Fraud detection model optimization method and device, equipment and medium
By building a multi-task fraud detection model, using timing reconstruction, timing prediction and timing classification task synchronization training, the existing model's problem of difficulty in capturing short-term fraud fragments and sample imbalance is solved, and a more efficient fraud detection effect is achieved.
Patent Information
- Application Number
- CN202411560040.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-04
- Publication Date
- 2025-02-18
AI Technical Summary
Existing fraud detection models are difficult to capture short-lived fraud fragments, the lack of clearly marked samples makes it difficult to learn fraud characteristics, and sample imbalance causes the model to tend to predict the majority and ignore the minority.
Build a multi-task model for fraud timing sequence classification training, including feature extraction network, encoding network, decoding network, reconstruction network, classification network and prediction network. Through timing reconstruction, timing prediction and timing classification task synchronization training, multi-task loss is utilized Value optimization encoded and classified network parameters.
Effectively capture short-term fraud fragments, improve the model's ability to learn the characteristics of fraudulent behavior, reduce the bias problems caused by sample imbalance, and improve the accuracy and efficiency of fraud detection.
Smart Images
Figure CN119477343A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the fields of artificial intelligence technology and financial technology, and in particular to a fraud detection model optimization method, device, equipment and medium. Background Art
[0002] Fraud is a common illegal behavior in the fields of finance, insurance, e-commerce, etc. It usually involves deliberately concealing the truth or providing false information to obtain improper benefits. The concealment of this behavior makes it difficult to accurately identify and locate it in time series data.
[0003] Fraudulent behavior usually has the following characteristics:
[0004] Fragmentary: It usually appears as short, discontinuous fragments in the time series. Compared with normal behavior, these fragments are often very short and difficult to capture by existing fraud detection models.
[0005] Unlabeled: In practical applications, fraudulent behavior fragments are often not clearly labeled, which makes it difficult for existing fraud detection models to learn the characteristics of fraudulent behavior from historical data;
[0006] False positives of suspected fraudulent segments: In a sequence of normal behavior, there are sometimes segments similar to fraudulent behavior, which may mislead the fraud detection model and increase the false positive rate;
[0007] Masking: Fraudulent behavior is often masked by a large number of normal behavior fragments, making it difficult for both manual review and fraud detection models to detect;
[0008] Sample imbalance: Fraud detection model In fraud detection, the number of samples of normal behavior usually far exceeds the number of samples of fraudulent behavior. This imbalance can cause the machine learning model to tend to predict the majority class (i.e. normal behavior) and thus ignore the minority class (i.e. fraudulent behavior). Summary of the invention
[0009] The present application provides a fraud detection model optimization, classification method, device, equipment and medium, which solves the technical problems that the existing models for classification and identification of fraudulent behavior have fragments that are difficult to capture, the lack of clear annotations of fragment samples makes it difficult to learn the characteristics of fraudulent behavior, and the imbalance of samples causes the model to tend to predict the majority class and ignore the minority class.
[0010] In view of this, the first aspect of the present application provides a fraud detection model optimization method, the method comprising:
[0011] Constructing a first model for fraud time series classification training, wherein the first model includes a feature extraction network, an encoding network, a decoding network, a reconstruction network, a classification network, and a prediction network;
[0012] Performing feature extraction on the training fraud time series sequence containing preset labels through the feature extraction network to obtain features of the training fraud time series sequence;
[0013] Encoding the feature through the encoding network to obtain a feature vector of the feature;
[0014] Performing time series reconstruction task training on the training fraud time series sequence through the encoding network, the decoding network and the reconstruction network to obtain a first loss value between the reconstructed time series sequence and the training fraud time series sequence;
[0015] Performing time series prediction task training on the training fraud time series sequence through the encoding network and the prediction network to obtain a second loss value between a time series true value of the training fraud time series sequence and a corresponding time series prediction value;
[0016] Performing time series classification task training on the training fraud time series sequence through the encoding network and the classification network to obtain a third loss value of the classification label and the preset label;
[0017] Optimizing a first network parameter of the encoding network according to the first loss value, the second loss value, and the third loss value;
[0018] According to the third loss value, the second network parameter of the classification network is optimized.
[0019] A second aspect of the present application provides a fraud detection model optimization device, the device comprising:
[0020] A construction unit, used to construct a first model for fraud time series classification training, wherein the first model includes a feature extraction network, an encoding network, a decoding network, a reconstruction network, a classification network, and a prediction network;
[0021] A feature extraction unit, configured to extract features from a training fraud time series sequence containing a preset label through the feature extraction network to obtain features of the training fraud time series sequence;
[0022] An encoding unit, used for encoding the feature through the encoding network to obtain a feature vector of the feature;
[0023] A timing reconstruction task training unit, used for performing timing reconstruction task training on the training fraud timing sequence through the encoding network, the decoding network and the reconstruction network to obtain a first loss value between the reconstructed timing sequence and the training fraud timing sequence;
[0024] A time series prediction task training unit, used for performing time series prediction task training on the training fraud time series sequence through the encoding network and the prediction network to obtain a second loss value between a time series true value of the training fraud time series sequence and a corresponding time series prediction value;
[0025] A time series classification task training unit, used for performing time series classification task training on the training fraud time series sequence through the encoding network and the classification network to obtain a third loss value of the classification label and the preset label;
[0026] A first optimization unit, configured to optimize a first network parameter of the encoding network according to the first loss value, the second loss value, and the third loss value;
[0027] The second optimization unit is used to optimize the second network parameter of the classification network according to the third loss value.
