Training method of transaction detection model and transaction data detection method and system
By introducing multi-party security computing technology in the training process of financial transaction detection model, the problem of sensitive transaction data information leakage is solved, and an accurate transaction detection model is established while protecting data privacy and ensuring transaction security.
Patent Information
- Application Number
- CN202411742624.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-29
- Publication Date
- 2025-03-18
AI Technical Summary
When training financial transaction detection models, it is difficult for the existing technology to effectively protect sensitive transaction data, resulting in the risk of information leakage.
By introducing multi-party security computing technology into the transaction detection system, the participant server trains the transaction detection model locally and sends the model parameters and flag data processed based on the hidden shard one-time transmission protocol to the central server. The central server aggregates the model parameters and uses flag data to train the global transaction detection model to ensure the privacy of sensitive information.
On the premise of maintaining the privacy of data of each participant, a relatively accurate transaction detection model has been established to ensure transaction security and crack down on illegal transactions.
Smart Images
Figure CN119648364A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of artificial intelligence technology, and specifically to a transaction detection model training method, a transaction data detection method and a system. Background Art
[0002] In order to effectively identify illegal financial transactions, machine learning technology is used to train artificial intelligence models that can identify abnormal transactions. In the process of model training, a large amount of transaction data is needed as training data to improve the effectiveness and accuracy of the model. However, in the training process, sensitive transaction data is usually required. Sensitive transaction data contains a large amount of customer privacy information and financial institutions' operating information.
[0003] Currently, there is a problem of using trained models to infer sensitive transaction data, leading to information leakage. Summary of the invention
[0004] In view of this, the present application provides a transaction detection model training method, a transaction data detection method and system, which can detect transaction data more accurately while protecting the private sensitive data of the participants.
[0005] The technical solutions provided by this application are as follows:
[0006] In a first aspect, the present application provides a method for training a transaction detection model, the method being applied to a transaction detection system, the transaction detection system comprising a participant server and a central server, the central server being connected to the participant server, the method comprising:
[0007] The participant server obtains local training data, trains a local transaction detection model using the local training data, and obtains model parameters, wherein the local training data includes training transaction data and a label, and the label is used to identify a normal transaction of a user to which the training transaction data belongs;
[0008] The participant server sends the model parameters to the central server;
[0009] The central server aggregates the model parameters of each of the local transaction detection models to obtain a first update parameter;
[0010] The participant server sends the marking data processed based on the secret sharding one-time transmission protocol to the central server, wherein the marking data includes sensitive information involved in the training transaction data;
[0011] The central server trains a global transaction detection model using the marker data to obtain second update parameters of the global transaction detection model, wherein the initial model parameters of the global transaction detection model are the first update parameters;
[0012] The central server sends the second update parameter to the participant server;
[0013] The participant server updates the local transaction detection model using the second update parameter.
[0014] In a possible implementation, the label includes a normal label and an abnormal label, and the using the local training data to train the local transaction detection model to obtain the model parameters includes:
[0015] Using the training transaction data and normal labels, training a local transaction detection model to obtain normal model parameters;
[0016] The training transaction data and the abnormal labels are used to train a local transaction detection model to obtain abnormal model parameters.
[0017] In a possible implementation, the central server aggregates model parameters of each of the local transaction detection models to obtain a first update parameter, including:
[0018] The central server aggregates normal model parameters and abnormal model parameters of each of the local transaction detection models to obtain first updated parameters.
[0019] In a possible implementation, the central server trains a global transaction detection model using the marker data, including:
[0020] The central server trains a global transaction detection model using marker data indicating that the training transaction data is normal.
[0021] In a second aspect, the present application provides a transaction data detection method, the method is applied to a transaction detection system, the transaction detection system includes a participant server and a central server, the central server is connected to the participant server, the method includes:
[0022] The participating server obtains the transaction data to be detected;
[0023] The participant server processes the transaction data to be detected by using a local transaction detection model to obtain an inference result output by the local transaction detection model, wherein the local transaction detection model is trained by using the transaction detection model training method according to any one of the first aspects;
[0024] The participant server obtains the target flag data sent by the central server and processed based on the secret sharding one-time transmission protocol, wherein the target flag data includes sensitive information involved in the transaction data to be detected;
[0025] The participant server uses the target mark data and the inference result to determine the detection result.
