Financial account security monitoring method and device, electronic equipment and storage medium

Abstract

The invention discloses a safety monitoring method and device for a financial account, electronic equipment and a storage medium, and relates to the field of financial science and tech, and the method comprises the steps: detecting historical transaction data and a login log of the financial account, and obtaining a login log of the financial account based on the preprocessed historical transaction data; and performing risk rating on the target financial account by adopting a multi-layer perceptron model to obtain an account risk level, inputting the preprocessed historical transaction data and the login log into an abnormal model set, and outputting an abnormal transaction detection result and an abnormal login state monitoring result. And calculating a probability value that the current transaction activity of the financial account is an abnormal transaction based on the account risk level, the abnormal transaction detection result and the abnormal login state monitoring result, and outputting transaction alarm prompt information based on the probability value. According to the invention, the technical problems of low flexibility and easy generation of false alarm or missing alarm because the financial account monitoring system adopts a static threshold to judge whether the transaction is abnormal in the prior art are solved.

Description

Technical Field

[0001] The present invention relates to the field of financial technology or other related fields, and in particular to a method and device for security monitoring of financial accounts, an electronic device and a storage medium. Background Art

[0002] With the rapid development of financial technology, digital payment and online banking services have become the norm in people's daily lives. However, with the popularity of online transactions and the rise of mobile payments, account security issues have become increasingly prominent. Hacker attacks, fraud, identity theft and other security threats have occurred frequently, causing huge economic losses to individual users and enterprises, and also posing a threat to the reputation of financial institutions. Therefore, financial institutions urgently need to adopt more advanced technical means to ensure account security, prevent and quickly respond to potential illegal operations.

[0003] Traditional bank account security monitoring systems mainly rely on preset rules and thresholds, such as anomaly detection based on transaction amounts, monitoring based on login frequency, etc. Although such systems can identify and prevent some obvious illegal activities to a certain extent, they have obvious drawbacks: existing security monitoring systems often focus on a specific aspect of an account, such as transaction amounts or login frequency, while ignoring the comprehensive analysis of account behavior, which leads to limited ability to identify complex and multi-dimensional attack methods. At the same time, most monitoring systems use static thresholds to judge anomalies, which is not flexible enough in the face of ever-changing attack methods and user behavior patterns, and is prone to false positives or false negatives.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a method and device for security monitoring of financial accounts, an electronic device and a storage medium, so as to at least solve the technical problem in the related art that the financial account monitoring system uses a static threshold to determine whether a transaction is abnormal, which has low flexibility and is prone to false alarms or missed alarms.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for security monitoring of a financial account is provided, comprising: detecting historical transaction data and login logs of a target financial account, and preprocessing the historical transaction data; based on the preprocessed historical transaction data, using a multi-layer perceptron model to perform risk rating on the target financial account to obtain an account risk level; inputting the preprocessed historical transaction data and the login log into an abnormal model set, and outputting abnormal transaction detection results and abnormal login status monitoring results, wherein the abnormal model set includes: an account abnormal login detection model, a frequent transaction detection model, and a transaction habit abnormality detection model, and the account abnormal login detection model is used to The login log is analyzed to determine whether the target financial account has an abnormal login status, the frequent transaction detection model is used to analyze the transaction quantity of the pre-processed historical transaction data to determine whether the target financial account has abnormal transactions, and the transaction habit abnormality detection model is used to analyze the transaction habits of the pre-processed historical transaction data to determine whether the target financial account has abnormal transactions; based on the account risk level, the abnormal transaction detection result and the abnormal login status monitoring result, a probability value of the current transaction activity of the target financial account being an abnormal transaction is calculated, and when the probability value indicates that the current transaction activity is an abnormal transaction, a transaction alarm prompt information is output.

[0007] Optionally, the step of using a multilayer perceptron model to perform risk rating on the target financial account to obtain the account risk level includes: extracting basic information, account information and credit information of a user involved in the target financial account; inputting the basic information, account information and credit information of the user, and the pre-processed historical transaction data into the multilayer perceptron model, and outputting a risk probability value associated with the target financial account and an account risk level corresponding to the risk probability value, wherein the multilayer perceptron model includes: an input layer, two hidden layers, and an output layer, using ReLU as an activation function of the multilayer perceptron model, and using a first log-likelihood loss function as a loss function of the multilayer perceptron model.

