Abnormality detection method, system, device and medium

Abstract

The invention belongs to the field of artificial intelligence, and relates to an anomaly detection method, which comprises the following steps that: a central server broadcasts an initial global model to a plurality of clients; and the client uses local data and an optimization algorithm to train a model within a preset time, and sends model parameters to the edge server of the corresponding subnet. And the edge server carries out local aggregation on the received parameters to form an aggregation model in the subnet, and sends the aggregation model to the central server. And the central server globally aggregates the aggregation models to obtain a target global model, and broadcasts the target global model back to the client. And the client updates parameters by using a global model combiner to obtain an anomaly detection model for anomaly detection of local financial behavior data. The invention further provides a system, equipment and a medium. In addition, the invention also relates to a block chain technology, and the local training data and the local financial behavior data can be stored in a block chain. The data exception detection efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to an anomaly detection method, system, device and medium. Background Art

[0002] In the banking field, fraud detection has always been a critical task. For a long time, traditional fraud detection methods have relied on centralized data sets, which is not only time-consuming and labor-intensive, but also requires a lot of computing resources. More importantly, it brings security risks that cannot be ignored. With the development of technology, although the introduction of federated learning technology has provided a new solution for fraud detection, allowing different banks to use their own data to independently train and update models, ensuring the privacy and security of data, and improving the accuracy and efficiency of detection, the existing federated learning technology still has many shortcomings.

[0003] Especially when training models on edge devices, the training process becomes extremely difficult because these devices generally have limited computing resources, limited storage capacity, and low network bandwidth. Traditional machine learning methods require uploading data to the cloud for processing, which leads to huge communication overhead and energy consumption, and may also leak user privacy. In addition, in the classic federated learning scenario, each iteration needs to wait for all selected edge devices to upload gradients, while the transmission delay caused by uplink and downlink communications is seriously ignored, which greatly affects the time of a single iteration, thereby reducing training efficiency and resulting in low efficiency of data anomaly detection. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide an anomaly detection method, system, device and medium to solve the problem of low efficiency of existing data anomaly detection.

[0005] In order to solve the above technical problems, an embodiment of the present application provides an anomaly detection method, which is applied to an anomaly detection system. The anomaly detection system includes a central server, multiple clients, and multiple edge servers. The multiple clients form multiple subnets, and the multiple edge servers are located at the edges of the multiple subnets. The following technical solutions are adopted:

[0006] The central server broadcasts the initial global model to multiple clients; within a preset time interval, multiple clients, based on local training data, use a preset optimization algorithm to perform model training on the received initial global model, obtain multiple model parameters, and send the multiple model parameters to multiple edge servers in multiple subnets; multiple edge servers locally aggregate the received multiple model parameters to obtain multiple aggregate models in multiple subnets, and send the multiple aggregate models to the central server; the central server globally aggregates the received multiple aggregate models to obtain a target global model, and broadcasts the target global model to multiple clients; based on the received target global model, multiple clients use a preset global model combiner to update multiple model parameters to obtain anomaly detection models, and perform anomaly detection on local financial behavior data based on the anomaly detection models.

[0007] Furthermore, the multiple clients perform model training on the received initial global model based on local training data and using a preset optimization algorithm within a preset time interval to obtain multiple model parameters, specifically including:

[0008] Multiple clients obtain a preset optimization algorithm, local training data, and an initial global model; determine whether the current time is within a preset time interval; if the current time is within the time interval, the initial global model is trained using an optimization algorithm based on the local training data to obtain multiple updated model parameters; if the current time is not within the time interval, a waiting time is determined, and when the time reaches the waiting time, the initial global model is trained using an optimization algorithm based on the local training data to obtain multiple updated model parameters.

[0009] Furthermore, the multiple edge servers locally aggregate the received multiple model parameters to obtain multiple aggregated models in multiple subnets, specifically including:

[0010] The plurality of edge servers determine a first weight coefficient of each model parameter according to a preset parameter evaluation strategy; perform local weighted average processing on the first weight coefficient and the plurality of model parameters to obtain a plurality of aggregate models in the plurality of subnets after aggregation processing.

[0011] Furthermore, the central server globally aggregates the received multiple aggregation models to obtain a target global model, which specifically includes:

[0012] The central server determines the second weight coefficient of the aggregation parameters of multiple aggregation models according to the preset weight distribution strategy; performs global weighted averaging on the second weight coefficient and the aggregation parameters to obtain updated global model parameters as the new global model for the current model training iteration round; determines whether the new global model meets the preset convergence conditions; if the new global model meets the convergence conditions, uses the new global model as the target global model; if the new global model does not meet the convergence conditions, broadcasts the new global model to multiple clients to start a new round of model training until a global model that meets the convergence conditions is obtained, and uses the global model that meets the convergence conditions as the target global model.

[0013] Furthermore, the central server globally aggregates the received multiple aggregation models to obtain a target global model, which specifically includes:

[0014] The central server determines the second weight coefficient of the aggregation parameters of multiple aggregation models according to a preset weight allocation strategy; performs global weighted averaging on the second weight coefficient and the aggregation parameters to obtain updated global model parameters as the new global model of the current model training iteration round; determines whether the current model training iteration round reaches the preset target round; if the current model training iteration round reaches the target round, the new global model is used as the target global model; if the current model training iteration round does not reach the target round, the new global model is broadcast to multiple clients to start a new round of model training until the model training iteration round reaches the target round, and the global model whose model training iteration round reaches the target round is used as the target global model.

[0015] Furthermore, the multiple clients use a preset global model combiner based on the received target global model to update multiple model parameters to obtain the anomaly detection model, which specifically includes:

[0016] Multiple clients obtain a preset global model combiner and a target global model; through the global model combiner, a target parameter of the target global model and multiple model parameters are weighted averaged to obtain an anomaly detection model.

