Abnormal transaction behavior detection method and device, storage medium and electronic equipment

Abstract

The invention discloses an abnormal transaction behavior detection method and device, a storage medium and electronic equipment, and relates to the technical field of artificial intelligence. The method may comprise: obtaining transaction behavior data of a target account, the transaction behavior data being used for representing a transaction record of the target account; converting the transaction behavior data to obtain feature data; a classification model is called to detect the feature data to obtain a detection result, the detection result is used for indicating whether the transaction operation corresponding to the feature data has an abnormal transaction behavior, and the classification model is obtained based on classification data set sample training; the classification data set sample at least comprises calling an anomaly detection model to detect the transaction behavior data to obtain abnormal data in the transaction behavior data, and the anomaly detection model is obtained based on training of a transaction behavior data sample. The technical problem that the efficiency of detecting the abnormal transaction behavior is low is solved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and more specifically, to a method, device, storage medium and electronic device for detecting abnormal transaction behavior. Background Art

[0002] At present, with the rapid development of information technology, network security issues are becoming increasingly prominent, and there is a need to detect abnormal transaction behaviors.

[0003] In the related art, abnormal transaction behaviors are usually detected by manual analysis. However, manual analysis requires a lot of manpower and time, and is easily affected by subjective factors, resulting in poor accuracy and consistency of detection results. In addition, manual analysis cannot monitor network traffic in real time, cannot detect and handle malicious traffic in a timely manner, is inefficient, and has a high false alarm rate, resulting in a low efficiency technical problem in detecting abnormal transaction behaviors.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a method, device, storage medium and electronic device for detecting abnormal transaction behavior, so as to at least solve the technical problem of low efficiency in detecting abnormal transaction behavior.

[0006] According to one aspect of an embodiment of the present application, a method for detecting abnormal transaction behavior is provided. The method may include: obtaining transaction behavior data of a target account, wherein the transaction behavior data is used to represent the transaction record of the target account; converting the transaction behavior data to obtain feature data; calling a classification model to detect the feature data to obtain a detection result, wherein the detection result is used to indicate whether there is an abnormal transaction behavior in the transaction operation corresponding to the feature data, the classification model is trained based on a classification data set sample, the classification data set sample at least includes calling an anomaly detection model to detect the transaction behavior data, and the abnormal data in the obtained transaction behavior data, the anomaly detection model is trained based on the transaction behavior data sample.

[0007] Optionally, the transaction behavior data is converted to obtain characteristic data, including: based on the activity of the target account, filtering out first transaction behavior data from the transaction behavior data, wherein the first transaction behavior data is used to represent the transaction behavior data of the target account whose activity is greater than an activity threshold; cleaning the first transaction behavior data to obtain second transaction behavior data; and converting the second transaction behavior data to obtain characteristic data.

[0008] Optionally, the second transaction behavior data includes discrete transaction behavior data and continuous transaction behavior data, and the second transaction behavior data is converted to obtain feature data, including: performing one-hot encoding on the discrete transaction behavior data, converting the discrete transaction behavior data into vector data, and normalizing the continuous transaction behavior data to obtain normalized continuous transaction behavior data; and determining the vector data and the normalized continuous transaction behavior data as feature data.

[0009] Optionally, the method also includes: taking abnormal data as negative sample data, and sampling normal data in the transaction behavior data to obtain positive sample data, wherein the proportion of the positive sample data is the same as the proportion of the negative sample data; and constructing a classification data set sample based on the positive sample data and the negative sample data.

[0010] Optionally, the method further includes: performing supervised learning on the initial classification model based on the classification data set samples to obtain the classification model.

[0011] Optionally, the method further includes: performing unsupervised learning on the initial anomaly detection model based on the transaction behavior data samples to obtain the anomaly detection model.

[0012] Optionally, after calling the classification model, detecting the feature data and obtaining the detection results, the method further includes: in response to the detection result indicating that the transaction operation corresponding to the feature data has abnormal transaction behavior, generating alarm information, wherein the alarm information is used to warn of the abnormal transaction behavior.

[0013] Optionally, the anomaly detection model is an isolation learning forest model.

[0014] According to another aspect of the embodiment of the present application, a device for detecting abnormal transaction behavior is also provided. The device may include: an acquisition unit, used to acquire transaction behavior data of a target account, wherein the transaction behavior data is used to represent the transaction record of the target account; a conversion unit, used to convert the transaction behavior data to obtain feature data; a detection unit, used to call a classification model, detect the feature data, and obtain a detection result, wherein the detection result is used to indicate whether there is an abnormal transaction behavior in the transaction operation corresponding to the feature data, the classification model is trained based on a classification data set sample, the classification data set sample at least includes calling an anomaly detection model to detect the transaction behavior data, and the abnormal data in the obtained transaction behavior data, and the anomaly detection model is trained based on the transaction behavior data sample.

