Transaction alert method and device for anonymous virtual wallets

Abstract

This invention discloses a transaction early warning method and apparatus for anonymous virtual wallets, relating to the fields of fintech or other related technical fields. The method includes: collecting transaction data of target financial transactions conducted using anonymous virtual wallets; extracting features and preprocessing the transaction data; inputting the preprocessed transaction data into an illegal fund transfer early warning model, whereby the model calculates the posterior probability of the transaction data belonging to each category; selecting the category with the highest posterior probability as the prediction result based on the calculated posterior probabilities; and outputting an alert message for the target financial transaction when the prediction result indicates that the target financial transaction involves illegal fund transfer. This invention solves the technical problem in related technologies where rule-based models cannot identify illegal fund transactions conducted by anonymous virtual wallets.

Description

Technical Field

[0001] This invention relates to the field of financial technology or other related fields, and more specifically, to a transaction alert method and apparatus for anonymous virtual wallets. Background Technology

[0002] In recent years, with the increasing complexity of the global financial environment, the identification of illicit fund transfers has faced numerous challenges, leading to increasingly stringent compliance requirements for financial institutions. Among related technologies, the methods used by financial institutions to identify illicit fund transfers primarily rely on manual analysis and identification of suspicious transactions. The suspicious transaction warning mechanisms mainly depend on basic customer information and transaction data, including but not limited to the customer's nationality, address, age, occupation, and the specific amount and purpose of the transaction. This information is used to build rule models, and warning indicators are determined through repeated training. However, this rule-based model training and updating method has limitations: the model's accuracy is highly dependent on the personal information provided by the customer. In scenarios where customer information is incomplete or transactions are anonymous, such as transactions through anonymous virtual wallets, the model's predictive performance is significantly reduced. Furthermore, existing rule models are mainly based on traditional transaction characteristics, making it difficult to effectively identify and warn of illicit fund transfers in anonymous virtual wallet transactions.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a transaction early warning method and apparatus for anonymous virtual wallets, to at least solve the technical problem that rule-based models used in related technologies cannot identify illegal fund transactions conducted by anonymous virtual wallets.

[0005] To achieve the above objectives, according to one aspect of this application, a transaction alert method for anonymous virtual wallets is provided, comprising: collecting transaction data of a target financial transaction using an anonymous virtual wallet; performing feature extraction and preprocessing on the transaction data; inputting the preprocessed transaction data into an illegal fund transfer alert model, wherein the illegal fund transfer alert model calculates the posterior probability of the transaction data belonging to each category; selecting the category with the highest posterior probability as the prediction result based on the calculated posterior probability, wherein, when the prediction result indicates that the target financial transaction involves illegal fund transfer, an alert message for the target financial transaction is output.

[0006] Optionally, the steps of collecting transaction data from targeted financial transactions using anonymous virtual wallets and performing feature extraction and preprocessing on the transaction data include: collecting transaction data when a consumer uses the anonymous virtual wallet to conduct a targeted financial transaction, wherein the transaction data includes at least one of the following: transaction time period, transaction amount, wallet balance after the transaction, transaction currency, transaction type, whether cross-border transactions are involved, and transaction purpose; extracting a feature set associated with illegal fund transfer warnings from the transaction data, wherein the feature set includes: transaction time period, transaction amount, wallet balance, currency type, lending identifier, transaction type, and cross-border transaction indicator; preprocessing the extracted feature set; and outputting the preprocessed transaction data as input to the illegal fund transfer warning model.

[0007] Optionally, the step of preprocessing the extracted feature set includes: performing outlier detection on the transaction amount feature in the feature set, converting negative or outlier amounts greater than a first preset outlier threshold to zero; or truncating negative or outlier amounts greater than the first preset outlier threshold; detecting whether there are outliers in the wallet balance feature in the feature set, setting values ​​greater than the maximum wallet limit as the maximum boundary limit value, or setting outliers less than the minimum wallet limit as the minimum boundary limit value; checking whether the transaction time period in the feature set exceeds the normal range, and setting the abnormal transaction time period as a specified time value.

[0008] Optionally, the step of preprocessing the extracted feature set includes: standardizing the feature values ​​of numerical features in the feature set using a normalization formula, wherein the numerical features include: transaction time period, transaction amount, and wallet balance; and labeling the categorical features in the feature set by converting the feature value of each feature into an integer code, wherein the categorical features include: currency type, lending identifier, transaction type, and cross-border transaction identifier.

[0009] Optionally, the illegal fund transfer early warning model is trained as follows: feature extraction and preprocessing of historical transaction data; training a Bayesian classification model using the preprocessed transaction dataset, calculating the prior probabilities of positive and negative categories using the Bayesian classification model, and calculating the conditional probability of each feature in each category using the Bayesian classification model, wherein the positive category is used to indicate data in the transaction dataset involving illegal fund transfer, and the negative category is used to indicate data in the transaction dataset not involving illegal fund transfer; updating the model parameters of the Bayesian classification model according to the training results, until the accuracy of the posterior probability of the transaction data output by the Bayesian classification model belonging to each category reaches a preset accuracy threshold, at which point the model training is considered complete, and the illegal fund transfer early warning model is obtained.

[0010] Optionally, it also includes: extracting features and preprocessing the new transaction data based on the newly collected transaction data, and dynamically adjusting the model parameters of the illegal fund transfer early warning model based on the preprocessed new transaction data.

[0011] Optionally, the step of selecting the category with the highest posterior probability as the prediction result based on the calculated posterior probability includes: comparing the calculated posterior probabilities of the positive and negative categories; selecting the category with the largest posterior probability value and using the selected category as the prediction result; determining that the target financial transaction is suspected of illegal fund transfer if the posterior probability of the positive category is greater than that of the negative category; and determining that the target financial transaction does not involve illegal fund transfer if the posterior probability of the negative category is greater than that of the positive category.