[0017] Furthermore, the steps of performing anomaly detection on local financial behavior data based on the anomaly detection model specifically include:

[0018] Obtain financial behavior data, preprocess the financial behavior data, and extract behavior feature information; input the behavior feature information into the anomaly detection model for anomaly detection to obtain the anomaly score of the financial behavior data; if the anomaly score exceeds the preset anomaly threshold, the financial behavior data is determined to be abnormal data.

[0019] In order to solve the above technical problems, the embodiment of the present application also provides an abnormality detection system, which adopts the following technical solutions:

[0020] The central server is used to broadcast the initial global model to multiple clients; globally aggregate the received multiple aggregate models to obtain the target global model, and broadcast the target global model to multiple clients;

[0021] Multiple clients are used to perform model training on the received initial global model within a preset time interval based on local training data and using a preset optimization algorithm to obtain multiple model parameters, and send the multiple model parameters to multiple edge servers of multiple subnets; based on the received target global model, using a preset global model combiner, update multiple model parameters to obtain anomaly detection models, and perform anomaly detection on local financial behavior data based on the anomaly detection models;

[0022] The multiple edge servers are used to locally aggregate the multiple model parameters received, obtain multiple aggregate models in multiple subnets, and send the multiple aggregate models to the central server.

[0023] In order to solve the above technical problems, an embodiment of the present application also provides a computer device, including a memory and a processor, wherein the memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the above-mentioned abnormality detection method are implemented.

[0024] In order to solve the above technical problems, an embodiment of the present application also provides a computer-readable storage medium, which stores computer-readable instructions. The computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the above-mentioned abnormality detection method.

[0025] Compared with the prior art, the embodiment of the present application has the following beneficial effects: within a preset time interval, each client uses local training data to independently train the model and sends the model parameters to the edge server of the subnet to which it belongs. In this process, the client performs multiple random gradient descent iterations on its own data set, effectively utilizing local data resources and reducing the need for data transmission. In addition, the edge server locally aggregates the received multiple model parameters to obtain an aggregated model in multiple subnets. This step is performed within the local subnet, and there is no need to upload the original local training data that may contain sensitive information to the central server or the cloud, thereby ensuring the privacy and security of the data, and greatly reducing the communication delay by reducing the frequency of communication between the edge and the cloud. By aggregating the model parameters in the local subnet and undergoing global aggregation by the central server, an updated target global model is obtained. This process reduces the communication delay between the edge and the cloud, accelerates the convergence speed of the global model, thereby improving the accuracy and training efficiency of the anomaly detection model, and thus can improve the efficiency of data anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0027] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0028] Figure 2 It is a flowchart of an anomaly detection method provided by the present application;

[0029] Figure 3 It is a structural schematic diagram of an anomaly detection system provided by the present application;

[0030] Figure 4 It is a structural schematic diagram of a computer device provided by this application. DETAILED DESCRIPTION

[0031] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0032] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0033] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0034] like Figure 1 As shown, the system architecture 100 may include a terminal device 101, a network 102 and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables.

[0035] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0036] The terminal device 101 can be any electronic device with a display screen and supporting web browsing. In addition to a laptop computer 1011, a tablet computer 1012 or a mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV), a laptop computer, a desktop computer, etc.

[0037] The server 103 may be a server that provides various services, such as a background server that provides support for a web page displayed on the terminal device 101 .

[0038] It should be noted that the anomaly detection method provided in the embodiment of the present application is generally performed jointly by a server and a terminal device. Accordingly, the anomaly detection system is generally arranged in the server and the terminal device.

[0039] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0040] Continue to refer Figure 2 , shows a flow chart of an embodiment of an anomaly detection method according to the present application. The anomaly detection method can be applied to an anomaly detection system, the anomaly detection system includes a central server, multiple clients and multiple edge servers, the multiple clients form multiple subnets, and the multiple edge servers are located at the edges of the multiple subnets. The anomaly detection method may include the following steps:

[0041] Step S201: the central server broadcasts an initial global model to multiple clients.

[0042] The central server refers to the core device responsible for coordinating and managing various nodes (such as clients and edge servers) in a distributed system. It is responsible for broadcasting the initial global model to multiple clients, receiving the aggregated model from the edge server, and performing global aggregation to finally obtain the target global model. For example, in a fraud detection system, the central server is responsible for coordinating the model training process of each bank client.

[0043] Among them, multiple clients refer to multiple nodes participating in model training, and each node represents an independent data source, such as the fraud detection system of different banks. They receive the initial global model broadcast by the central server, train the model based on local training data, and send the model parameters to the corresponding edge server. For example, each bank participates in model training as a client.

[0044] Broadcasting refers to the process whereby a central server sends information (such as the initial global model) to all clients. It ensures that all clients receive the same information at the same time, thereby starting a synchronized model training process. For example, a central server broadcasts the latest global model to all banking clients.

[0045] The initial global model refers to the initial model provided by the central server before model training begins. It serves as the starting point for model training and will be gradually optimized to a more accurate model as training progresses. For example, in fraud detection, the initial global model may be a simple classifier.

[0046] In step S202, multiple clients perform model training on the received initial global model based on local training data and a preset optimization algorithm within a preset time interval to obtain multiple model parameters, and send the multiple model parameters to multiple edge servers in multiple subnets.

[0047] The time interval refers to the time range for the client to perform model training. During this time interval, the client will perform model training based on local training data and send model parameters to the edge server. For example, 8:00 to 10:00 p.m. every day is the time interval for the client to perform model training.