[0026] In a possible implementation, the inference result includes a normal result and an abnormal result, and the participant server uses the target mark data and the inference result to determine the detection result, including:
[0027] The participant server uses the target mark data to select a detection result from the inference results, and the detection result is the normal result or the abnormal result.
[0028] In a third aspect, the present application provides a transaction detection system, the transaction detection system comprising a participant server and a central server, the central server being connected to the participant server;
[0029] The participant server is used to obtain local training data, train a local transaction detection model using the local training data, and obtain model parameters, wherein the local training data includes training transaction data and a label, and the label is used to identify a normal transaction of a user to which the training transaction data belongs;
[0030] The participant server is used to send the model parameters to the central server;
[0031] The central server is used to aggregate the model parameters of each of the local transaction detection models to obtain a first update parameter;
[0032] The participant server is used to send the marker data processed based on the secret sharding one-time transmission protocol to the central server, wherein the marker data includes sensitive information involved in the training transaction data;
[0033] The central server is used to train a global transaction detection model using the marker data to obtain second update parameters of the global transaction detection model, wherein the initial model parameters of the global transaction detection model are the first update parameters;
[0034] The central server is used to send the second update parameter to the participant server;
[0035] The participant server is used to update the local transaction detection model using the second update parameter.
[0036] In a possible implementation, the label includes a normal label and an abnormal label, and the participant server is used to train a local transaction detection model using the local training data to obtain model parameters, including:
[0037] The participant server is used to train a local transaction detection model using the training transaction data and normal labels to obtain normal model parameters; and to train a local transaction detection model using the training transaction data and abnormal labels to obtain abnormal model parameters.
[0038] In a possible implementation, the central server is used to aggregate model parameters of each of the local transaction detection models to obtain a first update parameter, including:
[0039] The central server is used to aggregate the normal model parameters and abnormal model parameters of each of the local transaction detection models to obtain the first update parameters.
[0040] In a possible implementation, the central server is used to train a global transaction detection model using the marker data, including:
[0041] The central server is used to train a global transaction detection model using marker data indicating that the training transaction data is normal.
[0042] In a fourth aspect, the present application provides a transaction detection system, the transaction detection system comprising a participant server and a central server, the central server being connected to the participant server;
[0043] The participant server is used to obtain the transaction data to be detected;
[0044] The participant server is used to process the transaction data to be detected by using a local transaction detection model to obtain an inference result output by the local transaction detection model, wherein the local transaction detection model is trained by using the transaction detection model training method according to any one of the first aspects;
[0045] The participant server is used to obtain the target flag data sent by the central server and processed based on the secret fragmentation one-time transmission protocol, wherein the target flag data includes sensitive information involved in the transaction data to be detected;
[0046] The participant server is used to determine the detection result by using the target mark data and the inference result.
[0047] In a possible implementation, the inference result includes a normal result and an abnormal result, and the participant server is used to determine the detection result by using the target mark data and the inference result, including:
[0048] The participant server is used to select a detection result from the inference results using the target mark data, and the detection result is the normal result or the abnormal result.
[0049] It can be seen that this application has the following beneficial effects:
[0050] The training method of the transaction detection model provided in the present application is that the participating server trains the local transaction detection model with the local training data to obtain the model parameters, and the participating server sends the model parameters to the central server. The central server aggregates the model parameters of each local transaction detection model to obtain the first update parameter. Each participating server sends the mark data processed based on the secret sharding one-time transmission protocol to the central server. The central server trains the global transaction detection model with the mark data to obtain the second update parameter. The central server sends the second update parameter to the participating server. The participating server updates the local transaction detection model with the second update parameter. The participating server processes the transaction data to be detected with the local transaction detection model to obtain the inference result output by the local transaction detection model. The participating server obtains the target mark data sent by the central server. The participating server determines the detection result using the target mark data and the inference result.