[0028] A third aspect of the present application provides a fraud detection model optimization device, the device comprising a processor and a memory:
[0029] The memory is used to store program code and transmit the program code to the processor;
[0030] The processor is used to execute the steps of the method for optimizing the fraud detection model as described in the first aspect according to the instructions in the program code.
[0031] A fourth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to execute the method described in the first aspect above.
[0032] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:
[0033] In the present application, a fraud detection model optimization method, device, equipment and medium are provided. By constructing a first model for fraud time series sequence classification training, time series reconstruction task training, time series prediction task training and time series classification task training of the first model are simultaneously performed, and the loss values obtained from the three task training are used to optimize the network parameters of the encoding network and the classification network in the first model. Then, only the second model consisting of the feature extraction network, the encoding network and the classification network needs to be applied to perform time series classification. At the same time, in the auxiliary tasks consisting of the time series reconstruction task training and the time series prediction task training, no additional labeled samples are required, and only the original time series sequence can be used for training. The auxiliary tasks have a high correlation and synergy with the classification tasks, and the loss function can decrease synchronously, which solves the technical problems that the existing models for classification and identification of fraudulent behavior are difficult to capture fragments, the fragment samples lack clear annotations, resulting in difficulty in learning the characteristics of fraudulent behavior, and the sample imbalance causes the model to predict the majority class and ignore the minority class. BRIEF DESCRIPTION OF THE DRAWINGS
[0034] Figure 1 This is a schematic diagram of an application environment of the fraud detection model optimization method in an embodiment of the present application;
[0035] Figure 2 A method flow chart of the fraud detection model optimization method in an embodiment of the present application;
[0036] Figure 3 This is a schematic diagram of the structure of the fraud detection model optimization device in an embodiment of the present application;
[0037] Figure 4 Schematic diagram of the structure of the fraud detection model optimization device in the embodiment of the present application. DETAILED DESCRIPTION
[0038] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0039] The fraud detection model optimization method provided in this application can be applied in Figure 1In the application environment, the client communicates with the server through the network. The server can construct a first model for fraud time series classification training, obtain the training fraud time series sequence sent by the client, and synchronously perform the time series reconstruction task training, time series prediction task training and time series classification task training of the first model based on the training fraud time series sequence. The network parameters of the encoding network and the classification network in the first model are optimized by using the loss values obtained from the three task trainings, and then the time series classification can be performed by applying the second model composed of the feature extraction network, the encoding network and the classification network. At the same time, in the auxiliary tasks composed of the time series reconstruction task training and the time series prediction task training, no additional label samples are required, and only the original time series sequence can be used for training. The auxiliary tasks have high correlation and synergy with the classification tasks, and the loss function can be synchronously reduced, which solves the technical problems that the existing models are difficult to capture the fragments of the classification and identification of fraudulent behavior, the lack of clear annotations of the fragment samples makes it difficult to learn the characteristics of the fraudulent behavior, and the imbalance of samples causes the model to predict the majority class and ignore the minority class. Among them, the client can be but not limited to various personal computers, laptops, smart phones, tablet computers and portable wearable devices. The server can be implemented with an independent server or a server cluster composed of multiple servers. The present application is described in detail below through specific embodiments.
[0040] For easier understanding, see Figure 2 , Figure 2 Flow chart of the method for optimizing the fraud detection model in the embodiment of the present application. Figure 2 As shown, specifically:
[0041] S201, constructing a first model for fraud time series classification training, the first model comprising a feature extraction network, an encoding network, a decoding network, a reconstruction network, a classification network, and a prediction network;
[0042] It should be noted that, in general, the conventional method for classification based on a time series is to input the preprocessed time series into the feature extraction network to extract the time series features, and then add the classification loss function to train the network's ability to extract fraud features. For tasks where the distribution of positive and negative sample data is uneven, the fraud time series segments are short and difficult to label, it is not easy to enhance the data, and the actual effect is generally poor.
[0043] The embodiment of the present application constructs a comprehensive model that integrates feature extraction, encoding, decoding, reconstruction, classification and prediction networks for training time series classification tasks.
