AI-Driven Intelligent Monitoring and Analysis System and Method for Abnormal Transactions

Abstract

The AI-driven intelligent monitoring and analysis system and method for abnormal transactions of the present application relate to the field of artificial intelligence technology. By obtaining structured features and unstructured features, feature fusion is performed to construct an account feature vector; a cross-domain heterogeneous graph is constructed, and based on a temporal heterogeneous graph neural network, the embedding vector of the account node in the cross-domain heterogeneous graph is learned to generate an account portrait vector; an abnormal transaction detection model is trained, using the account portrait vector and transaction records as input data to predict the abnormal probability of the current real-time transaction record of the account; all accounts are divided into account groups based on the account portrait vector, the group abnormal transaction threshold is calculated, and based on the group abnormal transaction threshold and the similarity between the account portrait vector and the central vector of the affiliated account group, an adaptive abnormal transaction threshold is calculated; if the abnormal probability is greater than the adaptive abnormal transaction threshold, the transaction of the account is marked as an abnormal transaction, and a risk control measure is triggered, and the adaptive abnormal transaction threshold is updated regularly.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and particularly to an intelligent monitoring and analysis system and method for abnormal transactions based on AI driving. Background Art

[0002] In the financial field, the monitoring of abnormal transactions is crucial for maintaining market stability and avoiding financial risks. With the rapid development of fintech, financial transactions are becoming increasingly frequent and complex. Traditional methods for detecting transaction anomalies are difficult to meet the real-time analysis requirements of massive transaction data.

[0003] The Chinese patent with the authorization announcement number CN106202389B discloses an abnormal monitoring method and device based on transaction data, including: obtaining real-time transaction data of a monitoring object, where the real-time transaction data at least includes the transactions per second TPS; determining the TPS group level in the scale level to which the monitoring object belongs according to the TPS of the monitoring object; determining the success rate statistical period and the transaction success rate threshold of the monitoring object according to the TPS group level of the monitoring object; statistically calculating the real-time transaction success rate of the monitoring object within the success rate statistical period according to the real-time transaction data of the monitoring object; comparing the real-time transaction success rate with the transaction success rate threshold, and if the real-time transaction success rate is less than the transaction success rate threshold, determining that the transaction data of the monitoring object is abnormal.

[0004] The trading behaviors of different user groups vary greatly, and the existing methods adopt unified anomaly detection rules, which are prone to high false alarm rates and missed alarm rates. Summary of the Invention

[0005] This application aims to solve at least one of the technical problems in the related technologies to some extent. For this reason, an object of this application is to propose an intelligent monitoring and analysis system and method for abnormal transactions based on AI driving, which improves the accuracy of anomaly recognition.

[0006] One aspect of this application provides an intelligent monitoring and analysis method for abnormal transactions based on AI driving, including:

[0007] Step S100: Obtain the structured features and unstructured features of each account in the trading system, fuse the structured features and unstructured features, and construct an account feature vector;

[0008] Step S200: Based on the account feature vector, define an account node, define relationship edges and edge weights according to the unstructured features, construct a cross-domain heterogeneous graph, and generate an account portrait vector by learning the embedding vector of the account node in the cross-domain heterogeneous graph based on a temporal heterogeneous graph neural network;

[0009] Step S300: Train an abnormal transaction detection model for predicting the abnormal probability of each transaction, using the account profile vector and each transaction record as input data, and the abnormal probability of the transaction record as output data, to predict the abnormal probability of the current real-time transaction record of the account;

[0010] Step S400: Divide all accounts into KM account groups based on the account profile vector, calculate the group abnormal transaction threshold for each account group, and calculate the adaptive abnormal transaction threshold of the account based on the group abnormal transaction threshold and the similarity between the account profile vector of each account and the central vector of its affiliated account group;

[0011] Step S500: Compare the abnormal probability output by the abnormal transaction detection model with the adaptive abnormal transaction threshold of the account. If the abnormal probability is greater than the adaptive abnormal transaction threshold, mark the transaction of the account as an abnormal transaction, trigger corresponding risk control measures, and regularly update the adaptive abnormal transaction threshold of each account;

[0012] The specific method for obtaining the structured features and unstructured features of each account in the trading system, fusing the structured features and unstructured features, and constructing an account feature vector is as follows:

[0013] Step S110: Obtain the structured features and unstructured features of each account from the trading system. The structured features include but are not limited to: transaction amount 、transaction frequency , and the unstructured features include but are not limited to: behavior sequence 、social relationship ;

[0014] Step S120: Extract the feature vectors of the structured features and unstructured features for fusion to obtain the account feature vector of each account ;

[0015] The specific method for defining account nodes based on the account feature vector, defining relationship edges and edge weights according to the unstructured features, and constructing a cross-domain heterogeneous graph is as follows:

[0016] Step S210: Use the structured features as the attributes of the account nodes, and form account nodes based on the account feature vector of each account node and the corresponding attributes;

[0017] Step S220: Construct relationship edges between accounts according to the unstructured features, and calculate the behavior sequence similarity between accounts based on the behavior sequence in the unstructured features; the behavior sequence of account node i is , and the behavior sequence of account node j is , where, They are the behavior vectors of account nodes i and j at time T respectively. Using the dynamic time warping algorithm and based on the time decay factor assign adaptive weights to the similarity of behavior sequences with different durations from the current moment, and calculate the similarity of the behavior sequences of account nodes i and account node j ;

[0018] Step S230: Convert the similarity of behavior sequences into the similarity of behaviors ;

[0019] Step S240: Obtain the k-hop neighbor sets of account nodes i and j in the social network according to the social relationships of the accounts. According to the k-hop neighbor sets , calculate the common neighbor index between account nodes , assign different weights to neighbors with different social distances to obtain the weighted common neighbor index , and normalize the weighted common neighbor index to interval to obtain the social association degree between account nodes i and j ;

[0020] Step S250: Calculate the edge weight of the relationship edge between account nodes i and j based on the behavior similarity and social association degree , and form a cross-domain heterogeneous graph with account nodes, relationship edges and their edge weights;

