Transaction abnormity identification method and device, equipment, medium and program product

Abstract

The invention provides a transaction abnormity identification method and device, equipment, a medium and a program product, which can be applied to the technical field of big data and the field of finance. The method comprises the steps of inputting to-be-identified data associated with real-time transaction operation into a pre-trained prediction model so as to perform abnormal behavior prediction on the to-be-identified data, and outputting a prediction value; based on the predicted value and a preset classification threshold, determining an identification result, the identification result being used for indicating whether the to-be-identified data has an abnormal behavior; the pre-training of the prediction model comprises the following operations: obtaining historical sample data associated with a plurality of historical transaction operations; based on the abnormal validity of each historical transaction operation in the plurality of historical transaction operations, determining a validity correlation coefficient of historical sample data associated with each historical transaction operation; determining the validity correlation coefficient as a label of the historical sample data; and training a prediction model based on the tag of the historical sample data and the historical sample data.

Description

Technical Field

[0001] The present disclosure relates to the field of big data technology and the financial field, and specifically to a transaction anomaly identification method, device, equipment, medium and program product. Background Art

[0002] With the rapid development of the Internet, bank cards, as a financial service tool derived from the Internet era, can not only realize cashless payment in the transaction process, but also reduce the circulation of checks in the market. However, while bank cards bring convenience to financial transactions, there are also many security risks. In particular, with the popularization of smart terminals in recent years, people have gained great convenience when using electronic banking to handle business, but at the same time, electronic banking is also faced with security risks and risks of malicious infringement.

[0003] In the process of implementing the embodiments of the present disclosure, it is found that in the identification of transaction anomalies, it is generally believed that the more abnormal cases there are, the higher the identification accuracy and coverage. However, in fact, while identifying transaction anomalies, those who create abnormal transactions are also identifying and circumventing existing identification methods. The abnormal means are changing with each passing day, resulting in low identification accuracy. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a transaction anomaly identification method, apparatus, device, medium and program product.

[0005] According to a first aspect of the present disclosure, a method for identifying transaction anomalies is provided, comprising:

[0006] Inputting the data to be identified associated with the real-time transaction operation into a pre-trained prediction model so as to predict abnormal behavior of the data to be identified and output a prediction value; and determining a recognition result based on the prediction value and a preset classification threshold, wherein the recognition result is used to indicate whether the data to be identified has abnormal behavior;

[0007] Among them, the pre-training of the prediction model includes the following operations: obtaining historical sample data associated with multiple historical transaction operations, wherein the multiple historical transaction operations have been executed before the real-time transaction operation; based on the abnormal effectiveness of each historical transaction operation in the multiple historical transaction operations, determining the effectiveness correlation coefficient of the historical sample data associated with each historical transaction operation; determining the effectiveness correlation coefficient as a label of the historical sample data; and training the prediction model based on the label of the historical sample data and the historical sample data.

[0008] According to an embodiment of the present disclosure, the transaction anomaly identification method also includes: determining the abnormal validity of each historical transaction operation based on the execution time of each historical transaction operation and the training time of the pre-trained prediction model; and / or determining the abnormal validity of each historical transaction operation based on the historical execution area of ​​each historical transaction operation and the execution area of ​​the real-time transaction operation.

[0009] According to an embodiment of the present disclosure, the abnormal effectiveness of each historical transaction operation is determined based on the execution time of each historical transaction operation and the training time of a pre-trained prediction model, including: determining a start time for starting to execute the historical transaction operation from multiple historical transaction operations based on the execution time of each historical transaction operation; determining a time interval between the start time and the training time; and determining the abnormal effectiveness of each historical transaction operation based on a ratio of the execution time of each historical transaction operation to the time interval.

[0010] According to an embodiment of the present disclosure, historical transaction operations include abnormal operations and normal operations; based on the ratio of the execution time of each historical transaction operation to the time interval, the abnormal effectiveness of each historical transaction operation is determined, including: when the historical transaction operation is determined to be an abnormal operation, the ratio of the execution time of the abnormal operation to the time interval is determined as the abnormal effectiveness of the abnormal operation; when the historical transaction operation is determined to be a normal operation, the inverse of the ratio of the execution time of the normal operation to the time interval is determined as the abnormal effectiveness of the normal operation.

[0011] According to an embodiment of the present disclosure, the abnormal effectiveness of each historical transaction operation is determined based on the execution time of each historical transaction operation and the training time of a pre-trained prediction model, including: determining a start time for starting to execute the historical transaction operation and an end time for ending to execute the historical transaction operation from multiple historical transaction operations based on the execution time of each historical transaction operation; determining an execution time interval based on the difference between the end time and the start time; dividing the execution time interval into multiple sub-intervals in chronological order; and determining the abnormal effectiveness of each historical transaction operation based on a target sub-interval to which the execution time of each historical transaction operation belongs and the training time of a pre-trained prediction model.

[0012] According to an embodiment of the present disclosure, the abnormal effectiveness of each historical transaction operation is determined based on the target sub-interval to which the execution time of each historical transaction operation belongs and the training time of the pre-trained prediction model, including: determining the abnormal effectiveness of each historical transaction operation according to the time distance between the target sub-interval and the training time, wherein the time distance is inversely proportional to the abnormal effectiveness.

[0013] According to an embodiment of the present disclosure, based on the historical execution area of ​​each historical transaction operation and the execution area of ​​the real-time transaction operation, the abnormal validity of each historical transaction operation is determined, including: determining the distance between the historical execution area and the execution area of ​​each historical transaction operation; and determining the abnormal validity of each historical transaction operation based on the distance and the abnormal type of the historical transaction operation, wherein the distance is inversely proportional to the abnormal validity, and the abnormal validity of two historical transaction operations with opposite abnormal types and the same historical execution area are opposite numbers of each other.