[0044] For example: Build a model in which the feature extraction network uses CNN, the encoding network uses LSTM, the decoding network uses a deconvolution layer, the reconstruction network uses MSE loss to calculate the reconstruction error, the classification network uses a fully connected layer and a softmax activation function, and the prediction network uses a linear regression layer.
[0045] S202, extracting features from the training fraud time series sequence containing preset labels through a feature extraction network to obtain features of the training fraud time series sequence;
[0046] It should be noted that in the time series classification task, the feature extraction network is responsible for extracting key features from the original time series data that are helpful for identification and classification tasks. These features should be able to represent the important changes and patterns of the time series data and provide useful information for subsequent encoding and classification.
[0047] Specific steps may include:
[0048] Preprocessing: Perform preprocessing operations such as normalization and denoising on the original time series data.
[0049] Feature extraction: Use specific network structures (such as convolutional neural network CNN, long short-term memory network LSTM, etc.) to extract the features of time series data.
[0050] Feature selection: Select the features that best represent the characteristics of the data, which may include statistical features, frequency domain features, etc.
[0051] Suppose we are working on a fraud detection task on credit card transaction data, where our goal is to identify unusual transaction patterns that may indicate fraudulent activity.
[0052] Data preprocessing:
[0053] Normalization: Normalize all transaction amounts to the range [0,1] to eliminate the impact of different amount magnitudes.
[0054] Handling missing values: For missing transaction records, you can fill them with the previous transaction data or use the mean.
[0055] Feature extraction network design:
[0056] Input layer: accepts transaction records within a continuous period of time as input.
[0057] Convolutional layer: A one-dimensional convolutional layer is used to extract local transaction patterns. For example, several consecutive large transactions may indicate anomalies.
[0058] Pooling layer: Use pooling layer to reduce the dimensionality of features while retaining important information.
[0059] Activation function: Use the ReLU activation function to increase the nonlinear characteristics of the network.
[0060] Feature extraction
[0061] Statistical features: Calculate statistical features such as average transaction amount and transaction frequency.
[0062] Frequency domain features: Use Fourier transform to extract the periodic characteristics of trading patterns.
[0063] Time window features: Consider trading behaviors within different time windows, such as the difference in trading between weekends and weekdays.
[0064] Output features: Output a fixed-length feature vector that contains the key information of the input time series data.
[0065] In this way, the feature extraction network can effectively extract features that are helpful for classification tasks from the original time series data, providing support for subsequent encoding and classification.
[0066] S203, encoding the feature through a coding network to obtain a feature vector of the feature;
[0067] It should be noted that the role of the encoding network in time series data processing is to further process the feature vector obtained from the feature extraction network to extract more abstract and representative features. These features can capture the key information in the time series data and encode it into a fixed-length feature vector, which is usually called "embedding". Common models of encoding networks include recurrent neural networks (RNN), long short-term memory networks (LSTM), gated recurrent units (GRU), etc.
[0068] Specific steps may include:
[0069] Sequence modeling: Processing the sequential characteristics of time series data and capturing temporal dependencies.
[0070] Feature compression: compressing the original feature vector into a smaller dimension for easier processing and classification.
[0071] Feature abstraction: extract key information and ignore unimportant details.
[0072] Through the encoding network, we can obtain a fixed-length feature vector, which can effectively represent the key information of the original time series data and provide input for subsequent classification or other tasks.
[0073] S204, training the fraudulent time series sequence through the encoding network, the decoding network, and the reconstruction network to perform time series reconstruction task training, and obtain a first loss value between the reconstructed time series sequence and the training fraudulent time series sequence;
[0074] Specifically include:
[0075] The feature vector is decoded by a decoding network to obtain a reconstructed time series sequence with the same sequence length as the training fraud time series sequence;
[0076] The first loss value of the reconstructed time series and the training fraud time series is obtained by reconstructing the network.
[0077] It should be noted that the time series reconstruction task is an important part of multi-task learning. It forces the model to learn features that can accurately reconstruct the input time series data. This not only improves the model's understanding of the data, but also indirectly enhances the performance of the classification task. The key to the reconstruction task is:
[0078] Choice of loss function: Mean squared error (MSE) or mean absolute error (MAE) is usually used as the loss function, but other loss functions such as Huber loss or cross entropy loss can also be explored.
[0079] Design of network structure: The structural design of the decoding network is crucial for the reconstruction task. Deconvolution layers or transposed convolution layers can be used to gradually restore the length of the time series data.
[0080] In the time series reconstruction task, the encoding network, decoding network, and reconstruction network work together to generate reconstructed data that is as similar as possible to the original time series data. This process includes:
[0081] Encoding phase: The encoding network receives the original time series data as input and compresses it into a feature vector. This feature vector captures the key features of the time series data.
[0082] Decoding phase: The decoding network receives the encoded feature vector and tries to map it back to a sequence of the same length as the original time series data. The goal of this step is to reconstruct the original data.