[0021] The training method of the temporal heterogeneous graph neural network is as follows:

[0022] Step S261: Construct a temporal heterogeneous graph neural network, including a heterogeneous graph encoding layer, a temporal encoding layer, an attention mechanism, an output layer and a training optimization module. Use the cross-domain heterogeneous graph at each moment as the input and the embedding vector of each account node at each moment as the output;

[0023] The heterogeneous graph encoding layer is used to map the features of each account node and relationship edge to a unified embedding space; on the basis of the heterogeneous graph encoding layer, a temporal encoding layer is introduced to capture the dynamic temporal evolution pattern of the node embedding representation. Using the cross-domain heterogeneous graph sequence at each moment as the input, output the embedding vector of each account node at each moment, depicting the trajectory of the embedding vector of the account node evolving over time; use the attention mechanism to adaptively allocate the weights of different neighbors to highlight the influence of key neighbors; the output layer outputs the embedding vectors of each account node at each moment; the training optimization module is used to calculate the gradient of the loss function with respect to the model parameters using the backpropagation algorithm.

[0024] Step S262: For each account node i, construct a positive sample set and a negative sample set based on behavior similarity and social association. Set the similarity threshold and the association threshold. Account nodes with a behavior similarity greater than the similarity threshold or a social association greater than the association threshold with account node i are used as positive samples, and account nodes that do not belong to the positive sample set are included in the negative sample set. The positive and negative samples are used as training data. Adopt an unsupervised training method, with the nodes in the cross-domain heterogeneous graph as the input and the embedded representations of the nodes as the output. Apply a temporal heterogeneous graph neural network on the cross-domain heterogeneous graph, and through forward propagation, generate the embedded vectors of all account nodes at each moment t ;

[0025] Step S263: Use the embedded vector of account node i at moment t , calculate the similarity between account node i and the account nodes in the positive sample set and the negative sample set. Based on the similarity, calculate the contrast loss function at the current moment t . Take the average of the contrast loss functions for all account nodes and all moments to obtain the final loss function , and use minimizing the loss function as the training objective;

[0026] Step S264: Calculate the gradient of the loss function with respect to the model parameters through the backpropagation algorithm, and use an optimizer to update the model parameters;

[0027] Step S265: Repeat steps S262 - S264 until the loss function converges;

[0028] The specific method for learning the embedded vectors of account nodes in the cross-domain heterogeneous graph and generating account portrait vectors based on the temporal heterogeneous graph neural network is as follows:

[0029] Step S260: On the cross-domain heterogeneous graph, use a temporal heterogeneous graph neural network to learn the embedded vectors of account nodes. Through forward propagation, obtain the embedded vector of account node i at the l-th layer , introduce an attention mechanism, and calculate the attention weights of neighbor account nodes with different social relationships for account node i ;

[0030] Step S270: Define a gated recurrent unit aggregation function in the temporal encoding layer to fuse the embedded vector of neighbor account node j at the current moment and the embedded vector of account node i at the previous moment to obtain the embedded vector of account node i at the current moment t ;

[0031] Step S280: Combine the embedded vector of account node i at moment t with the structured features of the account node Perform splicing to obtain the account profile vector of account node i ;

[0032] The method for training an abnormal transaction detection model used to predict the abnormal probability of each transaction, with the account profile vector and each transaction record as input data and the abnormal probability of the transaction record as output data, to predict the abnormal probability of the current real-time transaction record of the account is as follows:

[0033] Step S310: Obtain the transaction records of a batch of accounts, extract their account profile vectors, mark the abnormal transactions with abnormal transaction labels, construct training samples based on the account profile vectors and abnormal transaction labels, use the account profile vectors and transaction records as input data, and use the abnormal transaction labels as output data to train the abnormal transaction detection model;

[0034] Step S320: For each training sample, use accurately predicting the abnormal transaction label as the prediction target, use the cross-entropy loss function as the loss function of the training model, use minimizing the value of the loss function as the training target, and complete the training when the loss function converges;

[0035] Step S330: Use the trained abnormal transaction detection model. For the current real-time transaction, extract the account profile vector and real-time transaction record of the corresponding account as input data, and output the abnormal probability of this real-time transaction;

[0036] The method for dividing all accounts into KM account groups based on the account profile vector, calculating the group abnormal transaction threshold for each account group, and calculating the adaptive abnormal transaction threshold of the account based on the group abnormal transaction threshold and the similarity between the account profile vector of each account and the central vector of its affiliated account group is as follows:

[0037] Step S410: Divide all accounts into KM account groups based on the account profile vector through the k-means clustering algorithm;

[0038] Step S420: For each account group , extract the account profile vector and historical transaction records of the accounts therein and historical transaction records, use the account profile vector of the account and each historical transaction record as input data and input them into the abnormal transaction detection model to obtain the abnormal probability of each historical transaction, represents the abnormal probability of the f-th historical transaction of the account in the km-th account group;

[0039] Step S430: Statistically analyze the abnormal probability of each historical transaction of the account to obtain the account Abnormal transaction score distribution ;

[0040] Step S440: Calculate the statistical features of the abnormal transaction score distribution of the account , including the mean , standard deviation ;

[0041] Step S450: Calculate the statistical features of the abnormal transaction score distribution of each account within the account group to obtain the group abnormal transaction threshold of the account group ;

[0042] Step S460: For each account , calculate the similarity between its account portrait vector and the central vector of the account group to which it belongs , where represents the account portrait vector of the account , represents the central vector of the km-th account group;

[0043] Step S470: Calculate the adaptive abnormal transaction threshold of the account based on the similarity between the account portrait vector of the account and the central vector of the account group to which it belongs and the group abnormal transaction threshold .