[0012] According to another aspect of the present invention, a transaction early warning device for anonymous virtual wallets is also provided, comprising: a transaction data acquisition unit, configured to acquire transaction data of a target financial transaction using an anonymous virtual wallet, and to perform feature extraction and preprocessing on the transaction data; a data input unit, configured to input the preprocessed transaction data into an illegal fund transfer early warning model, wherein the illegal fund transfer early warning model calculates the posterior probability of the transaction data belonging to each category; and a transaction early warning unit, configured to select the category with the highest posterior probability as the prediction result based on the calculated posterior probability, wherein, when the prediction result indicates that the target financial transaction involves illegal fund transfer, an alarm message for the target financial transaction is output.

[0013] Optionally, the transaction data acquisition unit includes: a transaction data acquisition module, used to collect transaction data when a consumer uses the anonymous virtual wallet to conduct a target financial transaction, wherein the transaction data includes at least one of the following: transaction time period, transaction amount, wallet balance after the transaction, transaction currency, transaction type, whether cross-border transaction is involved, and transaction purpose; a feature extraction module, used to extract a feature set associated with illegal fund transfer warning from the transaction data, wherein the feature set includes: transaction time period, transaction amount, wallet balance, currency type, lending identifier, transaction type, and cross-border transaction indicator; a feature preprocessing module, used to preprocess the extracted feature set; and a transaction data output module, used to output the preprocessed transaction data as input to the illegal fund transfer warning model.

[0014] Optionally, the feature preprocessing module includes: a first outlier detection submodule, used to perform outlier detection on the transaction amount feature in the feature set, converting negative or outlier amount values ​​greater than a first preset outlier threshold to zero; or, truncating negative or outlier amount values ​​greater than the first preset outlier threshold; a second outlier detection submodule, used to detect whether there are outliers in the wallet balance feature in the feature set, setting values ​​greater than the maximum wallet limit as the maximum boundary limit value, or setting outliers less than the minimum wallet limit as the minimum boundary limit value; and a time period detection submodule, used to check whether the transaction time period in the feature set exceeds the normal range, and setting the abnormal transaction time period to a specified time value.

[0015] Optionally, the feature preprocessing module includes: a standardization submodule, used to standardize the feature values ​​of the numerical features in the feature set using a normalization formula, wherein the numerical features include: transaction time period, transaction amount, and wallet balance; and an encoding submodule, used to label and encode the categorical features in the feature set, converting the feature value of each feature into an integer code, wherein the categorical features include: currency type, lending identifier, transaction type, and cross-border transaction identifier.

[0016] Optionally, the illegal fund transfer early warning model is trained using the following units: a feature extraction subunit, used to extract and preprocess features from historical transaction data; a training subunit, used to train a Bayesian classification model using the preprocessed transaction dataset, whereby the Bayesian classification model calculates the prior probabilities of positive and negative categories, and calculates the conditional probability of each feature in each category, wherein the positive category indicates data in the transaction dataset involving illegal fund transfer, and the negative category indicates data in the transaction dataset not involving illegal fund transfer; and a parameter update subunit, used to update the model parameters of the Bayesian classification model based on the training results, until the accuracy of the posterior probability of the transaction data belonging to each category output by the Bayesian classification model reaches a preset accuracy threshold, at which point the model training is considered complete, and the illegal fund transfer early warning model is obtained.

[0017] Optionally, the transaction early warning device for anonymous virtual wallets further includes: a feature re-extraction unit, used to re-extract features and preprocess new transaction data based on newly collected transaction data, and dynamically adjust the model parameters of the illegal fund transfer early warning model based on the preprocessed new transaction data.

[0018] Optionally, the transaction warning unit includes: a probability comparison module for comparing the calculated posterior probabilities of the positive and negative categories; a category selection module for selecting the category with the largest posterior probability value and using the selected category as the prediction result; if the posterior probability of the positive category is greater than that of the negative category, the target financial transaction is determined to be suspected of illegal fund transfer; if the posterior probability of the negative category is greater than that of the positive category, the target financial transaction is determined not to involve illegal fund transfer.

[0019] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the transaction alert method for anonymous virtual wallet described above.

[0020] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the transaction alert method for anonymous virtual wallets described above.

[0021] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the transaction alert method for anonymous virtual wallets described in any one of the above embodiments.

[0022] In this disclosure, transaction data of target financial transactions using anonymous virtual wallets are collected, and feature extraction and preprocessing are performed on the transaction data. The preprocessed transaction data is input into an illegal fund transfer early warning model, which calculates the posterior probability of the transaction data belonging to each category. Based on the calculated posterior probability, the category with the highest posterior probability is selected as the prediction result. When the prediction result indicates that the target financial transaction involves illegal fund transfer, an alarm message for the target financial transaction is output.

[0023] In this disclosure, in the absence of customer information, the transaction data of customers using anonymous virtual wallets is monitored. Then, an early warning model is used to classify the transactions and automatically iterate the model to dynamically issue warnings for suspicious transactions. This accurately identifies information on illegal fund transfers using anonymous virtual wallets and provides timely warnings, thereby solving the technical problem in related technologies where rule-based models cannot identify illegal fund transactions conducted by anonymous virtual wallets. Attached Figure Description

[0024] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0025] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a transaction alert method for anonymous virtual wallets is shown.

[0026] Figure 2 This is a flowchart of an optional transaction alert method for anonymous virtual wallets according to an embodiment of the present invention;

[0027] Figure 3 This is a schematic diagram of an optional transaction alert device for anonymous virtual wallets according to an embodiment of the present invention;

[0028] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] To facilitate understanding of the present invention by those skilled in the art, some terms or nouns involved in the various embodiments of the present invention are explained below:

[0032] Bayesian models are statistical modeling methods based on probability theory. Based on Bayes' theorem, they provide a framework for calculating posterior probabilities (probabilities considering current data) using known prior probabilities (probabilities without considering current data) and likelihood probabilities (probabilities of a hypothesis occurring given current data). In this application, in identifying customer classifications involving illicit fund transfers, Bayesian models are used to assess the probability that transaction data belongs to the category of suspected or unsuspected illicit fund transfers.

[0033] An anonymous virtual wallet is a tool used in virtual transactions to store and transfer virtual funds. It is designed to protect user privacy and allow users to conduct transactions without revealing their identity.