[0014] A second aspect of the present disclosure provides a transaction anomaly identification device, comprising: a prediction module, used to input data to be identified associated with real-time transaction operations into a pre-trained prediction model, so as to predict abnormal behavior of the data to be identified and output a prediction value; and a determination module, used to determine a recognition result based on the prediction value and a preset classification threshold, wherein the recognition result is used to indicate whether the data to be identified has abnormal behavior;

[0015] Among them, the pre-training of the prediction model includes the following operations: obtaining historical sample data associated with multiple historical transaction operations, wherein the multiple historical transaction operations have been executed before the real-time transaction operation; based on the abnormal effectiveness of each historical transaction operation in the multiple historical transaction operations, determining the effectiveness correlation coefficient of the historical sample data associated with each historical transaction operation; determining the effectiveness correlation coefficient as a label of the historical sample data; and training the prediction model based on the label of the historical sample data and the historical sample data.

[0016] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0017] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0018] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0019] According to the embodiments of the present disclosure, the validity correlation coefficient of the historical sample data associated with the historical transaction operation is determined by the abnormal validity of the historical transaction operation. The validity correlation coefficient is used as a soft label, so that the prediction model can focus on the historical sample data associated with the historical transaction operation with high validity. Compared with directly training the model using abnormal cases within a preset time interval, the prediction model trained in this way can avoid the problem of reduced prediction accuracy of the model due to the increase or decrease in the proportion of invalid abnormal cases or features caused by the specified preset time interval being too long or too short, thereby improving the accuracy of the prediction model and further improving the recognition accuracy rate. At least partially solves the problem that while identifying transaction anomalies, the abnormal traders are also identifying and circumventing the existing recognition methods, and the abnormal means are changing with each passing day, resulting in low recognition accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0021] Figure 1 A diagram schematically illustrates an application scenario of a transaction anomaly identification method, apparatus, device, medium, and program product according to an embodiment of the present disclosure;

[0022] Figure 2 A flowchart of a transaction anomaly identification method according to an embodiment of the present disclosure is schematically shown;

[0023] Figure 3 A flowchart of a method for determining the abnormal validity of each historical transaction operation according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 4 A flowchart of a method for determining the abnormal validity of each historical transaction operation according to another embodiment of the present disclosure is schematically shown;

[0025] Figure 5 A flowchart of a method for determining the abnormal validity of each historical transaction operation according to another embodiment of the present disclosure is schematically shown;

[0026] Figure 6 A schematic diagram of a structure of a transaction anomaly identification device according to an embodiment of the present disclosure is shown; and

[0027] Figure 7 A block diagram of an electronic device suitable for implementing a method for identifying abnormal transactions according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0028] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0029] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0030] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0031] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0032] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0033] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0034] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0035] Banks and other financial institutions use a series of technical means to identify and prevent risks brought by transaction anomalies and protect the security of user assets and financial institution assets. For example, in transaction anomaly identification, the identification strategy can be obtained based on the analysis and summary of previous abnormal cases. It is generally believed that the more abnormal cases there are, the higher the recognition accuracy and coverage of the obtained identification strategy. But in fact, while identifying transaction anomalies, those who create transaction anomalies are also identifying and circumventing existing identification strategies, and the abnormal means are changing with each passing day. Therefore, as time goes by, the effectiveness of some abnormal cases is gradually reduced. When identifying abnormal behavior through analysis and learning of historical cases, due to the learning and training of too many outdated abnormal cases, not only will the accuracy of abnormal recognition of artificial intelligence models not be improved, but the accuracy and coverage of the model for abnormalities will be reduced, which will have a negative effect on the recognition of abnormal behavior by artificial intelligence models.

[0036] In addition, in financial institutions such as banks, abnormal users and normal users basically present a long-tail distribution, with abnormal users accounting for only a small portion and abnormal cases limited. If abnormal cases with a long history and low effectiveness are directly discarded, the available abnormal cases will become even scarcer, which may cause the AI ​​model to overfit and reduce the abnormal recognition rate of the AI ​​model. Therefore, how to effectively balance the problem of the gradual decrease in the effectiveness of abnormal cases over time and the scarcity of abnormal cases has become the key point in identifying transaction anomalies.

[0037] Based on this, an embodiment of the present disclosure provides a transaction anomaly identification method, including: inputting the data to be identified associated with the real-time transaction operation into a pre-trained prediction model, so as to predict abnormal behavior of the data to be identified and output a prediction value; and determining the identification result based on the prediction value and a preset classification threshold, wherein the identification result is used to indicate whether the data to be identified has abnormal behavior; wherein the pre-training of the prediction model includes the following operations: obtaining historical sample data associated with multiple historical transaction operations, wherein the multiple historical transaction operations have been executed before the real-time transaction operation; based on the abnormal validity of each historical transaction operation in the multiple historical transaction operations, determining the validity correlation coefficient of the historical sample data associated with each historical transaction operation; determining the validity correlation coefficient as the label of the historical sample data; and training the prediction model based on the label of the historical sample data and the historical sample data. The embodiment of the present disclosure also provides a transaction anomaly identification device, equipment, medium and program product.

[0038] Figure 1 The application scenario diagram of the transaction anomaly identification method, device, equipment, medium and program product according to the embodiment of the present disclosure is schematically shown.

[0039] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0040] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0041] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0042] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0043] It should be noted that the transaction anomaly identification method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the transaction anomaly identification device provided in the embodiment of the present disclosure can generally be set in the server 105. The transaction anomaly identification method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the transaction anomaly identification device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0044] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0045] The following will be based on Figure 1 The scene described by Figure 2~Figure 6 The transaction anomaly identification method of the disclosed embodiment is described in detail.