[0015] According to another aspect of an embodiment of the present application, a non-volatile storage medium is also provided, including: the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute any method for detecting abnormal transaction behavior.

[0016] According to another aspect of an embodiment of the present invention, a processor is further provided. The processor is used to run a program, wherein the method for detecting abnormal transaction behavior in an embodiment of the present invention is executed when the program is run.

[0017] According to another aspect of an embodiment of the present application, there is also provided an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute instructions to implement any method for detecting abnormal transaction behavior.

[0018] According to another aspect of the embodiment of the present application, a computer program product is further provided. The computer program product may include a computer program, wherein the computer program is configured to execute any one of the above-mentioned abnormal transaction behavior detection methods when running.

[0019] According to another aspect of the embodiment of the present application, a computer program product is also provided. The computer program product may include a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and the computer program is configured to execute any of the above-mentioned abnormal transaction behavior detection methods when running.

[0020] According to another aspect of the embodiment of the present application, a computer program is further provided, which is configured to execute any one of the above-mentioned abnormal transaction behavior detection methods when running.

[0021] In an embodiment of the present application, transaction behavior data of a target account is obtained, wherein the transaction behavior data is used to represent the transaction record of the target account; the transaction behavior data is converted to obtain feature data; a classification model is called to detect the feature data to obtain a detection result, wherein the detection result is used to indicate whether there is an abnormal transaction behavior in the transaction operation corresponding to the feature data, and the classification model is trained based on a classification data set sample, and the classification data set sample at least includes calling an anomaly detection model to detect the transaction behavior data, and the abnormal data in the obtained transaction behavior data, and the anomaly detection model is trained based on the transaction behavior data sample, thereby achieving the technical effect of improving the efficiency of detecting abnormal transaction behaviors, and further solving the technical problem of low efficiency in detecting abnormal transaction behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0023] Figure 1It is a hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for detecting abnormal transaction behavior according to an embodiment of the present application;

[0024] Figure 2 It is a flowchart of a method for detecting abnormal transaction behavior according to an embodiment of the present application;

[0025] Figure 3 is a structural schematic diagram of a detection device for abnormal transaction behavior according to an embodiment of the present application;

[0026] Figure 4 is a schematic block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] It should be noted that the collected information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with relevant laws, regulations and standards, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions to provide users with corresponding operation entrances for users to choose to agree or refuse the results of automated decision-making; if the user chooses to refuse, the expert decision-making process will be entered.

[0030] According to an embodiment of the present application, a method embodiment of a method for detecting abnormal trading behavior is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for detecting abnormal transaction behavior is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0032] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the detection method of abnormal transaction behavior in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the detection method of abnormal transaction behavior described above is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0034] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0035] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0036] Under the above operating environment, this application provides Figure 2 The detection method of abnormal trading behavior is shown. Figure 2 is a flow chart of a method for detecting abnormal transaction behavior according to an embodiment of the present application, such as Figure 2 As shown, the method may include the following steps:

[0037] Step S202, obtaining transaction behavior data of the target account, wherein the transaction behavior data is used to represent the transaction record of the target account.

[0038] In the technical solution provided in the above step S202, the transaction behavior data of the target account can be obtained. The target account can be a user's account. The transaction behavior data can be used to represent the transaction record of the target account, for example, the transaction behavior data can be data such as payment details and payment details.

[0039] For example, 1,000 users are randomly selected, and the payment records of the sample users are queried since a certain period of time, for example, since January 1, 2023. The payment details and payment details are recorded in Table 1. Non-empty fields can be filtered out from Table 1, and key fields for modeling analysis can be further selected: transaction date (trxdate), transaction time (trxtime), timestamp (timestamp_1), payment amount (pay_amount), payment status (pay_state), payment type (pay_type), customer type (customer_type), customer number (customer_no), payment service belonging area (belong_zone), payment service belonging outlet (belong_brno). Among them, transaction date, transaction time, and timestamp belong to time information, payment amount, payment status, payment type, payment service belonging area, and payment service belonging outlet belong to payment information, and customer type and customer number belong to customer information.

[0040] Optionally, the above data can be classified into discrete data and continuous data according to type. Discrete data can at least include payment status, payment type, customer type, customer number, transaction date, transaction time, payment service region, and payment service outlet. Continuous data can at least include timestamp and payment amount.

[0041] Table 1 Fee payment details and payment details

[0042]

[0043] Step S204, converting the transaction behavior data to obtain feature data.

[0044] In the technical solution provided in the above step S204, after obtaining the transaction behavior data of the target account, the obtained transaction behavior data can be converted to obtain feature data, wherein the feature data can be data obtained after preprocessing the transaction behavior data.

[0045] Optionally, after obtaining the transaction behavior data of the target account, the transaction behavior data can be filtered, for example, the data of recently active users can be filtered out from the transaction behavior data. The filtered data can be further cleaned to remove unnecessary field information. Finally, the cleaned data can be processed into numerical data, for example, continuous data can be normalized and discrete data can be uniquely encoded to obtain feature data.