[0083] Reconstruction network: The reconstruction network calculates the difference between the reconstructed time series sequence and the original time series sequence, and usually uses a loss function to quantify this difference.
[0084] This process can help the model learn representations that capture the essential characteristics of time series data.
[0085] Since the decoding network needs to restore the compressed feature vector to its original length, it forces the encoding network to capture enough detail information so that it can accurately reconstruct the original time series data.
[0086] The accuracy of reconstruction can be quantified by calculating the loss (such as MSE) between the reconstructed time series data and the original time series data. This loss value is fed back to the encoding network to guide its parameter update to better capture detailed features.
[0087] When the loss of the reconstruction task is optimized, the encoding network is forced to improve its ability to capture the details of the original time series data, thereby indirectly improving the accuracy of the classification task.
[0088] Through its reconstruction task, the decoding network not only learns how to restore the compressed features to the original time series length, but also indirectly promotes the ability of the encoding network to extract detailed features of time series data. This interaction ensures that the encoding network can capture subtle features that are useful for classification tasks, thereby improving the performance of the entire model in complex time series analysis tasks such as fraud detection.
[0089] Suppose our task is to detect fraud using customer credit card transaction data.
[0090] Coding network design
[0091] Input layer: accepts the customer's transaction sequence as input.
[0092] LSTM layer: Use LSTM network to capture the temporal dependencies and complex patterns of transaction sequences.
[0093] Decoding network design
[0094] Structure: The decoding network can be designed to be similar to the encoding network structure, but the operation is opposite, using the reverse operation of LSTM to gradually reconstruct the transaction sequence.
[0095] Rebuild the network design:
[0096] Loss function: Use mean squared error (MSE) or mean absolute error (MAE) as the loss function to calculate the difference between the reconstructed transaction sequence and the original transaction sequence.
[0097] Training process:
[0098] Forward propagation:
[0099] The customer's transaction sequence is compressed into a feature vector through the encoding network.
[0100] The feature vector is reconstructed into a transaction sequence through a decoding network.
[0101] Calculate the loss:
[0102] The reconstruction network calculates the loss value between the reconstructed transaction sequence and the original transaction sequence.
[0103] Backward Propagation:
[0104] According to the loss value, the parameters of the encoding network and the decoding network are updated through back propagation.
[0105] Output:
[0106] Reconstructed transaction sequence: The reconstructed transaction sequence is as close to the original transaction sequence as possible.
[0107] First loss value: MSE or MAE between the reconstructed sequence and the original sequence.
[0108] In this way, the time series reconstruction task can help the model learn the complex patterns of transaction data, the reconstruction loss can be used as an indicator for fraud detection, and the anomaly of the loss value can trigger further investigation or security measures.
[0109] S205, performing time series prediction task training on the training fraud time series sequence through the encoding network and the prediction network to obtain a second loss value of the time series true value of the training fraud time series sequence and the corresponding time series prediction value;
[0110] Specifically include:
[0111] Perform time series prediction on the feature vector through the prediction network to obtain the time series prediction value;
[0112] The loss is calculated between the time series prediction value and the time series true value corresponding to the training fraud time series sequence to obtain a second loss value.
[0113] It should be noted that the time series prediction task requires the model to predict future time series data points, which is crucial to capturing the dynamic characteristics of time series data. The key to the prediction task is:
[0114] Choice of prediction step size: The choice of prediction step size will affect the accuracy of model prediction and needs to be adjusted according to the specific task.
[0115] Feature extraction capability: The encoding network needs to be able to extract sufficient feature information to support the accuracy of the prediction task.
[0116] The learning content of the prediction network includes:
[0117] Task definition: The task of the prediction network is to predict the value of the next time point based on a part of the time series data.
[0118] Input: Instead of using all time series data, use the data from the previous N time points.
[0119] Output: Predict the value at the N+1th time point.
[0120] Specific steps
[0121] Data segmentation: Divide long time series data into multiple segments, each of which contains N time points.
[0122] Feature extraction: Extract features of each segment using an encoding network.
[0123] Prediction: Predict the value at the next time point based on the extracted features.
[0124] By predicting future values, the prediction network forces the encoding network to capture dynamic changes and trends in time series data, which helps improve the encoding network's sensitivity to time series changes.
[0125] The accuracy of the prediction can be quantified by calculating the loss (e.g., MSE) between the predicted value and the actual value. This loss value is fed back to the encoding network to guide its parameter update to better capture the dynamic characteristics of time series data.
[0126] The prediction task requires a deep understanding of the details of the time series data, which forces the encoding network to extract richer detailed features and thus improve its encoding ability.
[0127] During the training process, the prediction task and the classification task share the parameters of the encoding network. This joint optimization strategy can improve the performance of the classification task.