[0046] Figure 2 The flowchart of the transaction anomaly identification method according to an embodiment of the present disclosure is schematically shown.

[0047] like Figure 2 As shown, the transaction anomaly identification method of this embodiment includes operations S210 to S220.

[0048] In operation S210, the data to be identified that is associated with the real-time transaction operation is input into a pre-trained prediction model so as to predict abnormal behavior of the data to be identified and output a prediction value.

[0049] In operation S220, a recognition result is determined based on the prediction value and a preset classification threshold.

[0050] According to an embodiment of the present disclosure, real-time transaction operations may include but are not limited to operations performed by users when using electronic banking to conduct balance inquiries, transfers, shopping payments, financial management, and other services.

[0051] According to an embodiment of the present disclosure, the data to be identified may include at least one of the following: transaction flow, transaction amount, transaction object, object information, etc. The object information may be, for example, information used to characterize the credit of the object.

[0052] According to an embodiment of the present disclosure, pre-training of a prediction model may include the following operations: obtaining historical sample data associated with a plurality of historical transaction operations. Determining the validity correlation coefficient of the historical sample data associated with each historical transaction operation based on the abnormal validity of each historical transaction operation in the plurality of historical transaction operations. Determining the validity correlation coefficient as a label of the historical sample data. Training a prediction model based on the label of the historical sample data and the historical sample data.

[0053] According to an embodiment of the present disclosure, multiple historical transaction operations have been executed before the real-time transaction operation. The historical sample data may include at least one of the following: transaction flow, transaction amount, transaction object, object information, etc. The historical transaction operation may include abnormal operations and normal operations. For example, when there is abnormal behavior in the historical sample data associated with the historical transaction operation, the historical transaction operation may be considered as an abnormal operation, otherwise it is a normal operation. Each historical sample data associated with an abnormal operation can be regarded as an abnormal case.

[0054] Acquiring historical sample data associated with multiple historical transaction operations may include the following operations: determining multiple abnormal operations, where the abnormal operations may include, for example, all abnormal operations that are authorized to be viewed before the training time of the current training model. According to a preset ratio of abnormal operations to normal operations, determining a normal operation that occurs at the execution time of each abnormal operation in the multiple abnormal operations. Based on the determined abnormal operations and normal operations, acquiring historical sample data associated with the abnormal operations and the normal operations.

[0055] According to an embodiment of the present disclosure, the abnormal validity can be used to characterize the validity of abnormal behaviors existing in the historical sample data associated with the historical transaction operation up to the current moment, i.e., the training time. For example, at the same execution time, the abnormal validity for the abnormal operation is greater than the abnormal validity for the normal operation, and the abnormal validity for the normal operation can be zero or a negative value.

[0056] According to an embodiment of the present disclosure, the abnormal validity is proportional to the validity correlation coefficient, that is, the higher the abnormal validity, the higher the validity correlation coefficient. For example, the abnormal validity of each historical transaction operation in multiple historical transaction operations can be determined as the validity correlation coefficient of the historical sample data associated with each historical transaction operation.

[0057] According to an embodiment of the present disclosure, the labels of historical sample data and the historical sample data may be used to train a prediction model, so that the prediction model can continuously learn the characteristics of the historical sample data based on the labels of the historical sample data.

[0058] According to an embodiment of the present disclosure, the recognition result is used to indicate whether the data to be recognized has abnormal behavior.

[0059] According to an embodiment of the present disclosure, the preset classification threshold may be determined based on the abnormal effectiveness and recognition accuracy of historical transaction operations.

[0060] According to the embodiments of the present disclosure, the validity correlation coefficient of the historical sample data associated with the historical transaction operation is determined by the abnormal validity of the historical transaction operation. The validity correlation coefficient is used as a soft label, so that the prediction model can focus on the historical sample data associated with the historical transaction operation with high validity. Compared with directly training the model using abnormal cases within a preset time interval, the prediction model trained in this way can avoid the problem of reduced prediction accuracy of the model due to the increase or decrease in the proportion of invalid abnormal cases or features caused by the specified preset time interval being too long or too short, thereby improving the accuracy of the prediction model and further improving the recognition accuracy rate. At least partially solves the problem that while identifying transaction anomalies, the abnormal traders are also identifying and circumventing the existing recognition methods, and the abnormal means are changing with each passing day, resulting in low recognition accuracy.

[0061] In an embodiment of the present disclosure, before acquiring historical sample data and data to be identified, the user's consent or authorization may be obtained. For example, before operation S210, a request to acquire user information may be issued to the user. When the user agrees or authorizes that the user information may be acquired, operation S210 is performed.

[0062] In the process of implementing the embodiments of the present disclosure, it was found that the reference value of abnormal cases will change over time. The longer the time from identification, the lower the reference value of abnormal cases. In addition, for different identification areas, the difference in the area will also lead to different reference values ​​of abnormal cases. If these abnormal cases are directly discarded, the proportion of abnormal cases will be smaller, and the prediction model will be prone to overfitting. If these abnormal cases are not discarded, it will have a negative effect on the prediction of the prediction model. Although in the recognition method disclosed in the relevant examples, by adjusting the weight value, the weight value of the abnormal sample is increased, the weight value of the normal sample is reduced, the model recognition ability is improved, and the problem of rare abnormal cases is solved, but the problem of low accuracy of the prediction model caused by failed abnormal cases is still not solved.

[0063] Based on this, according to an embodiment of the present disclosure, the transaction abnormality identification method includes the following steps: Figure 2In addition to the operations S210 to S220 shown, the operation may also include: determining the abnormal validity of each historical transaction operation based on the execution time of each historical transaction operation and the training time of the pre-trained prediction model. Or determining the abnormal validity of each historical transaction operation based on the historical execution area of ​​each historical transaction operation and the execution area of ​​the real-time transaction operation. Or determining the first abnormal validity of each historical transaction operation based on the execution time of each historical transaction operation and the training time of the pre-trained prediction model, determining the second abnormal validity of each historical transaction operation based on the historical execution area of ​​each historical transaction operation and the execution area of ​​the real-time transaction operation, and then summing the first abnormal validity and the second abnormal validity for each historical transaction operation to obtain the abnormal validity of the historical transaction operation.