[0051] This application introduces multi-party secure computing technology into the transaction detection model training of federated learning. On the premise of maintaining the privacy of the signature data of each participant, a more accurate transaction detection model is established to ensure transaction security and combat illegal transactions. BRIEF DESCRIPTION OF THE DRAWINGS
[0052] Figure 1 A flowchart of a method for training a transaction detection model provided in an embodiment of the present application;
[0053] Figure 2 A schematic diagram of a training transaction detection model provided in an embodiment of the present application;
[0054] Figure 3 A flowchart of a transaction data detection method provided in an embodiment of the present application;
[0055] Figure 4 A flowchart of a transaction data detection method provided in an embodiment of the present application;
[0056] Figure 5 A schematic diagram of the structure of a transaction detection system provided in an embodiment of the present application. DETAILED DESCRIPTION
[0057] In order to facilitate the understanding and explanation of the technical solutions provided by the embodiments of the present application, the background technology of the present application will be described below.
[0058] The technical terms involved in the embodiments of the present application are first explained below.
[0059] Federated Learning: Federated Learning is a machine learning method that aims to train a unified machine learning model without centralizing the training data set in a single location. In federated learning, the model training process is performed on multiple local data holders (such as mobile devices, edge servers, institutions), each data holder updates the model locally, and aggregates the updated model parameters to the central server to form a global transaction detection model. This approach enables federated learning to achieve large-scale model training and optimization while protecting data privacy.
[0060] Secure Multi-Party Computation: Secure Multi-Party Computation (SMPC) is a cryptographic technology that aims to allow multiple parties to perform computations without disclosing private inputs. Participants can collaborate to perform computational tasks without directly sharing private inputs. Specifically, secure multi-party computation uses cryptographic protocols to ensure that each participant can only obtain the computational results, but cannot obtain the private input information of other participants. This protects data privacy while achieving the completion of collaborative computing tasks.
[0061] Differential Privacy: Differential Privacy is a data privacy protection technology that aims to protect the privacy of individual data when publishing statistical data or performing data analysis. Differential privacy adds a certain amount of random noise to the original data to confuse individual data, thereby preventing the specific information of individual data from being inferred by analyzing the published results.
[0062] Secret Sharing Oblivious Transfer (Secret Sharing OT) is a cryptographic protocol that combines the concepts of secret sharing and one-time transfer. In Secret Sharing OT, a message is divided into multiple parts and distributed to different participants. Only when all parts are collected can the original message be restored.
[0063] Federated learning, as a distributed machine learning method, provides the banking industry with an effective way to jointly train anti-fraud models while protecting customer privacy. At present, some banks have established a federated learning framework to achieve data sharing and model collaboration across different institutions. Each bank can train fraud detection models locally and aggregate the updated model parameters to the central server for model aggregation. This can effectively protect customer privacy while improving the accuracy and efficiency of fraud detection.
[0064] However, the current federated learning method may have the risk of data privacy leakage. Participants need to share model parameters, which exposes the characteristic information of the data to a certain extent, thereby increasing the risk of data privacy leakage. In addition, the model security in federated learning may not be sufficient to deal with malicious attacks, increasing the risk of model attacks, such as model tampering or model reverse attack, thus affecting the security of the model.
[0065] Based on this, an embodiment of the present application provides a training method for a transaction detection model, wherein a participant server trains a local transaction detection model using local training data to obtain model parameters, and the participant server sends the model parameters to a central server. The central server aggregates the model parameters of each local transaction detection model to obtain a first update parameter. Each participant server sends to the central server the flag data processed based on a secret sharding one-time transmission protocol. The central server trains a global transaction detection model using the flag data to obtain a second update parameter. The central server sends the second update parameter to the participant server. The participant server updates the local transaction detection model using the second update parameter. The participant server processes the transaction data to be detected using the local transaction detection model to obtain an inference result output by the local transaction detection model. The participant server obtains the target flag data sent by the central server. The participant server determines the detection result using the target flag data and the inference result.