[0034] It should be noted that the transaction early warning method and apparatus for anonymous virtual wallets disclosed herein can be used in the fintech field to detect illegal fund transfers by customers using anonymous virtual wallets based on a Bayesian model, and can also be used in any field other than the fintech field to detect illegal fund transfers by customers using anonymous virtual wallets based on a Bayesian model. This disclosure does not limit the application field of the transaction early warning method and apparatus for anonymous virtual wallets.

[0035] It should be noted that the information (including but not limited to user device information, virtual wallet information, user personal information, etc.) and data (including but not limited to transaction data used for analysis, stored data, and displayed data) collected in this public disclosure are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with the relevant laws, regulations, and standards of the relevant regions, and necessary confidentiality measures have been taken. This does not violate public order and good morals, and corresponding operation entry points are provided for users to choose to authorize or refuse. For example, this system has interfaces with relevant users or institutions. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or institution through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or institution.

[0036] It should be noted that in this disclosure, customer information is collected and analyzed, and users are provided with corresponding operation entry points to choose whether to agree to or reject the automated decision results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0037] The following embodiments of the present invention can be applied to various systems / applications / devices for transaction alerts in anonymous virtual wallets. The present invention overcomes the shortcomings of missing customer information and poor scalability of rule models. It uses artificial intelligence machine learning technology to model transactions based on the anonymous virtual wallet customer's mobile terminal, location, and transaction behavior (including transaction time period, transaction amount, balance, transaction type, and transaction currency), classifies transactions, automatically iterates the model, and dynamically issues alerts for suspicious transactions.

[0038] The present invention will now be described in detail with reference to various embodiments.

[0039] Example 1

[0040] According to an embodiment of the present invention, an embodiment of a transaction alert method for anonymous virtual wallets is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0041] The transaction alert method for anonymous virtual wallets provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a transaction alert method for anonymous virtual wallets is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1(Illustrated as 102a, 102b, ..., 102n) Processor 102 (processor 102 may include, but is not limited to, a microprocessor MCU (Microcontroller Unit) or a programmable gate array (FPGA), etc.), memory 104 for storing data, and transmission device 106 for communication functions. In addition, it may include: a display, input / output interface (I / O interface), Universal Serial Bus (USB) port (which may be included as one of the ports of a BUS bus), network interface, power supply, and / or camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0042] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0043] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the transaction alert method for anonymous virtual wallets in this embodiment of the application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned transaction alert method for anonymous virtual wallets. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0044] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0045] The display can be, for example, a touchscreen liquid crystal display (LCD), which allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0046] Under the aforementioned operating environment, this application provides the following: Figure 2 The method shown is for transaction alerts in anonymous virtual wallets. Figure 2 This is a flowchart of an optional transaction alert method for anonymous virtual wallets according to an embodiment of the present invention.

[0047] It should be noted that the transaction early warning method for anonymous virtual wallets provided in this embodiment is applied to monitoring scenarios where the risk of illegal fund transfers is identified during financial transactions using anonymous virtual wallets. When a user chooses to conduct transactions using an anonymous wallet, this embodiment can provide early warnings of potential illegal fund transfer activities by analyzing the characteristics of transaction data, such as transaction time period, amount, balance, transaction type, currency, and location information. Even when customer information is missing, the accuracy of the early warning can still be guaranteed.

[0048] like Figure 2 As shown, the transaction alert method for anonymous virtual wallets includes the following steps:

[0049] Step S101: Collect transaction data of target financial transactions using anonymous virtual wallets, and perform feature extraction and preprocessing on the transaction data.

[0050] In this embodiment, step S101 may include: collecting transaction data when a consumer uses an anonymous virtual wallet to conduct a target financial transaction, wherein the transaction data includes at least one of the following: transaction time period, transaction amount, wallet balance after the transaction, transaction currency, transaction type, whether it involves cross-border transactions, and transaction purpose; extracting a feature set associated with illegal fund transfer warning from the transaction data, wherein the feature set includes: transaction time period, transaction amount, wallet balance, currency type, lending identifier, transaction type, and cross-border transaction indicator; preprocessing the extracted feature set; and outputting the preprocessed transaction data as input to the illegal fund transfer warning model.

[0051] This step involves collecting data records generated when consumers use anonymous virtual wallets for financial transactions. The collected transaction data covers multiple dimensions, including but not limited to the transaction time period, transaction amount, wallet balance after the transaction, currency, transaction type (e.g., transfer, payment, remittance), whether it involves cross-border transactions, and the purpose of the transaction (if available). Due to the nature of anonymous virtual wallets, transaction data may not contain traditional customer identification information such as name, address, and occupation. Therefore, this embodiment focuses on collecting data related to transaction behavior to compensate for the challenges posed by information gaps.

[0052] By filtering key features directly related to illicit fund transfers from collected transaction data, a feature set is constructed. This feature set includes transaction time period, transaction amount, wallet balance, currency type, lending / borrowing identifier (i.e., transaction direction, whether it's income or expenditure), transaction type, and cross-border transaction indicators. This feature information reflects the timing patterns, monetary scale, direction of fund flow, and traces of international transactions, serving as crucial evidence for identifying illicit fund transfers.

[0053] After feature extraction, the data needs to be cleaned, standardized, and encoded to meet the requirements of the model input and improve the efficiency of model training and prediction. Cleaning involves removing or correcting errors and outliers in the transaction data, such as unreasonable transaction amounts or incorrect timestamps. Standardization involves standardizing numerical features such as transaction amounts and wallet balances to ensure comparability of features across different numerical ranges within the model. Encoding involves encoding categorical features, such as currency type, transaction type, and cross-border transaction markers, into a numerical form readable by the model. This preprocessed transaction data serves as input to the illegal fund transfer early warning model; after processing, this data can be directly used for model training or real-time prediction.

[0054] It should be noted that the transaction data in this embodiment should be organized into a format that the model can directly process, typically including feature vectors and corresponding labels (whether illicit fund transfers are involved). The output data ensures the efficiency of model training and the accuracy of prediction results, enabling effective early warning of illicit fund transfers even in the use case of anonymous virtual wallets.

