Abnormal transaction intelligent monitoring and analysis system and method based on AI drive

Abstract

The invention discloses an AI-driven abnormal transaction intelligent monitoring and analysis system and method, and relates to the technical field of artificial intelligence, and the method comprises the steps: obtaining structured features and unstructured features, carrying out the feature fusion, and constructing an account feature vector; constructing a cross-domain heterogeneous graph, learning an embedded vector of an account node in the cross-domain heterogeneous graph based on a time sequence heterogeneous graph neural network, and generating an account portrait vector; training an abnormal transaction detection model, and predicting the abnormal probability of the current real-time transaction record of the account by taking the account portrait vector and the transaction record as input data; dividing all accounts into account groups based on the account portrait vectors, calculating a group abnormal transaction threshold value, and calculating an adaptive abnormal transaction threshold value based on the group abnormal transaction threshold value and the similarity between the account portrait vectors and the center vectors of the account groups to which the account portrait vectors belong; and if the abnormal probability is greater than a self-adaptive abnormal transaction threshold, marking the transaction of the account as an abnormal transaction, triggering risk control measures, and regularly updating the self-adaptive abnormal transaction threshold.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to an AI-driven intelligent monitoring and analysis system and method for abnormal transactions. Background Art

[0002] In the financial field, monitoring of abnormal transactions is crucial to maintaining market stability and avoiding financial risks. With the rapid development of financial technology, financial transactions are becoming increasingly frequent and complex. Traditional transaction anomaly detection methods have been unable to adapt to the real-time analysis needs of massive transaction data.

[0003] A Chinese patent with authorization announcement number CN106202389B discloses a method and device for abnormality monitoring based on transaction data, including: obtaining real-time transaction data of a monitored object, the real-time transaction data at least including transactions per second TPS; determining the TPS group level in the scale level to which the monitored object belongs according to the TPS of the monitored object; determining the success rate statistical period and transaction success rate threshold of the monitored object according to the TPS group level of the monitored object; according to the real-time transaction data of the monitored object, counting the real-time transaction success rate of the monitored object within the success rate statistical period; comparing the real-time transaction success rate with the transaction success rate threshold, and if the real-time transaction success rate is less than the transaction success rate threshold, determining that the transaction data of the monitored object is abnormal.

[0004] The transaction behaviors of different user groups vary greatly. Existing methods use unified anomaly detection rules, which are prone to high false positive and false negative rates. Summary of the invention

[0005] The present application aims to solve at least one of the technical problems in the related art to a certain extent. To this end, one purpose of the present application is to propose an AI-driven intelligent monitoring and analysis system and method for abnormal transactions, thereby improving the accuracy of abnormal identification.

[0006] One aspect of the present application provides an AI-driven intelligent monitoring and analysis method for abnormal transactions, including: Step S100: Obtain structured features and unstructured features of each account in the transaction system, fuse the structured features and unstructured features, and construct an account feature vector; Step S200: Based on the account feature vector, define the account node, define the relationship edge and edge weight according to the unstructured feature, construct a cross-domain heterogeneous graph, learn the embedding vector of the account node in the cross-domain heterogeneous graph based on the time series heterogeneous graph neural network, and generate the account portrait vector; Step S300: training an abnormal transaction detection model for predicting the abnormal probability of each transaction, taking the account portrait vector and each transaction record as input data, taking the abnormal probability of the transaction record as output data, and predicting the abnormal probability of the current real-time transaction record of the account; Step S400: All accounts are divided into KM account groups based on the account portrait vector, and the group abnormal transaction threshold of each account group is calculated. Based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs, the adaptive abnormal transaction threshold of the account is calculated; Step S500: Compare the abnormal probability output by the abnormal transaction detection model with the adaptive abnormal transaction threshold of the account. If the abnormal probability is greater than the adaptive abnormal transaction threshold, the transaction of the account is marked as an abnormal transaction, and the corresponding risk control measures are triggered. The adaptive abnormal transaction threshold of each account is updated regularly. The specific method of obtaining the structured features and unstructured features of each account in the transaction system, fusing the structured features and unstructured features, and constructing the account feature vector is as follows: Step S110: Obtain structured features and unstructured features of each account from the transaction system, wherein the structured features include but are not limited to: transaction amount , Trading frequency The unstructured features include but are not limited to: behavior sequence , social relationships ; Step S120: Extract the feature vectors of structured features and unstructured features and fuse them to obtain the account feature vector of each account ; The specific method of defining account nodes based on account feature vectors, defining relationship edges and edge weights according to unstructured features, and constructing a cross-domain heterogeneous graph is as follows: Step S210: Using the structured features as attributes of the account node, constructing an account node based on the account feature vector and the corresponding attributes of each account node; Step S220: construct relationship edges between accounts based on unstructured features, and calculate the behavior sequence similarity between accounts based on the behavior sequence in the unstructured features; the behavior sequence of account node i is , the behavior sequence of account node j is ,in, are the behavior vectors of account nodes i and j at time T, respectively. The dynamic time warping algorithm is used based on the time decay factor Assign adaptive weights to the behavior sequence similarities of different time lengths from the current moment, and calculate the behavior sequence similarity of account node i and account node j ; Step S230: Converting the behavior sequence similarity into behavior similarity ; Step S240: Obtain the k-hop neighbor set of account nodes i and j in the social network according to the social relationship of the account. , calculate the common neighbor index between account nodes , assign different weights to neighbors with different social distances, and obtain the weighted common neighbor index , normalize the weighted common neighbor index to interval, get the social association between account nodes i and j ; Step S250: Calculate the edge weight of the relationship edge between account nodes i and j based on behavior similarity and social association , the account nodes, relationship edges and their edge weights form a cross-domain heterogeneous graph; The training method of the temporal heterogeneous graph neural network is: Step S261: construct a temporal heterogeneous graph neural network, including a heterogeneous graph encoding layer, a temporal encoding layer, an attention mechanism, an output layer, and a training optimization module, with the cross-domain heterogeneous graph at each moment as input and the embedded vector of the account node at each moment as output; The heterogeneous graph encoding layer is used to map the features of each account node and relationship edge to a unified embedding space; based on the heterogeneous graph encoding layer, a temporal encoding layer is introduced to capture the dynamic temporal evolution pattern of the node embedding representation, and the cross-domain heterogeneous graph sequence at each moment is used as input to output the embedding vector of the account node at each moment, and characterize the trajectory of the embedding vector of the account node evolving over time; the attention mechanism is used to adaptively assign weights to different neighbors to highlight the influence of key neighbors; the output layer outputs the embedding vector of each account node at each moment; the training optimization module is used to calculate the gradient of the loss function to the model parameters using the back propagation algorithm.