[0048] Local training data refers to data owned by the client and used for model training. This data usually contains financial behavior data related to fraud detection. For example, customer transaction record data owned by a bank client.

[0049] Among them, the optimization algorithm refers to the algorithm used to train the model. It iteratively updates the model parameters based on the training data and model parameters to minimize the loss function. For example, the gradient descent algorithm is an optimization algorithm.

[0050] The multiple model parameters refer to the set of model parameters obtained by the client during the model training process. These parameters characterize the internal structure and characteristics of the model. For example, in a neural network, weights and biases are model parameters.

[0051] Among them, multiple subnets refer to network subsets composed of multiple clients. Clients in each subnet communicate and exchange data through edge servers. For example, bank clients in different regions may form different subnets.

[0052] Among them, multiple edge servers are devices located at the edge of the subnet, which are responsible for receiving model parameters from clients, performing local aggregation, and sending the aggregated model to the central server. For example, each subnet is equipped with at least one edge server.

[0053] Step S203: the multiple edge servers locally aggregate the multiple model parameters received to obtain multiple aggregate models in the multiple subnets, and send the multiple aggregate models to the central server.

[0054] Among them, local aggregation refers to the process of edge servers aggregating model parameters from clients in the subnet. It can assign weights to each model parameter according to the parameter evaluation strategy and perform weighted average processing. For example, different weights are assigned to the model parameters of each client based on the amount and quality of data from the client.

[0055] Among them, multiple aggregate models refer to the set of models that represent the characteristics of each subnet after local aggregation. These models will be sent to the central server for global aggregation.

[0056] Step S204: the central server globally aggregates the received multiple aggregation models to obtain a target global model, and broadcasts the target global model to multiple clients.

[0057] Among them, global aggregation refers to the process of aggregating the aggregation models from different subnets by the central server. It can assign weights to the parameters of each aggregation model according to the weight distribution strategy, and perform weighted average processing to obtain the target global model. For example, different weights are assigned to the aggregation model of each subnet according to the data volume and data quality of the subnet.

[0058] The target global model refers to the model with the best performance after global aggregation. It will be broadcast to all clients to generate anomaly detection models for anomaly detection.

[0059] In step S205, the multiple clients use a preset global model combiner based on the received target global model to update multiple model parameters to obtain an anomaly detection model, and perform anomaly detection on the local financial behavior data based on the anomaly detection model.

[0060] The global model combiner is a tool used to combine the target global model with the client local model parameters. It obtains the final anomaly detection model by weighted averaging the target parameters of the target global model and the client model parameters.

[0061] Among them, the anomaly detection model refers to a model used to identify abnormal data. It is trained based on the target global model and the client's local data, and can accurately identify financial behavior data that is inconsistent with normal behavior. For example, in fraud detection, the anomaly detection model can identify potential fraudulent transactions.

[0062] Among them, local financial behavior data refers to the financial behavior data owned by the client and used for anomaly detection. This data usually contains information such as customer transaction records and account balances. For example, a bank client has customer transaction flow data.

[0063] Among them, anomaly detection refers to the process of using anomaly detection models to detect financial behavior data. It determines whether the data belongs to abnormal behavior by analyzing the characteristic information of the data.

[0064] In the embodiment of the present application, within a preset time interval, each client uses local training data to independently train the model and sends the model parameters to the edge server of the subnet to which it belongs. In this process, the client performs multiple random gradient descent iterations on its own data set, effectively utilizing local data resources and reducing the need for data transmission. In addition, the edge server locally aggregates the multiple model parameters received to obtain an aggregated model in multiple subnets. This step is performed within the local subnet, and there is no need to upload the original local training data that may contain sensitive information to the central server or the cloud, thereby ensuring the privacy and security of the data, and greatly reducing the communication delay by reducing the frequency of communication between the edge and the cloud. By aggregating the model parameters in the local subnet and undergoing global aggregation by the central server, an updated target global model is obtained. This process reduces the communication delay between the edge and the cloud, accelerates the convergence speed of the global model, thereby improving the accuracy and training efficiency of the anomaly detection model, and thus can improve the efficiency of data anomaly detection.

[0065] In some optional implementations of this embodiment, step 202, multiple clients perform model training on the received initial global model based on local training data and using a preset optimization algorithm within a preset time interval to obtain multiple model parameters, specifically including the following steps:

[0066] Multiple clients obtain a preset optimization algorithm, local training data, and an initial global model; determine whether the current time is within a preset time interval; if the current time is within the time interval, the initial global model is trained using an optimization algorithm based on the local training data to obtain multiple updated model parameters; if the current time is not within the time interval, a waiting time is determined, and when the time reaches the waiting time, the initial global model is trained using an optimization algorithm based on the local training data to obtain multiple updated model parameters.

[0067] In one example, the application of the technical solution to the optimization of a stock prediction model is taken as an example. A preset optimization algorithm (such as a gradient descent method), local training data (such as historical trading data of a certain stock), and an initial global model (such as a neural network-based stock prediction model) broadcast by a central server are obtained. The preset time interval is set to 9:30 to 11:30 on a trading day. If the current time is within this time interval, the initial global model is trained using the optimization algorithm using the local training data to obtain updated model parameters. These parameters enable the model to more accurately predict the trend of stock prices. If the current time is not within this time interval, the waiting time is determined, and the model training is not performed during this period. When the time reaches the waiting time, the model is trained again using the local training data and the optimization algorithm to obtain new model parameters.