[0008] Optionally, the account abnormal login detection model is trained in the following manner: obtaining financial account login data and user basic information within a specified historical time period, wherein the financial account login data includes at least one of the following: user login time point, number of successful user logins per unit time, number of failed user logins per unit time, number of user personal information modifications per unit time, and user login IP information; constructing a gradient boosting tree; using the financial account login data and user information within the specified historical time period to train the gradient boosting tree; using the trained gradient boosting tree as the account abnormal login detection model, the account abnormal login detection model outputs a probability value of abnormal login, and confirming whether the financial account is in an abnormal login state based on the probability value of abnormal login.

[0009] Optionally, the security monitoring method for financial accounts also includes: in the process of training the gradient boosting tree, using a second log-likelihood loss function as a model loss function; wherein the second log-likelihood loss function is: L(y,p)=-[y log(p)+(1-y)log(1-p)], y represents the true label of the data, the true label refers to the value 1 corresponding to the abnormal account login or the value 0 corresponding to the normal account login, and p is the probability value of the abnormal login of the financial account output by the gradient boosting tree.

[0010] Optionally, the frequent transaction detection model is trained in the following manner: detecting a first type of historical transaction data of multiple financial accounts, and preprocessing the first type of historical transaction data to obtain training data, wherein the first type of historical transaction data includes at least one of the following: single transaction amount, account transaction times, repeated transaction times, and transaction method data; using a sparse autoencoding algorithm to construct a sparse autoencoding anomaly detection model, wherein the sparse autoencoding anomaly detection model includes: an encoder, a decoder, and a hidden layer; inputting the training data into the encoder and decoder in the sparse autoencoding anomaly detection model, and outputting a probability value of the existence of abnormal transactions in the account; using the trained sparse autoencoding anomaly detection model as the frequent transaction detection model, the frequent transaction detection model outputs the probability value of abnormal transactions, and confirming whether there are abnormal transactions in the financial account based on the probability value of the abnormal transactions.

[0011] Optionally, the transaction habit anomaly detection model is trained in the following manner: detecting the second category of historical transaction data of multiple financial accounts, and preprocessing the second category of historical transaction data, wherein the second category of historical transaction data includes at least one of the following: the time point of each financial transaction, and the amounts of multiple transactions; constructing a long short-term memory neural network LSTM, wherein the architecture of the long short-term memory neural network LSTM includes: an encoder, an attention module and a decoder, the encoder uses an LSTM unit to process the input sequence, the attention module adjusts the data that the long short-term memory neural network LSTM pays attention to according to the attention score and the attention weight, and the decoder decodes the received transaction data vector and the decoder state of the previous time step; the preprocessed second category of historical transaction data is input into the encoder and the attention module, and the decoder outputs the transaction time habit data and the transaction amount habit data of the financial account; after training, the trained long short-term memory neural network LSTM is used as the transaction habit anomaly detection model.

[0012] Optionally, the step of preprocessing the historical transaction data includes: performing cleaning processing on the historical transaction data, wherein the cleaning processing includes: detecting the transaction data format, and according to the transaction data format, using a Z-Score standardization strategy to perform normal mapping processing on the historical transaction data, and using a Robust Sca ler strategy to delete extreme values ​​and outlier data in the historical transaction data; performing conversion processing and balancing processing on the historical transaction data.

[0013] Optionally, before detecting the historical transaction data and login log of the target financial account, the method further includes: obtaining user identity information of the logged-in user, wherein the user identity information includes: user biometrics, certificate information, login account number and password; performing multiple verification processes on the user identity information to obtain an identity verification result; and when the identity verification result indicates that the user identity has been verified, starting to detect the historical transaction data and login log of the target financial account.

