Mobile payment real-time supervision system based on behavior analysis algorithm

Abstract

The invention discloses a mobile payment real-time supervision system based on a behavior analysis algorithm, and the system specifically comprises a payment data collection module, a payment behavior model training module, a payment behavior data analysis module, a risk assessment module, and a real-time supervision module. According to the invention, through the risk assessment module, risk assessment can be conveniently carried out on the mobile payment transaction process of the user, and abnormal conditions in the abnormal transaction characteristics can be calculated, so that the severity of the transaction risk can be conveniently and rapidly judged according to the number of the abnormal conditions in the abnormal transaction characteristics; the real-time supervision module can perform supervision and early warning on abnormal conditions existing in the transaction process by combining a risk early warning mechanism according to the risk assessment result, and can perform corresponding monitoring processing of different degrees according to the severity of the transaction risk; therefore, transaction risks with different risk severity degrees can be effectively and correspondingly processed, and the security and compliance of mobile payment are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of mobile payment, and in particular to a real-time supervision system for mobile payment based on a behavior analysis algorithm. Background Art

[0002] Mobile payment is a service mode that allows users to use their mobile terminals to pay for the goods or services they consume. An organization or individual directly or indirectly sends payment instructions to a bank or financial institution through a mobile device, the Internet, or proximity sensing to generate monetary payment and fund transfer, thereby realizing the mobile payment function. With the rapid development of mobile payment technology, mobile payment has become an indispensable part of people's daily life, and mobile payment also faces many security risks. Therefore, in the process of mobile payment transactions, it is necessary to effectively supervise the user's mobile payment process. A Chinese patent discloses a mobile security payment method, device, and system, with application number 201611031798.1. The patent determines whether to continue the mobile payment behavior of the first terminal by the second terminal, thereby achieving the purpose of supervising the mobile payment behavior of the first terminal through the second terminal;

[0003] Currently, in the process of user mobile payment, it is impossible to obtain the transaction behavior information of the user during the transaction process, resulting in the inability to effectively judge the abnormal situations in the transaction process based on the user's transaction behavior information. In addition, incomplete acquisition of user transaction data information will also affect the accuracy of the judgment of abnormal situations in the transaction process. Summary of the invention

[0004] The present invention provides a real-time supervision system for mobile payment based on a behavior analysis algorithm, which can effectively solve the problem raised in the above background technology that, during the current user mobile payment process, the transaction behavior information existing in the user transaction process cannot be obtained, resulting in the inability to effectively judge the abnormal situation in the transaction process based on the user transaction behavior information, and the incomplete acquisition of user transaction data information will also affect the accuracy of the judgment of abnormal situation in the transaction process.

[0005] To achieve the above-mentioned objectives, the present invention provides the following technical solutions: a real-time supervision system for mobile payment based on a behavior analysis algorithm, which uses behavior analysis technology to supervise abnormal behaviors in the mobile payment process, and specifically includes a payment data collection module, a payment behavior model training module, a payment behavior data analysis module, a risk assessment module and a real-time supervision module.

[0006] According to the above technical solution, the payment data collection module is used to collect and integrate the mobile payment data information of users from different sources in the mobile payment system. The data collection module specifically includes a data collection unit, a data processing unit and a data storage unit.

[0007] According to the above technical solution, the data collection unit collects data information from multiple sources, and the collected data information specifically includes user payment behavior, transaction records and geographic location;

[0008] The user payment behavior specifically includes payment frequency, payment amount range and payment time;

[0009] The transaction record specifically includes user information, transaction object, transaction type and transaction device, wherein the user information specifically includes the name, account and mobile phone number of the mobile payment user;

[0010] The geographical location specifically includes the transaction location and the IP address of the transaction device.

