Abnormal transaction detection method, device and equipment, medium and program product

Abstract

The invention discloses an abnormal transaction detection method, device and equipment, a medium and a program product, and relates to the technical field of artificial intelligence. The abnormal transaction detection method comprises the following steps: performing feature extraction on transaction data to obtain spatio-temporal feature data; performing spatial dimension feature extraction on the spatial-temporal feature data through a deformable convolutional neural network to obtain spatial feature data; performing feature extraction of a time dimension on the spatial-temporal feature data through a bidirectional gating cycle unit network to obtain time feature data; and fusing the time feature data and the space feature data, and determining whether the transaction to which the transaction data belongs is an abnormal transaction based on a feature fusion result. According to the technical scheme of the embodiment of the invention, whether the current transaction is the abnormal transaction is determined through the transaction data, so that the security of financial transactions is improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to an abnormal transaction detection method, device, equipment, medium and program product. Background Art

[0002] With the rapid development of the economy, society and emerging technologies, the number of times people use credit cards to pay has increased significantly in the field of e-commerce and online banking. However, as credit cards become a common payment tool for online shopping, the risk of credit card fraud has also emerged.

[0003] Credit card fraud refers to the act of obtaining improper benefits from credit card holders or financial institutions by fraudulent means. For example, unauthorized transactions, credit card cloning, and electronic fraud. These fraudulent acts not only lead to financial losses, but also damage customer trust and corporate reputation. Therefore, it is particularly important to detect abnormal transactions during credit card transactions. Summary of the invention

[0004] The present invention provides an abnormal transaction detection method, device, equipment, medium and program product, so as to determine whether a transaction to which the transaction data belongs is an abnormal transaction through transaction data.

[0005] According to one aspect of the present invention, there is provided a method for detecting abnormal transactions, comprising:

[0006] Extract features from transaction data to obtain spatiotemporal feature data;

[0007] Extracting features of the spatial dimension of the spatiotemporal feature data through a deformable convolutional neural network to obtain spatial feature data;

[0008] Extracting the time dimension of the spatiotemporal feature data through a bidirectional gated recurrent unit network to obtain time feature data;

[0009] The time feature data and the space feature data are fused, and based on the feature fusion result, it is determined whether the transaction to which the transaction data belongs is an abnormal transaction.

[0010] According to another aspect of the present invention, there is provided an abnormal transaction detection device, comprising:

[0011] A spatiotemporal feature extraction module is used to extract features from transaction data to obtain spatiotemporal feature data;

[0012] A spatial feature extraction module is used to extract features of the spatial dimension of the spatiotemporal feature data through a deformable convolutional neural network to obtain spatial feature data;

[0013] A time feature extraction module, used to extract the time dimension of the spatiotemporal feature data through a bidirectional gated recurrent unit network to obtain time feature data;

[0014] The abnormal transaction detection module is used to fuse the time feature data and the space feature data, and determine whether the transaction to which the transaction data belongs is an abnormal transaction based on the feature fusion result.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormal transaction detection method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormal transaction detection method described in any embodiment of the present invention when executed.

[0020] According to another aspect of the present invention, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the abnormal transaction detection method of any embodiment of the present disclosure is implemented.

[0021] The technical solution of the embodiment of the present invention obtains spatiotemporal feature data by performing feature extraction on transaction data, and then performs feature extraction of the spatial dimension on the spatiotemporal feature data through a deformable convolutional neural network to obtain spatial feature data, and performs feature extraction of the temporal dimension on the spatiotemporal feature data through a bidirectional gated recurrent unit network to obtain temporal feature data, and finally fuses the temporal feature data and the spatial feature data, and determines whether the transaction to which the transaction data belongs is an abnormal transaction based on the feature fusion result. Whether the transaction to which the transaction data belongs is an abnormal transaction can be determined through the transaction data, thereby improving the security of financial transactions.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 is a flow chart of an abnormal transaction detection method provided according to Embodiment 1 of the present invention;