[0066] This application introduces multi-party secure computing technology into the training of the transaction detection model of federated learning. Under the premise of maintaining the privacy of the signature data of each participant, a highly accurate abnormal transaction detection model is established on the central server to ensure transaction security and combat illegal transactions.
[0067] In order to facilitate understanding of the technical solution provided in the embodiment of the present application, the training method of the transaction detection model and the transaction data detection method provided in the embodiment of the present application are described below in conjunction with the accompanying drawings.
[0068] The training method of the transaction detection model and the transaction data detection method are applied to the transaction detection system. The transaction detection system includes a participant server and a central server. The central server is connected to the participant server.
[0069] See also Figure 1 As shown, the figure is a flow chart of a training method for a transaction detection model provided in an embodiment of the present application.
[0070] S101: The participating server obtains local training data, and uses the local training data to train a local transaction detection model to obtain model parameters.
[0071] See also Figure 2 As shown, this figure is a schematic diagram of a training transaction detection model provided in an embodiment of the present application.
[0072] The participant server is, for example, a server of a financial institution, such as a local server of a bank. There are multiple participants.
[0073] Local training data refers to the local training data of each participant. Local training data includes training transaction data and labels.
[0074] The training transaction data is the basic transaction information of the financial institution. The training transaction data may include, for example, the transaction date, amount, currency, customer name, account number, address and zip code, etc. The tag is used to identify the normal transaction of the user to whom the training transaction data belongs.
[0075] In one possible implementation, the label includes a normal label and an abnormal label. The normal label indicates that the account related to the transaction data is normal, that is, the account has no relevant problems. The abnormal label indicates that the account related to the transaction data is abnormal, that is, the account has relevant problems. The labels included in the local training data are hypothetical and are not determined based on the status of the account itself.
[0076] For each training transaction data, the local transaction detection model is trained for normal labels and abnormal labels respectively, so as to realize training for two possible situations: normal account and abnormal account.
[0077] The local transaction detection model is a transaction detection model established on the server of the participating party.
[0078] Specifically, the local transaction detection model is trained using local training data to obtain model parameters, including:
[0079] The local transaction detection model is trained using the training transaction data and normal labels to obtain normal model parameters; the local transaction detection model is trained using the training transaction data and abnormal labels to obtain abnormal model parameters.
[0080] In this way, training is performed for the two situations respectively to obtain two types of model parameters.
[0081] S102: The participating server sends model parameters to the central server.
[0082] The central server is, for example, a local server of a trading center.
[0083] S103: The central server aggregates model parameters of each local transaction detection model to obtain a first update parameter.
[0084] Specifically, the central server uses an aggregator to aggregate the model parameters of each local transaction detection model. The central server uses noise aggregation based on differential privacy to aggregate model parameters and generate updated parameters for the global transaction detection model.
[0085] In the case where the model parameters include normal model parameters and abnormal model parameters, the central server aggregates the normal model parameters and abnormal model parameters of each local transaction detection model to obtain the first updated parameters.
[0086] S104: The participating server sends the marker data processed based on the secret fragmented one-time transmission protocol to the central server.
[0087] The participating party servers interact with the central server to obtain the identification data of each participating party.
[0088] Flag data includes sensitive information related to the training transaction data. Flag data is used to indicate any potential problems with the training transaction data or special features related to the account. Flag data is private information held by the bank and cannot be shared with the central server. Flag data can greatly improve the prediction accuracy of the transaction detection model.
[0089] Specifically, the participating server first generates secret shards. Each participating server divides its own signature data into multiple secret shards. These secret shards need to be securely distributed to other central servers.
[0090] The participating servers interact with the central server based on the OT protocol. The one-time transfer protocol is a basic protocol in cryptography, which is used to securely transmit information between two untrusted parties. The core idea of the OT protocol is to allow the receiver to obtain some information from the sender, while the sender does not know what specific information the receiver has obtained.
[0091] The OT protocol is executed between the participating servers and the central server so that the central server can securely obtain the secret shard. The central server has the secret shard of the participating servers and can perform calculations without exposing their other signature data.
[0092] S105: The central server trains the global transaction detection model using the marker data to obtain second update parameters of the global transaction detection model. The initial model parameters of the global transaction detection model are the first update parameters.