[0044] An aspect of the present application provides an AI-driven intelligent monitoring and analysis system for abnormal transactions, including:

[0045] An account feature acquisition module, configured to acquire the structured features and unstructured features of each account in the trading system, fuse the structured features and unstructured features, and construct an account feature vector;

[0046] An account portrait generation module, configured to define account nodes based on the account feature vector, define relationship edges and edge weights according to the unstructured features, construct a cross-domain heterogeneous graph, and generate an account portrait vector by learning the embedding vectors of the account nodes in the cross-domain heterogeneous graph based on a temporal heterogeneous graph neural network;

[0047] An abnormal probability prediction module, configured to train an abnormal transaction detection model for predicting the abnormal probability of each transaction, use the account portrait vector and each transaction record as input data, and use the abnormal probability of the transaction record as output data to predict the abnormal probability of the current real-time transaction record of the account;

[0048] ​An adaptive threshold calculation module, which is used to divide all accounts into KM account groups based on the account profile vectors, calculate the group abnormal transaction threshold for each account group, and calculate the adaptive abnormal transaction threshold of the account based on the group abnormal transaction threshold and the similarity between the account profile vector of each account and the central vector of its affiliated account group;

[0049] An abnormal detection and update module, which is used to compare the abnormal probability output by the abnormal transaction detection model with the adaptive abnormal transaction threshold of the account. If the abnormal probability is greater than the adaptive abnormal transaction threshold, mark the transaction of the account as an abnormal transaction, trigger corresponding risk control measures, and regularly update the adaptive abnormal transaction threshold of each account.

[0050] One aspect of the present application provides a readable storage medium, which stores a computer program, and the computer program is suitable for being loaded by a processor to execute the steps in the intelligent monitoring and analysis method for abnormal transactions driven by AI.

[0051] The intelligent monitoring and analysis system and method for abnormal transactions driven by AI proposed in the present application have the following advantages compared with the prior art:

[0052] The present application models the cross-domain account relationship in a graph way, reveals the common patterns hidden under different business scenarios, helps to identify group anomalies, and the heterogeneous graph contains rich structured and unstructured information, comprehensively depicting the behavior patterns of different user groups.

[0053] The present application first clusters users, then customizes the abnormal threshold for different groups, replaces the "one-size-fits-all" unified threshold, and dynamically adjusts the threshold according to the similarity between the user account and its affiliated group, considering the differences within the group. The more the account deviates from its affiliated group, the stricter the threshold, and vice versa, it is appropriately relaxed. Flexible defense can improve the detection rate while reducing the false alarm rate.

[0054] The present application processes the time-series heterogeneous graph data by using graph neural networks, learns the dynamically evolving user representations, captures the behavior evolution laws of different groups, discovers the subtle abnormal changes of different groups in a timely manner, reduces the missed alarm rate, and uses the attention mechanism to dynamically adjust the weights of different relationship neighbors, pays attention to the key influencing factors of different groups, improves the pertinence and interpretability of detection, and reduces the false alarm rate.

[0055] The present application comprehensively combines the user profile and the transaction sequence, and makes a judgment based on the abnormal transaction detection model, comprehensively considering the static attributes and dynamic behaviors of users, and improving the accuracy of abnormal identification. Brief Description of the Drawings

[0056] Figure 1It is the flowchart of the method for intelligent monitoring and analysis of abnormal transactions based on AI driving provided by this application;

[0057] Figure 2 It is the schematic diagram of the method for constructing a cross - domain heterogeneous graph provided by this application;

[0058] Figure 3 It is the schematic diagram of the method for generating an account portrait vector provided by this application;

[0059] Figure 4 It is the functional module diagram of the intelligent monitoring and analysis system for abnormal transactions based on AI driving provided by this application. Detailed implementation manners

[0060] To better understand this application, more detailed descriptions of various aspects of this application will be made with reference to the accompanying drawings. It should be understood that these detailed descriptions are only descriptions of the exemplary embodiments of this application and do not limit the scope of this application in any way. Throughout the specification, the same reference numerals refer to the same elements. The expression "and / or" includes any and all combinations of one or more of the associated listed items.

[0061] In the accompanying drawings, for ease of illustration, the sizes, dimensions and shapes of the elements have been slightly adjusted. The drawings are only examples and are not drawn strictly to scale. As used herein, terms such as "substantially", "about" and similar terms are used as terms indicating approximation, rather than terms indicating degree, and are intended to account for the inherent deviations in measured or calculated values that would be recognized by a person of ordinary skill in the art. Additionally, in this application, the order of description of the processing steps does not necessarily represent the order in which these processes occur in actual operation, unless otherwise clearly specified or derivable from the context.

[0062] It should also be understood that expressions such as "including", "including having", "having", "containing" and / or "containing having" in this specification are open - ended rather than closed - ended expressions, which mean that there are the stated features, elements and / or components, but do not exclude the existence of one or more other features, elements, components and / or their combinations. In addition, when an expression such as "at least one of..." appears after a list of listed features, it modifies the entire list of features, rather than just an individual element in the list. Moreover, when describing the embodiments of this application, the use of "may" means "one or more embodiments of this application". And the term "exemplary" is intended to refer to an example or illustration.

[0063] Unless otherwise defined, all terms used herein, including engineering and scientific terms, shall have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. It should also be understood that, unless explicitly stated otherwise in this application, words defined in commonly used dictionaries shall be interpreted as having a meaning consistent with their meaning in the context of the relevant art and shall not be interpreted in an idealized or overly formal sense.

[0064] It should be noted that, without conflict, the embodiments in this application and the features in the embodiments can be combined with each other. The following will detail this application with reference to the drawings and in combination with the embodiments.