[0025] Figure 2a is a flow chart of an abnormal transaction detection method provided according to Embodiment 2 of the present invention;

[0026] Figure 2b It is a model structure based on an expanded convolutional neural network provided according to the second embodiment of the present invention;

[0027] Figure 3 is a structural schematic diagram of an abnormal transaction detection device provided according to Embodiment 3 of the present invention;

[0028] Figure 4 It is a structural schematic diagram of an electronic device for implementing the abnormal transaction detection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment 1

[0032] Figure 1 A flowchart of an abnormal transaction detection method is provided for the first embodiment of the present invention. This embodiment can be applied to determine whether a transaction is abnormal by extracting transaction data features. The method can be performed by an abnormal transaction detection device, which can be implemented in the form of hardware and / or software. The abnormal transaction detection device can be configured in various general-purpose computing devices. Figure 1 As shown, the method includes:

[0033] S110: Extract features from transaction data to obtain spatiotemporal feature data.

[0034] Transaction data is used to describe the objects and transaction behaviors of financial transactions. Transaction data includes user information data and transaction behavior data. For example, transaction data includes credit card user information data, transaction time, transaction type, transaction object, and transaction amount.

[0035] Spatiotemporal feature data is used to describe the data characteristics of transaction data, which includes feature data of time dimension and space dimension.

[0036] In the embodiment of the present invention, in order to determine whether the current transaction is an abnormal transaction, the transaction data is first obtained, and the feature extraction of the transaction data is performed to obtain the spatiotemporal feature data. Specifically, the transaction data is embedded to obtain the feature vector of the transaction data, and the feature vector is input into the convolutional neural network to obtain the spatiotemporal feature data output by the convolutional neural network.

[0037] In a specific example, the acquired transaction data includes user data and transaction behavior data. The user data and transaction behavior data are concatenated to obtain a data sequence, and the data sequence is embedded to obtain a feature vector of the transaction data. Finally, the feature vector is input into a one-dimensional dilated convolutional neural network to obtain the time and space data output by the one-dimensional dilated convolutional neural network. Among them, the one-dimensional dilated convolutional neural network can control the distance between the elements in the convolution kernel by adjusting the dilation rate, thereby expanding the receptive field of the convolution kernel.

[0038] S120. Extracting features of the spatial dimension of the spatiotemporal feature data through a deformable convolutional neural network to obtain spatial feature data.

[0039] The deformable convolutional neural network is used to further optimize the feature representation based on the acquired spatiotemporal feature data to acquire the spatial dimension feature data. Exemplarily, the deformable convolutional neural network may include a convolution layer, a batch normalization layer, and an activation function.

[0040] In an embodiment of the present invention, the time-controlled feature data is further input into a deformable convolutional neural network to extract features in the spatial dimension, thereby obtaining spatial feature data. Exemplarily, the convolution layer in the deformable convolutional neural network uses a 3*3 convolution kernel and a preset expansion rate to extract local features, and further processes the extracted vector using a batch normalization layer and an activation function to obtain spatial feature data.

[0041] S130, extracting the time dimension of the spatiotemporal feature data through a bidirectional gated recurrent unit network to obtain time feature data.

[0042] Gated Recurrent Unit Networks are a special type of recurrent neural network suitable for learning long-term dependencies in sequence data.

[0043] In the embodiment of the present invention, the spatiotemporal feature data includes both time and space dimension feature data. By introducing a bidirectional gated recurrent unit network, the spatiotemporal feature data is further extracted in the time dimension to capture the long-term dependencies in the transaction data and obtain the time feature data. The bidirectional gated recurrent unit network can process the sequence data in the forward and backward directions respectively, taking into account the past transaction history and future transaction patterns.

[0044] S140: Fuse the time feature data and the space feature data, and determine whether the transaction to which the transaction data belongs is an abnormal transaction based on the feature fusion result.

[0045] In an embodiment of the present invention, the temporal feature data and the spatial feature data are fused. Specifically, additive fusion, weighted fusion, convolution fusion or a feature fusion method based on a self-attention mechanism can be used to fuse the temporal feature data and the spatial feature data to obtain a feature fusion result.

