Abnormal transaction detection method, device and equipment, medium and product

Abstract

The invention discloses an abnormal transaction detection method, device and equipment, a medium and a product. The method relates to the technical field of artificial intelligence and the field of financial science and technology, and comprises the following steps: determining a corresponding heterogeneous relation graph and a target context sequence according to target transaction information between a target client associated with a business system and a target client, so as to train and obtain a target anomaly detection model corresponding to the target client; determining other clients except the target client in the clients associated with the service system, and determining candidate parameters corresponding to candidate anomaly detection models obtained by training of other clients; and determining an optimal parameter according to a target parameter and a candidate parameter corresponding to the target anomaly detection model to obtain an optimal anomaly detection model, and performing anomaly detection on transaction conditions of the target client and other clients by adopting the optimal anomaly detection model. According to the method, the security of the privacy data of the client can be ensured, and the efficiency and accuracy of anomaly detection of each client can be improved.

Description

Technical Field

[0001] The present invention relates to the fields of artificial intelligence technology and financial technology, and in particular to an abnormal transaction detection method, device, equipment, medium and product. Background Art

[0002] With the gradual improvement of people's consumption level and the continuous change of consumption concepts in today's society, on the one hand, transactions between banking systems and customers tend to be complex and frequent, especially for credit card transactions. How to accurately identify abnormal situations in the transaction process is a very important and critical task. On the other hand, with the gradual improvement of financial regulatory regulations, more and more emphasis is placed on the protection of customer personal privacy.

[0003] Therefore, how to improve the efficiency and accuracy of anomaly detection on each client while ensuring the security of customer privacy data is an urgent problem to be solved. Summary of the invention

[0004] The present invention provides an abnormal transaction detection method, device, equipment, medium and product to improve the efficiency and accuracy of abnormality detection of each client while ensuring the security of customer privacy data.

[0005] According to one aspect of the present invention, there is provided a method for detecting abnormal transactions, comprising:

[0006] According to the target transaction information between the target client and the target customer associated with the business system, the corresponding heterogeneous relationship graph and target context sequence are determined to train a target anomaly detection model corresponding to the target client;

[0007] Determine other clients other than the target client among the clients associated with the business system, and determine candidate parameters corresponding to the candidate anomaly detection models trained by the other clients;

[0008] According to the target parameters and candidate parameters corresponding to the target anomaly detection model, the optimal parameters are determined to obtain the optimal anomaly detection model, and the optimal anomaly detection model is used to perform anomaly detection on the transaction conditions of the target client and other clients.

[0009] According to another aspect of the present invention, there is provided an abnormal transaction detection device, comprising:

[0010] A training module is used to determine the corresponding heterogeneous relationship graph and target context sequence according to the target transaction information between the target client and the target customer associated with the business system, so as to train a target anomaly detection model corresponding to the target client;

[0011] A determination module, used to determine other clients except the target client among the clients associated with the business system, and determine candidate parameters corresponding to the candidate anomaly detection models trained by the other clients;

[0012] The detection module is used to determine the optimal parameters according to the target parameters and candidate parameters corresponding to the target anomaly detection model to obtain the optimal anomaly detection model, and use the optimal anomaly detection model to perform anomaly detection on the transaction conditions of the target client and other clients.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormal transaction detection method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormal transaction detection method described in any embodiment of the present invention when executed.

[0018] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the abnormal transaction detection method of any embodiment of the present invention is implemented.

[0019] The technical solution of the embodiment of the present invention determines the corresponding heterogeneous relationship graph and target context sequence according to the target transaction information between the target client associated with the business system and the target customer, so as to train the target anomaly detection model corresponding to the target client; determines other clients except the target client among the clients associated with the business system, and determines the candidate parameters corresponding to the candidate anomaly detection models trained by the other clients; determines the optimal parameters according to the target parameters and candidate parameters corresponding to the target anomaly detection model, so as to obtain the optimal anomaly detection model, and uses the optimal anomaly detection model to perform anomaly detection on the transaction conditions of the target client and other clients. By synthesizing the parameters obtained by training the anomaly detection models of multiple clients respectively, the optimal anomaly detection model is obtained, which can improve the efficiency and accuracy of client anomaly detection while ensuring the security of customer privacy data.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flow chart of an abnormal transaction detection method provided by Embodiment 1 of the present invention;