[0068] The embodiment of the present application can flexibly adjust the model training timing within a preset time interval, which not only avoids the communication overhead and privacy leakage risks caused by uploading data to the cloud in traditional methods, but also significantly improves the training efficiency. Within the time interval, the client can independently train the initial global model based on local training data and optimization algorithms, and generate model parameter updates in a timely manner, ensuring the privacy and security of the data. When time does not allow instant training, the waiting time is intelligently set and the training update of the model is reasonably arranged, effectively balancing resource constraints and training requirements. This solution not only reduces transmission delays, but also shortens the time of a single iteration.

[0069] In some optional implementations of this embodiment, step S203, multiple edge servers locally aggregate the received multiple model parameters to obtain multiple aggregated models in multiple subnets, specifically including the following steps:

[0070] The plurality of edge servers determine a first weight coefficient of each model parameter according to a preset parameter evaluation strategy; perform local weighted average processing on the first weight coefficient and the plurality of model parameters to obtain a plurality of aggregate models in the plurality of subnets after aggregation processing.

[0071] The parameter evaluation strategy refers to the strategy used to evaluate the importance of model parameters. It assigns different weights to each model parameter based on factors such as the characteristics of the data and the structure of the model. For example, in the local aggregation process, the parameter evaluation strategy evaluates the importance of model parameters based on the amount and quality of data on the client.

[0072] The first weight coefficient refers to the weight assigned to each model parameter during the local aggregation process. It characterizes the importance of the model parameter in the aggregation process. For example, in a fraud detection system, the model parameters of clients with higher data quality are assigned higher weights.

[0073] In one example, each edge server determines the first weight coefficient of each model parameter according to a preset parameter evaluation strategy. Through calculation, each edge server obtains a set of weight coefficients for its own model parameters. Then, the edge server performs local weighted averaging on the first weight coefficient and multiple model parameters. This step aims to comprehensively consider the fraud detection needs and data characteristics of different financial institutions, and obtain more robust and accurate model parameters by weighted averaging. After this process, multiple aggregate models are generated in each subnet, which can better adapt to the fraud detection scenarios of their respective financial institutions.

[0074] The embodiment of the present application can aggregate models through edge servers, avoiding centralized storage and transmission of data and effectively protecting the privacy of financial data. Secondly, local weighted average processing improves the stability and accuracy of model parameters, so that the fraud detection model can perform well in different financial institutions. Finally, the method provided in this embodiment fully utilizes the computing power of edge servers, reduces communication costs, and improves training efficiency.

[0075] In some optional implementations of this embodiment, step S204, the central server globally aggregates the received multiple aggregation models to obtain a target global model, which specifically includes the following steps:

[0076] The central server determines the second weight coefficient of the aggregation parameters of multiple aggregation models according to the preset weight distribution strategy; performs global weighted averaging on the second weight coefficient and the aggregation parameters to obtain updated global model parameters as the new global model for the current model training iteration round; determines whether the new global model meets the preset convergence conditions; if the new global model meets the convergence conditions, uses the new global model as the target global model; if the new global model does not meet the convergence conditions, broadcasts the new global model to multiple clients to start a new round of model training until a global model that meets the convergence conditions is obtained, and uses the global model that meets the convergence conditions as the target global model.

[0077] Among them, the weight allocation strategy refers to the strategy used to allocate weights to different subnet aggregation models. It assigns different weights to the aggregation model of each subnet based on factors such as the characteristics of the subnet and data quality. For example, in the global aggregation process, the weight allocation strategy allocates weights based on the data volume and data quality of the subnet.

[0078] The second weight coefficient refers to the weight given to the parameters of each subnet aggregation model in the global aggregation process. It characterizes the importance of the subnet aggregation model in the global aggregation process. For example, in a fraud detection system, subnet aggregation models with higher data quality are given higher weights.

[0079] The updated global model parameters refer to the global model parameters obtained after one or more rounds of model training. They represent the latest state of the model during the training process.

[0080] The current model training iteration round refers to the model training round that is currently in progress. It represents the progress of the model training process. For example, in a fraud detection system, model training may require multiple rounds of iterations to achieve optimal performance.

[0081] The convergence condition refers to the condition for judging whether the model training is finished. When the model parameters change very little or no longer change in multiple consecutive iterations, the model can be considered to have converged.

[0082] In one example, the central server determines the second weight coefficient of the aggregation parameter of each aggregation model according to a preset weight allocation strategy. The weight allocation strategy takes into account factors such as the transaction scale of the financial institution, the number of historical fraud cases, and the detection accuracy of the model. Through comprehensive evaluation, the central server allocates the corresponding second weight coefficient to the aggregation parameter of each aggregation model. Then, the central server performs global weighted average processing on the second weight coefficient and the aggregation parameter to obtain the updated global model parameters. This step is intended to integrate the fraud detection capabilities of different financial institutions and generate a more comprehensive and accurate new global model. Subsequently, the central server determines whether the new global model meets the preset convergence conditions. If the new global model meets the convergence conditions, it is used as the target global model for subsequent fraud detection tasks. If the convergence conditions are not met, the central server broadcasts the new global model to all clients and starts a new round of model training. Through multiple iterations of training, a global model that meets the convergence conditions is obtained. In this process, the client of each financial institution performs local training based on the new global model and generates a new aggregation model. The central server continuously aggregates these model parameters and updates the global model until the convergence conditions are met.

[0083] The embodiments of the present application can make full use of the data resources of multiple clients (i.e., multiple financial institutions) through distributed training and model aggregation, thereby improving the accuracy and adaptability of fraud detection. Secondly, the introduction of a central server enables unified management and updating of model parameters, avoiding the problems of data leakage and excessive communication costs. Finally, through iterative training and judgment of convergence conditions, it is ensured that the final target global model has excellent detection performance and stability.