[0046] Step S206, calling the classification model to detect the feature data and obtain a detection result, wherein the detection result is used to indicate whether the transaction operation corresponding to the feature data has abnormal transaction behavior, and the classification model is trained based on the classification data set sample, and the classification data set sample at least includes calling the anomaly detection model to detect the transaction behavior data, and the abnormal data in the obtained transaction behavior data, and the anomaly detection model is trained based on the transaction behavior data sample.

[0047] In the technical solution provided in the above step S206, after converting the transaction behavior data to obtain the feature data, the classification model can be called to detect the feature data to obtain the detection result. Among them, the classification model can be a gradient boosting decision tree algorithm (eXtreme Gradient Boosting, referred to as XGBoost), XGBoost can be used to solve the prediction and classification problems of structured data, and through parallel computing and sparse matrix storage, efficient training and prediction can be achieved. XGBoost uses a variety of regularization methods, such as L1 and L2 regularization, to reduce the risk of overfitting. In addition, XGBoost also supports automatic hyperparameter adjustment and cross-validation, making model training simpler and more efficient. The detection result can be used to indicate whether there is abnormal trading behavior in the transaction operation corresponding to the feature data.

[0048] Optionally, the classification model is trained based on the classification data set samples, and the classification data set samples at least include calling the anomaly detection model to detect the transaction behavior data, and the anomaly detection model is trained based on the transaction behavior data samples. Among them, the anomaly detection model can use the isolated forest (IsolatedForest), which is a machine learning algorithm based on anomaly detection, using multiple random decision trees to classify data and find the anomaly points that are most similar to other data points. The isolation forest can handle high-dimensional data well and has strong robustness to outliers and noise; it can detect complex abnormal patterns and perform well in many application scenarios; for low-noise data, the accuracy of the isolation forest algorithm is high, so it is superior in terms of robustness of high-dimensional data, detection ability of complex patterns and high accuracy of low-noise data.

[0049] In an embodiment of the present application, transaction behavior data of a target account is obtained, wherein the transaction behavior data is used to represent the transaction record of the target account; the transaction behavior data is converted to obtain feature data; a classification model is called to detect the feature data to obtain a detection result, wherein the detection result is used to indicate whether there is an abnormal transaction behavior in the transaction operation corresponding to the feature data, and the classification model is trained based on a classification data set sample, and the classification data set sample at least includes calling an anomaly detection model to detect the transaction behavior data, and the abnormal data in the obtained transaction behavior data, and the anomaly detection model is trained based on the transaction behavior data sample, thereby achieving the technical effect of improving the efficiency of detecting abnormal transaction behaviors, and further solving the technical problem of low efficiency in detecting abnormal transaction behaviors.

[0050] The above embodiments of the present application are further described below.

[0051] In some embodiments of the present application, step S204, converting the transaction behavior data to obtain characteristic data, includes: based on the activity of the target account, filtering out first transaction behavior data from the transaction behavior data, wherein the first transaction behavior data is used to represent the transaction behavior data of the target account whose activity is greater than an activity threshold; cleaning the first transaction behavior data to obtain second transaction behavior data; converting the second transaction behavior data to obtain characteristic data.

[0052] In this embodiment, after obtaining the transaction behavior data of the target account, based on the activity of the target account, the first transaction behavior data can be screened out from the transaction behavior data. The first transaction behavior data can be further cleaned to obtain the second transaction behavior data. After obtaining the second transaction behavior data, the second transaction behavior data can be converted to obtain feature data. Among them, the activity of the target account can be measured by the payment record of the target account. The activity threshold can be a threshold pre-set according to actual conditions.

[0053] Optionally, after obtaining the transaction behavior data of the target account, since the amount of data directly querying the entire table is large, the scope can be limited according to actual needs to reduce the queried data. For example, based on the user's payment records since November, the user's identifier (ID) is screened out, and the user's payment record information since January 1, 2023 is further queried based on the user ID, so that the recently active users (i.e., the activity level is greater than the activity level threshold) can be screened out, and then the payment records of this batch of users since 2023 can be queried.

[0054] Optionally, after filtering out the first transaction behavior data from the transaction behavior data, the first transaction behavior data can be cleaned, for example, unnecessary field information can be cleared, key field information used for modeling can be retained, and payment records with a payment status of 0 (indicating payment failure) can be removed, thereby obtaining the second transaction behavior data.

[0055] This embodiment limits the query scope by data screening, avoids processing the entire table data, and significantly reduces the amount of data analyzed. Further, through data cleaning, unnecessary field information can be removed to avoid noise interference with model training, thereby improving the model training quality and prediction accuracy.