[0014] According to another aspect of an embodiment of the present invention, a financial account security monitoring device is provided, comprising: a transaction data detection unit, used to detect historical transaction data and login logs of a target financial account, and preprocess the historical transaction data; a risk rating unit, used to perform risk rating on the target financial account based on the preprocessed historical transaction data using a multi-layer perceptron model to obtain an account risk level; a transaction anomaly detection unit, used to input the preprocessed historical transaction data and login logs into an anomaly model set, and output an abnormal transaction detection result and an abnormal login status monitoring result, wherein the anomaly model set includes: an account abnormal login detection model, a frequent transaction detection model, and a transaction habit anomaly detection model, and the account abnormal login detection model is used to detect the historical transaction data and login logs after the preprocessing, and the target financial account is risk rated by a multi-layer perceptron model to obtain an account risk level; and a transaction anomaly detection unit is used to input the preprocessed historical transaction data and login logs into an anomaly model set, and output an abnormal transaction detection result and an abnormal login status monitoring result. The log detection model is used to analyze the login log to determine whether the target financial account has an abnormal login status, the frequent transaction detection model is used to analyze the transaction quantity of the preprocessed historical transaction data to determine whether the target financial account has abnormal transactions, and the transaction habit abnormality detection model is used to analyze the transaction habits of the preprocessed historical transaction data to determine whether the target financial account has abnormal transactions; the abnormal transaction identification unit is used to identify the probability value of the current transaction activity of the target financial account being an abnormal transaction based on the account risk level, the abnormal transaction detection result and the abnormal login status monitoring result, and output transaction alarm prompt information when the probability value indicates that the current transaction activity is an abnormal transaction.

[0015] Optionally, the risk rating unit includes: a user information extraction module, used to extract basic information, account information and credit information of users involved in the target financial account; a risk assessment module, used to input the basic information, account information and credit information of the user, and the pre-processed historical transaction data into the multi-layer perceptron model, and output a risk probability value associated with the target financial account and an account risk level corresponding to the risk probability value, wherein the multi-layer perceptron model includes: an input layer, two hidden layers, and an output layer, using ReLU as the activation function of the multi-layer perceptron model, and using a first log-likelihood loss function as the loss function of the multi-layer perceptron model.

[0016] Optionally, when training the account abnormal login detection model, the financial account security monitoring device includes: a historical login data acquisition unit, used to acquire the financial account login data and user basic information within a historical specified time period, wherein the financial account login data includes at least one of the following: user login time point, the number of successful user logins per unit time, the number of failed user logins per unit time, the number of user personal information modifications per unit time, and user login IP information; a gradient boosting tree construction unit, used to construct a gradient boosting tree; a first model training unit, used to train the gradient boosting tree using the financial account login data and user information within the historical specified time period; an abnormal login detection unit, used to use the trained gradient boosting tree as the account abnormal login detection model, the account abnormal login detection model outputs a probability value of abnormal login, and confirms whether the financial account is in an abnormal login state based on the probability value of abnormal login.

[0017] Optionally, the security monitoring device for financial accounts also includes: in the process of training the gradient boosting tree, using a second log-likelihood loss function as a model loss function; wherein the second log-likelihood loss function is: L(y,p)=-[y log(p)+(1-y)log(1-p)], y represents the true label of the data, the true label refers to the value 1 corresponding to the abnormal account login or the value 0 corresponding to the normal account login, and p is the probability value of the abnormal login of the financial account output by the gradient boosting tree.

[0018] Optionally, when training the frequent transaction detection model, the security monitoring device for financial accounts includes: a first historical transaction data detection unit, used to detect a first type of historical transaction data of multiple financial accounts, and pre-process the first type of historical transaction data to obtain training data, wherein the first type of historical transaction data includes at least one of the following: single transaction amount, account transaction times, repeated transaction times, and transaction method data; a sparse autoencoding anomaly detection model is constructed using a sparse autoencoding algorithm, wherein the sparse autoencoding anomaly detection model includes: an encoder, a decoder, and a hidden layer; an abnormal transaction probability calculation unit, used to input the training data into the encoder and decoder in the sparse autoencoding anomaly detection model, and output a probability value of the existence of abnormal transactions in the account; an abnormal transaction calculation unit, used to use the trained sparse autoencoding anomaly detection model as the frequent transaction detection model, and the frequent transaction detection model outputs the probability value of abnormal transactions, and confirms whether the financial account has abnormal transactions based on the probability value of abnormal transactions.

[0019] Optionally, when training the transaction habit anomaly detection model, the security monitoring device of the financial account includes: a second historical transaction data detection unit, which is used to detect the second type of historical transaction data of multiple financial accounts and pre-process the second type of historical transaction data, wherein the second type of historical transaction data includes at least one of the following: the time point of each financial transaction and the amount of multiple transactions; a neural network construction unit, which is used to construct a long short-term memory neural network LSTM, wherein the architecture of the long short-term memory neural network LSTM includes: an encoder, an attention module and a decoder, the encoder uses an LSTM unit to process the input sequence, the attention module adjusts the data that the long short-term memory neural network LSTM pays attention to according to the attention score and the attention weight, and the decoder decodes the received transaction data vector and the decoder state of the previous time step; a transaction habit output unit, which is used to input the pre-processed second type of historical transaction data into the encoder and the attention module, and the decoder outputs the transaction time habit data and the transaction amount habit data of the financial account; an abnormal transaction habit detection unit, which is used to use the trained long short-term memory neural network LSTM as the transaction habit anomaly detection model after training.