[0064] According to an embodiment of the present disclosure, the farther the execution time of each historical transaction operation is from the training time of the pre-trained prediction model, the lower the abnormal effectiveness of each historical transaction operation.

[0065] According to an embodiment of the present disclosure, the historical execution area can be determined based on the IP address of the historical transaction operation. The execution area can be determined based on the IP address of the real-time transaction operation.

[0066] According to an embodiment of the present disclosure, the farther the historical execution area of ​​each historical transaction operation is from the execution area of ​​the real-time transaction operation, the lower the abnormal validity of each historical transaction operation.

[0067] It should be noted that, at the same execution time, the abnormal validity of the abnormal operation may be the inverse of the abnormal validity of the normal operation, and the abnormal validity of the abnormal operation is greater than the abnormal validity of the normal operation.

[0068] According to the embodiments of the present disclosure, the abnormal validity of each historical transaction operation is determined based on the execution time of each historical transaction operation and the training time of the pre-trained prediction model, which can reduce the model's attention to abnormal operations that have become invalid over time, increase attention to effective abnormal operations, improve the accuracy of the prediction model, and avoid model overfitting caused by discarding abnormal operations with low abnormal validity. Based on the historical execution area of ​​each historical transaction operation and the execution area of ​​the real-time transaction operation, the abnormal validity of each historical transaction operation is determined, which can reduce the problem of inaccurate prediction caused by different reference values ​​of data related to abnormal operations due to different research areas. By combining the two solutions, the accuracy of the prediction model can be further improved.

[0069] Figure 3 A flowchart of a method for determining the abnormal validity of each historical transaction operation according to an embodiment of the present disclosure is schematically shown.

[0070] like Figure 3 As shown, the method for determining the abnormal validity of each historical transaction operation in this embodiment includes operations S310 to S330.

[0071] In operation S310, a start time for starting to execute the historical transaction operations is determined from a plurality of historical transaction operations according to the execution time of each historical transaction operation.

[0072] In operation S320, a time interval between the start time and the training time is determined.

[0073] In operation S330 , the abnormal validity of each historical transaction operation is determined based on a ratio of the execution time of each historical transaction operation to the time interval.

[0074] According to an embodiment of the present disclosure, the start time may be understood as the execution time of the earliest execution time of the historical transaction operation among multiple historical transaction operations.

[0075] According to an embodiment of the present disclosure, the time interval may be obtained by calculating the difference between the training time and the start time.

[0076] According to an embodiment of the present disclosure, historical transaction operations may include abnormal operations and normal operations.

[0077] Determining the abnormal effectiveness of each historical transaction operation based on the ratio of the execution time of each historical transaction operation to the time interval may include the following operations: when the historical transaction operation is determined to be an abnormal operation, determining the ratio of the execution time of the abnormal operation to the time interval as the abnormal effectiveness of the abnormal operation; when the historical transaction operation is determined to be a normal operation, determining the inverse of the ratio of the execution time of the normal operation to the time interval as the abnormal effectiveness of the normal operation.

[0078] For example, if the start time is January of a certain year and the time interval is 36 months, the abnormal validity of the abnormal operation corresponding to the start time can be determined as 1 / 36, and the abnormal validity of the normal operation corresponding to the start time can be determined as -1 / 36.

[0079] According to the embodiments of the present disclosure, the abnormal effectiveness of each historical transaction operation is determined based on the ratio of the execution time of each historical transaction operation to the time interval. The prediction model can be used as a regression model to identify abnormal behaviors, reduce the model's attention to abnormal operations that have become invalid over time, and increase attention to effective abnormal operations, thereby improving the accuracy of the prediction model and avoiding model overfitting caused by discarding abnormal operations with low abnormal effectiveness.

[0080] Figure 4 A flowchart of a method for determining the abnormal validity of each historical transaction operation according to another embodiment of the present disclosure is schematically shown.

[0081] like Figure 4 As shown, the method for determining the abnormal validity of each historical transaction operation in this embodiment includes operations S410 to S440.

[0082] In operation S410, based on the execution time of each historical transaction operation, a start time for starting to execute the historical transaction operation and an end time for ending to execute the historical transaction operation are determined from a plurality of historical transaction operations.

[0083] In operation S420, an execution time interval is determined according to the difference between the end time and the start time.

[0084] In operation S430 , the execution time interval is divided into a plurality of sub-intervals in chronological order.

[0085] In operation S440 , the abnormal validity of each historical transaction operation is determined based on the target sub-interval to which the execution time of each historical transaction operation belongs and the training time of the pre-trained prediction model.

[0086] According to an embodiment of the present disclosure, the termination time may be understood as the execution time of the latest execution time of the historical transaction operation among multiple historical transaction operations.

[0087] According to an embodiment of the present disclosure, the number of divided sub-intervals may be determined based on the prediction accuracy requirements of the model.

[0088] According to an embodiment of the present disclosure, multiple subintervals can be numbered sequentially based on the length of time between each subinterval and the training time, and then the abnormal validity of each historical transaction operation can be determined based on the number, the number of subintervals and the type of historical transaction operations.

[0089] For example, there are N sub-intervals, and the first sub-interval to the last sub-interval are numbered 1 to N respectively. The abnormal validity of the abnormal operation belonging to the first sub-interval may be 1 / N, the abnormal validity of the abnormal operation of the kth sub-interval may be k / N, and the abnormal validity of the abnormal operation of the last sub-interval may be N / N. Within the same sub-interval, the abnormal validity of the normal operation and the abnormal validity of the abnormal operation are opposite numbers.