[0023] Figure 2 is a flow chart of an abnormal transaction detection method provided by Embodiment 2 of the present invention;

[0024] Figure 3 This is a structural block diagram of an abnormal transaction detection device provided by Embodiment 3 of the present invention;

[0025] Figure 4 It is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", "target", "candidate", "alternative", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. The acquisition, storage, use, processing, etc. of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0028] It should be noted that the user information collected in the present invention is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or reject automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0029] It should be noted that in related technologies, some characteristic information of customers or card transactions will be screened out based on expert knowledge, and then whether the customer or transaction is abnormal will be used as a sample label, which will be input into a machine learning algorithm model together with the screened characteristic information to train the model and learn the customer's card usage behavior pattern. Finally, the trained model can be used to detect abnormal credit card transactions. However, the above solution has the following two disadvantages:

[0030] First, they can only be based on some individual information characteristics of customers, and when learning the behavioral patterns of customers' credit card transactions, they assume that the characteristics of customers or each card transaction are independent of each other. In real life, because people's behavior patterns are social, and in actual applications, abnormal transactions often appear at the same time and show certain correlations. Therefore, if these correlation information are ignored, it will cause certain deviations in the learning of card behavior patterns by the abnormal transaction detection model, and it will not be able to accurately detect abnormal transactions. Although some technical solutions also propose to introduce customer-related information, they can often only integrate a specific type of correlation. In real life, each individual generally has a variety of correlations. If only one of them is considered, a large amount of effective information will inevitably be lost, which will also have a lot of impact on the training effect of the model.

[0031] Secondly, the training of these models often needs to be based on the full amount of customer social and transaction data. In actual applications, with the improvement of people's privacy awareness and the improvement of relevant regulatory regulations, it is difficult to collect the full amount of data of different customers in a unified manner, and these data can only stay on the customer's private terminal. This results in the training framework used by the model in the existing technical solution is no longer applicable, and thus cannot meet the needs of abnormal transaction detection.

[0032] The technical solution of the present invention, in response to the above-mentioned problems, proposes an abnormal transaction detection solution that can fully integrate various types of customer associations and behavioral characteristics and merchant characteristic information, and complete model training by only retaining sample data on the personal terminal. It can improve the efficiency and accuracy of abnormal detection on each client while ensuring the security of customer privacy data. The specific implementation method will be introduced in detail in the subsequent embodiments.

[0033] Embodiment 1

[0034] Figure 1 1 is a flow chart of an abnormal transaction detection method provided in the first embodiment of the present invention; this embodiment can be applied to a bank's business system to integrate abnormal detection models trained by multiple clients to obtain an optimal abnormal detection model to instruct each client to perform abnormal detection. The method can be executed by an abnormal transaction detection device, which can be implemented in the form of hardware and / or software. The abnormal transaction detection device can be configured in an electronic device, such as a bank's business system, wherein the business system can be associated with at least two clients, and each client can interact with a customer to implement a transaction business, such as Figure 1 As shown, the abnormal transaction detection method includes:

[0035] S101. According to the target transaction information between the target client and the target customer associated with the business system, a corresponding heterogeneous relationship graph and a target context sequence are determined to train a target anomaly detection model corresponding to the target client.

[0036] Among them, the business system can be associated with at least two clients, and the business system can also include a parameter server for summarizing the parameters of different clients to obtain the optimal parameters. The target client can be any client associated with the business system. The number of target clients is at least two. Each target client can interact with its local customer to realize transaction business. The target customer is a local customer of the target client. The target customer can specifically interact with different target merchants in the target client to complete the transaction.

[0037] The target transaction information refers to information that can characterize the transaction between the target client and the target customer. The target transaction information may include at least one of the following: customer feature information, merchant feature information, transaction feature information, transaction relationship between the target customer and the target merchant in the target client, and social relationship between target customers.

[0038] The topological structure of the heterogeneous relationship graph can be represented by nodes and edges. Specifically, nodes can be of two types: customers and merchants, and the edges between nodes represent the social relationship between customers and the transaction relationship between customers and merchants. Social relationships can be relatives, friends, colleagues, common contacts, etc. If and only if the customer corresponding to the client has a transaction with a merchant, there is an edge between the customer and the corresponding merchant node.