[0055] For the above steps: preprocessing the extracted feature set may include: performing outlier detection on the transaction amount feature in the feature set, converting negative or outlier amounts greater than a first preset outlier threshold to zero; or truncating negative or outlier amounts greater than the first preset outlier threshold; detecting whether there are outliers in the wallet balance feature in the feature set, setting outliers greater than the maximum wallet limit to the maximum boundary limit value, or setting outliers less than the minimum wallet limit to the minimum boundary limit value; checking whether the transaction time period in the feature set exceeds the normal range, and setting the abnormal transaction time period to a specified time value.

[0056] In this embodiment, when preprocessing the feature set extracted from the transaction data, it is first necessary to perform outlier detection and processing of transaction amount, that is, to identify and process outliers in the transaction amount to avoid the influence of extreme data during model training or prediction. Here, the main focus is on outlier detection of transaction amount features. The detection range includes negative values ​​and values ​​exceeding a specific threshold. If the transaction amount features contain negative values ​​or the value is greater than the first preset outlier threshold, one of the following processing methods is adopted: the negative value or the abnormally large value is directly set to zero (0) to eliminate their influence on the model; the negative value or the abnormally large value is truncated, that is, its value is limited to ensure that the model prediction result is not distorted due to extreme values.

[0057] Additionally, it should be noted that this embodiment, when preprocessing the feature set extracted from transaction data, also requires outlier detection and processing of the wallet balance feature to ensure that the wallet balance feature reflects the actual and reasonable fund holding situation. This mainly involves detecting whether there are outliers in the wallet balance feature that exceed the normal range. When a value in the wallet balance feature is detected to be greater than the maximum amount in the wallet, it is set as the maximum boundary value to avoid the model misinterpreting abnormally large fund holdings. Similarly, if the value is less than the minimum amount in the wallet, it is set as the minimum boundary value to ensure the reasonableness of the model's input data.

[0058] Furthermore, in this embodiment, when preprocessing the feature set extracted from the transaction data, it is also necessary to perform outlier detection and processing for transaction time periods to standardize the transaction time period data and ensure that all transaction time markers are within an acceptable normal range. This mainly involves checking the transaction time periods recorded in the transaction data to determine whether they exceed the normal time range of a day (usually 0 to 24 hours). If a transaction time period is found to exceed the normal time range, it is set to a specified reasonable time value, such as uniformly setting the abnormal time to 24 hours, to maintain the continuity and integrity of the data.

[0059] Optionally, the preprocessing step for the extracted feature set includes: for numerical features in the feature set, standardizing the feature values ​​using a normalization formula, wherein the numerical features include: transaction time period, transaction amount, and wallet balance; and for categorical features in the feature set, label encoding is performed, converting the feature value of each feature into an integer code, wherein the categorical features include: currency type, lending identifier, transaction type, and cross-border transaction identifier.

[0060] Here, the purpose of standardizing numerical features is to map values ​​from different ranges to a uniform scale, avoiding model learning bias caused by differences in numerical ranges between features. This requires standardizing the numerical features using a normalization formula, which can be:

[0061]

[0062] Where x is the original eigenvalue, x min With x max These are the minimum and maximum values ​​of the feature in the dataset, respectively, x normzlized These are the normalized feature values. In this application, numerical features include transaction time period, transaction amount, and wallet balance, etc. These features are standardized using the above formula, mapping them to the range of 0 to 1 to ensure their comparability during model training and prediction.

[0063] Categorical feature encoding converts non-numerical information into numerical form to facilitate processing by machine learning models. Label encoding can be used here to convert the feature values ​​of each feature into integer codes, mapping different category values ​​to a series of different integers. In this embodiment, categorical features include currency type, lending / borrowing identifiers (representing the transaction direction, such as borrowing or lending), transaction type (such as transfer, payment, etc.), and cross-border transaction indicators. Label encoding converts these feature values ​​into integers starting from 0 and incrementing. For example, if there are three currency types, they can be encoded as 0, 1, and 2; the lending / borrowing identifier can be encoded as 0 for borrowing, 1 for lending, and so on.

[0064] Step S102: Input the preprocessed transaction data into the illegal fund transfer early warning model, and the illegal fund transfer early warning model calculates the posterior probability of the transaction data belonging to each category.

[0065] It should be noted beforehand that the illegal fund transfer early warning model mentioned in this embodiment is trained in the following way: feature extraction and preprocessing of historical transaction data in the historical process; training a Bayesian classification model using the preprocessed transaction dataset, calculating the prior probabilities of positive and negative categories by the Bayesian classification model, and calculating the conditional probability of each feature under each category by the Bayesian classification model, wherein the positive category is used to indicate data in the transaction dataset involving illegal fund transfer, and the negative category is used to indicate data in the transaction dataset not involving illegal fund transfer; updating the model parameters of the Bayesian classification model according to the training results, until the accuracy of the posterior probability of the transaction data output by the Bayesian classification model belonging to each category reaches a preset accuracy threshold, at which point the model training is considered complete, and the illegal fund transfer early warning model is obtained.

[0066] Before training the model, features relevant to illicit fund transfer warnings are extracted from historical transaction data. Ensuring the quality of this feature data requires pre-collecting historical transaction data, encompassing targeted financial transactions using anonymous virtual wallets. Numerical features (such as transaction time period, transaction amount, and wallet balance) are then normalized to ensure consistency in numerical ranges. Categorical features (such as currency type, lending identifier, transaction type, and cross-border transaction indicators) are tagged and encoded, converting non-numerical information into a numerical form that can be processed by the machine learning model.

[0067] Bayesian classification models are probabilistic machine learning models used for classification and prediction problems. Their core principles are Bayes' theorem and the feature independence assumption. In this embodiment, based on a preprocessed transaction dataset, the model identifies transactions suspected of involving illegal fund transfers as positive categories and transactions not involved in illegal fund transfers as negative categories. The model first calculates the prior probabilities of the positive and negative categories, i.e., the probability that the transaction data belongs to either the suspected or non-suspected illegal fund transfer category without considering features. The model further calculates the conditional probability of each feature in each category, i.e., the probability of a specific feature appearing given a certain category. Based on the calculated prior and conditional probabilities, the model parameters are continuously adjusted and optimized to improve prediction accuracy. During training, the accuracy of the posterior probabilities of the model's output transaction data belonging to the positive category (suspected illegal fund transfer) and the negative category (non-suspected illegal fund transfer) is monitored. This accuracy needs to reach a preset accuracy threshold to ensure that the model's prediction results are sufficiently reliable. When the model's accuracy reaches or exceeds the preset accuracy threshold, the model is considered to have completed training, and the model parameter configuration at this point is capable of effectively identifying illegal fund transfer activities.