[0007] Step S262: For each account node i, construct a positive sample set and a negative sample set based on behavioral similarity and social association, set a similarity threshold and an association threshold, and take the account nodes whose behavioral similarity with account node i is greater than the similarity threshold or whose social association is greater than the association threshold as positive samples, and include the account nodes that do not belong to the positive sample set into the negative sample set. Take the positive samples and negative samples as training data, adopt an unsupervised training method, take the nodes in the cross-domain heterogeneous graph as input, and take the embedded representation of the nodes as output. Apply the time series heterogeneous graph neural network on the cross-domain heterogeneous graph, and forward propagate to generate the embedding vectors of all account nodes at each time t. ; Step S263: Use the embedding vector of account node i at time t , calculate the account node i and the positive sample set , the similarity of the account nodes in the negative sample set, and the comparison loss function at the current time t is calculated based on the similarity , average the comparison loss functions of all account nodes and all moments to get the final loss function , with minimizing the loss function as the training objective; Step S264: Calculate the gradient of the loss function with respect to the model parameters through the back propagation algorithm, and use the optimizer to update the model parameters; Step S265: repeat steps S262 to S264 until the loss function converges; The specific method of learning the embedding vector of the account node in the cross-domain heterogeneous graph based on the time series heterogeneous graph neural network and generating the account portrait vector is as follows: Step S260: On the cross-domain heterogeneous graph, a temporal heterogeneous graph neural network is used to learn the embedding vector of the account node, and the embedding vector of the account node i in the lth layer is obtained by forward propagation. , introduce the attention mechanism to calculate the attention weights of neighbor account nodes with different social relationships for account node i ; Step S270: define a gated recursive unit aggregation function at the temporal coding layer to fuse the embedding vector of the neighbor account node j at the current moment and the embedding vector of account node i at the previous moment , get the embedding vector of account node i at the current time t ; Step S280: embedding vector of account node i at time t Structural features of account nodes Perform splicing to obtain the account portrait vector of account node i ; The training of the abnormal transaction detection model for predicting the abnormal probability of each transaction takes the account portrait vector and each transaction record as input data, and takes the abnormal probability of the transaction record as output data. The specific method for predicting the abnormal probability of the current real-time transaction record of the account is: Step S310: Obtain transaction records of a batch of accounts, extract their account portrait vectors, mark abnormal transactions with abnormal transaction labels, construct training samples based on the account portrait vectors and abnormal transaction labels, use the account portrait vectors and transaction records as input data, use the abnormal transaction labels as output data, and train the abnormal transaction detection model; Step S320: for each training sample, accurately predicting the abnormal transaction label is used as the prediction target, using the cross entropy loss function as the loss function of the training model, minimizing the value of the loss function is used as the training target, and the training is completed when the loss function converges; Step S330: using the trained abnormal transaction detection model, for the current real-time transaction, extracting the account portrait vector and real-time transaction record of the corresponding account as input data, and outputting the abnormal probability of the real-time transaction; The method of dividing all accounts into KM account groups based on the account portrait vector, calculating the group abnormal transaction threshold for each account group, and calculating the adaptive abnormal transaction threshold of the account based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs is as follows: Step S410: Divide all accounts into KM account groups based on the account portrait vector using the k-means clustering algorithm; Step S420: For each account group , extract the account Account portrait vector and historical transaction records, The account portrait vector and each historical transaction record are used as input data into the abnormal transaction detection model to obtain the abnormal probability of each historical transaction. Represents the account in the kmth account group The abnormal probability of the fth historical transaction; Step S430: Account The abnormal probability of each historical transaction is counted to obtain the account Distribution of abnormal transaction scores ; Step S440: Calculate Account Statistical characteristics of the distribution of abnormal transaction scores, including the mean , Standard Deviation ; Step S450: Calculate the statistical characteristics of the abnormal transaction score distribution of each account in the account group to obtain the group abnormal transaction threshold of the account group ; Step S460: For each account , calculate the similarity between its account portrait vector and the center vector of the account group to which it belongs ,in, Indicates account Account portrait vector, represents the center vector of the km-th account group; Step S470: According to the account The similarity between the account portrait vector and the central vector of the account group to which it belongs and the abnormal transaction threshold of the group are calculated. Adaptive abnormal transaction threshold .