[0039] The target context sequence refers to the sequence features obtained after context sampling of the heterogeneous relationship graph. The target anomaly detection model refers to the model trained by the target client based on the target transaction information to detect whether there is an anomaly in the transaction process between the target customer and the target client. The target anomaly detection model can be, for example, a graph translation model. The target anomaly detection model can be, for example, a credit card abnormal transaction detection model shared with other clients. The target detection model can include an encoder and a decoder. The encoder can include an attention mechanism layer and a forward propagation layer, and the decoder can also include an attention mechanism layer and a forward propagation layer.

[0040] Optionally, based on the target transaction information between the target client and the target customer associated with the business system, a corresponding heterogeneous relationship graph and a target context sequence are determined, including: determining customer feature information, merchant feature information and transaction feature information based on the target transaction information, and determining the transaction relationship between the target customer and the target merchant in the target client and the social relationship between the target customers to construct a heterogeneous relationship graph; based on the heterogeneous relationship graph, determining the attribute vector corresponding to the target transaction information, and labeling the attribute vector to obtain a target context sequence corresponding to the heterogeneous relationship graph.

[0041] Among them, customer characteristic information may include information such as gender, age or income, merchant characteristic information may include business status or merchant category, and transaction characteristic information may include information such as transaction amount, transaction location, transaction channel, transaction type, etc.

[0042] Exemplarily, the interaction between target customers, different target merchants and other target customers within a preset time period can be monitored, and based on the interaction situation, the transaction relationship between customers and merchants, the social relationship between customers, and the customer characteristic information, merchant characteristic information and card transaction characteristic information can be determined. Furthermore, a heterogeneous relationship graph can be constructed based on the transaction relationship between customers and merchants, the social relationship between customers, customer characteristic information, merchant characteristic information and card transaction characteristic information.

[0043] Optionally, based on the heterogeneous relationship graph, a breadth-first traversal algorithm can be used to perform context sampling to obtain a target context sequence corresponding to the heterogeneous relationship graph. Specifically, the breadth-first traversal algorithm can be used to traverse the heterogeneous relationship graph to respectively determine the attribute vectors corresponding to customer feature information, merchant feature information, transaction relationships, and social relationships.

[0044] For example, we can start from an initial node of the heterogeneous relationship graph and perform breadth-first traversal. In particular, the attributes of customers, merchants, transactions, and social relationships are represented by matrices and Indicates that each row of the matrix corresponds to the attribute vector of customers, merchants, transactions, and social relationships. Since the social relationship itself has no attributes, the mean of the attribute vectors of two customers is used as its attribute vector. That is, if there is a social relationship z between customer n and customer n+1, the attribute vector of the social relationship is:

[0045]

[0046] Furthermore, after the breadth-first traversal algorithm is completed, an original attribute vector sequence can be obtained in, and They represent the nth, kth, mth and zth row vectors of the attribute matrix corresponding to customers, transaction relationships, merchants and social relationships respectively.

[0047] It should be noted that the above-mentioned embodiment of the present invention constructs a graph by considering features such as transaction relationships and social relationships to determine attribute vectors and label them to obtain context sequences, which can better characterize the transaction situation between the client and the customer, thereby obtaining an accurate context sequence, which is helpful for the subsequent training of an accurate anomaly detection model.

[0048] Optionally, the attribute vector is labeled to obtain a target context sequence corresponding to the target transaction information, including: determining a category identification vector corresponding to the attribute vector to perform category labeling on the attribute vector sequence to obtain an attribute augmented vector; and performing node labeling on the attribute augmented vector according to an orthogonal node identification matrix corresponding to the attribute augmented vector to obtain a target context sequence corresponding to the target transaction information.

[0049] Specifically, the category labeling can be performed by horizontal matrix concatenation operations on the attribute vectors. The orthogonal matrix can be obtained by initialization at the beginning of model training, and can be used as a model parameter for training and learning in the subsequent iteration process of the model.

[0050] For example, since the original attribute vector sequence Φ (i.e., attribute vector) cannot provide discriminant information about whether an attribute vector belongs to a customer, a merchant, or a transaction, a trainable category identification vector is also required. Used to label attribute vector sequences.

[0051] For example, for a customer n, the attribute vector After the categories are labeled, they can be recorded as For a certain merchant m, the attribute vector After the categories are labeled, they can be recorded as For a transaction t, the attribute vector After the categories are labeled, they can be recorded as For the attribute vector of the social relationship between a customer n and customer n+1 After the categories are labeled, they can be recorded as Among them, [·,·] represents the horizontal concatenation of two matrices.