[0128] Through the autoregressive task, the prediction network not only learns to predict future time series values, but also indirectly enhances the ability of the encoding network to capture the dynamic changes of time series data. This enhanced encoding ability enables the encoding network to better serve the classification task and improves the performance of the entire model in complex time series analysis tasks. In this way, the collaborative work of the prediction network and the encoding network enables the model to more effectively handle tasks such as fraud detection, where fraud may only account for a small part of the entire time series data.
[0129] S206, performing time series classification task training on the training fraud time series sequence through the encoding network and the classification network to obtain a third loss value of the classification label and the preset label;
[0130] Specifically include:
[0131] The feature vector is classified through the classification network to obtain the classification label of the feature vector and its classification probability;
[0132] The third loss value is obtained according to the difference between the classification label and the preset label.
[0133] It should be noted that the time series classification task is the core task of the embodiment of the present application, and its goal is to distinguish different types of time series data, such as distinguishing normal transactions from fraudulent transactions. The key to the classification task is:
[0134] Design of classification network: The classification network needs to be able to process the feature vector output by the encoding network and output accurate classification results.
[0135] Choice of loss function: Cross entropy loss is a commonly used loss function for classification tasks, but you can also try other loss functions, such as focal loss, to solve the problem of class imbalance.
[0136] S207, optimizing a first network parameter of the encoding network according to the first loss value, the second loss value, and the third loss value;
[0137] Specifically include:
[0138] The first loss value, the second loss value and the third loss value are used as optimization targets to construct a comprehensive loss function;
[0139] Calculate the gradient of the first network parameter of the encoding network based on the comprehensive loss value of the comprehensive loss function through a back propagation algorithm;
[0140] The gradient descent method is used to update the first network parameters of the encoding network according to the gradient.
[0141] It should be noted that when processing time series data with an average length of 20,000, in which fraudulent behavior is extremely subtle and the segments are short (about 30 to 50 time points), traditional methods of increasing network depth or width, or even adding attention mechanisms, may not effectively improve model performance. This may be because fraudulent information is difficult to capture in a large amount of normal data.
[0142] Therefore, in the technical solution of the embodiment of the present application, a multi-task learning framework is constructed. When optimizing the parameters of the encoding network, multiple loss functions are usually considered, and these loss functions correspond to different tasks. The first loss value is usually associated with the time series reconstruction task, the second loss value is related to the time series prediction task, and the third loss value involves the time series classification task. These three loss values jointly guide the learning of the encoding network to improve the performance of the overall model.
[0143] Suppose we are processing credit card transaction data and our goal is to detect fraudulent transactions.
[0144] Task and loss function definition:
[0145] Time series reconstruction task (first loss value):
[0146] Loss function: Mean squared error (MSE) or other distance metric.
[0147] Purpose: Minimize the difference between the reconstructed transaction sequence and the original sequence.
[0148] Time series prediction task (second loss value):
[0149] Loss function: MSE or mean absolute error (MAE).
[0150] Purpose: To predict future transaction amounts or patterns.
[0151] Time series classification task (third loss value):
[0152] Loss function: cross entropy loss.
[0153] Purpose: To distinguish normal transactions from fraudulent ones.
[0154] Optimization process:
[0155] Forward propagation:
[0156] The original transaction sequence passes through the encoding network to obtain feature representation.
[0157] Feature representations are used for reconstruction, prediction, and classification tasks.
[0158] Calculate the loss:
[0159] Calculate the MSE for the reconstruction task.
[0160] Calculate the MSE or MAE for the prediction task.
[0161] Compute the cross entropy loss for classification tasks.
[0162] Backward Propagation:
[0163] Merge the gradients of the three tasks.
[0164] Update the parameters of the encoding network to reduce the overall loss.
[0165] By comprehensively considering the loss functions of multiple tasks to optimize the parameters of the encoding network, the model's ability to understand and process time series data can be improved. This approach is particularly suitable for processing complex time series data, such as financial transaction data, where fraud needs to be accurately identified from a large amount of normal data. In this way, the model can not only improve the accuracy of classification, but also learn richer and more representative time series features.
[0166] S208. Optimize the second network parameters of the classification network according to the third loss value.
[0167] It should be noted that in the multi-task learning framework, the classification network usually focuses on mapping the feature vector output by the encoding network to the final classification result. The third loss value specifically refers to the loss directly related to the classification task, and the cross entropy loss function is usually used to calculate the difference between the probability distribution of the predicted category and the true label. Optimizing the parameters of the classification network according to the third loss value is to improve the classification accuracy, especially in unbalanced datasets such as fraud detection.
[0168] Furthermore, after step S208, the following steps are further included:
[0169] S209, optimizing a third network parameter of the decoding network and a fourth network parameter of the reconstruction network according to the first loss value;
[0170] S210. Optimize a fifth network parameter of the prediction network according to the second loss value.