[0065] Example 1

[0066] As Figure 1 shown, the AI-driven intelligent monitoring and analysis method for abnormal transactions provided by this application includes:

[0067] Step S100: Obtain the structured features and unstructured features of each account in the trading system, fuse the structured features and unstructured features, and construct an account feature vector;

[0068] The specific method for obtaining the structured features and unstructured features of each account in the trading system, fusing the structured features and unstructured features, and constructing an account feature vector is as follows:

[0069] Step S110: Obtain the structured features and unstructured features of each account from the trading system. The structured features include, but are not limited to: transaction amount , transaction frequency , and the unstructured features include, but are not limited to: behavior sequence , social relationship ;

[0070] Step S120: Extract the feature vectors of the structured features and unstructured features for fusion to obtain the account feature vector of each account ;

[0071] The calculation formula for the account feature vector is: , where is the account feature vector, MI is the number of types of numerical features in the structured features, is the mi-th numerical feature in the structured features, is the number of types of features of the behavior sequence in the unstructured features, is the mj-th behavior sequence in the unstructured features, is the number of types of features of the social relationship in the unstructured features, It is the mk-th social relationship among unstructured features. They are the weight coefficients of the numerical features in the structured features, the behavior sequences in the unstructured features, and the social relationships respectively.

[0072] The above steps use the feature fusion method to map heterogeneous data to a unified feature space, which is convenient for subsequent modeling.

[0073] Step S200: Based on the account feature vector, define account nodes, define relationship edges and edge weights according to unstructured features, construct a cross-domain heterogeneous graph, and learn the embedding vectors of account nodes in the cross-domain heterogeneous graph based on the temporal heterogeneous graph neural network to generate account portrait vectors.

[0074] The specific method of defining account nodes based on the account feature vector, defining relationship edges and edge weights according to unstructured features, and constructing a cross-domain heterogeneous graph is as follows:

[0075] Step S210: Use the structured features as the attributes of the account nodes, and construct account nodes based on the account feature vector of each account node and the corresponding attributes.

[0076] Step S220: Construct relationship edges between accounts according to unstructured features, and calculate the behavior sequence similarity between accounts based on the behavior sequences in the unstructured features; the behavior sequence of account node i is , and the behavior sequence of account node j is , where They are the behavior vectors of account nodes i and j at time T respectively. Using the dynamic time warping algorithm, based on the time decay factor assign adaptive weights to the behavior sequence similarities of different durations from the current moment, and calculate the behavior sequence similarity between account node i and account node j.

[0077] Constructing relationship edges between accounts according to unstructured features means constructing relationship edges for accounts with behavior sequences and social relationships between them.

[0078] The calculation formula for the behavior sequence similarity is: , where is the optimal alignment path of the behavior sequences of account nodes i and j, is the L2 norm, is the behavior vector of account node i at time t, is the behavior vector of account node j at time, is the current moment;

[0079] The time decay factor assigns smaller weights to behaviors at times farther from the current moment, which can effectively reduce the influence of behaviors at farther times on the similarity.

[0080] The optimal alignment path of the behavior sequences of the account nodes i and j is found based on the dynamic time warping algorithm. First, the behavior sequences of the two accounts are made to correspond to each other, the distance between each pair of behaviors in the two behavior sequences is calculated to obtain a distance matrix, starting from the beginning of the sequence and ending at the end of the sequence, the best path is searched for, and the moving direction with the smallest cumulative distance is selected for each choice. The minimum cumulative distance to reach each point is recorded using the dynamic programming method. When reaching the end point, go back from the end point and select the previous point with the smallest cumulative distance each time. The finally obtained path is the best alignment path of the two behavior sequences.

[0081] Step S230: Convert the behavior sequence similarity into behavior similarity ;

[0082] The calculation formula for the behavior similarity is: , where is a scaling parameter used to control the scale of the behavior similarity and is set by those skilled in the art according to experience;

[0083] Step S240: Obtain the k-hop neighbor set of the account nodes i and j in the social network according to the social relationship of the accounts. According to the k-hop neighbor set , calculate the common neighbor index between the account nodes , assign different weights to the neighbors with different social distances to obtain the weighted common neighbor index , and normalize the weighted common neighbor index to the interval to obtain the social association degree between the account nodes i and j;

[0084] The calculation formula for the common neighbor index between the account nodes is: ;

[0085] The common neighbor index measures the number of neighbors shared by two account nodes in the social network and reflects the structural similarity between the accounts.

[0086] The calculation formula for the social association degree is: , where and respectively represent the weighted common neighbor indices of the account nodes i and j themselves;

[0087] The calculation formula for the weighted common neighbor index is: , where represents the weight of the kth neighbor in the k-hop neighbor set, and K is the total number of neighbors in the k-hop neighbor set;

[0088] The weight satisfies: , the specific value of the weight is set by those skilled in the art according to the social distance between the account nodes in the neighbor set;

[0089] The formula for calculating the weighted common neighbor index of the account node i itself is: ;

[0090] The formula for calculating the weighted common neighbor index of the account node j itself is: ;

[0091] The k-hop neighbor set refers to the set of all account nodes that can be reached from an account node through no more than k edges. For example, the 1-hop neighbors of a user are their direct friends, and the 2-hop neighbors include friends of friends, and so on.

[0092] The common neighbor index is an index used to measure the similarity between two nodes in a graph.

[0093] Step S250: Calculate the edge weight of the relationship edge between the account nodes i and j based on the behavior similarity and social association degree , and form a cross-domain heterogeneous graph with the account nodes, relationship edges, and their edge weights;

[0094] The formula for calculating the edge weight of the relationship edge is: , where is the weight factor;

[0095] The weight factor is set by those skilled in the art according to experience.

[0096] Figure 2 is a schematic diagram of the construction method of the cross-domain heterogeneous graph provided by this application;

[0097] The training method of the temporal heterogeneous graph neural network is:

[0098] Step S261: Construct a temporal heterogeneous graph neural network, including a heterogeneous graph encoding layer, a temporal encoding layer, an attention mechanism, an output layer, and a training optimization module, using the cross-domain heterogeneous graph at each moment as the input and the embedding vector of the account nodes at each moment as the output;

[0099] The heterogeneous graph encoding layer is used to map the features of each account node and relationship edge to a unified embedding space; on the basis of the heterogeneous graph encoding layer, a temporal encoding layer is introduced to capture the dynamic temporal evolution pattern of the node embedding representation. Taking the cross-domain heterogeneous graph sequences at each moment as input, it outputs the embedding vectors of account nodes at each moment, depicting the trajectory of the embedding vectors of account nodes evolving over time; the attention mechanism is used to adaptively assign weights to different neighbors to highlight the influence of key neighbors; the output layer outputs the embedding vectors of each account node at each moment; the training optimization module is used to calculate the gradient of the loss function with respect to the model parameters using the backpropagation algorithm.