[0084] In some optional implementations of this embodiment, step S204, the central server globally aggregates the received multiple aggregation models to obtain a target global model, which specifically includes the following steps:

[0085] The central server determines the second weight coefficient of the aggregation parameters of multiple aggregation models according to a preset weight allocation strategy; performs global weighted averaging on the second weight coefficient and the aggregation parameters to obtain updated global model parameters as the new global model of the current model training iteration round; determines whether the current model training iteration round reaches the preset target round; if the current model training iteration round reaches the target round, the new global model is used as the target global model; if the current model training iteration round does not reach the target round, the new global model is broadcast to multiple clients to start a new round of model training until the model training iteration round reaches the target round, and the global model whose model training iteration round reaches the target round is used as the target global model.

[0086] The target round refers to the preset upper limit of the model training iteration rounds. When the model training reaches or exceeds this target round, the training process will end regardless of whether the model converges or not. For example, in a fraud detection system, the model training may be preset to a maximum of 100 rounds of iterations.

[0087] In one example, the central server determines the second weight coefficient of the aggregation parameter of each aggregation model according to a preset weight allocation strategy. The weight allocation strategy comprehensively considers factors such as the reputation of the financial institution, the number of historical fraud cases, the accuracy and completeness of the model training data, etc. Through precise calculation, the central server allocates a reasonable second weight coefficient to the aggregation parameter of each aggregation model. Then, the central server performs global weighted average processing on the second weight coefficient and the aggregation parameter to obtain the updated global model parameter. This step is intended to integrate the fraud detection capabilities of different financial institutions and generate a more comprehensive and accurate new global model. Subsequently, the central server determines whether the current model training iteration round reaches the preset target round. The target round is set based on experimental data and experience to ensure that the global model reaches a sufficient degree of training and stability. If the current iteration round has reached the target round, the central server uses the new global model as the target global model and notifies all clients to update and apply the model. If the current iteration round does not reach the target round, the central server broadcasts the new global model to all clients and starts a new round of model training. In this round of training, each client performs local training based on the new global model and generates a new aggregation model. The central server aggregates and updates the model parameters again and repeats the above steps until the model training iteration rounds reach the target round.

[0088] The embodiments of the present application can make full use of the data resources and fraud detection experience of multiple clients (i.e., multiple financial institutions) through distributed training and model aggregation, significantly improving the accuracy and efficiency of fraud detection. Secondly, the introduction of the central server realizes the unified management and update of model parameters, reducing the risk of data leakage and communication costs. Finally, by setting target rounds and iterative training, it is ensured that the global model reaches a sufficient degree of training and stability.

[0089] In some optional implementations of this embodiment, step S205, multiple clients use a preset global model combiner based on the received target global model to update multiple model parameters to obtain an anomaly detection model, specifically including the following steps:

[0090] Multiple clients obtain a preset global model combiner and a target global model; through the global model combiner, a target parameter of the target global model and multiple model parameters are weighted averaged to obtain an anomaly detection model.

[0091] In one example, each client uses the global model combiner to weighted average the target parameters of the target global model with the parameters of their own trained models, generating a more comprehensive and accurate anomaly detection model. Finally, each client obtains an anomaly detection model generated based on the global model combiner. These anomaly detection models can be deployed and applied in their respective trading environments, achieving real-time monitoring and early warning of abnormal transactions. Through practical applications, financial institutions can promptly detect and deal with potential financial fraud, effectively maintaining the security and stability of the trading market.

[0092] The embodiment of the present application can realize the organic integration of different client anomaly detection models through the global model combiner, thereby improving the accuracy and robustness of the model. The target global model obtained by distributed training is used as a benchmark to ensure that the final anomaly detection model has wide applicability and stability.

[0093] In some optional implementations of this embodiment, step S205, performing anomaly detection on local financial behavior data based on anomaly detection model, may specifically include the following steps:

[0094] Obtain financial behavior data, preprocess the financial behavior data, and extract behavior feature information; input the behavior feature information into the anomaly detection model for anomaly detection to obtain the anomaly score of the financial behavior data; if the anomaly score exceeds the preset anomaly threshold, the financial behavior data is determined to be abnormal data.

[0095] Among them, behavioral feature information refers to feature information extracted from financial behavior data and used for anomaly detection. Such feature information may include transaction amount, transaction time, transaction type, etc. For example, in fraud detection, behavioral feature information with abnormally high transaction amount or abnormally concentrated transaction time may indicate fraud.

[0096] Among them, the anomaly score refers to the score obtained after the anomaly detection model evaluates the financial behavior data. It represents the probability or degree of abnormal behavior of the data.

[0097] The abnormal threshold refers to the threshold used to determine whether financial behavior data is abnormal behavior. When the abnormal score of financial behavior data exceeds this threshold, it will be judged as abnormal data.

[0098] Among them, abnormal data refers to financial behavior data that is determined to be abnormal by the anomaly detection model. For example, in fraud detection, abnormal data can include fraudulent transactions, fake accounts, etc.

[0099] In one example, financial behavior data mainly comes from credit card transaction records. These data include but are not limited to transaction time, transaction amount, transaction location, transaction type, cardholder information, etc. After obtaining the financial behavior data, preprocessing operations are performed. Including data cleaning (removing duplicate, invalid or erroneous data), data formatting (unifying data format and units), data normalization (scaling data to the same scale) and other steps. In addition, data mining technology can also be used to extract behavioral feature information, such as transaction frequency, transaction amount distribution, transaction location anomalies, etc. The preprocessed behavioral feature information is input into the anomaly detection model to output the anomaly score of the financial behavior data. A preset anomaly threshold is set to determine whether the financial behavior data is abnormal. If the anomaly score exceeds the threshold, the financial behavior data is judged as abnormal data, that is, there may be credit card fraud. At this time, the alarm mechanism can be automatically triggered, and the abnormal data can be pushed to the risk control department for review and processing.