[0090] In the scheme disclosed in the present invention, if the specified execution time interval is relatively long, the value of the invalid abnormal operation or feature in the sample label is closer to 0 than the normal sample, and the prediction model will pay less attention to this part of the samples, thereby paying more attention to the effective samples, and the prediction accuracy of the prediction model will be improved. Theoretically, the scheme disclosed in the present invention can use abnormal cases of infinite time to train the prediction model, and the model can find the long-term unchanged characteristics of the abnormal cases. The model accuracy will not be affected by the timeliness of the abnormal cases, thereby improving the model accuracy.

[0091] According to an embodiment of the present disclosure, the abnormal effectiveness of each historical transaction operation is determined based on the target sub-interval to which the execution time of each historical transaction operation belongs and the training time of the pre-trained prediction model, including: determining the abnormal effectiveness of each historical transaction operation based on the time distance between the target sub-interval and the training time.

[0092] According to an embodiment of the present disclosure, the time distance is inversely proportional to the anomaly effectiveness.

[0093] According to an embodiment of the present disclosure, determining the abnormal effectiveness of each historical transaction operation according to the time distance between the target subinterval and the training time may include the following operations: calculating the difference between the training time and the time at the end of the interval that is closest to the training time in the target subinterval to obtain the time distance. Determine the ratio of the time distance to the execution time interval, subtract the ratio from one to obtain the abnormal effectiveness of each abnormal operation, and determine the opposite of the abnormal effectiveness of the abnormal operation in the same target subinterval as the abnormal effectiveness of the normal operation in the target subinterval. According to an embodiment of the present disclosure, considering that the effectiveness of abnormal cases in a short period of time is not much different, the model cannot learn subtle changes, and excessive calculation will increase the consumption of computing resources. Therefore, by dividing the execution time by intervals, it is possible to reduce the amount of calculation and the consumption of computing resources while ensuring the accuracy of model prediction. According to an embodiment of the present disclosure, based on the abnormal effectiveness of each historical transaction operation in multiple historical transaction operations, determining the effectiveness correlation coefficient of historical sample data associated with each historical transaction operation may include the following operations: for each sub-interval: obtaining a first indicator value according to the product of the abnormal effectiveness of each historical transaction operation and an adjustment parameter for adjusting the abnormal effectiveness within the sub-interval; obtaining a second indicator value according to the order of the sub-interval and the number of sub-intervals; determining the effectiveness correlation coefficient of the historical sample data associated with the historical transaction operation within the sub-interval according to the first indicator value, the second indicator value and the abnormal effectiveness of the historical transaction operations within the sub-interval.

[0094] For example, in chronological order, the abnormal effectiveness of the abnormal operation in the first subinterval can be 1 / N, where N is the total number of subintervals, and the abnormal effectiveness of the abnormal operation in the kth subinterval can be k / N. Assume that the abnormal effectiveness of the abnormal operation is M, which is between 0 and 1. For the kth subinterval, the first indicator value can be expressed as α k *(1-M), α k represents the adjustment parameter α used to adjust the abnormal effectiveness of abnormal operations in the kth subinterval, and the second indicator value can be expressed as (k-1) / (N-1). The effectiveness correlation coefficient of the historical sample data associated with abnormal operations in the kth subinterval can be expressed as M+α k*(1-M)* (k-1) / (N-1). The validity correlation coefficient of the historical sample data associated with normal operation in the kth subinterval can be expressed as -(M+α k *(1-M)* (k-1) / (N-1)). The value of α can be determined based on the abnormal effectiveness of historical trading operations in multiple subintervals. For example, when the abnormal effectiveness of historical trading operations in adjacent subintervals is related to N, the value of α can be a number related to N. When the abnormal effectiveness of historical trading operations in N subintervals is evenly distributed and the differences in the abnormal effectiveness of historical trading operations in adjacent subintervals are equal, the value of α can be the same, that is, α 1 =α 2… α N . When the abnormal effectiveness of historical trading operations in the first subinterval is the smallest, the value of α can be a positive number. When the abnormal effectiveness of historical trading operations in the first subinterval is the largest, the value of α can be a negative number. When M is the abnormal effectiveness of abnormal operations in the first subinterval, and M=1 / N, α 1 =1, the validity correlation coefficient of the historical sample data associated with the abnormal operation in the first sub-interval is 1 / N.

[0095] According to an embodiment of the present disclosure, by determining the effectiveness correlation coefficient of historical sample data associated with each historical transaction operation through adjustment parameters for adjusting the abnormal effectiveness within a sub-interval and the abnormal effectiveness of each historical transaction operation in multiple historical transaction operations, it is possible to adjust the effectiveness correlation coefficient of historical sample data associated with the historical transaction operation based on the abnormal effectiveness of the historical transaction operation within each sub-interval, thereby increasing the interpretability of the effectiveness correlation coefficient.

[0096] Figure 5 A flowchart of a method for determining the abnormal validity of each historical transaction operation according to yet another embodiment of the present disclosure is schematically shown.

[0097] In the process of implementing the embodiments of the present disclosure, it is found that if the abnormal cases of the four cities A, B, C, and D have the same abnormal features, there are also abnormal features unique to each city. Assuming that the abnormal recognition modeling of city A is to be performed, if the abnormal cases of city A are directly used for modeling, there are relatively few cases, and the model is prone to overfitting and the accuracy is not high. If all the abnormal cases of the four cities are directly used as model training data, even if the names of the four cities are added as category features, the model finally trained is the model with the highest overall abnormal accuracy of the four cities, rather than the model with the highest abnormal accuracy of city A.