[0100] Step S262: For each account node i, construct a positive sample set and a negative sample set based on behavioral similarity and social association degree. Set a similarity threshold and an association degree threshold. Account nodes with a behavioral similarity greater than the similarity threshold or a social association degree greater than the association degree threshold with account node i are used as positive samples, and account nodes that do not belong to the positive sample set are included in the negative sample set. The positive samples and negative samples are used as training data. In an unsupervised training manner, with the nodes in the cross-domain heterogeneous graph as input and the embedding representations of the nodes as output, apply a temporal heterogeneous graph neural network on the cross-domain heterogeneous graph, and forward propagate to generate the embedding vectors of all account nodes at each moment t. ;

[0101] Step S263: Use the embedding vector of account node i at moment t , calculate the similarity between account node i and the account nodes in the positive sample set and the negative sample set, calculate the contrastive loss function at the current moment t based on the similarity , take the average of the contrastive loss functions for all account nodes and all moments to obtain the final loss function, and use minimizing the loss function as the training objective;

[0102] The calculation formula of the contrastive loss function is: , where is the similarity of the embedding vectors, is the positive sample set, is the negative sample set, is the embedding vector of account node p in the positive sample set at moment t, is the embedding vector of account node n in the negative sample set at moment t, is the logarithmic function;

[0103] The calculation formula of the loss function is: , where is the set of all account nodes, is the total number of moments;

[0104] Step S264: Calculate the gradient of the loss function with respect to the model parameters using the backpropagation algorithm, and update the model parameters using an optimizer;

[0105] Step S265: Repeat steps S262 - S264 until the loss function converges;

[0106] The specific method for generating the account portrait vector by learning the embedding vectors of account nodes in the cross - domain heterogeneous graph based on the temporal heterogeneous graph neural network is as follows:

[0107] Step S260: On the cross - domain heterogeneous graph, use the temporal heterogeneous graph neural network to learn the embedding vectors of account nodes, and obtain the embedding vector of account node i at the l - th layer through forward propagation , introduce the attention mechanism to calculate the attention weights of neighbor account nodes with different social relationships for account node i;

[0108] The calculation formula for the forward propagation is: , where is the activation function, Z is the set of types of social relationships between accounts, z is the social relationship, is the set of neighbor nodes of account node i under the social relationship z, j is the neighbor account node of account node i under the social relationship z, is the attention weight between account nodes i and j under the social relationship z, is the transformation matrix of the social relationship z, is the embedding vector of account node j in the (l - 1)-th layer, is the transformation matrix of the self - embedding of the account node, is the embedding vector of account node i in the (l - 1)-th layer, is the bias term in the l - th layer;

[0109] The calculation formula for the attention weight is: , where T is the transpose symbol, is the transformation matrix under the social relationship z in the attention mechanism, is the feature vector of the relationship edge between account node i and account node j, r is the neighbor account node of account node i under the social relationship z, is the embedding vector of account node r in the (l - 1)-th layer, is the feature vector of the relationship edge between account node i and account node r;

[0110] The feature vector of the relationship edge refers to the characteristics of the behavior and social relationship between account nodes;

[0111] Step S270: Define a gated recurrent unit aggregation function in the temporal encoding layer to fuse the embedding vectors of neighbor account node j at the current moment and the embedding vector of account node i at the previous moment , to obtain the embedding vector of account node i at the current moment t ;

[0112] The functional expression of the gated recurrent unit aggregation function is: , where is the set of neighbor nodes of account node i under social relationship z at moment t, is the attention weight between account nodes i and j under social relationship z at the current moment t, is the aggregation parameter matrix of social relationship z at moment t, is the gated recurrent unit aggregation function;

[0113] Step S280: Concatenate the embedding vector of account node i at moment t with the structured features of the account node to obtain the account portrait vector of account node i ;

[0114] The expression of the account portrait vector is: , where refers to the concatenation operation;

[0115] Figure 3 is a schematic diagram of the method for generating an account portrait vector provided by this application;

[0116] Step S300: Train an abnormal transaction detection model for predicting the abnormal probability of each transaction, using the account portrait vector and each transaction record as input data, and the abnormal probability of the transaction record as output data, to predict the abnormal probability of the current real-time transaction record of the account;

[0117] The specific method for training an abnormal transaction detection model for predicting the abnormal probability of each transaction, using the account portrait vector and each transaction record as input data, and the abnormal probability of the transaction record as output data, to predict the abnormal probability of the current real-time transaction record of the account is:

[0118] Step S310: Obtain the transaction records of a batch of accounts, extract their account portrait vectors, mark the abnormal transactions with abnormal transaction labels, construct training samples based on the account portrait vectors and abnormal transaction labels, use the account portrait vectors and transaction records as input data, and the abnormal transaction labels as output data, to train the abnormal transaction detection model;

[0119] The abnormal transaction detection model uses a machine learning algorithm; preferably, a logistic regression model is selected as the initial network of the abnormal transaction detection model;

[0120] Step S320: for each training sample, accurately predicting the abnormal transaction label is used as the prediction target, using the cross entropy loss function as the loss function of the training model, minimizing the value of the loss function is used as the training target, and the training is completed when the loss function converges;

[0121] The calculation formula of the loss function is: , where NI is the number of training samples, is the true abnormal transaction label of the ni-th training sample, is the abnormal probability predicted by the ni-th training sample;

[0122] Step S330: using the trained abnormal transaction detection model, for the current real-time transaction, extracting the account portrait vector and real-time transaction record of the corresponding account as input data, and outputting the abnormal probability of the real-time transaction;

[0123] The abnormal probability reflects the abnormality of the transaction, and a higher score indicates a more suspicious transaction.