[0046] Furthermore, the feature fusion result can be input into the fully connected layer for processing to obtain the final classification result, that is, based on the output of the fully connected layer, it is determined whether the transaction to which the transaction data belongs is an abnormal transaction.

[0047] The technical solution of the embodiment of the present invention obtains spatiotemporal feature data by performing feature extraction on transaction data, and then performs feature extraction of the spatial dimension on the spatiotemporal feature data through a deformable convolutional neural network to obtain spatial feature data, and performs feature extraction of the temporal dimension on the spatiotemporal feature data through a bidirectional gated recurrent unit network to obtain temporal feature data, and finally fuses the temporal feature data and the spatial feature data, and determines whether the transaction to which the transaction data belongs is an abnormal transaction based on the feature fusion result. Whether the transaction to which the transaction data belongs is an abnormal transaction can be determined through the transaction data, thereby improving the security of financial transactions.

[0048] Embodiment 2

[0049] Figure 2a A flowchart of an abnormal transaction detection method provided in the second embodiment of the present invention. This embodiment further refines the above embodiment and provides specific steps of extracting features from transaction data to obtain spatiotemporal feature data, extracting features of the spatial dimension of the spatiotemporal feature data through a deformable convolutional neural network to obtain spatial feature data, extracting features of the temporal dimension of the spatiotemporal feature data through a bidirectional gated recurrent unit network to obtain temporal feature data, and fusing the temporal feature data and the spatial feature data, and determining whether the transaction to which the transaction data belongs is an abnormal transaction based on the feature fusion result. The technical solution of the embodiment of the present invention is applied to a model based on an expanded convolutional neural network, wherein the structure of the model based on the expanded convolutional neural network is as follows: Figure 2b As shown, it specifically includes a one-dimensional dilated convolutional neural network, a deformable convolutional neural network, a bidirectional gated recurrent unit network, a feature fusion module, a fully connected layer, an activation function, a regularization layer, and a normalized exponential function layer.

[0050] like Figure 2a As shown, the abnormal transaction detection method includes:

[0051] S210. Input the transaction data into a one-dimensional dilated convolutional neural network to obtain spatiotemporal feature data output by the one-dimensional dilated convolutional neural network; the one-dimensional dilated convolutional neural network includes a dilated one-dimensional convolutional layer, a normalization layer, an activation function, and a regularization layer.

[0052] In an embodiment of the present invention, the transaction data is input into a one-dimensional dilated convolutional neural network to learn the spatiotemporal features of the transaction data through the one-dimensional dilated convolutional neural network to obtain spatiotemporal feature data. The one-dimensional dilated convolutional neural network includes a dilated one-dimensional convolutional layer, a normalization layer, an activation function, and a regularization layer.

[0053] In a one-dimensional dilated convolution layer, for a given convolution kernel, its application on the input feature data can be expressed as:

[0054]

[0055] Among them, y i is the i-th element of the output feature data, x i+j·d is the element in the input feature data, w j is the weight of the convolution kernel, L is half the size of the convolution kernel, and d is the dilation rate.

[0056] The core idea of ​​dilated convolution is to adjust the spacing between elements in the convolution kernel by adjusting the dilation rate, thereby increasing the receptive field. One-dimensional dilated convolutional neural networks can capture a wider range of contextual information through preset different dilation rates, while keeping the number of network parameters relatively low and not bringing computational burden.

[0057] Optionally, the difference between the number of transaction data of abnormal transactions and the number of transaction data of non-abnormal transactions in the training samples of the one-dimensional expanded convolutional neural network is less than a set threshold.