[0098] Based on this, Figure 5 As shown, the method for determining the abnormal validity of each historical transaction operation in this embodiment includes operations S510 to S520.

[0099] In operation S510 , a distance between a historical execution region and an execution region of each historical transaction operation is determined.

[0100] In operation S520 , based on the distance and the abnormal type of the historical transaction operation, the abnormal validity of each historical transaction operation is determined.

[0101] According to an embodiment of the present disclosure, the distance is inversely proportional to the anomaly validity, and the anomaly validity of two historical transaction operations with opposite anomaly types and the same historical execution area are opposite numbers of each other.

[0102] For example, suppose there are four cities, A, B, C, and D, and the model is mainly used to identify abnormal users in city A. The effectiveness of abnormal cases in city A is relatively high, while the effectiveness of abnormal cases in other cities is relatively low. Therefore, the abnormal effectiveness of abnormal operations in city A can be set to 1, and the abnormal effectiveness of normal operations can be set to -1. The abnormal effectiveness of abnormal operations in cities B, C, and D is set to K, and K is between 0 and 1. If cities B, C, and D are closer to A, the larger K is. The abnormal effectiveness of normal operations in cities B, C, and D is set to -K, and -K is between 0 and -1. If cities B, C, and D are closer to A, the larger -K is. By adding abnormal cases in cities B, C, and D, increasing abnormal cases, and soft-labeling the abnormal case labels of cities B, C, and D, the model can focus on abnormal cases in city A when using abnormal cases from four cities for training. This can not only solve the problem of the scarcity of abnormal cases in city A, but also find out the common abnormal features of cities A, B, C, and D and the abnormal features that city A has alone, thereby improving the prediction accuracy of the model.

[0103] According to an embodiment of the present disclosure, the distance between the historical execution area and the execution area can be determined based on the straight-line distance between two points in the geographical location. In the case where the historical transaction operation is determined to be an abnormal operation, the longest distance can be determined from multiple distances based on the distance to obtain the maximum distance. For each abnormal operation: based on the ratio of the distance to the maximum distance, the abnormal validity of the abnormal operation is determined. For example, the abnormal validity of the abnormal operation is obtained by subtracting one from the ratio of the distance to the maximum distance. In the case where the historical transaction operation is determined to be a normal operation, based on the execution area of ​​the normal operation, the abnormal operation belonging to the same execution area as the normal operation is determined, and the opposite number of the abnormal validity of the abnormal operation is used as the abnormal validity of the normal operation.

[0104] According to the embodiments of the present disclosure, considering that different regions have different businesses and users, the validity of abnormal cases in different regions is different for different regions. Therefore, determining the validity of abnormal cases based on the execution region can reduce the problem of inaccurate prediction caused by different reference values ​​of data related to abnormal operations due to different research regions.

[0105] According to another embodiment of the present disclosure, the abnormal validity of historical transaction operations can also be determined in combination with multiple levels and multiple methods. For example, the abnormal validity of historical transaction operations can be determined in combination from the two perspectives of time and space region. For example, the abnormal validity of abnormal operations in the subinterval farthest from the training time of city A is 1 / N, the abnormal validity of abnormal operations in the kth subinterval is k / N, and the abnormal validity of abnormal operations in the last subinterval is N / N, that is, 1. The abnormal validity of abnormal operations in the subinterval farthest from the training time of cities B, C, and D is K / N, the abnormal validity of abnormal operations in the kth subinterval is K*k / N, and the abnormal validity of abnormal operations in the last subinterval is K*N / N, which is equal to K.

[0106] Using the example above, the validity correlation coefficient of the historical sample data associated with abnormal operations in the kth subinterval of city A can be expressed as M+α kA *(1-M)*(k-1) / (N-1), α kA represents the adjustment parameter of the abnormal validity of city A in the kth subinterval; the validity correlation coefficient of the historical sample data associated with normal operation in the kth subinterval of city A is the negative of the validity correlation coefficient of the historical sample data associated with abnormal operation in the kth subinterval of city A, which can be expressed as -(M+α kA *(1-M)*(k-1) / (N-1)). The validity correlation coefficient of the historical sample data associated with abnormal operations in the kth subinterval of cities B, C, and D can be expressed as M+α kI *(1-M)*(k-1) / (N-1), α kI The adjustment parameter representing the abnormal validity of city I in the kth subinterval, where I can be any city among B, C, and D. The validity correlation coefficient of the historical sample data associated with normal operation in the kth subinterval of cities B, C, and D can be the negative of the validity correlation coefficient of the historical sample data associated with abnormal operation in the kth subinterval of cities B, C, and D, that is, - (M+α kI *(1-M)*(k-1) / (N-1)).

[0107] According to an embodiment of the present invention, combining multiple levels and multiple methods to determine the abnormal effectiveness of historical transaction operations can improve the accuracy of determining the abnormal effectiveness, which is beneficial to training the prediction model.

[0108] According to an embodiment of the present disclosure, historical sample data associated with abnormal operations can be obtained through internal data or external lists, and historical sample data associated with normal operations with the same execution time of a specified proportion can be extracted. The historical sample data is divided into a training set, a test set, and a cross-period verification set according to a predetermined ratio. The cross-period verification set can be a positive and negative sample that is close to the training time, and the execution time interval of the cross-period verification set strictly exists after the execution time interval of the training set and the test set. A soft label method can be used to set the model training sample label to a numerical value related to the abnormal validity, that is, the validity correlation coefficient. The historical sample data with the validity correlation coefficient label is input into the prediction model. The model extracts key features from the corresponding historical sample data by identifying the label, such as transaction flow, user information, etc., and then analyzes and outputs the training prediction value based on the extracted key features. The training prediction value is compared with the preset classification threshold to obtain the recognition result. According to the recognition result and the real label of the historical sample data, the parameters of the prediction model are adjusted until the model automatically converges to obtain a trained prediction model.