[0011] According to the above technical solution, the data processing unit processes the collected data information, including data cleaning and format conversion, removing duplicate data, filling missing data information and correcting erroneous data information through data cleaning, and standardizing the data information collected from different sources through format conversion, so that the data information from different sources can be subsequently compared and analyzed;

[0012] The transaction records in the data processing unit will extract the payment frequency and payment amount fluctuation characteristics based on the user's historical behavior data. After collecting the data, the feature extraction formula

[0013]

[0014] Preprocess the data:

[0015] Where X represents the collected original data;

[0016] μ and σ are the mean and standard deviation of the original data, respectively, which are used for normalization;

[0017] Then, based on the time series data of payment behavior, the behavior modeling formula is adopted:

[0018]

[0019] Where P(t) represents the temporal dynamic characteristics of the behavior;

[0020] w i Indicates the weight of each feature;

[0021] Among them, w is considered to have the greatest impact on risk. i =0.5;

[0022] For features with an impact of 20% or less, w i =0.1;

[0023] f(xi , t) represents the feature x i The value at time t;

[0024] where x i is the transaction amount, f(x i , t) = 1000, unit: yuan;

[0025] Feature extraction methods include:

[0026]

[0027] Where V 平 The volatility of the amount paid to users;

[0028] n is the total number of transactions;

[0029] t i is the amount of the i-th transaction;

[0030] t 平 is the average of all transaction amounts;

[0031] If the time interval between two payments is abnormally less than 1 minute, an abnormal alarm may be triggered;

[0032] At the same time, the transaction amount threshold, if the transaction amount exceeds the threshold, it is marked as abnormal:

[0033] The evaluated judgment is calculated by the above formula.

[0034] According to the above technical solution, the data storage unit stores and manages the data information processed by the data processing unit by constructing an internal database, and stores the data information while performing data backup and data recovery functions of the internal database;

[0035] When storing user payment data information, the data storage unit establishes different storage sub-units according to the timestamp of the payment data information, thereby realizing separate and differentiated storage of the payment data information according to the time axis.

[0036] According to the above technical solution, the payment behavior model training module refers to constructing a payment behavior analysis model using a machine learning algorithm, and the machine learning algorithm is a neural network algorithm;

[0037] When establishing a payment behavior model, it is necessary to input a large amount of historical transaction record information in the mobile payment process. Based on the input of historical data information, the model parameters are continuously adjusted and the performance of the payment behavior analysis model is optimized in a training and learning manner, so that the established payment behavior model can identify the normal transaction characteristics of users in the payment process based on the collected user payment data information, and distinguish abnormal transaction characteristics;

[0038] In payment behavior, the transaction amount, frequency, and transaction time change over time. By combining weighted average and standard deviation, the threshold is dynamically adjusted to better cope with different transaction scenarios. The formula is as follows:

[0039] Z(t) is the normalized value of the tth transaction;

[0040]

[0041] X(t) is the characteristic value of the tth transaction, which is the transaction amount;

[0042] For example, X(t) could be the amount or frequency of a transaction, depending on what kind of anomaly you want to detect;

[0043] μ(t) is the sliding average of the t-th transaction data;

[0044] σ(t) is the sliding standard deviation of the t-th transaction data. The sliding standard deviation is used to measure the current

[0045]

[0046] The volatility of data and historical data, that is, the fluctuation range of the feature value in the past period of time;

[0047] When payment behavior involves time series data, we can combine time series characteristics and weights to detect anomalies and use the following formula to calculate the abnormal transaction score:

[0048]

[0049] S(t) is the anomaly score of the tth transaction;

[0050] X(t) is the characteristic value of the t-th transaction, which is the amount. The observed value of the current transaction is used directly. For example, the transaction amount is the amount of the transaction.

[0051] It is the predicted value of the ith feature based on the tth transaction history. Models are usually used to predict the normal range of each feature, which helps to identify transactions that deviate from the normal pattern and can be predicted through historical data.

[0052] σ(t, i) is an estimate of the historical volatility of feature i, which reflects the volatility of the feature in historical transactions. The larger the standard deviation, the more volatile the feature is. Therefore, when calculating the anomaly score, features with greater volatility contribute more to the final score. The standard deviation is calculated using historical data.

[0053] W(t, i) is the time-series weighting factor of feature i, which can be adjusted dynamically according to the time of transaction, user activity frequency, etc. The standard deviation is calculated by historical data, and the standard deviation of the past n n transactions can be calculated using a sliding window;

[0054] Combining the timing information and historical volatility of each feature, it is possible to comprehensively consider multi-dimensional factors to assess whether a transaction is abnormal;

[0055] Sliding window size: Usually, data from a period of time in the past is selected as the basis for calculating the standard deviation and the average value. The window size n can be 7 days, 30 days, etc., depending on business needs and data characteristics.