[0093] The central server obtains the marker data of each participating server. The central server trains the global transaction detection model using the marker data. The initial model parameters of the global transaction detection model are the first update parameters obtained by aggregation. The central server trains the global transaction detection model to obtain the second update parameters of the global transaction detection model.
[0094] Specifically, the central server trains the global transaction detection model using the marker data indicating that the training transaction data is normal. The central server selects the marker data indicating normality to train the model and updates the model parameters. The secure multi-party protocol ensures that the central server does not know that each participating server uses local data to train the model locally. During the training process, the participating servers use the secure multi-party protocol to encrypt and calculate the updates of the model parameters to ensure that the data of individual participating servers will not be leaked.
[0095] S106: The central server sends a second update parameter to the participating server.
[0096] The central server sends the second updated parameter to each participating server.
[0097] S107: The participating server updates the local transaction detection model using the second update parameter.
[0098] In some possible implementations, S101 - S107 are repeatedly performed until the local transaction detection model or the global transaction detection model converges, or the number of training times reaches a predetermined number of training times.
[0099] Based on the transaction detection model trained by the training method of the transaction detection model, the embodiment of the present application also provides a transaction data detection method. The transaction data detection method is applied to a transaction detection system. The transaction detection system includes a participant server and a central server. The central server is connected to the participant server.
[0100] See also Figure 3 As shown, the figure is a flow chart of the transaction data detection method provided in an embodiment of the present application.
[0101] S301: The participating server obtains the transaction data to be tested.
[0102] See also Figure 4 As shown, this figure is a schematic diagram of a transaction data detection method provided in an embodiment of the present application.
[0103] The transaction data to be tested is the transaction data that needs to be judged as normal or abnormal. The transaction data to be tested is the transaction data belonging to the target account.
[0104] S302: The participating server uses the local transaction detection model to process the transaction data to be detected, and obtains the inference result output by the local transaction detection model.
[0105] The participating server assumes that the target account is normal and the account is abnormal, and uses the local transaction detection model to perform two inferences respectively, and obtains the inference results including normal results and abnormal results. As an example, the normal result includes the probability that the target account is normal. The abnormal result includes the probability that the target account is abnormal.
[0106] S303: The participating server obtains the target flag data sent by the central server and processed based on the secret fragmentation one-time transmission protocol, and the target flag data includes sensitive information involved in the transaction data to be detected.
[0107] The participating servers and the central server use a secure two-party computing protocol. The central server interacts with other participating servers and can determine whether the target account's flag data is abnormal without obtaining specific information about the target account.
[0108] The central server sends target identification data to the participating server. The target identification data is sensitive information involved in the transaction data to be detected, such as sensitive information related to the account involved in the transaction.
[0109] S304: The participating server uses the target mark data and the inference result to determine the detection result.
[0110] Specifically, the participating server uses the target flag data to select a detection result from a normal result or an abnormal result. For example, if the target flag data indicates that the transaction event is normal, the normal result is selected. If the target flag data indicates that the transaction event is abnormal, the abnormal result is selected.
[0111] The embodiment of the present application is based on a transaction detection model of multi-party secure computing and federated learning. Multi-party secure computing is used to allow the participating servers to perform calculations without sharing the original data. In federated learning, the participating servers can calculate the model parameters by using multi-party secure computing technology without directly sharing the original data, which can reduce the risk of data leakage and further protect the privacy of users.
[0112] In addition, computing is distributed among multiple parties to ensure that the process of model training and parameter aggregation is not exposed to any single party. This helps prevent malicious attackers from undermining the security of the model by monitoring communications or tampering with data. Moreover, the introduction of multi-party secure computing can reduce the trust requirements between participants. In traditional federated learning, participants usually need to trust each other to ensure the security of data and models. Multi-party secure computing can perform secure computing in an untrusted environment, thereby reducing the trust requirements. It can flexibly support more participants to join the federated learning process without worrying about data leakage or model security issues. This helps to build a more open and diverse federated learning ecosystem and attract more participants to participate in model training.