[0109] According to the embodiments of the present disclosure, the prediction model of the present disclosure is not a classification model in a conventional recognition model, but a regression model. After obtaining the model prediction value, a preset classification threshold is used. For example, 0 can be set as the classification threshold. A value greater than or equal to 0 indicates that abnormal behavior exists, and a value less than 0 indicates that there is no abnormal behavior.

[0110] According to the embodiments of the present disclosure, the present disclosure adopts a soft label method, which can improve the model's understanding and learning ability of complex data, enhance the model's robustness, and make the prediction model more robust.

[0111] Based on the above transaction anomaly identification method, the present disclosure also provides a transaction anomaly identification device. Figure 6 The device is described in detail.

[0112] Figure 6 The structural block diagram of the transaction anomaly identification device according to an embodiment of the present disclosure is schematically shown.

[0113] like Figure 6 As shown, the transaction anomaly identification device 600 of this embodiment includes a prediction module 610 and a determination module 620 .

[0114] The prediction module 610 is used to input the to-be-identified data associated with the real-time transaction operation into a pre-trained prediction model so as to predict abnormal behavior of the to-be-identified data and output a prediction value. In one embodiment, the prediction module 610 can be used to perform the operation S210 described above, which will not be described in detail here.

[0115] The determination module 620 is used to determine the recognition result based on the predicted value and the preset classification threshold. In one embodiment, the determination module 620 can be used to perform the operation S220 described above, which will not be described in detail here.

[0116] According to an embodiment of the present disclosure, the recognition result is used to indicate whether the data to be recognized has abnormal behavior.

[0117] According to an embodiment of the present disclosure, pre-training of a prediction model includes the following operations: obtaining historical sample data associated with multiple historical transaction operations, wherein the multiple historical transaction operations have been executed before real-time transaction operations; determining a validity correlation coefficient of the historical sample data associated with each historical transaction operation based on the abnormal validity of each historical transaction operation in the multiple historical transaction operations; determining the validity correlation coefficient as a label of the historical sample data; and training a prediction model based on the label of the historical sample data and the historical sample data.

[0118] According to an embodiment of the present disclosure, the transaction anomaly identification device 600 may further include: a first validity determination module and / or a second validity determination module.

[0119] The first validity determination module is used to determine the abnormal validity of each historical transaction operation based on the execution time of each historical transaction operation and the training time of the pre-trained prediction model. The second validity determination module is used to determine the abnormal validity of each historical transaction operation based on the historical execution area of ​​each historical transaction operation and the execution area of ​​the real-time transaction operation.

[0120] According to an embodiment of the present disclosure, the first validity determination module may include: a first sub-determination unit, a second sub-determination unit, and a third sub-determination unit.

[0121] The first sub-determination unit is used to determine the start time of the execution of the historical transaction operation from the multiple historical transaction operations according to the execution time of each historical transaction operation. The second sub-determination unit is used to determine the time interval between the start time and the training time. The third sub-determination unit is used to determine the abnormal validity of each historical transaction operation based on the ratio of the execution time of each historical transaction operation to the time interval.

[0122] According to an embodiment of the present disclosure, historical transaction operations may include abnormal operations and normal operations. Based on the ratio of the execution time of each historical transaction operation to the time interval, determining the abnormal validity of each historical transaction operation may include the following operations: when the historical transaction operation is determined to be an abnormal operation, determining the ratio of the execution time of the abnormal operation to the time interval as the abnormal validity of the abnormal operation; when the historical transaction operation is determined to be a normal operation, determining the inverse of the ratio of the execution time of the normal operation to the time interval as the abnormal validity of the normal operation.

[0123] According to an embodiment of the present disclosure, the first validity determination module may include: a fourth sub-determination unit, a fifth sub-determination unit, a division unit, and a sixth sub-determination unit.

[0124] The fourth sub-determination unit is used to determine the start time of the execution of the historical transaction operation and the end time of the execution of the historical transaction operation from multiple historical transaction operations based on the execution time of each historical transaction operation. The fifth sub-determination unit is used to determine the execution time interval according to the difference between the end time and the start time. The division unit is used to divide the execution time interval into multiple sub-intervals in chronological order. The sixth sub-determination unit is used to determine the abnormal validity of each historical transaction operation based on the target sub-interval to which the execution time of each historical transaction operation belongs and the training time of the pre-trained prediction model.

[0125] According to an embodiment of the present disclosure, determining the abnormal effectiveness of each historical transaction operation based on the target sub-interval to which the execution time of each historical transaction operation belongs and the training time of a pre-trained prediction model may include the following operations: determining the abnormal effectiveness of each historical transaction operation based on the time distance between the target sub-interval and the training time, wherein the time distance is inversely proportional to the abnormal effectiveness.

[0126] According to an embodiment of the present disclosure, the second validity determination module may include: a seventh sub-determination unit and an eighth sub-determination unit.

[0127] The seventh sub-determination unit is used to determine the distance between the historical execution area and the execution area of ​​each historical transaction operation. The eighth sub-determination unit is used to determine the abnormal validity of each historical transaction operation based on the distance and the abnormal type of the historical transaction operation, wherein the distance is inversely proportional to the abnormal validity, and the abnormal validity of two historical transaction operations with opposite abnormal types and the same historical execution area are opposite numbers of each other.

[0128] According to an embodiment of the present disclosure, any multiple modules in the prediction module 610 and the determination module 620 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the prediction module 610 and the determination module 620 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the prediction module 610 and the determination module 620 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be performed.

[0129] Figure 7 A block diagram of an electronic device suitable for implementing a method for identifying abnormal transactions according to an embodiment of the present disclosure is schematically shown.