[0058] In this optional embodiment, when training the one-dimensional dilated convolutional neural network, transaction data is collected in advance, but in the transaction data actually collected, the number of non-abnormal transaction data is much larger than the number of abnormal transaction data. If the collected data is directly used as training samples, the false alarm rate will be high due to the imbalance of various types of training samples. Therefore, it is necessary to adopt sampling methods such as random downsampling, nearest neighbor majority sampling, and synthetic minority oversampling to adjust the number of transaction data of abnormal transactions and non-abnormal transactions, so that the difference in the number of data of these two types of data is less than the set threshold, so as to maintain sample balance, improve the model training effect, and reduce false alarms or omissions.

[0059] In a specific example, by collecting transaction data as training samples, end-to-end training is performed on the dilated convolutional neural network model. First, credit card transaction data is collected from different data sources, and the transaction data is preprocessed by normalization, denoising, etc. Then, sampling methods such as random downsampling, nearest neighbor majority sampling, and synthetic minority oversampling are used to increase the number of minority samples and reduce the number of majority samples to achieve a balanced number of samples in each category. Then, the samples are manually labeled, for example, labeled as normal transaction data or abnormal transaction data. Furthermore, the labeled samples are divided into training sample sets, verification sample sets, and test sample sets according to the set ratio, and each sample set includes normal transaction data and abnormal transaction data.

[0060] Finally, the test sample set is used to train the dilated convolutional neural network model, and the parameters of the one-dimensional dilated convolutional neural network, deformable convolutional neural network, bidirectional gated recurrent unit network, feature fusion module, and fully connected layer in the model are adjusted. During the training process, the validation sample set is sampled to obtain model evaluation indicators, such as model accuracy, recall rate, precision, F1 score, and area under the curve (AUC). After the above evaluation indicators meet the training requirements, the training sample set is used to test the indicators of the trained model to evaluate the model effect.

[0061] S220. Perform local feature extraction on the spatiotemporal feature data through the convolution layer in the deformable convolutional neural network to obtain local features of the spatial dimension.

[0062] In the embodiment of the present invention, local features are extracted from spatiotemporal feature data through the convolution layer in the deformable convolutional neural network to obtain local features in the spatial dimension, which can further optimize the feature representation. Exemplarily, a 3*3 convolution kernel and a pre-selected expansion rate are used to extract local features and optimize the feature representation.

[0063] S230, processing the local features through a batch normalization layer and an activation function in a deformable convolutional neural network to obtain temporal feature data.

[0064] In the embodiment of the present invention, after extracting local features, the local features are processed by the batch normalization layer and the activation function in the deformable convolutional neural network to obtain temporal feature data. Specifically, the local features output by the convolution layer are normalized by the batch normalization layer, which can accelerate the model training during the training process on the one hand, and improve the model stability on the other hand. Finally, the activation function is used to introduce nonlinearity to assist the model in learning complex feature representations.

[0065] Exemplarily, the activation function is the LeakyReLU activation function, and the specific formula is as follows:

[0066] f(x)=max(0,x)+αmin(0,x)

[0067] Here, α is a constant less than 1.

[0068] S240, performing forward iterative processing on the spatiotemporal feature data through a forward gated recurrent unit in a bidirectional gated recurrent unit network to obtain a forward hidden state.

[0069] To handle the temporal dependencies in trading data, a bidirectional gated recurrent unit network is used to learn long-term dependencies in sequence data. The bidirectional gated recurrent unit processes sequence data in two directions: forward and backward. This enables the model to consider both past trading history and future trading patterns, thus providing a more comprehensive understanding of trading behavior.

[0070] In the embodiment of the present invention, firstly, the forward gated recurrent unit included in the bidirectional gated recurrent unit network performs forward iterative processing on the spatiotemporal feature data to obtain the forward hidden state. Specifically, the specific data processing method of the forward gated recurrent unit is as follows:

[0071] First, the forward update gate is used to determine the amount of information transferred from the current input and the previous state to the next state. The specific expression formula is:

[0072] Z t =σ(W z ·[h t-1 ,xt ]+b z )

[0073] Where σ is the sigmoid activation function, W z and b z is the weight matrix and bias term, [h t-1 ,x t ] is the input of the current time step of the hidden state of the previous time step and the output of the one-dimensional dilated convolutional neural network.