[0171] In the embodiment of the present application, through the multi-task learning framework, we can simultaneously train time series reconstruction, time series prediction and time series classification tasks, which not only improves the model's understanding of time series data, but also enhances the model's ability to identify fraudulent behavior. The advantages of multi-task learning are:
[0172] Shared representation: Different tasks can share the underlying feature representation, which helps the model learn more generalized features.
[0173] Improved generalization: By training multiple tasks simultaneously, the model can perform more robustly when faced with new, unseen data.
[0174] Reduced data requirements: Auxiliary tasks do not require additional labels and can be trained using unlabeled data, which greatly reduces the need for labeled data.
[0175] Further, after optimizing the second network parameter of the classification network according to the third loss value, the method further includes:
[0176] Constructing a second model for fraud time series classification detection, the second model comprising the optimized feature extraction network, encoding network and classification network;
[0177] Obtaining a fraud time series sequence to be classified;
[0178] The fraudulent time series sequence is classified through the second model to obtain the classification label of the fraudulent time series sequence.
[0179] It should be noted that in a multi-task learning framework, there are usually different processing methods when training and reasoning the model.
[0180] In the time series classification method of the embodiment of the present application, a second model consisting of a trained feature extraction network, an encoding network and a classification network is used. By obtaining a fraudulent time series sequence to be classified, the input time series sequence is sent to the encoding network to extract features, and only the classification network is used to send the encoded features to the classification branch for fraud detection, and the classification result is output, that is, whether the time series sequence is a fraudulent behavior.
[0181] This training and inference approach allows the model to benefit from multiple tasks during the training phase and learn richer and more robust feature representations, while focusing on classification tasks during the inference phase, improving the practicality and efficiency of the model in real applications.
[0182] See also Figure 3 , Figure 3 Schematic diagram of the structure of the fraud detection model optimization device in the embodiment of the present application. Figure 3 As shown, specifically:
[0183] A construction unit 301 is used to construct a first model for fraud time series classification training, the first model including a feature extraction network, an encoding network, a decoding network, a reconstruction network, a classification network and a prediction network;
[0184] A feature extraction unit 302 is used to extract features from a training fraud time series sequence containing a preset label through a feature extraction network to obtain features of the training fraud time series sequence;
[0185] The encoding unit 303 is used to encode the feature through the encoding network to obtain a feature vector of the feature;
[0186] A time series reconstruction task training unit 304 is used to perform time series reconstruction task training by training the fraudulent time series sequence through the encoding network, the decoding network and the reconstruction network, and obtain a first loss value between the reconstructed time series sequence and the training fraudulent time series sequence;
[0187] The time series prediction task training unit 305 is used to perform time series prediction task training on the training fraud time series sequence through the encoding network and the prediction network to obtain a second loss value of the time series true value and the corresponding time series prediction value of the training fraud time series sequence;
[0188] A time series classification task training unit 306 is used to perform time series classification task training on the training fraud time series sequence through the encoding network and the classification network to obtain a third loss value of the classification label and the preset label;
[0189] A first optimization unit 307, configured to optimize a first network parameter of the encoding network according to the first loss value, the second loss value, and the third loss value;
[0190] The second optimization unit 308 is used to optimize the second network parameters of the classification network according to the third loss value.
[0191] Furthermore, the time series reconstruction task training unit 304 is specifically used for:
[0192] The feature vector is decoded by a decoding network to obtain a reconstructed time series sequence with the same sequence length as the training fraud time series sequence;
[0193] The first loss value of the reconstructed time series and the training fraud time series is obtained by reconstructing the network.
[0194] Furthermore, the time series prediction task training unit 305 is specifically used for:
[0195] Perform time series prediction on the feature vector through the prediction network to obtain the time series prediction value;
[0196] The loss is calculated between the time series prediction value and the time series true value corresponding to the training fraud time series sequence to obtain a second loss value.
[0197] Furthermore, the time series classification task training unit 306 is specifically used for:
[0198] The feature vector is classified through the classification network to obtain the classification label of the feature vector and its classification probability;
[0199] The third loss value is obtained according to the difference between the classification label and the preset label.
[0200] Furthermore, the first optimization unit 307 specifically includes:
[0201] The first loss value, the second loss value and the third loss value are used as optimization targets to construct a comprehensive loss function;
[0202] Calculate the gradient of the first network parameter of the encoding network based on the comprehensive loss value of the comprehensive loss function through a back propagation algorithm;
[0203] The gradient descent method is used to update the first network parameters of the encoding network according to the gradient.
[0204] Furthermore, it also includes:
[0205] A third optimization unit 309, configured to optimize a third network parameter of the decoding network and a fourth network parameter of the reconstruction network according to the first loss value;
[0206] The fourth optimization unit 310 is used to optimize the fifth network parameter of the prediction network according to the second loss value.