[0056] According to the above technical solution, the payment behavior data analysis module is used to identify and analyze various payment behavior data information collected in the mobile payment system, specifically judging and analyzing the current user's payment behavior through the trained payment behavior model;

[0057] By inputting the collected user payment behavior data information into the payment behavior model, the payment behavior data information is judged and analyzed through the payment behavior model, so as to identify the normal transaction characteristics and abnormal transaction characteristics of users in the mobile payment process, and focus on marking the abnormal transaction characteristics.

[0058] According to the above technical solution, the abnormal transaction characteristics specifically include abnormally high frequency of quick payments, unusual transaction payment patterns, abnormal payment activities of newly registered users, excessively long stay time on the payment page, and multiple payments under the same IP address.

[0059] According to the above technical solution, the risk assessment module performs risk assessment on the user's mobile payment transaction process based on the analysis and identification results of the payment behavior model. In the process of risk assessment, the risk of the payment transaction is mainly scored by calculating the risk. When calculating the specific risk, the abnormal situations existing in the abnormal transaction characteristics are judged, and the severity of the transaction risk is judged according to the number of abnormal situations.

[0060] According to the five abnormal transaction characteristics: abnormally high frequency of fast payments, unusual transaction payment patterns, abnormal payment activities of newly registered users, too long stay on the payment page and multiple payments under the same IP address, the severity is divided into five levels according to the number of abnormal transaction characteristics: A, B, C, D, and E. Level A means that there is only one abnormal situation among the five abnormal transaction characteristics, level B means that there are two abnormal situations among the five abnormal transaction characteristics, level C means that there are three abnormal situations among the five abnormal transaction characteristics, level D means that there are four abnormal situations among the five abnormal transaction characteristics, and level E means that all abnormal situations exist among the five abnormal transaction characteristics.

[0061] According to the above technical solution, the real-time supervision module receives the risk assessment result sent by the risk assessment module, and when it is determined that the user has an abnormal transaction during the payment transaction process based on the risk assessment result and the preset risk warning mechanism, the regulatory department is notified of the abnormal transaction process, and the abnormal transaction is intercepted to interrupt the payment transaction of the abnormal user;

[0062] When handling abnormal transactions, regulatory authorities will monitor and handle them to varying degrees based on the severity of the transaction risk, as follows:

[0063] Abnormal trading behaviors of users with low risk of grade A and grade B will be reminded by warning emails, while abnormal trading behaviors of users with high risk of grade C, grade D and grade E will be monitored more strictly, including suspending account transactions of abnormal users and limiting transaction amounts.

[0064] Compared with the prior art, the present invention has the following beneficial effects:

[0065] 1. The risk assessment module facilitates risk assessment of the user's mobile payment transaction process, and calculates the abnormal situations in the abnormal transaction characteristics, so as to quickly judge the severity of the transaction risk according to the number of abnormal situations in the abnormal transaction characteristics. By dividing the severity of the risk, it is convenient to intuitively respond to the transaction risk, and it is also convenient to respond to different degrees of treatment measures in a timely manner according to the severity in the subsequent supervision process;

[0066] The real-time supervision module can supervise and warn of abnormal situations in the transaction process based on the risk assessment results and the risk warning mechanism, and can carry out different levels of monitoring and processing according to the severity of the transaction risk, so as to ensure that transaction risks of different risk severities can be effectively handled accordingly, thereby improving the security and compliance of mobile payments.