[0124] Step S400: All accounts are divided into KM account groups based on the account portrait vector, and the group abnormal transaction threshold of each account group is calculated. Based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs, the adaptive abnormal transaction threshold of the account is calculated;

[0125] The method of dividing all accounts into KM account groups based on the account portrait vector, calculating the group abnormal transaction threshold for each account group, and calculating the adaptive abnormal transaction threshold of the account based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs is as follows:

[0126] Step S410: Divide all accounts into KM account groups based on the account portrait vector using the k-means clustering algorithm;

[0127] The KM is the number of clusters of the k-means clustering algorithm, and the number of clusters is set by those skilled in the art based on experience.

[0128] Step S420: For each account group , extract the account Account portrait vector and historical transaction records, The account portrait vector and each historical transaction record are used as input data into the abnormal transaction detection model to obtain the abnormal probability of each historical transaction. Represents the account in the kmth account group The abnormal probability of the fth historical transaction;

[0129] Step S430: Statistically analyze the anomaly probability of each historical transaction of the account to obtain the anomaly transaction score distribution of the account ;

[0130] The expression of the anomaly transaction score distribution is: , where is the total number of historical transactions of the account ;

[0131] Step S440: Calculate the statistical characteristics of the anomaly transaction score distribution of the account , including the mean and the standard deviation ;

[0132] The calculation formula of the mean is: ;

[0133] The calculation formula of the standard deviation is: ;

[0134] Step S450: Calculate the statistical characteristics of the anomaly transaction score distribution of each account in the account group to obtain the group anomaly transaction threshold of the account group;

[0135] The calculation formula of the group anomaly transaction threshold of the account group is: , where is the number of accounts in the km-th account group, is the group threshold control parameter, represents the group anomaly transaction threshold of the km-th account group;

[0136] The group threshold control parameter is used to adjust the strictness of the group anomaly transaction threshold and is set by those skilled in the art according to experience;

[0137] Step S460: For each account , calculate the similarity between its account profile vector and the central vector of its affiliated account group, where represents the account profile vector of the account , represents the central vector of the km-th account group;

[0138] The central vector of the km-th account group is: ;

[0139] The calculation formula of the similarity between the account profile vector and the central vector of its affiliated account group is: , Indicates the modulus length;

[0140] Step S470: According to the account Calculate the similarity between the account portrait vector of the account and the central vector of the account group to which it belongs and the group abnormal transaction threshold, and calculate the account Adaptive abnormal transaction threshold ;

[0141] The calculation formula of the adaptive abnormal transaction threshold is: , where Is the similarity influence parameter;

[0142] The similarity influence parameter is used to adjust the influence degree of the similarity between the account portrait vector and the central vector on the threshold, and is set by those skilled in the art according to experience.

[0143] Step S500: Compare the abnormal probability output by the abnormal transaction detection model with the adaptive abnormal transaction threshold of the account. If the abnormal probability is greater than the adaptive abnormal transaction threshold, mark the transaction of the account as an abnormal transaction, trigger the corresponding risk control measures, and regularly update the adaptive abnormal transaction threshold of each account;

[0144] Further, if the abnormal probability is less than or equal to the adaptive abnormal transaction threshold, mark the transaction of the account as a normal transaction and no further processing is required.

[0145] Embodiment 2

[0146] As Figure 4 shown, the AI-driven abnormal transaction intelligent monitoring and analysis system provided by this application includes:

[0147] Account feature acquisition module, used to acquire the structured features and unstructured features of each account in the trading system, fuse the structured features and unstructured features, and construct an account feature vector;

[0148] Account portrait generation module, used to define account nodes based on the account feature vector, define relationship edges and edge weights according to unstructured features, construct a cross-domain heterogeneous graph, and generate an account portrait vector by learning the embedding vector of the account nodes in the cross-domain heterogeneous graph based on the temporal heterogeneous graph neural network;

[0149] Abnormal probability prediction module, used to train an abnormal transaction detection model for predicting the abnormal probability of each transaction, use the account portrait vector and each transaction record as input data, and use the abnormal probability of the transaction record as output data to predict the abnormal probability of the current real-time transaction record of the account;

[0150] An adaptive threshold calculation module, which is used to divide all accounts into KM account groups based on the account profile vectors, calculate the group abnormal transaction threshold for each account group, and calculate the adaptive abnormal transaction threshold of the account based on the group abnormal transaction threshold and the similarity between the account profile vector of each account and the central vector of its affiliated account group;

[0151] An abnormal detection update module, which is used to compare the abnormal probability output by the abnormal transaction detection model with the adaptive abnormal transaction threshold of the account. If the abnormal probability is greater than the adaptive abnormal transaction threshold, mark the transaction of the account as an abnormal transaction, trigger corresponding risk control measures, and regularly update the adaptive abnormal transaction threshold of each account.

[0152] Embodiment 3

[0153] According to an embodiment of the present application, a readable storage medium is also provided. Computer-readable instructions are stored on the readable storage medium. When the computer-readable instructions are run by a processor, the AI-driven abnormal transaction intelligent monitoring and analysis method according to the embodiment of the present application can be executed. The storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory and cache memory. Non-volatile memory may include, for example, read-only memory, hard disk, flash memory, etc.