[0207] Furthermore, it also includes:
[0208] A second construction unit 311 is used to construct a second model for fraud time series classification detection, the second model including the optimized feature extraction network, encoding network and classification network;
[0209] An acquisition unit 312 acquires a fraud time series sequence to be classified;
[0210] The time series classification unit 313 is used to classify the fraudulent time series sequence through the second model to obtain a classification label of the fraudulent time series sequence.
[0211] Another embodiment of the present invention provides a fraud detection model optimization device, such as Figure 4 As shown, the device 10 includes:
[0212] One or more processors 110 and memory 120, Figure 4 A processor 110 is used as an example for description. The processor 110 and the memory 120 may be connected via a bus or other means. Figure 4 The example of connecting through bus is taken in the following.
[0213] The processor 110 is used to complete various control logics of the device 10, and it can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), a single-chip microcomputer, an ARM (Acorn RISCMachine) or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component, or any combination of these components. In addition, the processor 110 can also be any traditional processor, microprocessor or state machine. The processor 110 can also be implemented as a combination of computing devices, for example, a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a DSP and / or any other such configuration.
[0214] The memory 120 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions corresponding to the method for constructing a multilingual phoneme representation model in the embodiment of the present invention. The processor 110 executes various functional applications and data processing of the device 10 by running the non-volatile software programs, instructions and units stored in the memory 120, that is, implements the method for constructing a multilingual phoneme representation model in the above method embodiment.
[0215] The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function; the data storage area may store data created according to the use of the device 10, etc. In addition, the memory 120 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 120 may optionally include a memory remotely arranged relative to the processor 110, and these remote memories may be connected to the device 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
[0216] One or more units are stored in the memory 120, and when executed by one or more processors 110, the following steps are implemented:
[0217] Constructing a first model for fraud time series classification training, the first model comprising a feature extraction network, an encoding network, a decoding network, a reconstruction network, a classification network, and a prediction network;
[0218] Extract features from the training fraud time series sequence containing preset labels through a feature extraction network to obtain features of the training fraud time series sequence;
[0219] The features are encoded through the encoding network to obtain the feature vector of the feature;
[0220] The fraudulent time series is trained by the encoding network, the decoding network and the reconstruction network to perform time series reconstruction task training, and the first loss value of the reconstructed time series and the training fraudulent time series is obtained;
[0221] The training fraud time series sequence is trained on the time series prediction task through the encoding network and the prediction network to obtain the second loss value of the time series true value and the corresponding time series prediction value of the training fraud time series sequence;
[0222] The training fraud time series is trained on the time series classification task through the encoding network and the classification network to obtain the third loss value of the classification label and the preset label;
[0223] Optimizing a first network parameter of the encoding network according to the first loss value, the second loss value, and the third loss value;
[0224] According to the third loss value, the second network parameters of the classification network are optimized.
[0225] An embodiment of the present invention provides a non-volatile computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by one or more processors, any implementation of a fraud detection model optimization method described in the above embodiments is implemented.
[0226] As an example, non-volatile storage media can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) as external cache memory. By way of illustration and not limitation, RAM can be obtained in many forms such as synchronous RAM (SRAM), dynamic RAM, (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and direct Rambus RAM (DRRAM). The disclosed memory components or memories of the operating environment described herein are intended to include one or more of these and / or any other suitable types of memory.
[0227] In an embodiment of the present application, a fraud detection model optimization method, apparatus, device and medium are provided. By constructing a first model for fraud time series sequence classification training, time series reconstruction task training, time series prediction task training and time series classification task training of the first model are simultaneously performed, and the loss values obtained from the three task trainings are used to optimize the network parameters of the encoding network and the classification network in the first model. Then, time series classification can be performed by applying a second model consisting of a feature extraction network, an encoding network and a classification network. At the same time, in the auxiliary tasks consisting of the time series reconstruction task training and the time series prediction task training, no additional labeled samples are required, and only the original time series sequence can be used for training. The auxiliary tasks have a high correlation and synergy with the classification tasks, and the loss function can decrease synchronously, which solves the technical problems that the existing models for classification and identification of fraudulent behavior are difficult to capture fragments, the fragment samples lack clear annotations, making it difficult to learn the characteristics of fraudulent behavior, and the sample imbalance causes the model to predict the majority class and ignore the minority class.
[0228] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.
[0229] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein, for example. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0230] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.
[0231] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.
[0232] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0233] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
[0234] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (full name in English: Read-Only Memory, English abbreviation: ROM), random access memory (full name in English: Random Access Memory, English abbreviation: RAM), disk or optical disk and other media that can store program codes.
[0235] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.
[0236] It should be noted that if software tools or components other than those of our company appear in the embodiments of the present application, they are only used for illustrative purposes and do not represent actual use.