[0056] In some embodiments of the present application, the second transaction behavior data includes discrete transaction behavior data and continuous transaction behavior data, and the second transaction behavior data is converted to obtain feature data, including: performing unique hot encoding on the discrete transaction behavior data, converting the discrete transaction behavior data into vector data, and normalizing the continuous transaction behavior data to obtain normalized continuous transaction behavior data; and determining the vector data and the normalized continuous transaction behavior data as feature data.

[0057] In this embodiment, the second transaction behavior data includes discrete transaction behavior data and continuous transaction behavior data. After the first transaction behavior data is cleaned to obtain the second transaction behavior data, the discrete transaction behavior data in the second transaction behavior data can be uniquely encoded to convert the discrete transaction behavior data into vector data, and the continuous transaction behavior data in the second transaction behavior data can be normalized to obtain the normalized continuous transaction behavior data. The obtained vector data and the normalized continuous transaction behavior data can be further determined as feature data.

[0058] Optionally, after cleaning the first transaction behavior data to obtain the second transaction behavior data, the continuous data in the second transaction behavior data, such as timestamp and payment amount, can be normalized to reduce the difference between features and make the model easier to train. For the discrete data in the second transaction behavior data, such as customer type, payment type, payment service region, payment service outlet, etc., unique hot encoding is used to convert them into vector data.

[0059] This embodiment normalizes continuous data to reduce the numerical differences between features and avoid certain features dominating the model's learning process due to their large values, thereby improving the model's training efficiency and prediction accuracy. By using unique-hot encoding for discrete data, discrete data can be converted into vector data, making each category feature an independent dimension, enhancing the model's ability to understand category features and classification accuracy.

[0060] In some embodiments of the present application, the method further includes: performing unsupervised learning on the initial anomaly detection model based on the transaction behavior data sample to obtain the anomaly detection model.

[0061] In this embodiment, based on the transaction behavior data samples, the initial anomaly detection model can be subjected to unsupervised learning to obtain an anomaly detection model. That is, the anomaly detection model is used to perform unsupervised learning to mark abnormal values ​​in the data distribution.

[0062] Optionally, the preprocessed data is used as the input of Isolation Forest, and the main parameters of Isolation Forest are set as follows: the number of estimators (n_estimators) is set to 100, the number of samples sampled in each component (max_samples) is set to Auto, the outlier ratio (contamination) is set to 0.1, and the random number seed (random_state) is set to 42. The output of Isolation Forest is an outlier label, and samples with a label of -1 are considered outliers, and samples with a label of 1 are considered normal values.

[0063] This embodiment uses an anomaly detection model for unsupervised learning, which can realize automatic identification of outliers in the data, improve monitoring efficiency, reduce false alarms, enhance security, and provide valuable information for subsequent in-depth analysis and model optimization.

[0064] In some embodiments of the present application, the method also includes: taking abnormal data as negative sample data, and sampling normal data in the transaction behavior data to obtain positive sample data, wherein the proportion of the positive sample data is the same as the proportion of the negative sample data; and constructing a classification data set sample based on the positive sample data and the negative sample data.

[0065] In this embodiment, the abnormal data can be used as negative sample data, and the normal data in the transaction behavior data can be sampled to obtain positive sample data. Further based on the positive sample data and the negative sample data, a classification data set sample can be constructed. Among them, the ratio of positive sample data is the same as the ratio of negative sample data, that is, the positive-negative ratio of the classification data set is close to 1:1.

[0066] Optionally, after being processed by the isolation forest model, some negative samples can be obtained. By adding some manually constructed negative sample data and sampling from the positive samples, a classification data set with a positive-to-negative ratio close to 1:1 can be obtained.

[0067] This embodiment can significantly improve the accuracy, recall and precision of the model by constructing a classification data set with a positive-to-negative ratio close to 1:1, optimize model performance, reduce model bias, and enhance the applicability and credibility of the model in actual scenarios, thereby achieving more efficient and reliable risk identification and anomaly detection.

[0068] In some embodiments of the present application, the method further includes: performing supervised learning on the initial classification model based on the classification data set samples to obtain the classification model.

[0069] In this embodiment, supervised learning can be performed on the initial classification model based on the classification data set samples to obtain the classification model. That is, supervised learning is performed using the classification model to predict unauthorized behavior based on the feature data.

[0070] Optionally, the main parameters of XGBoost are set as the number of decision trees (n_estimators) is set to 100, the maximum depth (max_depth) is set to 6, the learning rate (learning_rate) is set to 0.3, and the random number seed (seed) is set to 42. After the classification data set is trained by XGBoost, the accuracy on the validation set can reach more than 90%.

[0071] This embodiment uses a classification model based on feature data for supervised learning, which can effectively predict unauthorized behavior, improve the accuracy and efficiency of monitoring, reduce false positives and false negatives, and provide data support for security decisions.