[0100] The embodiment of the present application can effectively reduce data noise and redundancy by preprocessing and extracting features from financial behavior data, thereby improving the detection efficiency of the anomaly detection model. Secondly, by using the anomaly detection model to monitor the transaction behavior of financial behavior data in real time, potential fraud can be discovered in a timely manner, reducing fraud losses. Finally, by setting a reasonable anomaly threshold, the system is ensured to respond quickly to and handle abnormal transactions.

[0101] It should be emphasized that in order to further ensure the privacy and security of the above-mentioned local training data, multiple model parameters and local financial behavior data, the above-mentioned local training data, multiple model parameters and local financial behavior data can also be stored in a node of a blockchain.

[0102] The blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0103] The embodiments of the present application can build and optimize related models and networks based on artificial intelligence technology, such as initial global models, multiple aggregation models, target global models, anomaly detection models, etc. Among them, artificial intelligence (AI) models are the crystallization of theory and practice that simulates the decision-making process of human intelligence through algorithms and data analysis to solve complex problems, predict future trends, or realize automation tasks. These models use a large amount of historical data and real-time information, and are trained and optimized through a specific algorithm framework to achieve efficient, accurate and reliable performance.

[0104] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0105] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0106] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of an abnormality detection system, which is similar to Figure 2Corresponding to the method embodiment shown, the system can be specifically applied to various electronic devices.

[0107] like Figure 3 As shown, the anomaly detection system 400 of this embodiment includes: a central server 401, multiple clients 402 and multiple edge servers 403. Among them:

[0108] The central server 401 is used to broadcast an initial global model to multiple clients; perform global aggregation on the received multiple aggregated models to obtain a target global model, and broadcast the target global model to multiple clients;

[0109] Multiple clients 402 are used to perform model training on the received initial global model within a preset time interval based on local training data and using a preset optimization algorithm to obtain multiple model parameters, and send the multiple model parameters to multiple edge servers of multiple subnets; based on the received target global model, using a preset global model combiner, update the multiple model parameters to obtain anomaly detection model, and perform anomaly detection on local financial behavior data based on the anomaly detection model;

[0110] The plurality of edge servers 403 are used to locally aggregate the received plurality of model parameters, obtain a plurality of aggregate models in a plurality of subnets, and send the plurality of aggregate models to the central server.

[0111] In the embodiment of the present application, within a preset time interval, each client uses local training data to independently train the model and sends the model parameters to the edge server of the subnet to which it belongs. In this process, the client performs multiple random gradient descent iterations on its own data set, effectively utilizing local data resources and reducing the need for data transmission. In addition, the edge server locally aggregates the multiple model parameters received to obtain an aggregated model in multiple subnets. This step is performed within the local subnet, and there is no need to upload the original local training data that may contain sensitive information to the central server or the cloud, thereby ensuring the privacy and security of the data, and greatly reducing the communication delay by reducing the frequency of communication between the edge and the cloud. By aggregating the model parameters in the local subnet and undergoing global aggregation by the central server, an updated target global model is obtained. This process reduces the communication delay between the edge and the cloud, accelerates the convergence speed of the global model, thereby improving the accuracy and training efficiency of the anomaly detection model, and thus can improve the efficiency of data anomaly detection.

[0112] In one embodiment, multiple clients 402 are also used for multiple clients to obtain a preset optimization algorithm, local training data and an initial global model; determine whether the current time is within a preset time interval; if the current time is within the time interval, the initial global model is trained using an optimization algorithm based on the local training data to obtain multiple updated model parameters; if the current time is not within the time interval, the waiting time is determined, and when the time reaches the waiting time, the initial global model is trained using an optimization algorithm based on the local training data to obtain multiple updated model parameters.

[0113] The embodiment of the present application can flexibly adjust the model training timing within a preset time interval, which not only avoids the communication overhead and privacy leakage risks caused by uploading data to the cloud in traditional methods, but also significantly improves the training efficiency. Within the time interval, the client can independently train the initial global model based on local training data and optimization algorithms, and generate model parameter updates in a timely manner, ensuring the privacy and security of the data. When time does not allow instant training, the waiting time is intelligently set and the training update of the model is reasonably arranged, effectively balancing resource constraints and training requirements. This solution not only reduces transmission delays, but also shortens the time of a single iteration.

[0114] In one embodiment, the multiple edge servers 403 are also used for the multiple edge servers to determine the first weight coefficient of each model parameter according to a preset parameter evaluation strategy; perform local weighted averaging processing on the first weight coefficient and multiple model parameters to obtain multiple aggregation models in multiple subnets after aggregation processing.

[0115] The embodiment of the present application can aggregate models through edge servers, avoiding centralized storage and transmission of data and effectively protecting the privacy of financial data. Secondly, local weighted average processing improves the stability and accuracy of model parameters, so that the fraud detection model can perform well in different financial institutions. Finally, the method provided in this embodiment fully utilizes the computing power of edge servers, reduces communication costs, and improves training efficiency.

[0116] In one embodiment, the central server 401 is also used for the central server to determine the second weight coefficient of the aggregation parameters of multiple aggregation models according to a preset weight distribution strategy; perform global weighted averaging on the second weight coefficient and the aggregation parameters to obtain updated global model parameters as the new global model for the current model training iteration round; determine whether the new global model meets the preset convergence conditions; if the new global model meets the convergence conditions, use the new global model as the target global model; if the new global model does not meet the convergence conditions, broadcast the new global model to multiple clients to start a new round of model training until a global model that meets the convergence conditions is obtained, and the global model that meets the convergence conditions is used as the target global model.