[0008] One aspect of the present application provides an AI-driven intelligent monitoring and analysis system for abnormal transactions, including: The account feature acquisition module is used to obtain the structured and unstructured features of each account in the trading system, fuse the structured and unstructured features, and construct an account feature vector; The account portrait generation module is used to define account nodes based on account feature vectors, define relationship edges and edge weights based on unstructured features, build cross-domain heterogeneous graphs, learn the embedding vectors of account nodes in cross-domain heterogeneous graphs based on time-series heterogeneous graph neural networks, and generate account portrait vectors; The abnormal probability prediction module is used to train an abnormal transaction detection model for predicting the abnormal probability of each transaction. It uses the account portrait vector and each transaction record as input data and the abnormal probability of the transaction record as output data to predict the abnormal probability of the current real-time transaction record of the account. An adaptive threshold calculation module is used to divide all accounts into KM account groups based on the account portrait vector, calculate the group abnormal transaction threshold for each account group, and calculate the adaptive abnormal transaction threshold of the account based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs; The anomaly detection update module is used to compare the anomaly probability output by the abnormal transaction detection model with the adaptive abnormal transaction threshold of the account. If the anomaly probability is greater than the adaptive abnormal transaction threshold, the transaction of the account is marked as an abnormal transaction, and the corresponding risk control measures are triggered. The adaptive abnormal transaction threshold of each account is updated regularly.

[0009] One aspect of the present application provides a readable storage medium, which stores a computer program, and the computer program is suitable for loading by a processor to execute the steps in an AI-driven intelligent monitoring and analysis method for abnormal transactions.

[0010] Compared with the prior art, the AI-driven intelligent monitoring and analysis system and method for abnormal transactions proposed in this application have the following advantages: This application models cross-domain account relationships through graphs, revealing common patterns hidden in different business scenarios, which helps to identify group anomalies. The heterogeneous graph contains rich structured and unstructured information, comprehensively describing the behavior patterns of different user groups.

[0011] This application clusters users first, and then customizes abnormal thresholds for different groups, replacing the "one-size-fits-all" unified threshold. At the same time, the threshold is dynamically adjusted according to the similarity between the user account and the group to which it belongs, taking into account the differences within the group. The more the account deviates from the group to which it belongs, the stricter the threshold, and vice versa. Flexible defense can improve the detection rate while reducing the false alarm rate.

[0012] This application uses graph neural networks to process time-series heterogeneous graph data, learn dynamically evolving user representations, capture the evolution laws of behaviors of different groups, promptly discover subtle abnormal changes in different groups, reduce the missed alarm rate, and use an attention mechanism to dynamically adjust the weights of neighbors with different relationships, focus on the key influencing factors of different groups, improve the pertinence and interpretability of detection, and reduce the false alarm rate.

[0013] This application integrates user portraits and transaction sequences, makes judgments based on abnormal transaction detection models, comprehensively considers user static attributes and dynamic behaviors, and improves the accuracy of anomaly identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A method flow chart of the AI-driven abnormal transaction intelligent monitoring and analysis method provided in this application; Figure 2 A schematic diagram of a method for constructing a cross-domain heterogeneous graph provided in this application; Figure 3 A schematic diagram of the method for generating an account portrait vector provided in this application; Figure 4 Functional module diagram of the AI-driven abnormal transaction intelligent monitoring and analysis system provided for this application. DETAILED DESCRIPTION

[0015] In order to better understand the present application, various aspects of the present application will be described in more detail with reference to the accompanying drawings. It should be understood that these detailed descriptions are only descriptions of exemplary embodiments of the present application and do not limit the scope of the present application in any way. Throughout the specification, the same reference numerals refer to the same elements. The expression "and / or" includes any and all combinations of one or more of the associated listed items.

[0016] In the accompanying drawings, the size, dimensions and shapes of the elements have been slightly adjusted for ease of illustration. The drawings are for illustration only and are not strictly drawn to scale. As used herein, the terms "substantially", "approximately" and similar terms are used as terms of approximation, not as terms of degree, and are intended to illustrate the inherent deviations in measurements or calculations that will be recognized by those of ordinary skill in the art. In addition, in this application, the order in which the steps are described does not necessarily represent the order in which these processes occur in actual operation, unless otherwise specified or can be derived from the context.

[0017] It should also be understood that expressions such as "including", "comprising", "having", "containing" and / or "comprising" are open rather than closed expressions in this specification, which indicate the presence of the stated features, elements and / or components, but do not exclude the presence of one or more other features, elements, components and / or combinations thereof. In addition, when expressions such as "at least one of..." appear after a list of listed features, they modify the entire list of features rather than just the individual elements in the list. In addition, when describing embodiments of the present application, "may" is used to mean "one or more embodiments of the present application". And, the term "exemplary" is intended to refer to an example or illustration.

[0018] Unless otherwise defined, all words (including engineering terms and scientific and technological terms) used in this article have the same meaning as those commonly understood by ordinary technicians in the field to which this application belongs. It should also be understood that unless there is a clear explanation in this application, words defined in commonly used dictionaries should be interpreted as having the same meaning as their meaning in the context of the relevant technology, and should not be interpreted in an idealized or overly formal sense.

[0019] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0020] Example 1

[0021] like Figure 1 As shown, the AI-driven abnormal transaction intelligent monitoring and analysis method provided in this application includes: Step S100: Obtain structured features and unstructured features of each account in the transaction system, fuse the structured features and unstructured features, and construct an account feature vector; The specific method of obtaining the structured features and unstructured features of each account in the transaction system, fusing the structured features and unstructured features, and constructing the account feature vector is as follows: Step S110: Obtain structured features and unstructured features of each account from the transaction system, wherein the structured features include but are not limited to: transaction amount , Trading frequency The unstructured features include but are not limited to: behavior sequence , social relationships ; Step S120: Extract the feature vectors of structured features and unstructured features and fuse them to obtain the account feature vector of each account ; The calculation formula of the account feature vector is: ,in, is the account feature vector, MI is the number of types of numerical features in the structured features, is the mi-th numerical feature in the structured feature, is the number of feature types of behavior sequences in unstructured features, is the mjth behavior sequence in the unstructured feature, is the number of feature types of social relations in unstructured features, is the mkth social relationship in the unstructured features, They are the weight coefficients of numerical features in structured features, behavior sequences in unstructured features, and social relationships; The above steps use feature fusion to map heterogeneous data into a unified feature space, which facilitates subsequent modeling.