[0074] Furthermore, the amount of state ignored or updated is controlled by resetting the gate, and the specific formula is:

[0075] r t =σ(W r ·[h t-1 ,x t ]+b r )

[0076] Among them, W r and b r is the weight matrix and bias term of the reset gate.

[0077] Furthermore, the new activation of the current input and the reset gate output is combined through the candidate activation module. The specific expression formula is:

[0078]

[0079] Among them, tanh is the activation function, W and b are the weight matrix and bias term of the candidate activation module.

[0080] Ultimately, the output forward hidden state is an updated version of the current activations, as follows:

[0081]

[0082] S250, performing backward iterative processing on the spatiotemporal feature data through a backward gated recurrent unit in a bidirectional gated recurrent unit network to obtain a backward hidden state.

[0083] In the embodiment of the present invention, the backward gated recurrent unit included in the bidirectional gated recurrent unit network is further used to perform backward iterative processing on the spatiotemporal feature data to obtain a backward hidden state. Specifically, the specific data processing method of the backward gated recurrent unit is as follows:

[0084] First, the amount of information transferred from the current input and the previous state to the next state is determined by the backward update gate. The specific expression formula is:

[0085]

[0086] Where σ is the sigmoid activation function, and is the weight matrix and bias term, is the input of the current time step of the hidden state of the previous time step and the output of the one-dimensional dilated convolutional neural network.

[0087] Furthermore, the amount of state ignored or updated is controlled by resetting the gate, and the specific formula is:

[0088]

[0089] in, and is the weight matrix and bias term of the reset gate.

[0090] Furthermore, the new activation of the current input and the reset gate output is combined through the candidate activation module. The specific expression formula is:

[0091]

[0092] Among them, tanh is the activation function, and are the weight matrix and bias term of the candidate activation module.

[0093] Ultimately, the output forward hidden state is an updated version of the current activations, as follows:

[0094]

[0095] S260: Generate temporal feature data based on the forward hidden state and the backward hidden state.

[0096] In the embodiment of the present invention, after the forward hidden state and the backward hidden state are obtained, the temporal feature data is generated based on the forward hidden state and the backward hidden state. Specifically, the forward hidden state and the backward hidden state are subjected to information fusion to obtain the temporal feature data.

[0097] The use of bidirectional gated recurrent unit networks can enhance the model's understanding of the dynamics of the time dimension of transaction data, especially in the fraud detection process, where time dependency is a critical factor. By combining the forward hidden state and the backward hidden state, the bidirectional gated recurrent unit network can provide a more comprehensive representation of transaction behavior, thereby improving the accuracy of model predictions.

[0098] S270: Perform weighted fusion of temporal feature data and spatial feature data.

[0099] In the embodiment of the present invention, the time feature data and the space feature data are weightedly fused to obtain a feature fusion result. The weighted fusion method can realize the fusion of the time and space dimension feature data while ensuring a small amount of calculation, thereby improving the accuracy of abnormal transaction identification.

[0100] S280: Classify the feature fusion results through the fully connected layer, activation function, regularization layer, and normalized exponential function layer to determine whether the transaction to which the transaction data belongs is an abnormal transaction.

[0101] In the embodiment of the present invention, the fully connected layer acts as a classifier, nonlinearly mapping the feature fusion result into a one-dimensional feature vector, which contains all feature information and can be converted into the probability of classification into each expected category. Furthermore, the activation function is used to introduce nonlinearity through a nonlinear function to help the network learn complex patterns. The output of the activation function can reduce overfitting and improve the generalization ability of the model through the regularization layer. Finally, the final output is converted into the form of a probability distribution through a normalized exponential function layer (Softmax layer). Through the above model results, the situation of misidentifying normal transactions as fraud (abnormal transactions) and failing to identify real fraud is reduced, and the accuracy of abnormal transaction detection is improved.