[0117] The embodiments of the present application can make full use of the data resources of multiple clients (i.e., multiple financial institutions) through distributed training and model aggregation, thereby improving the accuracy and adaptability of fraud detection. Secondly, the introduction of a central server enables unified management and updating of model parameters, avoiding the problems of data leakage and excessive communication costs. Finally, through iterative training and judgment of convergence conditions, it is ensured that the final target global model has excellent detection performance and stability.

[0118] In one embodiment, the central server 401 is also used for the central server to determine the second weight coefficient of the aggregation parameters of multiple aggregation models according to a preset weight distribution strategy; perform global weighted averaging on the second weight coefficient and the aggregation parameters to obtain updated global model parameters as the new global model for the current model training iteration round; determine whether the current model training iteration round reaches the preset target round; if the current model training iteration round reaches the target round, use the new global model as the target global model; if the current model training iteration round does not reach the target round, broadcast the new global model to multiple clients to start a new round of model training until the model training iteration round reaches the target round, and use the global model whose model training iteration round reaches the target round as the target global model.

[0119] The embodiments of the present application can make full use of the data resources and fraud detection experience of multiple clients (i.e., multiple financial institutions) through distributed training and model aggregation, significantly improving the accuracy and efficiency of fraud detection. Secondly, the introduction of the central server realizes the unified management and update of model parameters, reducing the risk of data leakage and communication costs. Finally, by setting target rounds and iterative training, it is ensured that the global model reaches a sufficient degree of training and stability.

[0120] In one embodiment, multiple clients 402 are also used for multiple clients to obtain a preset global model combiner and a target global model; through the global model combiner, the target parameters of the target global model and multiple model parameters are weighted averaged to obtain an anomaly detection model.

[0121] The embodiment of the present application can realize the organic integration of different client anomaly detection models through the global model combiner, thereby improving the accuracy and robustness of the model. The target global model obtained by distributed training is used as a benchmark to ensure that the final anomaly detection model has wide applicability and stability.

[0122] In one embodiment, multiple clients 402 are also used to obtain financial behavior data, pre-process the financial behavior data, and extract behavior feature information; input the behavior feature information into an anomaly detection model for anomaly detection to obtain an anomaly score for the financial behavior data; if the anomaly score exceeds a preset anomaly threshold, the financial behavior data is determined to be abnormal data.

[0123] The embodiment of the present application can effectively reduce data noise and redundancy by preprocessing and extracting features from financial behavior data, thereby improving the detection efficiency of the anomaly detection model. Secondly, by using the anomaly detection model to monitor the transaction behavior of financial behavior data in real time, potential fraud can be discovered in a timely manner, reducing fraud losses. Finally, by setting a reasonable anomaly threshold, the system is ensured to respond quickly to and handle abnormal transactions.

[0124] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0125] The computer device 6 includes a memory 61, a processor 62, and a network interface 63 that are interconnected and communicated through a system bus. It should be noted that the figure only shows a computer device 6 having a memory 61, a processor 62, and a network interface 63, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASIC), programmable gate arrays (FPGA), digital signal processors (DSP), embedded devices, etc.

[0126] Computer devices can be computing devices such as desktop computers, notebooks, PDAs, and cloud servers. Computer devices can interact with users through keyboards, mice, remote controls, touch pads, or voice control devices.

[0127] The memory 61 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 61 can be an internal storage unit of the computer device 6, such as a hard disk or memory of the computer device 6. In other embodiments, the memory 61 can also be an external storage device of the computer device 6, such as a plug-in hard disk equipped on the computer device 6, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Of course, the memory 61 can also include both the internal storage unit of the computer device 6 and its external storage device. In this embodiment, the memory 61 is generally used to store the operating system and various application software installed on the computer device 6, such as computer-readable instructions of the abnormality detection method, etc. In addition, the memory 61 can also be used to temporarily store various types of data that have been output or are to be output.

[0128] The processor 62 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 62 is generally used to control the overall operation of the computer device 6. In this embodiment, the processor 62 is used to run computer-readable instructions stored in the memory 61 or process data, such as computer-readable instructions for running an anomaly detection method.

[0129] The network interface 63 may include a wireless network interface or a wired network interface, and the network interface 63 is generally used to establish a communication connection between the computer device 6 and other electronic devices.

[0130] In the embodiment of the present application, within a preset time interval, each client uses local training data to independently train the model and sends the model parameters to the edge server of the subnet to which it belongs. In this process, the client performs multiple random gradient descent iterations on its own data set, effectively utilizing local data resources and reducing the need for data transmission. In addition, the edge server locally aggregates the multiple model parameters received to obtain an aggregated model in multiple subnets. This step is performed within the local subnet, and there is no need to upload the original local training data that may contain sensitive information to the central server or the cloud, thereby ensuring the privacy and security of the data, and greatly reducing the communication delay by reducing the frequency of communication between the edge and the cloud. By aggregating the model parameters in the local subnet and undergoing global aggregation by the central server, an updated target global model is obtained. This process reduces the communication delay between the edge and the cloud, accelerates the convergence speed of the global model, thereby improving the accuracy and training efficiency of the anomaly detection model, and thus can improve the efficiency of data anomaly detection.

[0131] The present application also provides another implementation, namely, providing a computer-readable storage medium, which stores computer-readable instructions. The computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the anomaly detection method as described above.