[0052] For example, since the above attribute vector sequence Φ also cannot provide the association relationship information between nodes and edges, two orthogonal node identification matrices are also required: and Used to complete the augmented vector after the above categories are labeled and Do further marking.

[0053] For example, for a certain customer n, the attribute augmented vector After the nodes are labeled, they can be recorded as For a certain merchant m, the attribute augmentation vector The node is marked as For a transaction relationship k, the attribute augmented vector If the two end nodes are customer node n and merchant node m, the category labeling is recorded as For the attribute augmented vector of the social relationship z between two customers If the two end nodes are customer node n and customer node n+1, the category labeling postscript

[0054]

[0055] It should be noted that the above-mentioned embodiment of the present invention implements labeling operation through category identification vector and orthogonal node identification matrix to obtain context sequence, which can better characterize the discrimination information of whether the attribute vector belongs to the customer, merchant or transaction, as well as the association relationship information between nodes and edges, and obtain an accurate context sequence.

[0056] Optionally, training a target anomaly detection model corresponding to the target client includes: inputting the target context sequence into a preset graph translation model to obtain a prediction result through an encoder and a decoder of the preset graph translation model; according to the prediction result and a preset expected result, based on a binary cross entropy loss function, iteratively updating the preset graph translation model to train the target anomaly detection model corresponding to the target client.

[0057] The internal structure of the encoder and decoder is composed of an attention mechanism and a forward propagation layer cascaded. The prediction result is the prediction result of whether there is an abnormality in the transaction process. The prediction result can be the presence of an abnormality or the absence of an abnormality. The preset expected result refers to the result of whether the actual abnormality corresponding to the preset target transaction information is abnormal. The preset graph translation model refers to the preset initialization prediction model.

[0058] Optionally, the deviation between the predicted result and the preset expected result can be evaluated based on the binary cross entropy loss function, and the preset graph translation model can be iteratively updated according to the deviation.

[0059] For example, the binary cross entropy loss function can be expressed by the following formula:

[0060]

[0061] Among them, y∈{1,0} is the prediction result, y i ′∈{1,0} is the preset expected result, indicating whether there is an abnormal transaction behavior or a label set for abnormal transactions (1 represents yes, 0 represents no). After the above loss function is constructed, an initial learning rate can be defined, and the Adam gradient descent method can be used to minimize the deviation obtained by the binary cross entropy loss function to complete the training of the model parameters of the preset graph translation model and obtain the target anomaly detection model corresponding to the target client.

[0062] It should be noted that the above embodiment of the present invention provides an implementable method for training a target anomaly detection model by inputting a target context sequence into a graph translation model and performing training based on a binary cross entropy loss function, and a model with high accuracy can be trained.

[0063] Optionally, the target context sequence is input into a preset graph translation model to obtain a prediction result through an encoder and a decoder of the preset graph translation model, including: inputting the target context sequence into the preset graph translation model, and using the attention mechanism layer and the forward propagation layer of the encoder in the preset graph translation model, and the attention mechanism layer and the forward propagation layer of the decoder in the preset graph translation model to obtain decoding features; according to the decoding features, based on a preset activation function, determining the prediction label of the preset graph translation model to obtain a prediction result.

[0064] The decoding feature is the feature output by the last decoder in the preset graph translation model. The preset activation function may be a sigmoid function.

[0065] For example, during the model training phase, the bipartite graph attribute graph context information, i.e., the target context sequence, can be input into the encoder of the preset graph translation model in full. Specifically, the context information is calculated as follows through the attention mechanism of the encoder:

[0066]

[0067] in, m, n, k, z represent the number of features corresponding to customer feature information, merchant feature information, transaction relationship, and social relationship, respectively; dc, db, dt, ds represent the number of attributes corresponding to customer feature information, merchant feature information, transaction relationship, and social relationship, respectively; e d q Represent the number of columns of the category identification vector and the orthogonal node identification matrix respectively, and [·;·] represents the vertical concatenation of the two matrices, that is, the augmented matrices of the customer, merchant, and transaction attribute matrices after two labelings (category and node) are vertically concatenated. Since the lengths of customer, merchant, and transaction attributes are different, the longest attribute vector length is used here, and the attribute vectors that are less than this length are filled with 0 elements. Softmax(·) is a normalization function that is used to normalize the elements in each row vector of the matrix input to the interval between 0 and 1, and make the sum of all elements of the row vector 1.