[0067] 2. The payment data collection module can collect, process and analyze transaction data information during the user's mobile payment process to ensure the accuracy and comprehensiveness of data collection and accurately judge abnormal transaction behaviors;

[0068] The payment behavior model training module and the payment behavior data analysis module can identify and judge the collected user payment data information by establishing a payment behavior model, thereby identifying and marking the abnormal transaction characteristics of the user during the payment process based on the user's payment behavior information, facilitating the monitoring of abnormal behavior in the mobile payment process, so that regulatory measures can be taken quickly to protect the security of mobile payments. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0070] In the attached picture:

[0071] Figure 1 It is a structural block diagram of the real-time monitoring system of the present invention. DETAILED DESCRIPTION

[0072] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0073] Example: Figure 1 As shown, the present invention provides a technical solution, a real-time supervision system for mobile payment based on a behavior analysis algorithm, which uses behavior analysis technology to supervise abnormal behaviors in the mobile payment process, and specifically includes a payment data collection module, a payment behavior model training module, a payment behavior data analysis module, a risk assessment module and a real-time supervision module.

[0074] Based on the above technical solution, the payment data collection module is used to collect and integrate the mobile payment data information of users from different sources in the mobile payment system. The data collection module specifically includes a data collection unit, a data processing unit and a data storage unit.

[0075] Based on the above technical solution, the data collection unit collects data information from multiple sources, and the collected data information specifically includes user payment behavior, transaction records and geographic location;

[0076] User payment behavior specifically includes payment frequency, payment amount range, and payment time;

[0077] Transaction records specifically include user information, transaction object, transaction type and transaction device, where user information specifically includes the name, account number and mobile phone number of the mobile payment user;

[0078] The geographic location specifically includes the transaction location and the IP address of the transaction device.

[0079] Based on the above technical solution, the data processing unit processes the collected data information, including data cleaning and format conversion. Through data cleaning, duplicate data is removed, missing data information is filled, and erroneous data information is corrected. Through format conversion, data information collected from different sources can be standardized, so that data information from different sources can be subsequently compared and analyzed.

[0080] The transaction records in the data processing unit will extract the payment frequency and payment amount fluctuation characteristics based on the user's historical behavior data. After collecting the data, the feature extraction formula

[0081]

[0082] Preprocess the data:

[0083] Where X represents the collected original data;

[0084] μ and σ are the mean and standard deviation of the original data, respectively, which are used for normalization;

[0085] Then, based on the time series data of payment behavior, the behavior modeling formula is adopted:

[0086]

[0087] Where P(t) represents the temporal dynamic characteristics of the behavior;

[0088] w i Indicates the weight of each feature;

[0089] Among them, w is considered to have the greatest impact on risk. i =0.5;

[0090] For features with an impact of 20% or less, w i =0.1;

[0091] f(x i , t) represents the feature x i The value at time t;

[0092] where x i is the transaction amount, f(x i , t) = 1000, unit: yuan;

[0093] x i is the device offset distance, f(x i , t) = 5 units: kilometers;

[0094] Feature extraction methods include:

[0095]

[0096] Where V 平 The volatility of the amount paid to users;

[0097] n is the total number of transactions;

[0098] t i is the amount of the i-th transaction;

[0099] t 平is the average of all transaction amounts;

[0100] If the time interval between two payments is abnormally less than 1 minute, an abnormal alarm may be triggered;

[0101] At the same time, the transaction amount threshold, if the transaction amount exceeds the threshold, it is marked as abnormal:

[0102] The evaluated judgment is calculated by the above formula.

[0103] Based on the above technical solution, the data storage unit stores and manages the data information processed by the data processing unit by constructing an internal database, and by storing the data information, it is convenient to analyze and query the data information, and at the same time, the data backup and data recovery functions of the internal database are used to prevent data loss;

[0104] When storing user payment data information, the data storage unit establishes different storage sub-units according to the timestamp of the payment data information, thereby realizing separate and differentiated storage of the payment data information according to the time axis.

[0105] Based on the above technical solution, the payment behavior model training module refers to constructing a payment behavior analysis model using a machine learning algorithm, where the machine learning algorithm is a neural network algorithm;

[0106] When establishing a payment behavior model, it is necessary to input a large amount of historical transaction record information in the mobile payment process. Based on the input of historical data information, the model parameters are continuously adjusted and the performance of the payment behavior analysis model is optimized in a training and learning manner, so that the established payment behavior model can identify the normal transaction characteristics of users in the payment process based on the collected user payment data information, and distinguish abnormal transaction characteristics;

[0107] In payment behavior, transaction amount, frequency, and transaction time change over time.