[0022] Step S200: Based on the account feature vector, define the account node, define the relationship edge and edge weight according to the unstructured feature, construct a cross-domain heterogeneous graph, learn the embedding vector of the account node in the cross-domain heterogeneous graph based on the time series heterogeneous graph neural network, and generate the account portrait vector; The specific method of defining account nodes based on account feature vectors, defining relationship edges and edge weights according to unstructured features, and constructing a cross-domain heterogeneous graph is as follows: Step S210: Using the structured features as attributes of the account node, constructing an account node based on the account feature vector and the corresponding attributes of each account node; Step S220: construct relationship edges between accounts based on unstructured features, and calculate the behavior sequence similarity between accounts based on the behavior sequence in the unstructured features; the behavior sequence of account node i is , the behavior sequence of account node j is ,in, are the behavior vectors of account nodes i and j at time T, respectively. The dynamic time warping algorithm is used based on the time decay factor Assign adaptive weights to the behavior sequence similarities of different time lengths from the current moment, and calculate the behavior sequence similarities of account node i and account node j; The construction of relationship edges between accounts based on unstructured features refers to the construction of relationship edges between accounts that have behavioral sequences and social relationships; The calculation formula of the behavior sequence similarity is: ,in, is the optimal alignment path of the behavior sequence of account nodes i and j, is the L2 norm, is the behavior vector of account node i at time t, For account node j in The behavior vector at the moment, for the current moment; The time decay factor assigns a smaller weight to behaviors at a time far away from the current moment, which can effectively reduce the impact of behaviors at a far away time on the similarity.

[0023] The optimal alignment path of the behavior sequences of the account nodes i and j is found based on the dynamic time warping algorithm. First, the behavior sequences of the two accounts are matched with each other, and the distance between each pair of behaviors in the two behavior sequences is calculated to obtain a distance matrix. The optimal path is found from the starting point of the sequence to the end point of the sequence. Each moving direction with the smallest cumulative distance is selected, and the minimum cumulative distance to each point is recorded using the dynamic programming method. When the end point is reached, go back from the end point and select the previous point with the smallest cumulative distance each time. The final path is the optimal alignment path for the two behavior sequences.

[0024] Step S230: Converting the behavior sequence similarity into behavior similarity ; The calculation formula of the behavior similarity is: ,in, is a scaling parameter used to control the scale of behavioral similarity and is set by those skilled in the art based on experience; Step S240: Obtain the k-hop neighbor set of account nodes i and j in the social network according to the social relationship of the account. , calculate the common neighbor index between account nodes , assign different weights to neighbors with different social distances, and obtain the weighted common neighbor index , normalize the weighted common neighbor index to Interval, get the social connection between account nodes i and j; The calculation formula of the common neighbor index between the account nodes is: ; The common neighbor index measures the number of shared neighbors between two account nodes in a social network, reflecting the structural similarity between accounts.

[0025] The calculation formula of the social association degree is: ,in, and Respectively represent the weighted common neighbor index of account nodes i and j themselves; The calculation formula of the weighted common neighbor index is: ,in, represents the weight of the kth neighbor in the k-hop neighbor set, and K is the total number of neighbors in the k-hop neighbor set; The weight satisfy: The specific value of the weight is set by those skilled in the art according to the social distance between the account nodes in the neighbor set; The calculation formula of the weighted common neighbor index of the account node i itself is: ; The calculation formula of the weighted common neighbor index of the account node j itself is: ; The k-hop neighbor set refers to the set of all account nodes that can be reached from an account node through no more than k edges. For example, a user's 1-hop neighbors are his direct friends, 2-hop neighbors include friends of friends, and so on.

[0026] The common neighbor index is an indicator used to measure the similarity between two nodes in a graph.

[0027] Step S250: Calculate the edge weight of the relationship edge between account nodes i and j based on behavior similarity and social association , the account nodes, relationship edges and their edge weights form a cross-domain heterogeneous graph; The calculation formula of the edge weight of the relationship edge is: ,in, is the weight factor; The weight factor is set by those skilled in the art based on experience.

[0028] Figure 2 A schematic diagram of a method for constructing a cross-domain heterogeneous graph provided in this application; The training method of the temporal heterogeneous graph neural network is: Step S261: construct a temporal heterogeneous graph neural network, including a heterogeneous graph encoding layer, a temporal encoding layer, an attention mechanism, an output layer, and a training optimization module, with the cross-domain heterogeneous graph at each moment as input and the embedded vector of the account node at each moment as output; The heterogeneous graph encoding layer is used to map the features of each account node and relationship edge to a unified embedding space; based on the heterogeneous graph encoding layer, a temporal encoding layer is introduced to capture the dynamic temporal evolution pattern of the node embedding representation, and the cross-domain heterogeneous graph sequence at each moment is used as input to output the embedding vector of the account node at each moment, and characterize the trajectory of the embedding vector of the account node evolving over time; the attention mechanism is used to adaptively assign weights to different neighbors to highlight the influence of key neighbors; the output layer outputs the embedding vector of each account node at each moment; the training optimization module is used to calculate the gradient of the loss function to the model parameters using the back propagation algorithm.