[0068] The trained illicit fund transfer early warning model can be applied to a real-time transaction monitoring system to analyze newly occurring transaction data and automatically output the probability that a transaction is suspected of involving illicit fund transfers. As more real-time transaction data is collected, the model can be continuously updated and optimized to adapt to constantly changing transaction patterns and illicit fund transfer methods, maintaining the up-to-dateness and effectiveness of its early warning effect. Optionally, this embodiment also includes: re-extracting features and preprocessing the newly collected transaction data, and dynamically adjusting the model parameters of the illicit fund transfer early warning model based on the preprocessed new transaction data.

[0069] When adjusting model parameters, it is necessary to continuously collect new transaction data, which may come from real-time transaction records of anonymous virtual wallets. Similar to historical data processing, a set of features associated with illicit fund transfer warnings is extracted from the new transaction data, including transaction time period, transaction amount, wallet balance, currency type, lending identifier, transaction type, and cross-border transaction indicators. The newly extracted feature set is preprocessed, including standardization of numerical features (such as normalization of transaction amount and wallet balance) and encoding of categorical features (such as label encoding of currency type and transaction type), ensuring consistency in format and scale between the new data and historical data. Based on the characteristics of Bayesian classification models, the addition of new data can be regarded as an update to the model parameters. Specifically, using the newly collected and preprocessed transaction data, the prior probabilities of the positive category (suspected illicit fund transfer transactions) and the negative category (normal transactions) are recalculated. Simultaneously, the conditional probability of each feature under each category is updated.

[0070] Through the above steps, the dynamic recalculation of conditional and prior probabilities ensures that the model can promptly capture potential signals of illegal fund transfers in transaction data. The feature set of new transaction data is input into the model as the basis for dynamic adjustment. The model automatically adjusts its parameters, including updating prior and conditional probabilities, by analyzing the new data. After parameter adjustment, the model performs self-validation to evaluate its predictive performance. If the model's accuracy and stability meet preset standards, the adjusted parameters are saved for subsequent analysis and prediction of transaction data.

[0071] By dynamically adjusting the model parameters, this application enables the illegal fund transfer early warning model to maintain efficient and accurate early warning capabilities in a constantly changing trading environment. As the system continues to operate, the model will continuously evolve, improving its efficiency in identifying emerging illegal fund transfer methods.

[0072] Step S103: Based on the calculated posterior probability, select the category with the highest posterior probability as the prediction result. Wherein, if the prediction result indicates that the target financial transaction involves illegal fund transfer, output an alarm message for the target financial transaction to prevent the transaction from being completed.

[0073] It should be noted that step S103 in this embodiment includes: comparing the calculated posterior probabilities of the positive and negative categories; selecting the category with the largest posterior probability value and using the selected category as the prediction result; determining that the target financial transaction is suspected of illegal fund transfer when the posterior probability of the positive category is greater than that of the negative category; and determining that the target financial transaction does not involve illegal fund transfer when the posterior probability of the negative category is greater than that of the positive category.

[0074] During the model training phase, the Bayesian classification model learns the features of transaction data and their association with the positive category (suspected illegal fund transfer transactions) and the negative category (normal transactions). For each new target financial transaction, the model calculates the posterior probability of belonging to the positive and negative categories based on its feature values. The posterior probability is the model's estimate of the probability that the transaction data belongs to a certain category after considering the transaction feature information; it reflects the likelihood of the transaction data belonging to the positive or negative category given the features. After calculating the posterior probabilities for the positive and negative categories, the model compares them to determine which category the transaction data is more likely to belong to, thereby judging whether the transaction involves suspected illegal fund transfers.

[0075] Specifically, during the comparison process, the posterior probability of the positive class needs to be directly compared with the posterior probability of the negative class to identify the class with the larger probability value. Then, based on the comparison result, this embodiment uses the following judgment rules to determine the final prediction result: If the posterior probability of the positive class is greater than the posterior probability of the negative class, the model determines that the target financial transaction is suspected of illegal fund transfer. In this case, the early warning system will mark the transaction and may trigger further investigation or prevent the transaction. If the posterior probability of the negative class is greater than the posterior probability of the positive class, the model determines that the target financial transaction does not involve illegal fund transfer. In this case, the transaction will be considered a normal financial activity and can continue.

[0076] By using the posterior probability calculated through a Bayesian model, this embodiment achieves intelligent classification of transaction data. It considers not only the independent impact of individual features but also the combined effect of all features, thereby improving the accuracy of identifying illicit fund transfers. Simultaneously, the probability-based judgment mechanism allows the model to express the degree of suspiciousness of transactions in a quantitative form, providing decision-makers with a more objective and quantifiable basis for early warning.

[0077] This embodiment has the ability to automatically iterate and update, and can continuously adjust the model parameters based on newly collected transaction data, ensuring that the accuracy and effectiveness of the early warning model are continuously optimized as the transaction scenario changes. This dynamic adjustment mechanism greatly reduces the human resource cost of model maintenance.

[0078] Through the above steps, transaction data of target financial transactions using anonymous virtual wallets can be collected. Feature extraction and preprocessing of the transaction data are then performed. The preprocessed transaction data is input into an illegal fund transfer early warning model, which calculates the posterior probability of the transaction data belonging to each category. Based on the calculated posterior probabilities, the category with the highest posterior probability is selected as the prediction result. If the prediction result indicates that the target financial transaction involves illegal fund transfer, an alert is output to prevent the transaction from being completed. In this embodiment, when customer information is missing, by monitoring the transaction data of customers using anonymous virtual wallets, and then using an early warning model to classify transactions and automatically iterate the model, suspicious transaction alerts are dynamically issued. This accurately identifies information about illegal fund transfers using anonymous virtual wallets and provides timely alerts, thus solving the technical problem in related technologies where rule-based models cannot identify illegal fund transactions using anonymous virtual wallets.