[0154] In addition, according to the embodiments of the present application, the processes described in the above method flowcharts can be implemented as computer software programs. For example, the present application provides a non-transitory machine-readable storage medium storing machine-readable instructions that can be run by a processor to execute instructions corresponding to the method steps provided by the present application. For example: obtaining the structured features and unstructured features of each account in the trading system, performing feature fusion on the structured features and unstructured features to construct an account feature vector; based on the account feature vector, defining account nodes, defining relationship edges and edge weights according to the unstructured features, constructing a cross-domain heterogeneous graph, learning the embedding vectors of the account nodes in the cross-domain heterogeneous graph based on a temporal heterogeneous graph neural network to generate an account portrait vector; training an abnormal transaction detection model for predicting the abnormal probability of each transaction, using the account portrait vector and each transaction record as input data, and using the abnormal probability of the transaction record as output data to predict the abnormal probability of the current real-time transaction record of the account; dividing all accounts into KM account groups based on the account portrait vector, calculating the group abnormal transaction threshold for each account group, and calculating the adaptive abnormal transaction threshold of the account based on the similarity between the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of its affiliated account group; comparing the abnormal probability output by the abnormal transaction detection model with the adaptive abnormal transaction threshold of the account. If the abnormal probability is greater than the adaptive abnormal transaction threshold, mark the transaction of the account as an abnormal transaction and trigger corresponding risk control measures, and regularly update the adaptive abnormal transaction threshold of each account. When the computer program is executed by a central processing unit, the above functions defined in the method of the present application are executed.

[0155] The methods and systems of the present application can be implemented in many ways. For example, the methods and systems of the present application can be implemented through software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of method steps is only for illustration, and the method steps of the present application are not limited to the specific order described above, unless otherwise specifically stated. In addition, in some embodiments, the present application can also be implemented as a program recorded in a recording medium, and these programs include machine-readable instructions for implementing the methods according to the present application. Therefore, the present application also covers a recording medium storing a program for executing the methods according to the present application.

[0156] In addition, parts of the above technical solutions provided in the embodiments of the present application that are consistent with the corresponding technical solutions in the prior art in terms of implementation principles are not described in detail to avoid excessive elaboration.

[0157] The specific embodiments described above further elaborate in detail the objectives, technical solutions, and beneficial effects of the present invention. It should be understood that the above description is only the specific embodiments of the present invention and is not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims

1. An AI-driven intelligent monitoring and analysis method for abnormal transactions, characterized in that: include: Obtain the structured and unstructured features of each account in the trading system, fuse the structured and unstructured features, and construct an account feature vector; Based on the account feature vector, define the account node, define the relationship edge and edge weight according to the unstructured features, build a cross-domain heterogeneous graph, learn the embedding vector of the account node in the cross-domain heterogeneous graph based on the time series heterogeneous graph neural network, and generate the account portrait vector; Train an abnormal transaction detection model for predicting the abnormal probability of each transaction, using the account profile vector and each transaction record as input data, and the abnormal probability of the transaction record as output data, to predict the abnormal probability of the current real-time transaction record of the account; Based on the account portrait vector, all accounts are divided into KM account groups, and the group abnormal transaction threshold of each account group is calculated. Based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs, the adaptive abnormal transaction threshold of the account is calculated; Compare the abnormal probability output by the abnormal transaction detection model with the adaptive abnormal transaction threshold of the account. If the abnormal probability is greater than the adaptive abnormal transaction threshold, the transaction of the account is marked as an abnormal transaction, and the corresponding risk control measures are triggered. The adaptive abnormal transaction threshold of each account is updated regularly. The specific method of learning the embedding vector of the account node in the cross-domain heterogeneous graph based on the time series heterogeneous graph neural network and generating the account portrait vector is as follows: On the cross-domain heterogeneous graph, a temporal heterogeneous graph neural network is used to learn the embedding vector of the account node, and the embedding vector of the account node i in the lth layer is obtained through forward propagation. , introduce the attention mechanism to calculate the attention weights of neighbor account nodes with different social relationships for account node i ; Define the gated recursive unit aggregation function in the temporal coding layer to fuse the embedding vector of the neighbor account node j at the current moment and the embedding vector of account node i at the previous moment , get the embedding vector of account node i at the current time t ; The embedding vector of account node i at time t Structural features of account nodes Perform splicing to obtain the account portrait vector of account node i .

2. The AI-driven abnormal transaction intelligent monitoring and analysis method according to claim 1, characterized in that: The specific method of obtaining the structured features and unstructured features of each account in the transaction system, fusing the structured features and unstructured features, and constructing the account feature vector is as follows: Obtain structured and unstructured features of each account from the trading system, where the structured features include but are not limited to: transaction amount , Trading frequency The unstructured features include but are not limited to: behavior sequence , social relationships ; Extract the feature vectors of structured features and unstructured features and fuse them to obtain the account feature vector of each account .

3. The AI-driven abnormal transaction intelligent monitoring and analysis method according to claim 2, characterized in that: The specific method of defining account nodes based on account feature vectors, defining relationship edges and edge weights according to unstructured features, and constructing a cross-domain heterogeneous graph is as follows: The structured features are used as attributes of the account nodes, and the account nodes are constructed based on the account feature vectors and corresponding attributes of each account node; The relationship edges between accounts are constructed based on the unstructured features, and the behavior sequence similarity between accounts is calculated based on the behavior sequence in the unstructured features; the behavior sequence of account node i is , the behavior sequence of account node j is ,in, , are the behavior vectors of account nodes i and j at time T, respectively. The dynamic time warping algorithm is used based on the time decay factor Assign adaptive weights to the behavior sequence similarities of different time lengths from the current moment, and calculate the behavior sequence similarity of account node i and account node j ; Converting behavior sequence similarity to behavior similarity ; According to the social relationship of the account, the k-hop neighbor set of account nodes i and j in the social network is obtained. , , calculate the common neighbor index between account nodes , assign different weights to neighbors with different social distances, and obtain the weighted common neighbor index , normalize the weighted common neighbor index to interval, get the social association between account nodes i and j ; Calculate the edge weight of the relationship between account nodes i and j based on behavioral similarity and social association , the account nodes, relationship edges and their edge weights form a cross-domain heterogeneous graph.