[0029] Step S262: For each account node i, construct a positive sample set and a negative sample set based on behavioral similarity and social association, set a similarity threshold and an association threshold, and take the account nodes whose behavioral similarity with account node i is greater than the similarity threshold or whose social association is greater than the association threshold as positive samples, and include the account nodes that do not belong to the positive sample set into the negative sample set. Take the positive samples and negative samples as training data, adopt an unsupervised training method, take the nodes in the cross-domain heterogeneous graph as input, and take the embedded representation of the nodes as output. Apply the time series heterogeneous graph neural network on the cross-domain heterogeneous graph, and forward propagate to generate the embedding vectors of all account nodes at each time t. ; Step S263: Use the embedding vector of account node i at time t , calculate the account node i and the positive sample set , the similarity of the account nodes in the negative sample set, and the comparison loss function at the current time t is calculated based on the similarity , average the contrast loss functions of all account nodes and all moments to get the final loss function, and minimize the loss function as the training goal; The calculation formula of the contrast loss function is: ,in, is the similarity of the embedding vector, is the positive sample set, is the negative sample set, is the embedding vector of the account node p in the positive sample set at time t, is the embedding vector of account node n in the negative sample set at time t, is a logarithmic function; The calculation formula of the loss function is: ,in, is the set of all account nodes, is the total time; Step S264: Calculate the gradient of the loss function with respect to the model parameters through the back propagation algorithm, and use the optimizer to update the model parameters; Step S265: repeat steps S262 to S264 until the loss function converges; The specific method of learning the embedding vector of the account node in the cross-domain heterogeneous graph based on the time series heterogeneous graph neural network and generating the account portrait vector is as follows: Step S260: On the cross-domain heterogeneous graph, a temporal heterogeneous graph neural network is used to learn the embedding vector of the account node, and the embedding vector of the account node i in the lth layer is obtained by forward propagation. , introduce the attention mechanism to calculate the attention weights of neighbor account nodes with different social relationships to account node i; The calculation formula for the forward propagation is: ,in, is the activation function, Z is the type set of social relationships between accounts, z is the social relationship, is the set of neighbor nodes of account node i under social relationship z, j is the neighbor account node of account node i under social relationship z, is the attention weight between account nodes i and j under social relationship z, is the transformation matrix of social relationship z, is the embedding vector of account node j in layer l-1, is the transformation matrix embedded in the account node itself, is the embedding vector of account node i in layer l-1, is the bias term of the lth layer; The calculation formula of the attention weight is: , where T is the transpose symbol, is the transformation matrix under the social relationship z in the attention mechanism, is the characteristic vector of the relationship edge between account node i and account node j, r is the neighbor account node of account node i under social relationship z, is the embedding vector of the account node r in the l-1th layer, is the feature vector of the relationship edge between account node i and account node r; The feature vector of the relationship edge refers to the characteristics of the behavior and social relationship between the account nodes; Step S270: define a gated recursive unit aggregation function at the temporal coding layer to fuse the embedding vector of the neighbor account node j at the current moment and the embedding vector of account node i at the previous moment , get the embedding vector of account node i at the current time t ; The functional expression of the gated recursive unit aggregation function is: ,in, is the set of neighbor nodes of account node i under social relationship z at time t, is the attention weight between account nodes i and j under social relationship z at the current time t, is the aggregation parameter matrix of social relationship z at time t, is the aggregation function of the gated recurrent unit; Step S280: embedding vector of account node i at time t Structural features of account nodes Perform splicing to obtain the account portrait vector of account node i ; The expression of the account portrait vector is: ,in, Refers to the splicing operation; Figure 3 A schematic diagram of the method for generating an account portrait vector provided in this application; Step S300: training an abnormal transaction detection model for predicting the abnormal probability of each transaction, taking the account portrait vector and each transaction record as input data, taking the abnormal probability of the transaction record as output data, and predicting the abnormal probability of the current real-time transaction record of the account; The training of the abnormal transaction detection model for predicting the abnormal probability of each transaction takes the account portrait vector and each transaction record as input data, and takes the abnormal probability of the transaction record as output data. The specific method for predicting the abnormal probability of the current real-time transaction record of the account is: Step S310: Obtain transaction records of a batch of accounts, extract their account portrait vectors, mark abnormal transactions with abnormal transaction labels, construct training samples based on the account portrait vectors and abnormal transaction labels, use the account portrait vectors and transaction records as input data, use the abnormal transaction labels as output data, and train the abnormal transaction detection model; The abnormal transaction detection model adopts a machine learning algorithm; preferably, a logistic regression model is selected as the initial network of the abnormal transaction detection model; Step S320: for each training sample, accurately predicting the abnormal transaction label is used as the prediction target, using the cross entropy loss function as the loss function of the training model, minimizing the value of the loss function is used as the training target, and the training is completed when the loss function converges; The calculation formula of the loss function is: , where NI is the number of training samples, is the true abnormal transaction label of the ni-th training sample, is the abnormal probability predicted by the ni-th training sample; Step S330: using the trained abnormal transaction detection model, for the current real-time transaction, extracting the account portrait vector and real-time transaction record of the corresponding account as input data, and outputting the abnormal probability of the real-time transaction; The abnormal probability reflects the abnormality of the transaction, and a higher score indicates a more suspicious transaction.

[0030] Step S400: All accounts are divided into KM account groups based on the account portrait vector, and the group abnormal transaction threshold of each account group is calculated. Based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs, the adaptive abnormal transaction threshold of the account is calculated; The method of dividing all accounts into KM account groups based on the account portrait vector, calculating the group abnormal transaction threshold for each account group, and calculating the adaptive abnormal transaction threshold of the account based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs is as follows: Step S410: Divide all accounts into KM account groups based on the account portrait vector using the k-means clustering algorithm; The KM is the number of clusters of the k-means clustering algorithm, and the number of clusters is set by those skilled in the art based on experience.