[0113] Based on the training method of a transaction detection model provided by the above method embodiment, the embodiment of the present application also provides a transaction detection system, which will be described below in conjunction with the accompanying drawings.
[0114] See also Figure 5 As shown in FIG. 1 , this figure is a schematic diagram of the structure of a transaction detection system provided in an embodiment of the present application. The transaction detection system includes a participant server 501 and a central server 502, and the central server 502 is connected to the participant server 501. Figure 5 As shown, the transaction detection system includes:
[0115] The participant server 501 is used to obtain local training data, train a local transaction detection model using the local training data, and obtain model parameters, wherein the local training data includes training transaction data and a label, and the label is used to identify the normal transaction status of the user to whom the training transaction data belongs;
[0116] The participant server 501 is used to send the model parameters to the central server 502;
[0117] The central server 502 is used to aggregate the model parameters of each of the local transaction detection models to obtain a first update parameter;
[0118] The participant server 501 is used to send the marker data processed based on the secret sharding one-time transmission protocol to the central server 502, wherein the marker data includes sensitive information involved in the training transaction data;
[0119] The central server 502 is used to train a global transaction detection model using the marker data to obtain second update parameters of the global transaction detection model, wherein the initial model parameters of the global transaction detection model are the first update parameters;
[0120] The central server 502 is used to send the second update parameter to the participant server 501;
[0121] The participant server 501 is used to update the local transaction detection model using the second update parameter.
[0122] In a possible implementation, the label includes a normal label and an abnormal label, and the participant server 501 is used to train a local transaction detection model using the local training data to obtain model parameters, including:
[0123] The participant server 501 is used to train a local transaction detection model using the training transaction data and normal labels to obtain normal model parameters; and to train a local transaction detection model using the training transaction data and abnormal labels to obtain abnormal model parameters.
[0124] In a possible implementation, the central server 502 is used to aggregate the model parameters of each of the local transaction detection models to obtain the first update parameter, including:
[0125] The central server 502 is used to aggregate the normal model parameters and abnormal model parameters of each of the local transaction detection models to obtain first updated parameters.
[0126] In a possible implementation, the central server 502 is used to train a global transaction detection model using the marker data, including:
[0127] The central server 502 is used to train the global transaction detection model using the marker data indicating that the training transaction data is normal.
[0128] Based on a transaction data detection method provided in the above method embodiment, the embodiment of the present application also provides a transaction detection system, which will be described below in conjunction with the accompanying drawings.
[0129] The transaction detection system includes a participant server and a central server, wherein the central server is connected to the participant server.
[0130] The participant server is used to obtain the transaction data to be detected;
[0131] The participant server is used to process the transaction data to be detected by using a local transaction detection model to obtain an inference result output by the local transaction detection model, wherein the local transaction detection model is trained by using the training method of the transaction detection model described above;
[0132] The participant server is used to obtain the target flag data sent by the central server and processed based on the secret fragmentation one-time transmission protocol, wherein the target flag data includes sensitive information involved in the transaction data to be detected;
[0133] The participant server is used to determine the detection result by using the target mark data and the inference result.
[0134] In a possible implementation, the inference result includes a normal result and an abnormal result, and the participant server is used to determine the detection result by using the target mark data and the inference result, including:
[0135] The participant server is used to select a detection result from the inference results using the target mark data, and the detection result is the normal result or the abnormal result.
[0136] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.
[0137] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.
[0138] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.
[0139] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
[0140] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A training method for a transaction detection model, characterized in that: The method is applied to a transaction detection system, the transaction detection system includes a participant server and a central server, the central server is connected to the participant server, and the method includes: The participant server obtains local training data, trains a local transaction detection model using the local training data, and obtains model parameters, wherein the local training data includes training transaction data and a label, and the label is used to identify a normal transaction of a user to which the training transaction data belongs; The participant server sends the model parameters to the central server; The central server aggregates the model parameters of each of the local transaction detection models to obtain a first update parameter; The participant server sends the marking data processed based on the secret sharding one-time transmission protocol to the central server, wherein the marking data includes sensitive information involved in the training transaction data; The central server trains a global transaction detection model using the marker data to obtain second update parameters of the global transaction detection model, wherein the initial model parameters of the global transaction detection model are the first update parameters; The central server sends the second update parameter to the participant server; The participant server updates the local transaction detection model using the second update parameter.