[0079] In this embodiment, machine learning methods can automatically identify and learn the characteristic patterns of anonymous virtual wallet transactions, overcoming the problem of significantly reduced early warning effectiveness of traditional rule-based models when customer information is missing. Even in an anonymous environment, suspicious transactions can be accurately identified through transaction behavior characteristics, improving the intelligence level of the entire anti-illegal fund transfer early warning system.

[0080] Meanwhile, this embodiment classifies transactions using posterior probabilities calculated by a Bayesian model, enabling a more accurate determination of whether a target financial transaction involves illegal fund transfers. Compared to traditional identification schemes that rely solely on basic customer information, this approach can capture more potential signals of illegal fund transfers from transaction behavior, thereby improving the accuracy of early warnings.

[0081] The following describes in detail another optional implementation method.

[0082] Step 1: Collect transaction data for training the model. The dataset should include the following fields: transaction data, including: transaction time period, transaction amount, account balance, currency code, lending indicator, transaction type, and cross-border indicator, as well as a label for each transaction, i.e., whether it involves illegal fund transfer. Among them, the transaction time period, transaction amount, and account balance fields are numerical features, with values ​​of positive real numbers; the currency code, lending indicator, transaction type, and cross-border indicator are categorical features, with values ​​of natural numbers.

[0083] Step 2: Data preprocessing of transaction data, mainly including: (1) Data cleaning: cleaning the transaction time period, transaction amount and account balance features in the transaction data and handling outliers. (2) Standardization: standardizing numerical features to ensure that they are within a similar numerical range. (3) Label coding: label coding categorical features.

[0084] Step Two (1): A. Check if the transaction amount feature has negative or abnormally large values. If so, set it to 0 or truncate it. B. Check if the account balance feature has abnormal values. If it has values ​​greater than the account's maximum limit or less than the account's minimum limit, set it to the corresponding boundary value. C. Transaction time period: Check if the transaction time period exceeds the normal range (1 to 24 hours). If abnormal values ​​exist, set it to 24. D. Check if the categorical feature has unknown or abnormal categories. If abnormal values ​​exist, delete the transaction data.

[0085] Step 2(2): Process the numerical features according to the following normalization formula:

[0086]

[0087] Step 2 (3): Map the values ​​of categorical features to integers that start from 0 and increment sequentially.

[0088] Step 3: Train a Naive Bayes classifier model using the processed features and labels.

[0089] Step 3 (1): Assume the feature vector X = {x1, x2, x3, ..., x...} n}. Calculate the prior probabilities of belonging to the positive category (suspected illegal fund transfer) and the negative category (not suspected of illegal fund transfer), respectively.

[0090]

[0091] P(C0) = 1 - P(C1|X).

[0092] Step 3(2): For each feature x i and each category C i Calculate the feature x under this category i The conditional probability P(C) i |x i According to the Naive Bayes assumption, assuming that the features are independent of each other, then:

[0093]

[0094] Step 4: Prediction.

[0095] Step 4(1): For new transaction data, its feature vector is Xτ={xτ1,xτ2,xτ3......x τn}, calculate the posterior probability of it belonging to each category.

[0096]

[0097] Step 4(2): Based on the calculated posterior probability, select the category with the highest posterior probability as the prediction result.

[0098]

[0099] Step 5: Automatic Iterative Updates. Based on the continuously arriving new data, repeat steps 2 and 3 to continuously improve the model parameters.

[0100] Compared with existing methods, the embodiments of the present invention propose a dynamic suspicious transaction early warning method, which overcomes the shortcomings of low early warning model update frequency and high maintenance cost in existing methods.

[0101] Through the above implementation steps, analysis and early warning can be performed instantly upon the arrival of new transaction data, eliminating the need for regular manual model training and updates. This real-time monitoring capability is crucial for rapidly responding to illicit fund transfer activities, effectively preventing the flow of illegal funds and reducing the impact of illicit fund transfer risks on financial institutions and society.

[0102] Furthermore, the above implementation methods ensure the accuracy of suspicious transaction alerts even when customer information is missing. The model can also be dynamically adjusted according to changes in the transaction scenario, significantly reducing human resource costs and improving the timeliness of identifying illegal fund transfers.

[0103] The following is a detailed description with reference to another embodiment.

[0104] Example 2

[0105] The transaction alert device for anonymous virtual wallets provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in Embodiment 1 above.

[0106] Figure 3 This is a schematic diagram of an optional transaction alert device for anonymous virtual wallets according to an embodiment of the present invention, such as... Figure 3 As shown, the transaction alert device for anonymous virtual wallets may include: a transaction data acquisition unit 31, a data input unit 32, and a transaction alert unit 33.

[0107] Among them, the transaction data acquisition unit 31 is used to collect transaction data of target financial transactions using anonymous virtual wallets, and to extract features and preprocess the transaction data.

[0108] The data input unit 32 is used to input the preprocessed transaction data into the illegal fund transfer early warning model, which calculates the posterior probability of the transaction data belonging to each category.

[0109] The transaction warning unit 33 is used to select the category with the highest posterior probability as the prediction result based on the calculated posterior probability. When the prediction result indicates that the target financial transaction involves illegal fund transfer, it outputs an alarm message for the target financial transaction to prevent the transaction from being completed.

[0110] The aforementioned transaction early warning device for anonymous virtual wallets can collect transaction data of target financial transactions using anonymous virtual wallets through a transaction data acquisition unit 31. This data is then processed and pre-processed. The pre-processed data is input to an illegal fund transfer early warning model via a data input unit 32. The model calculates the posterior probability of the transaction data belonging to each category. The early warning unit 33 then selects the category with the highest posterior probability as the prediction result. If the prediction result indicates that the target financial transaction involves illegal fund transfer, an alarm message is output to prevent the transaction from being completed. In this embodiment, when customer information is missing, by monitoring the transaction data of customers using anonymous virtual wallets, classifying transactions using an early warning model, and automatically iterating the model to dynamically issue suspicious transaction warnings, information on illegal fund transfers using anonymous virtual wallets can be accurately identified, and timely warning information can be provided. This solves the technical problem in related technologies where rule-based models cannot identify illegal fund transactions using anonymous virtual wallets.