[0031] Step S420: For each account group , extract the account Account portrait vector and historical transaction records, The account portrait vector and each historical transaction record are used as input data into the abnormal transaction detection model to obtain the abnormal probability of each historical transaction. Represents the account in the kmth account group The abnormal probability of the fth historical transaction; Step S430: Account The abnormal probability of each historical transaction is counted to obtain the account Distribution of abnormal transaction scores; The expression of the abnormal transaction score distribution is: ,in, For Account Total number of historical transactions; Step S440: Calculate Account Statistical characteristics of the distribution of abnormal transaction scores, including the mean , Standard Deviation ; The calculation formula of the mean is: ; The calculation formula of the standard deviation is: ; Step S450: Calculate the statistical characteristics of the abnormal transaction score distribution of each account in the account group to obtain the group abnormal transaction threshold of the account group ; The calculation formula for the group abnormal transaction threshold of the account group is: ,in, is the number of accounts in the km-th account group, is the population threshold control parameter, represents the abnormal transaction threshold of the km-th account group; The group threshold control parameter is used to adjust the strictness of the group abnormal transaction threshold, and is set by those skilled in the art based on experience; Step S460: For each account , calculate the similarity between its account portrait vector and the center vector of the account group to which it belongs ,in, Indicates account Account portrait vector, represents the center vector of the km-th account group; The center vector of the km-th account group is: ; The calculation formula for the similarity between the account portrait vector and the central vector of the account group to which it belongs is: , Indicates the module length; Step S470: According to the account The similarity between the account portrait vector and the central vector of the account group to which it belongs and the abnormal transaction threshold of the group are calculated. Adaptive abnormal transaction threshold ; The calculation formula of the adaptive abnormal transaction threshold is: ,in, is the similarity influencing parameter; The similarity impact parameter is used to adjust the influence of the similarity between the account portrait vector and the center vector on the threshold, and is set by technicians in this field based on experience.

[0032] Step S500: Compare the abnormal probability output by the abnormal transaction detection model with the adaptive abnormal transaction threshold of the account. If the abnormal probability is greater than the adaptive abnormal transaction threshold, the transaction of the account is marked as an abnormal transaction, and the corresponding risk control measures are triggered. The adaptive abnormal transaction threshold of each account is updated regularly. Furthermore, if the abnormal probability is less than or equal to the adaptive abnormal transaction threshold, the transaction of the account is marked as a normal transaction and no further processing is required.

[0033] Example 2

[0034] like Figure 4 As shown, the AI-driven abnormal transaction intelligent monitoring and analysis system provided by this application includes: The account feature acquisition module is used to obtain the structured and unstructured features of each account in the trading system, fuse the structured and unstructured features, and construct an account feature vector; The account portrait generation module is used to define account nodes based on account feature vectors, define relationship edges and edge weights based on unstructured features, build cross-domain heterogeneous graphs, learn the embedding vectors of account nodes in cross-domain heterogeneous graphs based on time-series heterogeneous graph neural networks, and generate account portrait vectors; The abnormal probability prediction module is used to train an abnormal transaction detection model for predicting the abnormal probability of each transaction. It uses the account portrait vector and each transaction record as input data and the abnormal probability of the transaction record as output data to predict the abnormal probability of the current real-time transaction record of the account. An adaptive threshold calculation module is used to divide all accounts into KM account groups based on the account portrait vector, calculate the group abnormal transaction threshold for each account group, and calculate the adaptive abnormal transaction threshold of the account based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs; The anomaly detection update module is used to compare the anomaly probability output by the abnormal transaction detection model with the adaptive abnormal transaction threshold of the account. If the anomaly probability is greater than the adaptive abnormal transaction threshold, the transaction of the account is marked as an abnormal transaction, and the corresponding risk control measures are triggered. The adaptive abnormal transaction threshold of each account is updated regularly.

[0035] Example 3

[0036] According to one embodiment of the present application, a readable storage medium is also provided. Computer-readable instructions are stored on the readable storage medium. When the computer-readable instructions are executed by the processor, the AI-driven intelligent monitoring and analysis method for abnormal transactions according to the embodiment of the present application can be executed. The storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory and cache memory. Non-volatile memory may include, for example, read-only memory, hard disk, flash memory, etc.

[0037] In addition, according to the implementation mode of the present application, the process described in the above method flow chart can be implemented as a computer software program. For example, the present application provides a non-transitory machine-readable storage medium, which stores machine-readable instructions, and the machine-readable instructions can be executed by a processor to execute instructions corresponding to the method steps provided by the present application, such as: obtaining the structured features and unstructured features of each account in the transaction system, fusing the structured features and unstructured features, and constructing an account feature vector; based on the account feature vector, defining account nodes, defining relationship edges and edge weights according to the unstructured features, constructing a cross-domain heterogeneous graph, learning the embedding vectors of account nodes in the cross-domain heterogeneous graph based on the time series heterogeneous graph neural network, and generating an account portrait vector; training an abnormal transaction detection model for predicting the abnormal probability of each transaction, and using the account portrait vector to generate an account portrait vector; The vector and each transaction record are used as input data, and the abnormal probability of the transaction record is used as output data to predict the abnormal probability of the current real-time transaction record of the account; all accounts are divided into KM account groups based on the account portrait vector, and the group abnormal transaction threshold of each account group is calculated, and the adaptive abnormal transaction threshold of the account is calculated based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs; the abnormal probability output by the abnormal transaction detection model is compared with the adaptive abnormal transaction threshold of the account, and if the abnormal probability is greater than the adaptive abnormal transaction threshold, the transaction of the account is marked as an abnormal transaction, and the corresponding risk control measures are triggered, and the adaptive abnormal transaction threshold of each account is regularly updated. When the computer program is executed by the central processing unit, the above functions defined in the method of the present application are executed.