[0072] In some embodiments of the present application, after calling the classification model, detecting the feature data, and obtaining the detection results, the method further includes: in response to the detection result that the transaction operation corresponding to the feature data has abnormal transaction behavior, generating an alarm message, wherein the alarm information is used to warn of the abnormal transaction behavior.

[0073] In this embodiment, after the classification model is called to detect the feature data and obtain the detection result, if the detection result is that the transaction operation corresponding to the feature data has abnormal transaction behavior, an alarm information is generated. The alarm information can be used to warn of abnormal transaction behavior.

[0074] This embodiment can improve the monitoring and response capabilities for abnormal transaction behaviors, enhance security, reduce losses, optimize resource allocation, promote continuous improvement, and enhance user trust by issuing alerts for abnormal transaction behaviors.

[0075] In an embodiment of the present application, transaction behavior data of a target account is obtained, wherein the transaction behavior data is used to represent the transaction record of the target account; the transaction behavior data is converted to obtain feature data; a classification model is called to detect the feature data to obtain a detection result, wherein the detection result is used to indicate whether there is an abnormal transaction behavior in the transaction operation corresponding to the feature data, and the classification model is trained based on a classification data set sample, and the classification data set sample at least includes calling an anomaly detection model to detect the transaction behavior data, and the abnormal data in the obtained transaction behavior data, and the anomaly detection model is trained based on the transaction behavior data sample, thereby achieving the technical effect of improving the efficiency of detecting abnormal transaction behaviors, and further solving the technical problem of low efficiency in detecting abnormal transaction behaviors.

[0076] In order to facilitate those skilled in the art to better understand the technical solution of the present application, a specific embodiment is now described.

[0077] At present, with the rapid development of information technology, network security issues are becoming increasingly prominent. Application risk monitoring mainly relies on manual analysis, which has problems such as low efficiency and high false alarm rate. In the existing technology, application risk monitoring mainly relies on manual analysis, which has problems such as low efficiency and high false alarm rate. Manual analysis requires a lot of manpower and time, and is easily affected by subjective factors, resulting in poor accuracy and consistency of monitoring results. In addition, manual analysis cannot monitor network traffic in real time, and cannot detect and handle malicious traffic in a timely manner.

[0078] Machine learning algorithms have powerful capabilities in data analysis and pattern recognition, and can effectively solve the above problems. In order to effectively deal with application risks, this application proposes an active monitoring method for application risks based on machine learning, which uses machine learning algorithms to identify malicious traffic characteristics and implement active monitoring and alarm of unauthorized transactions.

[0079] In this embodiment, malicious traffic features are identified through a machine learning algorithm to achieve active monitoring and alarming of unauthorized transactions. The powerful capabilities of machine learning algorithms can be used to quickly and accurately identify malicious traffic features and improve monitoring efficiency. The training and optimization of machine learning algorithms can improve recognition accuracy and reduce false alarm rates. In addition, the automation characteristics of machine learning algorithms can perform automatic monitoring, identification, and alarming without manual intervention, reducing the workload. By increasing data sets and optimizing algorithms, monitoring capabilities and performance can be continuously improved to achieve scalability. That is, the present application identifies malicious traffic features through a machine learning algorithm to achieve active monitoring and alarming of unauthorized transactions. Through efficient, accurate, automated, and scalable features, application risks can be effectively addressed and network security levels can be improved.

[0080] For horizontal unauthorized behaviors of different accounts on a single device, based on algorithms such as Isolation Forest and XGBoost, the transaction details data are cleaned, features are extracted and labeled, sample sets are made, and model parameters are fine-tuned to form an abnormal unauthorized behavior detection model, thereby solving the problem that traditional security equipment cannot monitor logical loopholes such as unauthorized behaviors.

[0081] First, we obtain data, randomly select 1,000 users, and query the payment records of sample users since January 1, 2023. Table 1 records the payment details and payment details. We can filter out non-empty fields from Table 1 and further select key fields for modeling analysis: transaction date, transaction time, timestamp, payment amount, payment status, payment type, customer type, customer number, payment business region, payment business outlet. Among them, transaction date, transaction time, and timestamp belong to time information, payment amount, payment status, payment type, payment business region, and payment business outlet belong to payment information, and customer type and customer number belong to customer information.

[0082] The above data can be classified into discrete data and continuous data according to type. Among them, discrete data can at least include payment status, payment type, customer type, customer number, transaction date, transaction time, payment service attribution area, payment service attribution outlet. Continuous data can at least include timestamp and payment amount.

[0083] Secondly, preprocess the data. Since the amount of data in directly querying the entire table is large, you can limit the scope according to actual needs to reduce the queried data. For example, based on the user's payment record since November, filter out the user's ID, and further query the user's payment record information since January 1, 2023 based on the user ID, so that you can filter out the most recently active users, and then query the payment records of this batch of users since 2023. After filtering the data, you can clean the filtered data, for example, you can clear unnecessary field information, retain the key field information used for modeling, and remove payment records with a payment status of 0 (indicating payment failure).