[0111] Optionally, the transaction data acquisition unit includes: a transaction data acquisition module for collecting transaction data when a consumer uses an anonymous virtual wallet to conduct a target financial transaction, wherein the transaction data includes at least one of the following: transaction time period, transaction amount, wallet balance after the transaction, transaction currency, transaction type, whether cross-border transaction is involved, and transaction purpose; a feature extraction module for extracting a feature set associated with illegal fund transfer warning from the transaction data, wherein the feature set includes: transaction time period, transaction amount, wallet balance, currency type, lending identifier, transaction type, and cross-border transaction indicator; a feature preprocessing module for preprocessing the extracted feature set; and a transaction data output module for outputting the preprocessed transaction data as input to the illegal fund transfer warning model.

[0112] Optionally, the feature preprocessing module includes: a first outlier detection submodule, used to detect outliers in the transaction amount feature of the feature set, converting negative or outlier amounts greater than a first preset outlier threshold to zero; or, truncating negative or outlier amounts greater than the first preset outlier threshold; a second outlier detection submodule, used to detect whether there are outliers in the wallet balance feature of the feature set, setting outliers greater than the maximum wallet limit to the maximum boundary limit value, or setting outliers less than the minimum wallet limit to the minimum boundary limit value; and a time period detection submodule, used to check whether the transaction time period in the feature set exceeds the normal range, and setting the abnormal transaction time period to a specified time value.

[0113] Optionally, the feature preprocessing module includes: a standardization submodule, used to standardize the feature values ​​of numerical features in the feature set using a normalization formula, wherein the numerical features include: transaction time period, transaction amount, and wallet balance; and an encoding submodule, used to label and encode the categorical features in the feature set, converting the feature value of each feature into an integer code, wherein the categorical features include: currency type, lending identifier, transaction type, and cross-border transaction identifier.

[0114] Optionally, the illegal fund transfer early warning model is trained through the following units: a feature extraction subunit, used to extract and preprocess features from historical transaction data; a training subunit, used to train a Bayesian classification model using the preprocessed transaction dataset, where the Bayesian classification model calculates the prior probabilities of the positive and negative classes, and calculates the conditional probability of each feature in each class, where the positive class indicates data in the transaction dataset involving illegal fund transfer, and the negative class indicates data in the transaction dataset not involving illegal fund transfer; and a parameter update subunit, used to update the model parameters of the Bayesian classification model based on the training results, until the accuracy of the posterior probability of the transaction data belonging to each class output by the Bayesian classification model reaches a preset accuracy threshold, at which point the model training is considered complete, and the illegal fund transfer early warning model is obtained.

[0115] Optionally, the transaction alert device for anonymous virtual wallets further includes: a feature re-extraction unit, used to re-extract features from and preprocess the newly collected transaction data, and dynamically adjust the model parameters of the illegal fund transfer alert model based on the preprocessed new transaction data.

[0116] Optionally, the transaction alert unit includes: a probability comparison module for comparing the calculated posterior probabilities of the positive and negative categories; a category selection module for selecting the category with the largest posterior probability value and using the selected category as the prediction result; if the posterior probability of the positive category is greater than that of the negative category, the target financial transaction is determined to be suspected of illegal fund transfer; if the posterior probability of the negative category is greater than that of the positive category, the target financial transaction is determined not to involve illegal fund transfer.

[0117] The aforementioned transaction alert device for anonymous virtual wallets may also include a processor and a memory. The transaction data acquisition unit 31, data input unit 32, transaction alert unit 33, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0118] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, the identification of financial transactions involving illicit fund transfers using anonymous virtual wallets can be achieved.

[0119] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0120] Example 3

[0121] Embodiments of this application may provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 Only one of the following is shown: processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0122] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0123] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: collect transaction data of a target financial transaction using an anonymous virtual wallet, extract features from the transaction data and preprocess it; input the preprocessed transaction data into an illegal fund transfer early warning model, which calculates the posterior probability of the transaction data belonging to each category; select the category with the highest posterior probability as the prediction result based on the calculated posterior probability, wherein, if the prediction result indicates that the target financial transaction involves illegal fund transfer, an alarm message for the target financial transaction is output.

[0124] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: collecting transaction data when a consumer uses an anonymous virtual wallet to conduct a targeted financial transaction, wherein the transaction data includes at least one of the following: transaction time period, transaction amount, wallet balance after the transaction, transaction currency, transaction type, whether cross-border transaction is involved, and transaction purpose; extracting a feature set associated with illegal fund transfer warnings from the transaction data, wherein the feature set includes: transaction time period, transaction amount, wallet balance, currency type, lending identifier, transaction type, and cross-border transaction indicator; preprocessing the extracted feature set; and outputting the preprocessed transaction data as input to the illegal fund transfer warning model.

[0125] The processor can access the information and application stored in the memory via the transmission device to perform the following steps: perform outlier detection on the transaction amount feature in the feature set, converting negative or outlier amounts greater than a first preset outlier threshold to zero; or, truncating negative or outlier amounts greater than the first preset outlier threshold; detect whether there are outliers in the wallet balance feature in the feature set, setting values ​​greater than the maximum wallet balance to the maximum boundary value, or setting outliers less than the minimum wallet balance to the minimum boundary value; check whether the transaction time period in the feature set exceeds the normal range, and set the abnormal transaction time period to a specified time value.

[0126] The processor can access the information and application programs stored in the memory via the transmission device to perform the following steps: For numerical features in the feature set, the feature values ​​are standardized using a normalization formula, where the numerical features include: transaction time period, transaction amount, and wallet balance; For categorical features in the feature set, label encoding is performed, converting the feature value of each feature into an integer code, where the categorical features include: currency type, lending identifier, transaction type, and cross-border transaction identifier.