[0038] The method and system of the present application may be implemented in many ways. For example, the method and system of the present application may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order for the method steps is for illustration only, and the method steps of the present application are not limited to the order specifically described above unless otherwise specified. In addition, in some embodiments, the present application may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present application. Therefore, the present application also covers a recording medium storing a program for executing the method according to the present application.

[0039] In addition, the parts of the above-mentioned technical solutions provided in the embodiments of the present application that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive redundancy.

[0040] The specific implementation modes as described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation mode of the present invention and is not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An AI-driven intelligent monitoring and analysis method for abnormal transactions, characterized in that: include: Obtain the structured and unstructured features of each account in the trading system, fuse the structured and unstructured features, and construct an account feature vector; Based on the account feature vector, define the account node, define the relationship edge and edge weight according to the unstructured features, build a cross-domain heterogeneous graph, learn the embedding vector of the account node in the cross-domain heterogeneous graph based on the time series heterogeneous graph neural network, and generate the account portrait vector; Train an abnormal transaction detection model for predicting the abnormal probability of each transaction, using the account profile vector and each transaction record as input data, and the abnormal probability of the transaction record as output data, to predict the abnormal probability of the current real-time transaction record of the account; Based on the account portrait vector, all accounts are divided into KM account groups, and the group abnormal transaction threshold of each account group is calculated. Based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs, the adaptive abnormal transaction threshold of the account is calculated; The abnormal probability output by the abnormal transaction detection model is compared with the adaptive abnormal transaction threshold of the account. If the abnormal probability is greater than the adaptive abnormal transaction threshold, the transaction of the account is marked as an abnormal transaction, and the corresponding risk control measures are triggered. The adaptive abnormal transaction threshold of each account is updated regularly.

2. The AI-driven abnormal transaction intelligent monitoring and analysis method according to claim 1, characterized in that: The specific method of obtaining the structured features and unstructured features of each account in the transaction system, fusing the structured features and unstructured features, and constructing the account feature vector is as follows: Obtain structured and unstructured features of each account from the trading system, where the structured features include but are not limited to: transaction amount , Trading frequency The unstructured features include but are not limited to: behavior sequence , social relationships ; Extract the feature vectors of structured features and unstructured features and fuse them to obtain the account feature vector of each account .

3. The AI-driven abnormal transaction intelligent monitoring and analysis method according to claim 2, characterized in that: The specific method of defining account nodes based on account feature vectors, defining relationship edges and edge weights according to unstructured features, and constructing a cross-domain heterogeneous graph is as follows: The structured features are used as attributes of the account nodes, and the account nodes are constructed based on the account feature vectors and corresponding attributes of each account node; The relationship edges between accounts are constructed based on the unstructured features, and the behavior sequence similarity between accounts is calculated based on the behavior sequence in the unstructured features; the behavior sequence of account node i is , the behavior sequence of account node j is ,in, are the behavior vectors of account nodes i and j at time T, respectively. The dynamic time warping algorithm is used based on the time decay factor Assign adaptive weights to the behavior sequence similarities of different time lengths from the current moment, and calculate the behavior sequence similarity of account node i and account node j ; Converting behavior sequence similarity to behavior similarity ; According to the social relationship of the account, the k-hop neighbor set of account nodes i and j in the social network is obtained. , calculate the common neighbor index between account nodes , assign different weights to neighbors with different social distances, and obtain the weighted common neighbor index , normalize the weighted common neighbor index to interval, get the social association between account nodes i and j ; Calculate the edge weight of the relationship between account nodes i and j based on behavioral similarity and social association , the account nodes, relationship edges and their edge weights form a cross-domain heterogeneous graph.

4. The AI-driven abnormal transaction intelligent monitoring and analysis method according to claim 3, characterized in that: The training method of the temporal heterogeneous graph neural network is: Step S261: construct a temporal heterogeneous graph neural network, including a heterogeneous graph encoding layer, a temporal encoding layer, an attention mechanism, an output layer, and a training optimization module, with the cross-domain heterogeneous graph at each moment as input and the embedded vector of the account node at each moment as output; The heterogeneous graph encoding layer is used to map the features of each account node and relationship edge to a unified embedding space; based on the heterogeneous graph encoding layer, a temporal encoding layer is introduced to capture the dynamic temporal evolution pattern of the node embedding representation, and the cross-domain heterogeneous graph sequence at each moment is used as input to output the embedding vector of the account node at each moment, and to describe the trajectory of the embedding vector of the account node evolving over time; the attention mechanism is used to adaptively assign weights to different neighbors to highlight the influence of key neighbors; the output layer outputs the embedding vector of each account node at each moment; The training optimization module is used to calculate the gradient of the loss function to the model parameters using the back-propagation algorithm; Step S262: For each account node i, construct a positive sample set and a negative sample set based on behavioral similarity and social association, set a similarity threshold and an association threshold, and take the account nodes whose behavioral similarity with account node i is greater than the similarity threshold or whose social association is greater than the association threshold as positive samples, and include the account nodes that do not belong to the positive sample set into the negative sample set. Take the positive samples and negative samples as training data, adopt an unsupervised training method, take the nodes in the cross-domain heterogeneous graph as input, and take the embedded representation of the nodes as output. Apply the time series heterogeneous graph neural network on the cross-domain heterogeneous graph, and forward propagate to generate the embedding vectors of all account nodes at each time t. ; Step S263: Use the embedding vector of account node i at time t , calculate the account node i and the positive sample set , the similarity of the account nodes in the negative sample set, and the comparison loss function at the current time t is calculated based on the similarity , average the comparison loss functions of all account nodes and all moments to get the final loss function , with minimizing the loss function as the training objective; Step S264: Calculate the gradient of the loss function with respect to the model parameters through the back propagation algorithm, and use the optimizer to update the model parameters; Step S265: Repeat steps S262 to S264 until the loss function converges.