4. The AI-driven abnormal transaction intelligent monitoring and analysis method according to claim 3, characterized in that: The training method of the temporal heterogeneous graph neural network is: Step S261: construct a temporal heterogeneous graph neural network, including a heterogeneous graph encoding layer, a temporal encoding layer, an attention mechanism, an output layer, and a training optimization module, with the cross-domain heterogeneous graph at each moment as input and the embedded vector of the account node at each moment as output; The heterogeneous graph encoding layer is used to map the features of each account node and relationship edge to a unified embedding space; based on the heterogeneous graph encoding layer, a temporal encoding layer is introduced to capture the dynamic temporal evolution pattern of the node embedding representation, and the cross-domain heterogeneous graph sequence at each moment is used as input to output the embedding vector of the account node at each moment, and to describe the trajectory of the embedding vector of the account node evolving over time; the attention mechanism is used to adaptively assign weights to different neighbors to highlight the influence of key neighbors; the output layer outputs the embedding vector of each account node at each moment; The training optimization module is used to calculate the gradient of the loss function to the model parameters using the back-propagation algorithm; Step S262: For each account node i, construct a positive sample set and a negative sample set based on behavioral similarity and social association, set a similarity threshold and an association threshold, and take the account nodes whose behavioral similarity with account node i is greater than the similarity threshold or whose social association is greater than the association threshold as positive samples, and include the account nodes that do not belong to the positive sample set into the negative sample set. Take the positive samples and negative samples as training data, adopt an unsupervised training method, take the nodes in the cross-domain heterogeneous graph as input, and take the embedded representation of the nodes as output. Apply the time series heterogeneous graph neural network on the cross-domain heterogeneous graph, and forward propagate to generate the embedding vectors of all account nodes at each time t. ; Step S263: Use the embedding vector of account node i at time t , calculate the account node i and the positive sample set , the similarity of the account nodes in the negative sample set, and the comparison loss function at the current time t is calculated based on the similarity , average the comparison loss functions of all account nodes and all moments to get the final loss function , with minimizing the loss function as the training objective; Step S264: Calculate the gradient of the loss function with respect to the model parameters through the back propagation algorithm, and use the optimizer to update the model parameters; Step S265: Repeat steps S262 to S264 until the loss function converges.

5. The AI-driven abnormal transaction intelligent monitoring and analysis method according to claim 4, characterized in that: The training of the abnormal transaction detection model for predicting the abnormal probability of each transaction takes the account portrait vector and each transaction record as input data, and takes the abnormal probability of the transaction record as output data. The specific method for predicting the abnormal probability of the current real-time transaction record of the account is: Obtain transaction records of a batch of accounts, extract their account portrait vectors, mark abnormal transactions with abnormal transaction labels, build training samples based on account portrait vectors and abnormal transaction labels, use account portrait vectors and transaction records as input data, use abnormal transaction labels as output data, and train an abnormal transaction detection model; For each training sample, the prediction target is to accurately predict the abnormal transaction label, the cross entropy loss function is used as the loss function of the training model, and the training target is to minimize the value of the loss function. When the loss function converges, the training is completed. Using the trained abnormal transaction detection model, for the current real-time transaction, the account portrait vector and real-time transaction record of the corresponding account are extracted as input data, and the abnormal probability of the real-time transaction is output.

6. The AI-driven abnormal transaction intelligent monitoring and analysis method according to claim 5, characterized in that: The method of dividing all accounts into KM account groups based on the account portrait vector, calculating the group abnormal transaction threshold for each account group, and calculating the adaptive abnormal transaction threshold of the account based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs is as follows: Based on the account portrait vector, all accounts are divided into KM account groups using the k-means clustering algorithm; For each account group , extract the account Account portrait vector and historical transaction records, The account portrait vector and each historical transaction record are used as input data into the abnormal transaction detection model to obtain the abnormal probability of each historical transaction. Represents the account in the kmth account group The abnormal probability of the fth historical transaction; For Accounts The abnormal probability of each historical transaction is counted to obtain the account Distribution of abnormal transaction scores ; Calculation Account Statistical characteristics of the distribution of abnormal transaction scores, including the mean , Standard Deviation ; Calculate the statistical characteristics of the abnormal transaction score distribution of each account in the account group, and obtain the group abnormal transaction threshold of the account group ; For each account , calculate the similarity between its account portrait vector and the center vector of the account group to which it belongs ,in, Indicates account Account portrait vector, represents the center vector of the km-th account group; According to the account The similarity between the account portrait vector and the central vector of the account group to which it belongs and the abnormal transaction threshold of the group are calculated. Adaptive abnormal transaction threshold .

7. An AI-driven intelligent monitoring and analysis system for abnormal transactions, which is used to implement the AI-driven intelligent monitoring and analysis method for abnormal transactions described in any one of claims 1 to 6, characterized in that: include: The account feature acquisition module is used to obtain the structured and unstructured features of each account in the trading system, fuse the structured and unstructured features, and construct an account feature vector; The account portrait generation module is used to define account nodes based on account feature vectors, define relationship edges and edge weights based on unstructured features, build cross-domain heterogeneous graphs, learn the embedding vectors of account nodes in cross-domain heterogeneous graphs based on time-series heterogeneous graph neural networks, and generate account portrait vectors; The abnormal probability prediction module is used to train an abnormal transaction detection model for predicting the abnormal probability of each transaction. It uses the account portrait vector and each transaction record as input data and the abnormal probability of the transaction record as output data to predict the abnormal probability of the current real-time transaction record of the account. An adaptive threshold calculation module is used to divide all accounts into KM account groups based on the account portrait vector, calculate the group abnormal transaction threshold for each account group, and calculate the adaptive abnormal transaction threshold of the account based on the group abnormal transaction threshold and the similarity between the account portrait vector of each account and the central vector of the account group to which it belongs; The anomaly detection update module is used to compare the anomaly probability output by the abnormal transaction detection model with the adaptive abnormal transaction threshold of the account. If the anomaly probability is greater than the adaptive abnormal transaction threshold, the transaction of the account is marked as an abnormal transaction, and the corresponding risk control measures are triggered. The adaptive abnormal transaction threshold of each account is updated regularly.

8. A readable storage medium, characterized in that: The readable storage medium stores a computer program, which is suitable for being loaded by a processor to execute the steps in the AI-driven intelligent monitoring and analysis method for abnormal transactions as described in any one of claims 1 to 6.

Images