[0130] like Figure 7 As shown, the electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 to a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include an onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0131] In RAM 703, various programs and data required for the operation of electronic device 700 are stored. Processor 701, ROM 702 and RAM 703 are connected to each other via bus 704. Processor 701 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 702 and / or RAM 703. It should be noted that the program can also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0132] According to an embodiment of the present disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to the bus 704. The electronic device 700 may further include one or more of the following components connected to the input / output (I / O) interface 705: an input portion 706 including a keyboard, a mouse, etc.; an output portion 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 708 including a hard disk, etc.; and a communication portion 709 including a network interface card such as a LAN card, a modem, etc. The communication portion 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the input / output (I / O) interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage portion 708 as needed.

[0133] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0134] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 702 and / or RAM 703 described above and / or one or more memories other than ROM 702 and RAM 703.

[0135] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the transaction anomaly identification method provided by the embodiment of the present disclosure.

[0136] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 701. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0137] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 709, and / or installed from the removable medium 711. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0138] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0139] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0140] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0141] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0142] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for identifying abnormal transactions, characterized in that: The method comprises: Inputting the to-be-identified data associated with the real-time transaction operation into a pre-trained prediction model so as to predict abnormal behavior of the to-be-identified data and output a prediction value; and Based on the predicted value and a preset classification threshold, determining a recognition result, wherein the recognition result is used to indicate whether the data to be recognized has abnormal behavior; The pre-training of the prediction model includes the following operations: Acquire historical sample data associated with a plurality of historical trading operations, wherein the plurality of historical trading operations have been executed before the real-time trading operation; Based on the abnormal validity of each of the historical transaction operations among the plurality of the historical transaction operations, determining a validity correlation coefficient of the historical sample data associated with each of the historical transaction operations; Determining the validity correlation coefficient as a label of the historical sample data; and The prediction model is trained based on the label of the historical sample data and the historical sample data.

2. The method according to claim 1, characterized in that The method further comprises: Determining the abnormal validity of each of the historical transaction operations based on the execution time of each of the historical transaction operations and the training time of the pre-trained prediction model; and / or The abnormal validity of each of the historical trading operations is determined based on the historical execution area of ​​each of the historical trading operations and the execution area of ​​the real-time trading operations.

3. The method according to claim 2, characterized in that The determining the abnormal validity of each of the historical transaction operations based on the execution time of each of the historical transaction operations and the training time of the pre-trained prediction model comprises: According to the execution time of each of the historical transaction operations, determining the start time for starting to execute the historical transaction operations from the plurality of the historical transaction operations; Determine the time interval between the start time and the training time; and The abnormal validity of each of the historical transaction operations is determined based on a ratio of the execution time of each of the historical transaction operations to the time interval.

4. The method according to claim 3, characterized in that The historical transaction operations include abnormal operations and normal operations; The determining the abnormal validity of each of the historical transaction operations based on the ratio of the execution time of each of the historical transaction operations to the time interval includes: In the case where the historical transaction operation is determined to be the abnormal operation, a ratio of the execution time of the abnormal operation to the time interval is determined as the abnormal validity of the abnormal operation; In the case where the historical transaction operation is determined to be the normal operation, the inverse of the ratio of the execution time of the normal operation to the time interval is determined as the abnormal validity of the normal operation.

5. The method according to claim 2, characterized in that: The determining the abnormal validity of each of the historical transaction operations based on the execution time of each of the historical transaction operations and the training time of the pre-trained prediction model includes: Based on the execution time of each of the historical transaction operations, determining a start time for starting to execute the historical transaction operations and an end time for ending to execute the historical transaction operations from the plurality of the historical transaction operations; Determine the execution time interval according to the difference between the end time and the start time; Dividing the execution time interval into a plurality of sub-intervals in chronological order; and The abnormal validity of each of the historical transaction operations is determined based on the target subinterval to which the execution time of each of the historical transaction operations belongs and the training time of pre-training the prediction model.

6. The method according to claim 5, characterized in that The determining the abnormal validity of each of the historical transaction operations based on the target subinterval to which the execution time of each of the historical transaction operations belongs and the training time of the pre-trained prediction model comprises: The abnormal validity of each of the historical trading operations is determined according to the time distance between the target subinterval and the training time, wherein the time distance is inversely proportional to the abnormal validity.

7. The method according to claim 2, characterized in that The determining the abnormal validity of each of the historical trading operations based on the historical execution area of ​​each of the historical trading operations and the execution area of ​​the real-time trading operations comprises: determining a distance between the historical execution region and the execution region of each of the historical trading operations; and Based on the distance and the abnormality type of the historical transaction operation, the abnormality validity of each historical transaction operation is determined, wherein the distance is inversely proportional to the abnormality validity, and the abnormality validity of two historical transaction operations with opposite abnormality types and the same historical execution area are opposite numbers of each other.

8. A transaction abnormality identification device, characterized in that: The device comprises: A prediction module, used for inputting the to-be-identified data associated with the real-time transaction operation into a pre-trained prediction model, so as to predict abnormal behavior of the to-be-identified data and output a prediction value; and A determination module, used to determine a recognition result based on the predicted value and a preset classification threshold, wherein the recognition result is used to indicate whether the data to be recognized has abnormal behavior; The pre-training of the prediction model includes the following operations: Acquire historical sample data associated with a plurality of historical trading operations, wherein the plurality of historical trading operations have been executed before the real-time trading operation; Based on the abnormal validity of each of the historical transaction operations among the plurality of the historical transaction operations, determining a validity correlation coefficient of the historical sample data associated with each of the historical transaction operations; Determining the validity correlation coefficient as a label of the historical sample data; and The prediction model is trained based on the label of the historical sample data and the historical sample data.

9. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images