[0108]

[0109] By combining weighted average and standard deviation, the threshold is adjusted dynamically to better cope with different trading scenarios. The formula is as follows:

[0110] Z(t) is the normalized value of the tth transaction;

[0111] X(t) is the characteristic value of the tth transaction, which is the transaction amount;

[0112] For example, if you are analyzing transaction amounts, you can directly use the amount of each transaction.

[0113] For example, X(t) could be the amount or frequency of a transaction, depending on what kind of anomaly you want to detect;

[0114] μ(t) is the sliding average of the t-th transaction data;

[0115] μ(t) can be calculated by the following formula:

[0116]

[0117] Where n is the window size, which indicates the number of past transactions considered when calculating the average. The choice of this window size needs to be adjusted according to the actual situation. For example, you can choose the data of the past 7 days or 30 days to calculate the average.

[0118] σ(t) is the sliding standard deviation of the t-th transaction data. The sliding standard deviation is used to measure the volatility of current data and historical data, that is, the fluctuation range of the characteristic value in the past period of time;

[0119] It can be calculated by the following formula:

[0120]

[0121] n is the window size, which indicates the number of past transactions considered when calculating the standard deviation. The larger the standard deviation, the greater the volatility of the transaction data, which also means that the judgment of abnormal transactions may be more stringent;

[0122] W(t) reflects the impact of changes in time, transaction type, or user habits. For example, higher weights may be given during peak hours;

[0123] This factor reflects the weighted impact of time or transaction characteristics and can be designed according to different needs and dynamically adjusted in the following ways:

[0124] Time weighting: transactions during certain periods are more important or sensitive than others. For example, trading behavior during peak hours or holidays is significantly different from normal times, so the weighting factor can be increased during these periods.

[0125] History weighting: If a user’s transaction history shows a relatively fixed pattern, the weight of the historical data can be increased to highlight the user’s normal behavior pattern;

[0126] User behavior weighting: For some users, changes in transaction behavior may be more likely to lead to anomalies. Therefore, their transactions can be weighted based on their historical behavior.

[0127] The weighting factors can usually be set by:

[0128] W(t)=1+λ×t

[0129] Among them, λ is an adjustment factor that controls the growth rate of the weighted factor, and t is time or some other feature. You can set different weights based on the actual scenario.

[0130] Among them, choose the window size n:

[0131] The window size n is a key parameter in the calculation of sliding average and standard deviation. It determines the impact of historical data on current transactions. If the window size is too small, it may be too sensitive to short-term fluctuations; if it is too large, some potential short-term anomalies may be ignored. The selection of a suitable n needs to be optimized based on actual data. For example, if it is daily transaction data, the past 7 days or 30 days can be selected as the window.

[0132] Threshold settings:

[0133] Finally, a threshold needs to be set to determine whether the transaction is abnormal. Generally speaking, if the value of Z(t) exceeds a predetermined threshold (such as 2 or 3), the transaction can be considered abnormal. For example, when Z(t)>3, it is marked as an abnormal transaction.

[0134] For X(t), directly take the observed value of the current transaction feature;

[0135] For μ(t) and σ(t), we need to choose a suitable sliding window size n (such as 7 or 30) and calculate the mean and standard deviation of the past n days.

[0136] For W(t), it can be adjusted according to actual needs and domain knowledge. Generally speaking, W(t) can be dynamically calculated in the following ways:

[0137] Linear weighting: Based on the influence of time or specific characteristics, simple weighting, such as adding a certain weight to each time unit.

[0138] Nonlinear weighting: using exponential, logarithmic and other functions to reflect changes in weights over time or behavior patterns;

[0139] When payment behavior involves time series data, we can combine time series characteristics and weights to detect anomalies and use the following formula to calculate the abnormal transaction score:

[0140]

[0141] S(t) is the anomaly score of the tth transaction;

[0142] X(t) is the characteristic value of the t-th transaction, which is the amount. The observed value of the current transaction is used directly. For example, the transaction amount is the amount of the transaction.