2. The method according to claim 1, characterized in that The labels include normal labels and abnormal labels. The local transaction detection model is trained using the local training data to obtain model parameters, including: Using the training transaction data and normal labels, training a local transaction detection model to obtain normal model parameters; The training transaction data and the abnormal labels are used to train a local transaction detection model to obtain abnormal model parameters.
3. The method according to claim 2, characterized in that The central server aggregates the model parameters of each of the local transaction detection models to obtain a first update parameter, including: The central server aggregates normal model parameters and abnormal model parameters of each of the local transaction detection models to obtain first update parameters.
4. The method according to claim 2, characterized in that: The central server trains a global transaction detection model using the marker data, including: The central server trains a global transaction detection model using marker data indicating that the training transaction data is normal.
5. A transaction data detection method, characterized in that: The method is applied to a transaction detection system, the transaction detection system includes a participant server and a central server, the central server is connected to the participant server, and the method includes: The participating server obtains the transaction data to be detected; The participant server processes the transaction data to be detected using a local transaction detection model to obtain an inference result output by the local transaction detection model, wherein the local transaction detection model is trained using the transaction detection model training method according to any one of claims 1 to 4; The participant server obtains the target flag data sent by the central server and processed based on the secret sharding one-time transmission protocol, wherein the target flag data includes sensitive information involved in the transaction data to be detected; The participant server uses the target mark data and the inference result to determine the detection result.
6. The method according to claim 5, characterized in that The inference result includes a normal result and an abnormal result. The participant server uses the target mark data and the inference result to determine the detection result, including: The participant server uses the target mark data to select a detection result from the inference results, and the detection result is the normal result or the abnormal result.
7. A transaction detection system, characterized in that: The transaction detection system includes a participant server and a central server, wherein the central server is connected to the participant server; The participant server is used to obtain local training data, train a local transaction detection model using the local training data, and obtain model parameters, wherein the local training data includes training transaction data and a label, and the label is used to identify a normal transaction of a user to which the training transaction data belongs; The participant server is used to send the model parameters to the central server; The central server is used to aggregate the model parameters of each of the local transaction detection models to obtain a first update parameter; The participant server is used to send the marker data processed based on the secret sharding one-time transmission protocol to the central server, wherein the marker data includes sensitive information involved in the training transaction data; The central server is used to train a global transaction detection model using the marker data to obtain second update parameters of the global transaction detection model, wherein the initial model parameters of the global transaction detection model are the first update parameters; The central server is used to send the second update parameter to the participant server; The participant server is used to update the local transaction detection model using the second update parameter.
8. The system according to claim 7, characterized in that The labels include normal labels and abnormal labels. The participant server is used to train a local transaction detection model using the local training data to obtain model parameters, including: The participant server is used to train a local transaction detection model using the training transaction data and normal labels to obtain normal model parameters; and to train a local transaction detection model using the training transaction data and abnormal labels to obtain abnormal model parameters.
9. A transaction detection system, characterized in that: The transaction detection system includes a participant server and a central server, wherein the central server is connected to the participant server; The participant server is used to obtain the transaction data to be detected; The participant server is used to process the transaction data to be detected by using a local transaction detection model to obtain an inference result output by the local transaction detection model, wherein the local transaction detection model is trained by using the transaction detection model training method according to any one of claims 1 to 4; The participant server is used to obtain the target flag data sent by the central server and processed based on the secret fragmentation one-time transmission protocol, wherein the target flag data includes sensitive information involved in the transaction data to be detected; The participant server is used to determine the detection result by using the target mark data and the inference result.
10. The system according to claim 9, characterized in that The inference result includes a normal result and an abnormal result. The participant server is used to determine the detection result by using the target mark data and the inference result, including: The participant server is used to select a detection result from the inference results using the target mark data, and the detection result is the normal result or the abnormal result.