[0068] Furthermore, after the output of the attention mechanism in the encoder, it will pass through a forward propagation layer, perform the following nonlinear change calculations and map it into a new low-dimensional vector space:

[0069] FFN encode(X″)=max(0,Attention encode (X″,X″,X″)W1+b1)W2+b2

[0070] Among them, W1 and W2 are preset weights, b1 and b2 are preset bias values, and they are all trainable model parameters. This calculated low-dimensional vector FFN encode (X″) is the final output of the encoder.

[0071] In getting the output FFN of this encoder encode After (X″), it can be input into the attention mechanism of the decoder together with the data in the training set to perform the following calculation:

[0072] Attention encode (FFN encode (X″),X″ (i,·) ,X″ (i,·) )

[0073]

[0074] Among them, X″ (i,·) Represents the i-th row vector of matrix X″. Then, similar to the calculation method of the encoder, the output of this attention mechanism is encode , input into a forward propagation layer, and get FFN decode (X″ (i,·) ) and use it as the output of the decoder, i.e., the decoded feature.

[0075] Optionally, you can add the following sigmoid function to the output layer of the decoder as the final output y of the preset graph translation model: i , i.e. the predicted label:

[0076]

[0077] Among them, w and b are preset weights and bias values, which are trainable model parameters.

[0078] Optionally, according to the value of the prediction label, if the prediction label is 1, it can be determined that the prediction result is abnormal, and if the prediction label is 0, it can be determined that the prediction result is not abnormal.

[0079] It should be noted that the above embodiment of the present invention obtains the model output through the attention mechanism and the forward propagation layer in the encoder and the decoder and obtains the prediction result through the activation function. The graph translation model can be used to process the context features to obtain accurate prediction results.

[0080] S102: Determine other clients except the target client among the clients associated with the business system, and determine candidate parameters corresponding to the candidate anomaly detection models trained by the other clients.

[0081] Among them, other clients refer to clients other than the target client among the clients associated with the business system. Other clients and the target client can interact with the client to conduct transactions and realize business processing. Different clients have different customers and merchants, and the transaction information obtained is also different. The candidate parameters corresponding to the candidate anomaly detection model and the target parameters corresponding to the target anomaly detection model are essentially the same, and are both gradient information obtained after model training.

[0082] Optionally, other clients may also execute the steps described in S101 of the present invention to obtain an anomaly detection model based on local transaction information training. The business system may use the parameter server to obtain candidate parameters corresponding to the candidate anomaly detection models obtained by training of other associated clients.

[0083] S103. Determine optimal parameters according to target parameters and candidate parameters corresponding to the target anomaly detection model to obtain an optimal anomaly detection model, and use the optimal anomaly detection model to perform anomaly detection on the transaction conditions of the target client and other clients.

[0084] The optimal parameter may be the average value of the target parameter and the candidate parameter. The optimal anomaly detection model is the final anomaly detection model obtained by combining the candidate anomaly detection models and the target anomaly detection model. Both the candidate anomaly detection model and the target anomaly detection model are local detection models located on the client, and the optimal anomaly detection model is the final global detection model.

[0085] Optionally, the gradient information of the model trained by each client is determined, that is, the target parameters and candidate parameters corresponding to the target anomaly detection model are determined, and the gradient information is further fused so that each client adopts the fused gradient information (that is, the optimal parameters) to obtain the final global anomaly detection model, that is, the optimal anomaly detection model.

[0086] It should be noted that due to the limitation of privacy protection, when each client trains the model, the attribute relationship graph is a local data, that is, each client can only access the social and transaction relationships of the client's customers and the hidden features of the corresponding customers and merchants, so the model trained in this way has a certain deviation. Therefore, in order to train a global, unbiased anomaly detection model, it is necessary to introduce a federated learning framework during model training, that is, to use the parameter server to average the parameters of each client detection model to obtain the optimal anomaly detection model.

[0087] Optionally, determining the optimal parameters based on the target parameters and candidate parameters corresponding to the target anomaly detection model includes: determining the parameter averages of the target parameters corresponding to the target anomaly detection model and the candidate parameters corresponding to the candidate anomaly detection model; and determining the parameter averages as the optimal parameters corresponding to the optimal anomaly detection model.