[0127] The processor can access the information and application programs stored in the memory via a transmission device to execute the following steps: The illegal fund transfer early warning model is trained as follows: Feature extraction and preprocessing of historical transaction data in the historical process; training a Bayesian classification model using the preprocessed transaction dataset, calculating the prior probabilities of positive and negative categories by the Bayesian classification model, and calculating the conditional probability of each feature under each category by the Bayesian classification model, where the positive category is used to indicate data in the transaction dataset involving illegal fund transfer, and the negative category is used to indicate data in the transaction dataset not involving illegal fund transfer; updating the model parameters of the Bayesian classification model according to the training results until the accuracy of the posterior probability of the transaction data output by the Bayesian classification model belonging to each category reaches a preset accuracy threshold, at which point the model training is considered complete, and the illegal fund transfer early warning model is obtained.

[0128] The processor can access the information and application stored in the memory via the transmission device to perform the following steps: extract features and preprocess the new transaction data based on the newly collected transaction data, and dynamically adjust the model parameters of the illegal fund transfer early warning model based on the preprocessed new transaction data.

[0129] The processor can access the information and application programs stored in the memory via the transmission device to perform the following steps: compare the calculated posterior probabilities of the positive and negative categories; select the category with the highest posterior probability value and use the selected category as the prediction result; if the posterior probability of the positive category is greater than that of the negative category, determine that the target financial transaction is suspected of illegal fund transfer; if the posterior probability of the negative category is greater than that of the positive category, determine that the target financial transaction does not involve illegal fund transfer.

[0130] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0131] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0132] Example 4

[0133] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the transaction alert method for anonymous virtual wallets provided in Embodiment 1.

[0134] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the transaction alert method for anonymous virtual wallets according to any one of the above embodiments.

[0135] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0136] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the transaction alert method for anonymous virtual wallets described in various embodiments of this application.

[0137] This application also provides a computer program product, including a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the transaction alert method for anonymous virtual wallets described in various embodiments of this application.

[0138] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0139] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0140] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0141] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0142] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0143] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0144] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A transaction alert method for anonymous virtual wallets, characterized in that, include: Collect transaction data of target financial transactions using anonymous virtual wallets, and perform feature extraction and preprocessing on the transaction data; The preprocessed transaction data is input into the illegal fund transfer early warning model, which calculates the posterior probability of the transaction data belonging to each category. Based on the calculated posterior probability, the category with the highest posterior probability is selected as the prediction result. Wherein, if the prediction result indicates that the target financial transaction involves illegal fund transfer, an alarm message for the target financial transaction is output. The illegal fund transfer early warning model is trained as follows: Feature extraction and preprocessing of historical transaction data; training a Bayesian classification model using the preprocessed transaction dataset, calculating the prior probabilities of positive and negative categories, and calculating the conditional probability of each feature in each category, where the positive category indicates data in the transaction dataset involved in illegal fund transfers, and the negative category indicates data in the transaction dataset not involved in illegal fund transfers; updating the model parameters of the Bayesian classification model based on the training results until the accuracy of the posterior probability of the transaction data belonging to each category output by the Bayesian classification model reaches a preset accuracy threshold, at which point the model training is considered complete, and the illegal fund transfer early warning model is obtained; re-extracting features and preprocessing the new transaction data based on the newly collected transaction data, and dynamically adjusting the model parameters of the illegal fund transfer early warning model based on the preprocessed new transaction data; The step of selecting the category with the highest posterior probability as the prediction result based on the calculated posterior probabilities includes: comparing the calculated posterior probabilities of the positive and negative categories; selecting the category with the largest posterior probability value and using the selected category as the prediction result; determining that the target financial transaction is suspected of illegal fund transfer if the posterior probability of the positive category is greater than that of the negative category; and determining that the target financial transaction does not involve illegal fund transfer if the posterior probability of the negative category is greater than that of the positive category.

2. The transaction early warning method according to claim 1, characterized in that, The steps of collecting transaction data for target financial transactions using anonymous virtual wallets, and extracting and preprocessing the transaction data include: The transaction data collected when consumers use the anonymous virtual wallet to conduct targeted financial transactions includes at least one of the following: transaction time period, transaction amount, wallet balance after the transaction, transaction currency, transaction type, whether cross-border transaction is involved, and transaction purpose; Extract a set of features associated with illegal fund transfer warnings from the transaction data, wherein the set of features includes: transaction time period, transaction amount, wallet balance, currency type, lending identifier, transaction type, and cross-border transaction indicator; The extracted feature set is preprocessed; The preprocessed transaction data is output as input to the illegal fund transfer early warning model.

3. The transaction early warning method according to claim 2, characterized in that, The preprocessing steps for the extracted feature set include: Anomaly detection is performed on the transaction amount features in the feature set, and abnormal amount values ​​that are negative or greater than a first preset anomaly threshold are converted to zero; or, abnormal amount values ​​that are negative or greater than the first preset anomaly threshold are truncated. Detect whether there are outliers in the wallet balance feature in the feature set, and set outliers greater than the maximum wallet limit as the maximum boundary limit value, or set outliers less than the minimum wallet limit as the minimum boundary limit value; Check whether the transaction time periods in the feature set exceed the normal range, and set the abnormal transaction time periods to a specified time value.

4. The transaction early warning method according to claim 2, characterized in that, The preprocessing steps for the extracted feature set include: For the numerical features in the feature set, the feature values ​​are standardized using a normalization formula. The numerical features include: transaction time period, transaction amount, and wallet balance. The categorical features in the feature set are labeled and encoded by converting the feature value of each feature into an integer code. The categorical features include: currency type, lending identifier, transaction type, and cross-border transaction indicator.

5. A transaction alert device for anonymous virtual wallets, used to execute the transaction alert method for anonymous virtual wallets as described in claim 1, characterized in that, include: The transaction data acquisition unit is used to collect transaction data of target financial transactions using anonymous virtual wallets, and to perform feature extraction and preprocessing on the transaction data; The data input unit is used to input the preprocessed transaction data into the illegal fund transfer early warning model, and the illegal fund transfer early warning model calculates the posterior probability of the transaction data belonging to each category; The transaction alert unit is used to select the category with the highest posterior probability as the prediction result based on the calculated posterior probability, wherein, when the prediction result indicates that the target financial transaction involves illegal fund transfer, an alert message for the target financial transaction is output.

6. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the transaction alert method for anonymous virtual wallets as described in any one of claims 1 to 4.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the transaction alert method for anonymous virtual wallets as described in any one of claims 1 to 4.

Images