the model can accurately classify the input data, improve the accuracy of the final abnormal flow detection, and greatly reduce the workload of manual review.

[0201] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can refer to the relevant descriptions on the server side and the client side in the aforementioned method embodiment. To avoid repetition, they will not be described one by one here.

[0202] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0203] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0204] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

[0205] It should be noted that if software tools or components other than those of our company appear in the embodiments of the present application, they are only used for illustrative purposes and do not represent actual use.

Claims

1. A method for detecting abnormal water flow based on a neural network, characterized in that: include: Obtaining order flow data and preprocessing the flow data; Perform abnormal flow pre-training on the pre-built neural network model to generate an abnormal flow model; Inputting the water flow data into the abnormal water flow model, and using the abnormal water flow model to identify abnormal water flow data; The abnormal water flow data is stored in an abnormal water flow data table pre-established in a database, and the detection result and the abnormal water flow data are output.

2. The abnormal water flow detection method based on neural network as claimed in claim 1, characterized in that: Obtaining order flow data and preprocessing the flow data includes: Obtaining order flow data and extracting valid field data of the flow data; The valid field data is standardized.

3. The abnormal water flow detection method based on neural network as claimed in claim 1, characterized in that: Perform abnormal pipeline pre-training on the pre-built neural network model to generate an abnormal pipeline model. Previously, it also included: Construct a word vector embedding layer to convert the valid field data of the pipeline data into word vectors; Construct a convolution layer, perform convolution calculation on the word vector and a preset convolution kernel, and output the word vector feature value; Construct a pooling layer, use an activation function to perform nonlinear processing on the word vector feature value, perform maximum pooling on the word vector feature value after nonlinear processing, and output the key feature value of the word vector; Construct an output layer, classify and map the key feature values ​​of the word vector, and convert them into corresponding probability distributions, and generate the neural network model according to the word vector embedding layer, the convolution layer, the pooling layer, and the output layer.

4. The abnormal water flow detection method based on neural network as claimed in claim 3 is characterized in that: The key feature values ​​of the word vector are classified and mapped and converted into corresponding probability distributions, and the neural network model is generated according to the word vector embedding layer, the convolution layer, the pooling layer, and the output layer, including: Constructing a fully connected layer in the constructed output layer, mapping the key feature values ​​of the word vector to the final category space, and outputting the corresponding classification feature combination; In the output layer, the constructed Softmax layer is used to convert the classification feature combination into a corresponding probability distribution, and the neural network model is generated according to the word vector embedding layer, the convolution layer, the pooling layer, and the output layer.

5. The abnormal water flow detection method based on neural network as claimed in claim 1 or 4, characterized in that: Perform abnormal pipeline pre-training on the pre-built neural network model to generate an abnormal pipeline model, including: Divide historical flow data into training samples and test samples according to a preset ratio; The abnormal water flow pre-training is performed on the neural network model through a preset loss function and the training samples to generate the abnormal water flow model.

6. The abnormal water flow detection method based on neural network as claimed in claim 5, characterized in that: The abnormal flow pre-training of the neural network model is performed by using a preset loss function and the training sample to generate the abnormal flow model, including: Determine the loss function during model training through the weights and cross entropy function of the neural network model; Using the loss function and the training samples to perform abnormal flow pre-training on the neural network model; The test sample is used to evaluate the abnormal water flow pre-training result. If the abnormal water flow pre-training result meets the abnormal water flow ratio threshold, the abnormal water flow model is generated by the neural network model after abnormal water flow pre-training.

7. The abnormal water flow detection method based on neural network as claimed in claim 1, characterized in that: Inputting the pipeline data into the abnormal pipeline model, and using the abnormal pipeline model to identify the abnormal pipeline data, includes: Inputting the water flow data into the abnormal water flow model, classifying the water flow data through a preset classifier, and identifying the abnormal water flow data to be confirmed; The abnormal transaction data to be confirmed is detected by a preset abnormality detection algorithm, and the abnormal transaction data is identified and output.

8. An abnormal water flow detection device based on a neural network, characterized in that: include: An acquisition module, used to acquire order flow data and pre-process the flow data; The abnormal flow model module is used to perform abnormal flow pre-training on the pre-built neural network model to generate an abnormal flow model; An abnormal water flow data module, used for inputting the water flow data into the abnormal water flow model, and allowing the abnormal water flow model to identify the abnormal water flow data; A storage module, used for storing the abnormal flow data in an abnormal flow data table pre-established in a database; The output module is used to output the detection results and the abnormal flow data.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the abnormal water flow detection method based on a neural network as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the abnormal water flow detection method based on a neural network as described in any one of claims 1 to 7 are implemented.

Images