[0088] Exemplarily, the optimal parameters corresponding to the optimal anomaly detection model may be determined by the following formula:

[0089]

[0090] in, They represent the parameters of each client associated with the business system, including candidate parameters and target parameters. n is the number of clients associated with the business system. is the optimal parameter corresponding to the optimal anomaly detection model.

[0091] Optionally, a trained model, i.e., an optimal anomaly detection model, may be used to perform abnormal transaction detection on the client's customers or credit cards that complete transactions, i.e., to perform anomaly detection on the transaction situations of the target client and other clients.

[0092] It should be noted that the above-mentioned embodiment of the present invention obtains the optimal parameters by integrating the model parameters trained by the target client and other clients, thereby avoiding the transmission of customer privacy information between clients. At the same time, the model parameters trained by each client data can be integrated to obtain the optimal anomaly detection model, thereby effectively improving the accuracy of anomaly detection.

[0093] The technical solution of the embodiment of the present invention determines the corresponding heterogeneous relationship graph and target context sequence according to the target transaction information between the target client associated with the business system and the target customer, so as to train the target anomaly detection model corresponding to the target client; determines other clients except the target client among the clients associated with the business system, and determines the candidate parameters corresponding to the candidate anomaly detection models trained by the other clients; determines the optimal parameters according to the target parameters and candidate parameters corresponding to the target anomaly detection model, so as to obtain the optimal anomaly detection model, and uses the optimal anomaly detection model to perform anomaly detection on the transaction conditions of the target client and other clients. By synthesizing the parameters obtained by training the anomaly detection models of multiple clients respectively, the optimal anomaly detection model is obtained, which can improve the efficiency and accuracy of client anomaly detection while ensuring the security of customer privacy data.

[0094] Embodiment 2

[0095] Figure 2is a flow chart of an abnormal transaction detection method provided in the second embodiment of the present invention; based on the above embodiment, this embodiment provides a preferred example of training a target client to obtain a target anomaly detection model, specifically, Figure 2 As shown in the figure, there are two types of nodes in the heterogeneous relationship graph (customers and merchants). Figure 1 The leftmost part of the client rectangle is represented by a red circle (customer) and a purple rectangle (merchant). The edges between nodes represent the social relationship between customers and the transaction relationship between customers and merchants. Specifically, there is an edge between the two customer nodes if and only if a customer has a certain social connection (relative, friend, colleague, common contact, etc.) with the customer corresponding to the client. This type of edge is in the attached Figure 1 The leftmost side of the client rectangle is represented by a black solid line without an arrow. On the other hand, if and only if the client corresponding to the client has had a transaction with a merchant, there is an edge between the client and the corresponding merchant node. Figure 1 The leftmost side of the client rectangular area is represented by a colored solid line without arrows, among which solid lines with arrows of different colors represent transaction relationships of different channels.

[0096] Optionally, in addition to the topological structure of the graph, the attributes in the graph are composed of basic characteristic information of customers, merchants, and card transactions (such as gender, age, income, business status, merchant category, transaction type, transaction amount, etc.). Among them, the characteristics of card transactions (represented by yellow square groups in the figure) can directly use the original information stored on the client.

[0097] However, since these features of customers and merchants have certain privacy, each client cannot directly obtain the features of customers and merchants on other clients. In order to protect their privacy, information needs to be transmitted between clients, and these original features need to be mapped before transmission to obtain the hidden features of customers and merchants. This process can be represented by the black double-headed arrow boxes between the clients and the black single-headed arrow boxes between the merchant information library and the client in the figure. Among them, the gray and green square groups represent the hidden features of customers and merchants respectively.

[0098] Optionally, after constructing the heterogeneous relationship graph, determine the attribute vector corresponding to the target transaction information, and perform category labeling and node labeling on the attribute vector in turn to obtain a target context sequence, and input the target context sequence into the encoder and decoder of the language model (i.e., the preset graph translation model) to train and obtain gradient parameters. As shown in the figure, after the two clients are trained separately to obtain the gradient information of the anomaly prediction model, gradient fusion can be performed through the parameter server to obtain the optimal parameters, and the optimal parameters are gradient-distributed, so that each client can use the optimal anomaly detection model corresponding to the optimal parameters for anomaly detection.

[0099] The present invention overcomes the shortcomings of existing abnormal transaction detection technologies and provides an abnormal transaction detection method that can fully integrate various types of customer association relationships and behavioral characteristics as well as merchant characteristic information, and can complete model training by retaining only sample data on a personal terminal. The method is particularly suitable for detecting anomalies in customer credit card transactions, and can accurately identify abnormal transactions while effectively protecting customer privacy information, thereby ensuring that card issuers have reliable risk control capabilities during lending.