[0084] After cleaning the data, the cleaned continuous data, such as timestamps and payment amounts, can be normalized to reduce the differences between features and make the model easier to train. For cleaned discrete data, such as customer type, payment type, payment service region, payment service outlet, etc., one-hot encoding is used to convert them into vector data.

[0085] Finally, the algorithm is selected. The algorithm mainly consists of two parts. The first part is to use the anomaly detection model for unsupervised learning to mark the abnormal values ​​in the data distribution. The second part is to use the classification model for supervised learning to predict unauthorized behavior based on feature data.

[0086] The algorithm selected for anomaly detection is Isolation Forest. Isolation Forest is a machine learning algorithm based on anomaly detection that uses multiple random decision trees to classify data and find the anomalies that are most similar to other data points. The main advantages of the Isolation Forest algorithm include: robustness to high-dimensional data. The Isolation Forest algorithm can handle high-dimensional data well and has strong robustness to outliers and noise; the ability to detect complex patterns. The Isolation Forest algorithm can detect complex abnormal patterns, making it perform well in many application scenarios; high accuracy for low-noise data. For low-noise data, the accuracy of the Isolation Forest algorithm is high.

[0087] The classification model selected is XGBoost, which is an efficient gradient boosting decision tree algorithm, mainly used to solve the prediction and classification problems of structured data. Efficient training and prediction are achieved through parallel computing and sparse matrix storage. XGBoost uses a variety of regularization methods, such as L1 and L2 regularization, to reduce the risk of overfitting. In addition, XGBoost also supports automatic hyperparameter adjustment and cross-validation, making model training simpler and more efficient.

[0088] The preprocessed data is used as the input of the isolation forest. The main parameters of the isolation forest are set as follows: the estimator (n_estimators) is set to 100, the number of samples sampled in each component (max_samples) is set to Auto, the outlier ratio (contamination) is set to 0.1, and the random number seed (random_state) is set to 42. The output of the isolation forest is an outlier label. Samples with a label of -1 are considered outliers, and samples with a label of 1 are considered normal values. After being processed by the isolation forest model, some negative samples can be obtained. Add some manually constructed negative sample data, and then sample from the positive samples to obtain a classification data set with a positive-negative ratio close to 1:1. Then the classification model is constructed. The model selected here is XGBoost. The main parameters of XGBoost are set as follows: the number of decision trees (n_estimators) is set to 100, the maximum depth (max_depth) is set to 6, the learning rate (learning_rate) is set to 0.3, and the random number seed (seed) is set to 42. After the classification data set is trained with XGBoost, the accuracy on the validation set can reach more than 90%.

[0089] Through the use of machine learning algorithms, malicious traffic characteristics can be quickly and accurately identified, improving monitoring efficiency. Compared with traditional manual analysis, machine learning algorithms can process large amounts of data and extract useful information from them, making the monitoring process more efficient and reducing manpower and time costs. Through the training and optimization of machine learning algorithms, the recognition accuracy can be improved and the false alarm rate can be reduced. Machine learning algorithms can gradually improve their own accuracy and reliability through the analysis and learning of large amounts of data, making the monitoring results more accurate and reducing misjudgments and missed judgments.

[0090] Through the use of machine learning algorithms, automatic monitoring, identification and alarming can be achieved without manual intervention, which reduces the workload of individual staff and improves work efficiency. At the same time, automated monitoring also makes the monitoring results more consistent and reliable. By increasing data sets and optimizing algorithms, the monitoring capabilities and performance can be continuously improved. The flexibility and scalability of machine learning algorithms enable the device to adapt to the ever-changing application risks and network environments, so that it can continuously provide effective monitoring and alarm services.

[0091] In an embodiment of the present application, transaction behavior data of a target account is obtained, wherein the transaction behavior data is used to represent the transaction record of the target account; the transaction behavior data is converted to obtain feature data; a classification model is called to detect the feature data to obtain a detection result, wherein the detection result is used to indicate whether there is an abnormal transaction behavior in the transaction operation corresponding to the feature data, and the classification model is trained based on a classification data set sample, and the classification data set sample at least includes calling an anomaly detection model to detect the transaction behavior data, and the abnormal data in the obtained transaction behavior data, and the anomaly detection model is trained based on the transaction behavior data sample, thereby achieving the technical effect of improving the efficiency of detecting abnormal transaction behaviors, and further solving the technical problem of low efficiency in detecting abnormal transaction behaviors.

[0092] The embodiment of the present application also provides a detection device for abnormal transaction behavior. It should be noted that the detection device for abnormal transaction behavior of this embodiment can be used to execute the detection method for abnormal transaction behavior of the embodiment of the present invention.