[0102] The technical solution of the embodiment of the present invention extracts spatiotemporal feature data from transaction data through a one-dimensional expanded convolutional neural network. The distance between convolutional elements can be adjusted by adjusting the expansion rate to increase the receptive field and capture a wider range of contextual information. Furthermore, the feature representation in the spatial and temporal dimensions is further optimized through a deformable convolutional neural network and a bidirectional gated recurrent unit network to improve the prediction accuracy of the model.

[0103] Embodiment 3

[0104] Figure 3 This is a schematic diagram of the structure of an abnormal transaction detection device provided in Embodiment 3 of the present invention.

[0105] like Figure 3 As shown, the device comprises:

[0106] The spatiotemporal feature extraction module 310 is used to extract features from transaction data to obtain spatiotemporal feature data;

[0107] The spatial feature extraction module 320 is used to extract the features of the spatial dimension of the spatiotemporal feature data through a deformable convolutional neural network to obtain spatial feature data;

[0108] A time feature extraction module 330 is used to extract the time dimension of the spatiotemporal feature data through a bidirectional gated recurrent unit network to obtain time feature data;

[0109] The abnormal transaction detection module 340 is used to fuse the time feature data and the space feature data, and determine whether the transaction to which the transaction data belongs is an abnormal transaction based on the feature fusion result.

[0110] The technical solution of the embodiment of the present invention obtains spatiotemporal feature data by performing feature extraction on transaction data, and then performs feature extraction of the spatial dimension on the spatiotemporal feature data through a deformable convolutional neural network to obtain spatial feature data, and performs feature extraction of the temporal dimension on the spatiotemporal feature data through a bidirectional gated recurrent unit network to obtain temporal feature data, and finally fuses the temporal feature data and the spatial feature data, and determines whether the transaction to which the transaction data belongs is an abnormal transaction based on the feature fusion result. Whether the transaction to which the transaction data belongs is an abnormal transaction can be determined through the transaction data, thereby improving the security of financial transactions.

[0111] Optionally, the spatiotemporal feature extraction module 310 is specifically used for:

[0112] Inputting the transaction data into a one-dimensional dilated convolutional neural network to obtain spatiotemporal feature data output by the one-dimensional dilated convolutional neural network;

[0113] The one-dimensional dilated convolutional neural network includes a dilated one-dimensional convolutional layer, a normalization layer, an activation function and a regularization layer.

[0114] Optionally, the spatial feature extraction module 320 is specifically used for:

[0115] Performing local feature extraction on the spatiotemporal feature data through the convolution layer in the deformable convolutional neural network to obtain local features of the spatial dimension;

[0116] The local features are processed through a batch normalization layer and an activation function in the deformable convolutional neural network to obtain temporal feature data.

[0117] Optionally, the time feature extraction module 330 is specifically used for:

[0118] Performing forward iterative processing on the spatiotemporal feature data through a forward gated recurrent unit in the bidirectional gated recurrent unit network to obtain a forward hidden state;

[0119] Performing backward iterative processing on the spatiotemporal feature data through a backward gated recurrent unit in the bidirectional gated recurrent unit network to obtain a backward hidden state;

[0120] Based on the forward hidden state and the backward hidden state, temporal feature data is generated.

[0121] Optionally, the abnormal transaction detection module 340 is specifically used to:

[0122] Performing weighted fusion on the temporal feature data and the spatial feature data;

[0123] The feature fusion results are classified through the fully connected layer, activation function, regularization layer and normalized exponential function layer to determine whether the transaction to which the transaction data belongs is an abnormal transaction.

[0124] Optionally, the difference between the number of transaction data of abnormal transactions and the number of transaction data of non-abnormal transactions in the training samples of the one-dimensional expanded convolutional neural network is less than a set threshold.

[0125] The abnormal transaction detection device provided in the embodiment of the present invention can execute the abnormal transaction detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0126] In the technical solution of the present invention, the collected information is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0127] Embodiment 4

[0128] According to an embodiment of the present invention, the present invention also provides an electronic device, a readable storage medium and a computer program product.

[0129] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, applicators, blade applicators, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0130] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0131] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0132] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the abnormal transaction detection method.