[0132] In the embodiment of the present application, within a preset time interval, each client uses local training data to independently train the model and sends the model parameters to the edge server of the subnet to which it belongs. In this process, the client performs multiple random gradient descent iterations on its own data set, effectively utilizing local data resources and reducing the need for data transmission. In addition, the edge server locally aggregates the multiple model parameters received to obtain an aggregated model in multiple subnets. This step is performed within the local subnet, and there is no need to upload the original local training data that may contain sensitive information to the central server or the cloud, thereby ensuring the privacy and security of the data, and greatly reducing the communication delay by reducing the frequency of communication between the edge and the cloud. By aggregating the model parameters in the local subnet and undergoing global aggregation by the central server, an updated target global model is obtained. This process reduces the communication delay between the edge and the cloud, accelerates the convergence speed of the global model, thereby improving the accuracy and training efficiency of the anomaly detection model, and thus can improve the efficiency of data anomaly detection.

[0133] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods of each embodiment of the present application.

[0134] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. An anomaly detection method, characterized in that: Applied to an anomaly detection system, the anomaly detection system includes a central server, multiple clients and multiple edge servers, the multiple clients form multiple subnets, the multiple edge servers are located at the edges of the multiple subnets, and the method includes the following steps: The central server broadcasts the initial global model to the plurality of clients; The multiple clients perform model training on the received initial global model based on local training data and a preset optimization algorithm within a preset time interval to obtain multiple model parameters, and send the multiple model parameters to the multiple edge servers of the multiple subnets; The multiple edge servers locally aggregate the multiple model parameters received to obtain multiple aggregate models in the multiple subnets, and send the multiple aggregate models to the central server; The central server globally aggregates the received multiple aggregate models to obtain a target global model, and broadcasts the target global model to the multiple clients; The multiple clients use a preset global model combiner based on the received target global model to update the multiple model parameters to obtain an anomaly detection model, and perform anomaly detection on the local financial behavior data based on the anomaly detection model.

2. The method according to claim 1, characterized in that The multiple clients perform model training on the received initial global model based on local training data and using a preset optimization algorithm within a preset time interval to obtain multiple model parameters, specifically including: The multiple clients obtain a preset optimization algorithm, the local training data, and the initial global model; Determine whether the current time is within the preset time interval; If the current time is within the time interval, then, based on the local training data, the optimization algorithm is used to perform model training on the initial global model to obtain a plurality of updated model parameters; If the current time is not within the time interval, the waiting time is determined. When the time reaches the waiting time, the initial global model is trained using the optimization algorithm according to the local training data to obtain multiple updated model parameters.

3. The method according to claim 1, characterized in that The step of locally aggregating the received model parameters by the multiple edge servers to obtain multiple aggregated models in the multiple subnets specifically includes: The plurality of edge servers determine a first weight coefficient of each model parameter according to a preset parameter evaluation strategy; The first weight coefficient and the multiple model parameters are locally weighted averaged to obtain multiple aggregation models within the multiple subnets after aggregation processing.

4. The method according to claim 1, characterized in that: The central server globally aggregates the received multiple aggregation models to obtain a target global model, specifically comprising: The central server determines, according to a preset weight allocation strategy, second weight coefficients of the aggregation parameters of the plurality of aggregation models; Performing global weighted averaging on the second weight coefficient and the aggregation parameter to obtain updated global model parameters as a new global model for the current model training iteration round; Determining whether the new global model satisfies a preset convergence condition; If the new global model satisfies the convergence condition, the new global model is used as the target global model; If the new global model does not meet the convergence condition, the new global model is broadcast to the multiple clients to start a new round of model training until a global model that meets the convergence condition is obtained, and the global model that meets the convergence condition is used as the target global model.

5. The method according to claim 1, characterized in that The central server globally aggregates the received multiple aggregation models to obtain a target global model, specifically comprising: The central server determines, according to a preset weight allocation strategy, second weight coefficients of the aggregation parameters of the plurality of aggregation models; Performing global weighted averaging on the second weight coefficient and the aggregation parameter to obtain updated global model parameters as a new global model for the current model training iteration round; Determine whether the current model training iteration round has reached a preset target round; If the current model training iteration round reaches the target round, the new global model is used as the target global model; If the current model training iteration round does not reach the target round, the new global model is broadcast to the multiple clients to start a new round of model training until the model training iteration round reaches the target round, and the global model whose model training iteration round reaches the target round is used as the target global model.

6. The method according to claim 1, characterized in that The step of the multiple clients updating the multiple model parameters based on the received target global model using a preset global model combiner to obtain an anomaly detection model specifically includes: The multiple clients obtain a preset global model combiner and the target global model; The target parameter of the target global model and the multiple model parameters are weighted averaged by the global model combiner to obtain an anomaly detection model.

7. The method according to claim 6, characterized in that The step of performing anomaly detection on local financial behavior data based on the anomaly detection model specifically includes: Acquiring financial behavior data, preprocessing the financial behavior data, and extracting behavior feature information; Inputting the behavior feature information into the anomaly detection model to perform anomaly detection to obtain an anomaly score of the financial behavior data; If the abnormality score exceeds a preset abnormality threshold, the financial behavior data is determined to be abnormal data.

8. An anomaly detection system, characterized in that: include: A central server, used to broadcast the initial global model to multiple clients; Performing global aggregation on the received multiple aggregation models to obtain a target global model, and broadcasting the target global model to the multiple clients; The multiple clients are used to perform model training on the received initial global model based on local training data and using a preset optimization algorithm within a preset time interval to obtain multiple model parameters, and send the multiple model parameters to multiple edge servers of multiple subnets; Based on the received target global model, using a preset global model combiner, updating the multiple model parameters to obtain an anomaly detection model, and performing anomaly detection on the local financial behavior data based on the anomaly detection model; The multiple edge servers are used to locally aggregate the multiple model parameters received to obtain multiple aggregate models within the multiple subnets, and send the multiple aggregate models to the central server.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the abnormality detection method according to any one of claims 1 to 7 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the abnormality detection method according to any one of claims 1 to 7 are implemented.

Images