[0093] Figure 3 is a structural schematic diagram of a detection device for abnormal transaction behavior according to an embodiment of the present application, such as Figure 3 As shown, the abnormal transaction behavior detection device 300 may include: an acquisition unit 302 , a conversion unit 304 and a detection unit 306 .

[0094] The acquisition unit 302 is used to acquire transaction behavior data of the target account, wherein the transaction behavior data is used to represent the transaction record of the target account.

[0095] The conversion unit 304 is used to convert the transaction behavior data to obtain feature data.

[0096] The detection unit 306 is used to call the classification model to detect the feature data and obtain a detection result, wherein the detection result is used to indicate whether the transaction operation corresponding to the feature data has abnormal transaction behavior. The classification model is trained based on the classification data set sample. The classification data set sample at least includes calling the anomaly detection model to detect the transaction behavior data, and the abnormal data in the obtained transaction behavior data. The anomaly detection model is trained based on the transaction behavior data sample.

[0097] Optionally, the conversion unit 304 includes: a screening module, used to screen out first transaction behavior data from the transaction behavior data based on the activity of the target account, wherein the first transaction behavior data is used to represent the transaction behavior data of the target account whose activity is greater than an activity threshold; a cleaning module, used to clean the first transaction behavior data to obtain second transaction behavior data; and a conversion module, used to convert the second transaction behavior data to obtain feature data.

[0098] Optionally, the conversion module includes: a processing submodule, used to perform one-hot encoding on discrete transaction behavior data, convert the discrete transaction behavior data into vector data, and normalize the continuous transaction behavior data to obtain normalized continuous transaction behavior data; a determination submodule, used to determine the vector data and the normalized continuous transaction behavior data as feature data.

[0099] Optionally, the device also includes: a first learning unit, used to perform unsupervised learning on the initial anomaly detection model based on the transaction behavior data sample to obtain the anomaly detection model.

[0100] Optionally, the method also includes: a sampling unit, used to take abnormal data as negative sample data, and sample normal data in the transaction behavior data to obtain positive sample data, wherein the proportion of the positive sample data is the same as the proportion of the negative sample data; a construction unit, used to construct a classification data set sample based on the positive sample data and the negative sample data.

[0101] Optionally, the method further includes: a second learning unit, used to perform supervised learning on the initial classification model based on the classification data set samples to obtain the classification model.

[0102] Optionally, after calling the classification model, detecting the feature data and obtaining the detection result, the device also includes: a generation unit, which is used to generate alarm information in response to the detection result that the transaction operation corresponding to the feature data has abnormal transaction behavior, wherein the alarm information is used to warn of abnormal transaction behavior.

[0103] Optionally, the anomaly detection model is an isolation learning forest model.

[0104] In the device, the transaction behavior data of the target account is acquired by the acquisition unit 302, wherein the transaction behavior data is used to represent the transaction record of the target account. The transaction behavior data is converted by the conversion unit 304 to obtain feature data. The classification model is called by the detection unit 306 to detect the feature data to obtain a detection result, wherein the detection result is used to indicate whether there is an abnormal transaction behavior in the transaction operation corresponding to the feature data. The classification model is trained based on the classification data set sample, and the classification data set sample at least includes calling the anomaly detection model to detect the transaction behavior data, and the abnormal data in the obtained transaction behavior data is obtained. The anomaly detection model is trained based on the transaction behavior data sample, thereby achieving the technical effect of improving the efficiency of detecting abnormal transaction behaviors, thereby solving the technical problem of low efficiency in detecting abnormal transaction behaviors.

[0105] It should be noted that the acquisition unit 302, the conversion unit 304 and the detection unit 306 correspond to steps S202 to S206, and the three modules and the corresponding steps implement the same examples and application scenarios, but are not limited to the contents disclosed in the above embodiment 1. It should be noted that the above modules or units may be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n), and the above modules may also be part of the device and may be run in the computer terminal 10 provided in the embodiment.

[0106] An embodiment of the present application may provide an electronic device, Figure 4 is a structural block diagram of an electronic device according to an embodiment of the present application, such as Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (only one is shown) processor 402, memory 404, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0107] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0108] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: obtain the transaction behavior data of the target account, wherein the transaction behavior data is used to represent the transaction record of the target account; convert the transaction behavior data to obtain feature data; call the classification model to detect the feature data to obtain the detection result, wherein the detection result is used to indicate whether there is abnormal transaction behavior in the transaction operation corresponding to the feature data, the classification model is trained based on the classification data set sample, the classification data set sample at least includes calling the anomaly detection model to detect the transaction behavior data, and the abnormal data in the obtained transaction behavior data, the anomaly detection model is trained based on the transaction behavior data sample.

[0109] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: based on the activity of the target account, filter out first transaction behavior data from the transaction behavior data, wherein the first transaction behavior data is used to represent the transaction behavior data of the target account whose activity is greater than the activity threshold; clean the first transaction behavior data to obtain second transaction behavior data; and convert the second transaction behavior data to obtain feature data.