[0100] Embodiment 3

[0101] Figure 3 : is a structural block diagram of an abnormal transaction detection device provided in the third embodiment of the present invention; this embodiment can be applied to the bank's business system to integrate the abnormal detection models trained by multiple clients to obtain the optimal abnormal detection model to instruct each client to perform abnormal detection. The abnormal transaction detection device provided in the embodiment of the present invention can execute the abnormal transaction detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method; the abnormal transaction detection device can be implemented in the form of hardware and / or software, and configured in an electronic device with abnormal transaction detection function, such as a bank's business system, wherein the business system can be associated with at least two clients, and each client can interact with the customer to implement transaction business, such as Figure 3 As shown, the abnormal transaction detection device specifically includes:

[0102] The training module 301 is used to determine the corresponding heterogeneous relationship graph and target context sequence according to the target transaction information between the target client and the target customer associated with the business system, so as to train and obtain the target anomaly detection model corresponding to the target client;

[0103] A determination module 302 is used to determine other clients except the target client among the clients associated with the business system, and determine candidate parameters corresponding to the candidate anomaly detection models trained by the other clients;

[0104] The detection module 303 is used to determine the optimal parameters according to the target parameters and candidate parameters corresponding to the target anomaly detection model to obtain the optimal anomaly detection model, and use the optimal anomaly detection model to perform anomaly detection on the transaction conditions of the target client and other clients.

[0105] The technical solution of the embodiment of the present invention determines the corresponding heterogeneous relationship graph and target context sequence according to the target transaction information between the target client associated with the business system and the target customer, so as to train the target anomaly detection model corresponding to the target client; determines other clients except the target client among the clients associated with the business system, and determines the candidate parameters corresponding to the candidate anomaly detection models trained by the other clients; determines the optimal parameters according to the target parameters and candidate parameters corresponding to the target anomaly detection model, so as to obtain the optimal anomaly detection model, and uses the optimal anomaly detection model to perform anomaly detection on the transaction conditions of the target client and other clients. By synthesizing the parameters obtained by training the anomaly detection models of multiple clients respectively, the optimal anomaly detection model is obtained, which can improve the efficiency and accuracy of client anomaly detection while ensuring the security of customer privacy data.

[0106] Furthermore, the training module 301 may include:

[0107] A construction unit, used to determine customer characteristic information, merchant characteristic information and transaction characteristic information according to target transaction information, and determine the transaction relationship between the target customer and the target merchant in the target client and the social relationship between the target customers, so as to construct a heterogeneous relationship graph;

[0108] The obtaining unit is used to determine the attribute vector corresponding to the target transaction information according to the heterogeneous relationship graph, and mark the attribute vector to obtain the target context sequence corresponding to the heterogeneous relationship graph.

[0109] Furthermore, the unit is specifically used for:

[0110] The target context sequence corresponding to the target transaction information includes:

[0111] Determine the category identification vector corresponding to the attribute vector to classify the attribute vector sequence and obtain the attribute augmentation vector;

[0112] According to the orthogonal node identification matrix corresponding to the attribute augmented vector, the attribute augmented vector is node-labeled to obtain the target context sequence corresponding to the target transaction information.

[0113] Furthermore, the training module 301 may include:

[0114] An input unit, used for inputting a target context sequence into a preset graph translation model to obtain a prediction result through an encoder and a decoder of the preset graph translation model;

[0115] The training unit is used to iteratively update the preset graph translation model based on the prediction results and the preset expected results and based on the binary cross entropy loss function, so as to train the target anomaly detection model corresponding to the target client.

[0116] Furthermore, the input unit is specifically used for:

[0117] Input the target context sequence into the preset graph translation model, and use the attention mechanism layer and forward propagation layer of the encoder in the preset graph translation model, and the attention mechanism layer and forward propagation layer of the decoder in the preset graph translation model to obtain decoding features;

[0118] According to the decoding features, based on the preset activation function, the prediction label of the preset graph translation model is determined to obtain the prediction result.

[0119] Furthermore, the detection module 303 is specifically used for:

[0120] Determine a parameter average of a target parameter corresponding to the target anomaly detection model and a candidate parameter corresponding to the candidate anomaly detection model;

[0121] The parameter average is determined as the optimal parameter corresponding to the optimal anomaly detection model.