[0133] In some embodiments, the abnormal transaction detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the abnormal transaction detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the abnormal transaction detection method in any other appropriate manner (e.g., by means of firmware).

[0134] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0135] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or application.

[0136] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0137] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0138] The systems and techniques described herein may be implemented in a computing system that includes a backend component (e.g., as a data applier), or a computing system that includes a middleware component (e.g., an application applier), or a computing system that includes a frontend component (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0139] A computing system may include a client and an application server. The client and the application server are generally remote from each other and usually interact through a communication network. The relationship between the client and the application server is generated by computer programs running on corresponding computers and having a client-application server relationship with each other. The application server may be a cloud application server, also known as a cloud computing application server or a cloud host, which is a host product in a cloud computing application system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS applications.

[0140] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0141] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting abnormal transactions, characterized in that: include: Extract features from transaction data to obtain spatiotemporal feature data; Extracting features of the spatial dimension of the spatiotemporal feature data through a deformable convolutional neural network to obtain spatial feature data; Extracting the time dimension of the spatiotemporal feature data through a bidirectional gated recurrent unit network to obtain time feature data; The time feature data and the space feature data are fused, and based on the feature fusion result, it is determined whether the transaction to which the transaction data belongs is an abnormal transaction.

2. The method according to claim 1, characterized in that: Extract features from transaction data to obtain spatiotemporal feature data, including: Inputting the transaction data into a one-dimensional dilated convolutional neural network to obtain spatiotemporal feature data output by the one-dimensional dilated convolutional neural network; The one-dimensional dilated convolutional neural network includes a dilated one-dimensional convolutional layer, a normalization layer, an activation function and a regularization layer.

3. The method according to claim 1, characterized in that The spatial dimension of the spatiotemporal feature data is extracted by a deformable convolutional neural network to obtain spatial feature data, including: Performing local feature extraction on the spatiotemporal feature data through the convolution layer in the deformable convolutional neural network to obtain local features of the spatial dimension; The local features are processed through a batch normalization layer and an activation function in the deformable convolutional neural network to obtain temporal feature data.

4. The method according to claim 1, characterized in that The time dimension feature extraction is performed on the spatiotemporal feature data through a bidirectional gated recurrent unit network to obtain time feature data, including: Performing forward iterative processing on the spatiotemporal feature data through a forward gated recurrent unit in the bidirectional gated recurrent unit network to obtain a forward hidden state; Performing backward iterative processing on the spatiotemporal feature data through a backward gated recurrent unit in the bidirectional gated recurrent unit network to obtain a backward hidden state; Based on the forward hidden state and the backward hidden state, temporal feature data is generated.

5. The method according to claim 1, characterized in that The time feature data and the space feature data are integrated, and based on the feature integration result, whether the transaction to which the transaction data belongs is an abnormal transaction is determined, including: Performing weighted fusion on the temporal feature data and the spatial feature data; The feature fusion results are classified through the fully connected layer, activation function, regularization layer and normalized exponential function layer to determine whether the transaction to which the transaction data belongs is an abnormal transaction.

6. The method according to claim 2, characterized in that The difference between the number of transaction data of abnormal transactions and the number of transaction data of non-abnormal transactions in the training samples of the one-dimensional expanded convolutional neural network is less than a set threshold.

7. An abnormal transaction detection device, characterized in that: include: A spatiotemporal feature extraction module is used to extract features from transaction data to obtain spatiotemporal feature data; A spatial feature extraction module is used to extract features of the spatial dimension of the spatiotemporal feature data through a deformable convolutional neural network to obtain spatial feature data; A time feature extraction module, used to extract the time dimension of the spatiotemporal feature data through a bidirectional gated recurrent unit network to obtain time feature data; The abnormal transaction detection module is used to fuse the time feature data and the space feature data, and determine whether the transaction to which the transaction data belongs is an abnormal transaction based on the feature fusion result.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormal transaction detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormal transaction detection method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the abnormal transaction detection method according to any one of claims 1 to 6.

Images