[0143] It is the predicted value of the ith feature based on the tth transaction history. Models (such as time series prediction, regression model, or historical average) are usually used to predict the normal range of each feature. This helps to identify transactions that deviate from the normal pattern. It can be predicted through historical data. Common practices include using sliding average, regression model, or other prediction methods. For example, for the transaction amount, the average transaction amount of the past 7 days can be used as the predicted value.

[0144] σ(t, i) is an estimate of the historical volatility (standard deviation) of feature i, which reflects the volatility of the feature in historical transactions. The larger the standard deviation, the more volatile the feature is. Therefore, when calculating the anomaly score, features with greater volatility contribute more to the final score. By calculating the standard deviation through historical data, a sliding window can be used to calculate the standard deviation of the past nnn transactions, such as data from the past 7 days or 30 days, to reflect the volatility of the feature.

[0145] W(t, i) is the time-series weighting factor of feature i, which can be adjusted dynamically according to the time of transaction, user activity frequency, etc. The standard deviation is calculated through historical data. The standard deviation of the past n n transactions can be calculated using a sliding window, such as the data of the past 7 days or 30 days, to reflect the volatility of the feature;

[0146] Combining the timing information and historical volatility of each feature, it is possible to comprehensively consider multi-dimensional factors to assess whether a transaction is abnormal;

[0147] Sliding window size: Usually, data from a period of time in the past is selected as the basis for calculating the standard deviation and the average value. The window size n can be 7 days, 30 days, etc., depending on business needs and data characteristics.

[0148] Weighting factors: Weighting factors can be set through the above-mentioned domain knowledge or historical data analysis, or dynamically adjusted using adaptive methods.

[0149] Based on the above technical solution, the payment behavior data analysis module is used to identify and analyze various payment behavior data information collected in the mobile payment system, and specifically judge and analyze the current user's payment behavior through the trained payment behavior model;

[0150] By inputting the collected user payment behavior data information into the payment behavior model, the payment behavior data information is judged and analyzed through the payment behavior model, so as to identify the normal transaction characteristics and abnormal transaction characteristics of users in the mobile payment process, and focus on marking the abnormal transaction characteristics.

[0151] Based on the above technical solution, abnormal transaction characteristics specifically include abnormally high frequency of quick payments, unusual transaction payment patterns, abnormal payment activities of newly registered users, excessively long stay on the payment page, and multiple payments under the same IP address.

[0152] Based on the above technical solution, the risk assessment module conducts risk assessment on the user's mobile payment transaction process according to the analysis and identification results of the payment behavior model. In the process of risk assessment, the risk of the payment transaction is mainly scored by calculating the risk. When calculating the specific risk, the abnormal situations existing in the abnormal transaction characteristics are judged, and the severity of the transaction risk is judged according to the number of abnormal situations.

[0153] According to the five abnormal transaction characteristics: abnormally high frequency of fast payments, unusual transaction payment patterns, abnormal payment activities of newly registered users, too long stay on the payment page and multiple payments under the same IP address, the severity is divided into five levels according to the number of abnormal transaction characteristics: A, B, C, D, and E. Level A means that there is only one abnormal situation among the five abnormal transaction characteristics, level B means that there are two abnormal situations among the five abnormal transaction characteristics, level C means that there are three abnormal situations among the five abnormal transaction characteristics, level D means that there are four abnormal situations among the five abnormal transaction characteristics, and level E means that all abnormal situations exist among the five abnormal transaction characteristics.

[0154] Based on the above technical solution, the real-time supervision module receives the risk assessment results sent by the risk assessment module, and when it is determined that there are abnormal transactions in the payment transaction process of the user according to the risk assessment results and the preset risk warning mechanism, the abnormal transaction process is notified to the supervision department, and the abnormal transaction is intercepted at the same time, interrupting the payment transaction of the abnormal user;

[0155] When handling abnormal transactions, regulatory authorities will monitor and handle them to varying degrees based on the severity of the transaction risk, as follows:

[0156] Abnormal trading behaviors of users with low risk of grade A and grade B will be reminded by warning emails, while abnormal trading behaviors of users with high risk of grade C, grade D and grade E will be monitored more strictly, including suspending account transactions of abnormal users and limiting transaction amounts.