[0122] Embodiment 4

[0123] Figure 4 It is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0124] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0125] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0126] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the abnormal transaction detection method.

[0127] In some embodiments, the abnormal transaction detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the abnormal transaction detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the abnormal transaction detection method in any other appropriate manner (e.g., by means of firmware).

[0128] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0129] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0130] In the context of the present invention, a computer readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium may be a machine readable signal medium. A more specific example of a machine readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0131] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0132] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0133] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0134] In one embodiment, the embodiment of the present invention further includes a computer program product, the computer program product includes a computer program, and the computer program implements the abnormal transaction detection method of any embodiment of the present invention when executed by a processor.

[0135] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0136] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0137] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting abnormal transactions, characterized in that: include: According to the target transaction information between the target client and the target customer associated with the business system, the corresponding heterogeneous relationship graph and target context sequence are determined to train a target anomaly detection model corresponding to the target client; Determine other clients other than the target client among the clients associated with the business system, and determine candidate parameters corresponding to the candidate anomaly detection models trained by the other clients; According to the target parameters and candidate parameters corresponding to the target anomaly detection model, the optimal parameters are determined to obtain the optimal anomaly detection model, and the optimal anomaly detection model is used to perform anomaly detection on the transaction conditions of the target client and other clients.

2. The method according to claim 1, characterized in that According to the target transaction information between the target client and the target customer associated with the business system, the corresponding heterogeneous relationship graph and target context sequence are determined, including: Determine customer feature information, merchant feature information and transaction feature information according to target transaction information, and determine the transaction relationship between the target customer and the target merchant in the target client and the social relationship between the target customers to construct a heterogeneous relationship graph; According to the heterogeneous relationship graph, the attribute vector corresponding to the target transaction information is determined, and the attribute vector is labeled to obtain the target context sequence corresponding to the heterogeneous relationship graph.

3. The method according to claim 2, characterized in that The attribute vector is labeled to obtain the target context sequence corresponding to the target transaction information, including: Determine the category identification vector corresponding to the attribute vector to classify the attribute vector sequence and obtain the attribute augmentation vector; According to the orthogonal node identification matrix corresponding to the attribute augmented vector, the attribute augmented vector is node-labeled to obtain the target context sequence corresponding to the target transaction information.

4. The method according to claim 1, characterized in that: The target anomaly detection model corresponding to the target client is trained, including: Input the target context sequence into the preset graph translation model to obtain a prediction result through the encoder and decoder of the preset graph translation model; According to the prediction results and the preset expected results, the preset graph translation model is iteratively updated based on the binary cross entropy loss function to train the target anomaly detection model corresponding to the target client.

5. The method according to claim 4, characterized in that The target context sequence is input into the preset graph translation model to obtain the prediction results through the encoder and decoder of the preset graph translation model, including: Input the target context sequence into the preset graph translation model, and use the attention mechanism layer and forward propagation layer of the encoder in the preset graph translation model, and the attention mechanism layer and forward propagation layer of the decoder in the preset graph translation model to obtain decoding features; According to the decoding features, based on the preset activation function, the prediction label of the preset graph translation model is determined to obtain the prediction result.

6. The method according to claim 1, characterized in that According to the target parameters and candidate parameters corresponding to the target anomaly detection model, the optimal parameters are determined, including: Determine a parameter average of a target parameter corresponding to the target anomaly detection model and a candidate parameter corresponding to the candidate anomaly detection model; The parameter average is determined as the optimal parameter corresponding to the optimal anomaly detection model.

7. An abnormal transaction detection device, characterized in that: include: A training module is used to determine the corresponding heterogeneous relationship graph and target context sequence according to the target transaction information between the target client and the target customer associated with the business system, so as to train a target anomaly detection model corresponding to the target client; A determination module, used to determine other clients except the target client among the clients associated with the business system, and determine candidate parameters corresponding to the candidate anomaly detection models trained by the other clients; The detection module is used to determine the optimal parameters according to the target parameters and candidate parameters corresponding to the target anomaly detection model to obtain the optimal anomaly detection model, and use the optimal anomaly detection model to perform anomaly detection on the transaction conditions of the target client and other clients.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormal transaction detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormal transaction detection method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the abnormal transaction detection method according to any one of claims 1 to 6.

Images