5. The AI-driven abnormal transaction intelligent monitoring and analysis method according to claim 4, characterized in that: The specific method of learning the embedding vector of the account node in the cross-domain heterogeneous graph based on the time series heterogeneous graph neural network and generating the account portrait vector is as follows: On the cross-domain heterogeneous graph, a temporal heterogeneous graph neural network is used to learn the embedding vector of the account node, and the embedding vector of the account node i in the lth layer is obtained through forward propagation. , introduce the attention mechanism to calculate the attention weights of neighbor account nodes with different social relationships for account node i ; Define the gated recursive unit aggregation function in the temporal coding layer to fuse the embedding vector of the neighbor account node j at the current moment and the embedding vector of account node i at the previous moment , get the embedding vector of account node i at the current time t ; The embedding vector of account node i at time t Structural features of account nodes Perform splicing to obtain the account portrait vector of account node i .

6. The AI-driven abnormal transaction intelligent monitoring and analysis method according to claim 5, characterized in that: The training of the abnormal transaction detection model for predicting the abnormal probability of each transaction takes the account portrait vector and each transaction record as input data, and takes the abnormal probability of the transaction record as output data. The specific method for predicting the abnormal probability of the current real-time transaction record of the account is: Obtain transaction records of a batch of accounts, extract their account portrait vectors, mark abnormal transactions with abnormal transaction labels, build training samples based on account portrait vectors and abnormal transaction labels, use account portrait vectors and transaction records as input data, use abnormal transaction labels as output data, and train an abnormal transaction detection model; For each training sample, the prediction target is to accurately predict the abnormal transaction label, the cross entropy loss function is used as the loss function of the training model, and the training target is to minimize the value of the loss function. When the loss function converges, the training is completed. Using the trained abnormal transaction detection model, for the current real-time transaction, the account portrait vector and real-time transaction record of the corresponding account are extracted as input data, and the abnormal probability of the real-time transaction is output.

7. The AI-driven abnormal transaction intelligent monitoring and analysis method according to claim 6, characterized in that: The method of dividing all accounts into KM account groups based on the account portrait vector, calculating the group abnormal transaction threshold for each account group, and calculating the adaptive abnormal transaction threshold of the account based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs is as follows: Based on the account portrait vector, all accounts are divided into KM account groups using the k-means clustering algorithm; For each account group , extract the account Account portrait vector and historical transaction records, The account portrait vector and each historical transaction record are used as input data into the abnormal transaction detection model to obtain the abnormal probability of each historical transaction. Represents the account in the kmth account group The abnormal probability of the fth historical transaction; For Accounts The abnormal probability of each historical transaction is counted to obtain the account Distribution of abnormal transaction scores ; Calculation Account Statistical characteristics of the distribution of abnormal transaction scores, including the mean , Standard Deviation ; Calculate the statistical characteristics of the abnormal transaction score distribution of each account in the account group, and obtain the group abnormal transaction threshold of the account group ; For each account , calculate the similarity between its account portrait vector and the center vector of the account group to which it belongs ,in, Indicates account Account portrait vector, Represents the center vector of the km-th account group According to the account The similarity between the account portrait vector and the central vector of the account group to which it belongs and the abnormal transaction threshold of the group are calculated. Adaptive abnormal transaction threshold .

8. An AI-driven intelligent monitoring and analysis system for abnormal transactions, which is used to implement the AI-driven intelligent monitoring and analysis method for abnormal transactions described in any one of claims 1 to 7, characterized in that: include: The account feature acquisition module is used to obtain the structured and unstructured features of each account in the trading system, fuse the structured and unstructured features, and construct an account feature vector; The account portrait generation module is used to define account nodes based on account feature vectors, define relationship edges and edge weights based on unstructured features, build cross-domain heterogeneous graphs, learn the embedding vectors of account nodes in cross-domain heterogeneous graphs based on time-series heterogeneous graph neural networks, and generate account portrait vectors; The abnormal probability prediction module is used to train an abnormal transaction detection model for predicting the abnormal probability of each transaction. It uses the account portrait vector and each transaction record as input data and the abnormal probability of the transaction record as output data to predict the abnormal probability of the current real-time transaction record of the account. An adaptive threshold calculation module is used to divide all accounts into KM account groups based on the account portrait vector, calculate the group abnormal transaction threshold for each account group, and calculate the adaptive abnormal transaction threshold of the account based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs; The anomaly detection update module is used to compare the anomaly probability output by the abnormal transaction detection model with the adaptive abnormal transaction threshold of the account. If the anomaly probability is greater than the adaptive abnormal transaction threshold, the transaction of the account is marked as an abnormal transaction, and the corresponding risk control measures are triggered. The adaptive abnormal transaction threshold of each account is updated regularly.

9. A readable storage medium, characterized in that: The readable storage medium stores a computer program, which is suitable for being loaded by a processor to execute the steps in the AI-driven intelligent monitoring and analysis method for abnormal transactions as described in any one of claims 1 to 7.

Images