Claims
1. A fraud detection model optimization method, characterized in that: include: Constructing a first model for fraud time series classification training, wherein the first model includes a feature extraction network, an encoding network, a decoding network, a reconstruction network, a classification network, and a prediction network; Performing feature extraction on the training fraud time series sequence containing preset labels through the feature extraction network to obtain features of the training fraud time series sequence; Encoding the feature through the encoding network to obtain a feature vector of the feature; Performing time series reconstruction task training on the training fraud time series sequence through the encoding network, the decoding network and the reconstruction network to obtain a first loss value between the reconstructed time series sequence and the training fraud time series sequence; Performing time series prediction task training on the training fraud time series sequence through the encoding network and the prediction network to obtain a second loss value between a time series true value of the training fraud time series sequence and a corresponding time series prediction value; Performing time series classification task training on the training fraud time series sequence through the encoding network and the classification network to obtain a third loss value of the classification label and the preset label; Optimizing a first network parameter of the encoding network according to the first loss value, the second loss value, and the third loss value; According to the third loss value, the second network parameter of the classification network is optimized.
2. The fraud detection model optimization method according to claim 1, characterized in that: The training fraudulent time series sequence is trained through the encoding network, the decoding network and the reconstruction network to perform time series reconstruction task training to obtain a first loss value between the reconstructed time series sequence and the training fraudulent time series sequence specifically includes: Decoding the feature vector through the decoding network to obtain a reconstructed time series sequence having the same sequence length as the training fraud time series sequence; A first loss value between the reconstructed time series sequence and the training fraud time series sequence is obtained through the reconstruction network.
3. The fraud detection model optimization method according to claim 1, characterized in that: The step of performing time series prediction task training on the training fraud time series sequence through the encoding network and the prediction network to obtain a second loss value between the time series true value of the training fraud time series sequence and the corresponding time series prediction value specifically includes: Performing time series prediction on the feature vector through the prediction network to obtain a time series prediction value; The loss is calculated between the time series prediction value and the time series true value corresponding to the training fraud time series sequence to obtain a second loss value.
4. The fraud detection model optimization method according to claim 1, characterized in that: The step of performing time series classification task training on the training fraud time series by using the encoding network and the classification network to obtain the third loss value of the classification label and the preset label specifically includes: Classify the feature vector through the classification network to obtain the classification label and classification probability of the feature vector; A third loss value is obtained according to the difference between the classification label and the preset label.
5. The fraud detection model optimization method according to claim 1, characterized in that: The optimizing the first network parameter of the encoding network according to the first loss value, the second loss value and the third loss value specifically includes: Constructing a comprehensive loss function by taking the first loss value, the second loss value and the third loss value as optimization targets; Calculating the gradient of the first network parameter of the encoding network based on the comprehensive loss value of the comprehensive loss function through a back propagation algorithm; A gradient descent method is adopted to update a first network parameter of the encoding network according to the gradient.
6. The fraud detection model optimization method according to claim 1, characterized in that: After optimizing the second network parameter of the classification network according to the third loss value, the method further comprises: Optimizing a third network parameter of the decoding network and a fourth network parameter of the reconstruction network according to the first loss value; According to the second loss value, a fifth network parameter of the prediction network is optimized.
7. The fraud detection model optimization method according to claim 1, characterized in that: After optimizing the second network parameter of the classification network according to the third loss value, the method further comprises: Constructing a second model for fraud time series classification detection, wherein the second model includes the optimized feature extraction network, the encoding network, and the classification network; Obtaining a fraud time series sequence to be classified; The fraudulent time series sequence is classified by the second model to obtain a classification label of the fraudulent time series sequence.
8. A fraud detection model optimization device, characterized in that: include: A construction unit, used to construct a first model for fraud time series classification training, wherein the first model includes a feature extraction network, an encoding network, a decoding network, a reconstruction network, a classification network, and a prediction network; A feature extraction unit, configured to extract features from a training fraud time series sequence containing a preset label through the feature extraction network to obtain features of the training fraud time series sequence; An encoding unit, used for encoding the feature through the encoding network to obtain a feature vector of the feature; A timing reconstruction task training unit, used for performing timing reconstruction task training on the training fraud timing sequence through the encoding network, the decoding network and the reconstruction network to obtain a first loss value between the reconstructed timing sequence and the training fraud timing sequence; A time series prediction task training unit, used for performing time series prediction task training on the training fraud time series sequence through the encoding network and the prediction network to obtain a second loss value between a time series true value of the training fraud time series sequence and a corresponding time series prediction value; A time series classification task training unit, used for performing time series classification task training on the training fraud time series sequence through the encoding network and the classification network to obtain a third loss value of the classification label and the preset label; A first optimization unit, configured to optimize a first network parameter of the encoding network according to the first loss value, the second loss value, and the third loss value; The second optimization unit is used to optimize the second network parameter of the classification network according to the third loss value.
9. A fraud detection model optimization device, characterized in that: The device comprises a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the fraud detection model optimization method according to any one of claims 1-7 according to the instructions in the program code.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program code, and the program code is used to execute the fraud detection model optimization method according to any one of claims 1 to 7.