[0157] Finally, it should be noted that the above description is only a preferred example of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A real-time supervision system for mobile payment based on behavior analysis algorithm, characterized by: Behavioral analysis technology is used to monitor abnormal behaviors in the mobile payment process, including payment data collection module, payment behavior model training module, payment behavior data analysis module, risk assessment module and real-time supervision module.

2. According to claim 1, a mobile payment real-time supervision system based on a behavior analysis algorithm is characterized by: The payment data collection module is used to collect and integrate the mobile payment data information of users from different sources in the mobile payment system. The data collection module specifically includes a data collection unit, a data processing unit and a data storage unit.

3. A mobile payment real-time supervision system based on a behavior analysis algorithm according to claim 2, characterized in that: The data collection unit collects data information from multiple sources, and the collected data information specifically includes user payment behavior, transaction records and geographic location; The user payment behavior specifically includes payment frequency, payment amount range and payment time; The transaction record specifically includes user information, transaction object, transaction type and transaction device, wherein the user information specifically includes the name, account and mobile phone number of the mobile payment user; The geographical location specifically includes the transaction location and the IP address of the transaction device.

4. The mobile payment real-time supervision system based on behavior analysis algorithm according to claim 2 is characterized by: The data processing unit processes the collected data information, including data cleaning and format conversion. The data cleaning is used to remove duplicate data, fill in missing data information, and correct erroneous data information. The format conversion is used to standardize the data information collected from different sources, so that the data information from different sources can be compared and analyzed later. The transaction records in the data processing unit will extract the payment frequency and payment amount fluctuation characteristics based on the user's historical behavior data. After collecting the data, the data will be pre-processed through the feature extraction formula: Where X represents the collected original data; μ and σ are the mean and standard deviation of the original data, respectively, which are used for normalization; Then, based on the time series data of payment behavior, the behavior modeling formula is adopted: Where P(t) represents the temporal dynamic characteristics of the behavior; w i Indicates the weight of each feature; Among them, w is considered to have the greatest impact on risk. i =0.5; For features with an influence of 20% or less, w i =0.1; f(x i , t) represents the feature x i The value at time t; where x i is the transaction amount, f(x i , t) = 1000, unit: yuan; Feature extraction methods include: Where V 平 The volatility of the amount paid to users; n is the total number of transactions; t i is the amount of the i-th transaction; t 平 is the average of all transaction amounts; If the time interval between two payments is less than 1 minute, an abnormal alarm will be triggered; At the same time, the transaction amount threshold, if the transaction amount exceeds the threshold, it is marked as abnormal: The evaluated judgment is calculated by the above formula.

5. The mobile payment real-time supervision system based on behavior analysis algorithm according to claim 2 is characterized by: The data storage unit stores and manages the data information processed by the data processing unit by constructing an internal database, and stores the data information while performing data backup and data recovery functions of the internal database; When storing user payment data information, the data storage unit establishes different storage sub-units according to the timestamp of the payment data information, thereby realizing separate and differentiated storage of the payment data information according to the time axis.