[0110] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: perform one-hot encoding on discrete transaction behavior data, convert the discrete transaction behavior data into vector data, and normalize the continuous transaction behavior data to obtain normalized continuous transaction behavior data; determine the vector data and the normalized continuous transaction behavior data as feature data.

[0111] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: taking the abnormal data as negative sample data, and sampling the normal data in the transaction behavior data to obtain positive sample data, wherein the proportion of the positive sample data is the same as the proportion of the negative sample data; and constructing a classification data set sample based on the positive sample data and the negative sample data.

[0112] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: based on the classification data set samples, supervised learning is performed on the initial classification model to obtain a classification model.

[0113] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: based on the transaction behavior data samples, unsupervised learning is performed on the initial anomaly detection model to obtain an anomaly detection model.

[0114] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: in response to the detection result that the transaction operation corresponding to the characteristic data has abnormal transaction behavior, generate an alarm message, wherein the alarm information is used to warn of the abnormal transaction behavior.

[0115] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: the anomaly detection model is an isolated learning forest model.

[0116] It can be understood by those skilled in the art that Figure 4 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Figure 4 The structure of the electronic device is not limited. Figure 4 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 4 Different configurations are shown.

[0117] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0118] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the abnormal transaction behavior detection method provided in the first embodiment.

[0119] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0120] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the program steps of the method for detecting abnormal transaction behavior.

[0121] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0122] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0123] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0124] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0125] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0126] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0127] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting abnormal transaction behavior, characterized in that: include: Acquire transaction behavior data of a target account, wherein the transaction behavior data is used to represent a transaction record of the target account; Converting the transaction behavior data to obtain feature data; Calling a classification model to detect the feature data and obtain a detection result, wherein the detection result is used to indicate whether there is abnormal transaction behavior in the transaction operation corresponding to the feature data, and the classification model is trained based on a classification data set sample, and the classification data set sample at least includes calling an anomaly detection model to detect the transaction behavior data, and obtaining abnormal data in the transaction behavior data, and the anomaly detection model is trained based on the transaction behavior data sample.

2. The method according to claim 1, characterized in that The transaction behavior data is converted to obtain feature data, including: Based on the activity of the target account, first transaction behavior data is filtered out from the transaction behavior data, wherein the first transaction behavior data is used to represent the transaction behavior data of the target account whose activity is greater than an activity threshold; Cleaning the first transaction behavior data to obtain second transaction behavior data; The second transaction behavior data is converted to obtain the characteristic data.

3. The method according to claim 2, characterized in that The second transaction behavior data includes discrete transaction behavior data and continuous transaction behavior data. The second transaction behavior data is converted to obtain the feature data, including: Performing one-hot encoding on the discrete transaction behavior data, converting the discrete transaction behavior data into vector data, and performing normalization processing on the continuous transaction behavior data to obtain normalized continuous transaction behavior data; The vector data and the normalized continuous transaction behavior data are determined as the feature data.

4. The method according to claim 1, characterized in that: The method further comprises: The abnormal data is used as negative sample data, and normal data in the transaction behavior data is sampled to obtain positive sample data, wherein the proportion of the positive sample data is the same as the proportion of the negative sample data; The classification data set sample is constructed based on the positive sample data and the negative sample data.

5. The method according to claim 4, characterized in that The method further comprises: Based on the classification data set samples, supervised learning is performed on the initial classification model to obtain the classification model.

6. The method according to claim 1, characterized in that The method further comprises: Based on the transaction behavior data samples, unsupervised learning is performed on the initial anomaly detection model to obtain the anomaly detection model.

7. The method according to claim 1, characterized in that After calling the classification model to detect the feature data and obtaining the detection result, the method further includes: In response to the detection result indicating that the transaction operation corresponding to the characteristic data has abnormal transaction behavior, an alarm message is generated, wherein the alarm message is used to warn of the abnormal transaction behavior.

8. The method according to claim 1, characterized in that The anomaly detection model is an isolation learning forest model.

9. A device for detecting abnormal transaction behavior, characterized in that: include: an acquisition unit, configured to acquire transaction behavior data of a target account, wherein the transaction behavior data is used to represent a transaction record of the target account; A conversion unit, used to convert the transaction behavior data to obtain feature data; A detection unit is used to call a classification model to detect the feature data and obtain a detection result, wherein the detection result is used to indicate whether there is an abnormal transaction behavior in the transaction operation corresponding to the feature data, the classification model is trained based on a classification data set sample, and the classification data set sample at least includes calling an anomaly detection model to detect the transaction behavior data, and the abnormal data in the transaction behavior data is obtained, and the anomaly detection model is trained based on the transaction behavior data sample.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is executed, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 8.

11. An electronic device, characterized in that: include: A memory storing an executable program; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 8 when running.

12. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images