6. The mobile payment real-time supervision system based on behavior analysis algorithm according to claim 1 is characterized by: The payment behavior model training module refers to constructing a payment behavior analysis model using a machine learning algorithm, where the machine learning algorithm is a neural network algorithm; When establishing a payment behavior model, it is necessary to input a large amount of historical transaction record information in the mobile payment process. Based on the input of historical data information, the model parameters are continuously adjusted and the performance of the payment behavior analysis model is optimized in a training and learning manner, so that the established payment behavior model can identify the normal transaction characteristics of users in the payment process based on the collected user payment data information, and distinguish abnormal transaction characteristics; In payment behavior, the transaction amount, frequency, and transaction time change over time. By combining weighted average and standard deviation, the threshold is dynamically adjusted to better cope with different transaction scenarios. The formula is as follows: Z(t) is the normalized value of the tth transaction; X(t) is the characteristic value of the tth transaction, which is the transaction amount; For example, X(t) could be the amount or frequency of a transaction, depending on what kind of anomaly you want to detect; μ(t) is the sliding average of the t-th transaction data; σ(t) is the sliding standard deviation of the t-th transaction data. The sliding standard deviation is used to measure the volatility of current data and historical data, that is, the fluctuation range of the characteristic value in the past period of time; When payment behavior involves time series data, we can combine time series characteristics and weights to detect anomalies and use the following formula to calculate the abnormal transaction score: S(t) is the anomaly score of the tth transaction; X(t) is the characteristic value of the t-th transaction, which is the amount. The observed value of the current transaction is used directly. For example, the transaction amount is the amount of the transaction. It is the predicted value of the ith feature based on the tth transaction history. Models are usually used to predict the normal range of each feature, which helps to identify transactions that deviate from the normal pattern and can be predicted through historical data. σ(t, i) is an estimate of the historical volatility of feature i, which reflects the volatility of the feature in historical transactions. The larger the standard deviation, the more volatile the feature is. Therefore, when calculating the anomaly score, features with greater volatility contribute more to the final score. The standard deviation is calculated using historical data. W(t, i) is the time-series weighting factor of feature i, which can be adjusted dynamically according to the time of transaction, user activity frequency, etc. The standard deviation is calculated by historical data, and the standard deviation of the past n n transactions can be calculated using a sliding window; Combining the timing information and historical volatility of each feature, it is possible to comprehensively consider multi-dimensional factors to assess whether a transaction is abnormal; Sliding window size: Usually, data from a period of time in the past is selected as the basis for calculating the standard deviation and the average value. The window size n can be 7 days or 30 days, depending on business needs and data characteristics.

7. A mobile payment real-time supervision system based on a behavior analysis algorithm according to claim 6, characterized in that: The payment behavior data analysis module is used to identify and analyze various payment behavior data information collected in the mobile payment system, specifically judging and analyzing the current user's payment behavior through a trained payment behavior model; By inputting the collected user payment behavior data information into the payment behavior model, the payment behavior data information is judged and analyzed through the payment behavior model, so as to identify the normal transaction characteristics and abnormal transaction characteristics of users in the mobile payment process, and focus on marking the abnormal transaction characteristics.

8. A mobile payment real-time supervision system based on a behavior analysis algorithm according to claim 7, characterized in that: The abnormal transaction characteristics specifically include abnormally high frequency of quick payments, unusual transaction payment patterns, abnormal payment activities of newly registered users, excessively long stays on payment pages, and multiple payments under the same IP address.

9. The mobile payment real-time supervision system based on behavior analysis algorithm according to claim 7 is characterized by: The risk assessment module conducts risk assessment on the user's mobile payment transaction process based on the analysis and identification results of the payment behavior model. In the process of risk assessment, the risk of the payment transaction is mainly scored by calculating the risk. When calculating the specific risk, the abnormal situations existing in the abnormal transaction characteristics are judged, and the severity of the transaction risk is judged according to the number of abnormal situations. According to the five abnormal transaction characteristics: abnormally high frequency of fast payments, unusual transaction payment patterns, abnormal payment activities of newly registered users, too long stay on the payment page and multiple payments under the same IP address, the severity is divided into five levels according to the number of abnormal transaction characteristics: A, B, C, D, and E. Level A means that there is only one abnormal situation among the five abnormal transaction characteristics, level B means that there are two abnormal situations among the five abnormal transaction characteristics, level C means that there are three abnormal situations among the five abnormal transaction characteristics, level D means that there are four abnormal situations among the five abnormal transaction characteristics, and level E means that all abnormal situations exist among the five abnormal transaction characteristics.

10. A mobile payment real-time supervision system based on a behavior analysis algorithm according to claim 9, characterized in that: The real-time supervision module receives the risk assessment result sent by the risk assessment module, and when it is determined that there is an abnormal transaction in the payment transaction process of the user based on the risk assessment result and the preset risk warning mechanism, the supervision department is notified of the abnormal transaction process, and the abnormal transaction is intercepted to interrupt the payment transaction of the abnormal user; When handling abnormal transactions, regulatory authorities will monitor and handle them to varying degrees based on the severity of the transaction risk, as follows: Abnormal trading behaviors of users with low risk of grade A and grade B will be reminded by warning emails, while abnormal trading behaviors of users with high risk of grade C, grade D and grade E will be monitored more strictly, including suspending the account transactions of abnormal users and limiting the transaction amount.

Images