[0020] Optionally, the transaction data detection unit includes: a cleaning module, used to perform cleaning processing on the historical transaction data, wherein the cleaning processing includes: detecting the transaction data format, and according to the transaction data format, using the Z-Score standardization strategy to perform normal mapping processing on the historical transaction data, and using the Robust Sca ler strategy to delete extreme values ​​and outlier data in the historical transaction data; a conversion module, used to perform conversion processing and balancing processing on the historical transaction data.

[0021] Optionally, the security monitoring device for financial accounts also includes: a user identity acquisition unit, used to obtain user identity information of the logged-in user before detecting the historical transaction data and login log of the target financial account, wherein the user identity information includes: user biometrics, certificate information, login account and password; an identity authentication unit, used to perform multiple verification processes on the user identity information to obtain an identity authentication result; an identity authentication pass module, used to start detecting the historical transaction data and login log of the target financial account when the identity authentication result indicates that the user identity has passed the verification.

[0022] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned methods for security monitoring of financial accounts.

[0023] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned methods for security monitoring of financial accounts.

[0024] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, which implements the steps of any one of the above-mentioned methods for security monitoring of financial accounts when executed by a processor.

[0025] In the present disclosure, historical transaction data and login logs of a target financial account can be detected, and the historical transaction data can be preprocessed. Based on the preprocessed historical transaction data, a multi-layer perceptron model is used to perform risk rating on the target financial account to obtain an account risk level. The preprocessed historical transaction data and login log are input into an abnormal model set, and an abnormal transaction detection result and an abnormal login status monitoring result are output. The abnormal model set includes: an account abnormal login detection model, a frequent transaction detection model, and a transaction habit abnormality detection model. The account abnormal login detection model is used to analyze the login log to determine whether the target financial account has an abnormal login status. The frequent transaction detection model is used to perform transaction quantity analysis on the preprocessed historical transaction data to determine whether the target financial account has abnormal transactions. The transaction habit abnormality detection model is used to perform transaction habit analysis on the preprocessed historical transaction data to determine whether the target financial account has abnormal transactions. Based on the account risk level, the abnormal transaction detection result, and the abnormal login status monitoring result, a probability value that the current transaction activity of the target financial account is an abnormal transaction is calculated. When the probability value indicates that the current transaction activity is an abnormal transaction, a transaction alarm prompt information is output.

[0026] Based on the above-mentioned public content, it is possible to dynamically evaluate the quality and risk level of an account, realize hierarchical management of user risks, and at the same time, monitor the transaction activities generated by each financial account in real time, quickly identify suspicious transaction patterns or abnormal transaction behaviors, and trigger the alarm mechanism. Once an anomaly is detected, it can quickly lock the target information and issue an alarm. By constructing and optimizing account risk assessment models, abnormal login detection models, frequent transaction detection models, and transaction habit anomaly detection models, it is possible to more accurately identify abnormal behaviors and reduce false alarm and omission rates, thereby solving the technical problem in related technologies that the financial account monitoring system uses static thresholds to determine whether a transaction is abnormal, has low flexibility, and is prone to false alarms or omissions. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0028] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for security monitoring of a financial account is shown;

[0029] Figure 2 is a flow chart of an optional financial account security monitoring method according to an embodiment of the present invention;

[0030] Figure 3 is a schematic diagram of module connections of an optional financial institution account dynamic security monitoring system according to an embodiment of the present invention;

[0031] Figure 4 It is a financial platform user account security management method based on artificial intelligence according to an embodiment of the present invention;

[0032] Figure 5 is a schematic diagram of an optional security monitoring device for a financial account according to an embodiment of the present invention;

[0033] Figure 6 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0035] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0036] To facilitate those skilled in the art to understand the present invention, some terms or nouns involved in the embodiments of the present invention are explained below:

[0037] Multi-layer perceptron, MLP for short, is a feedforward artificial neural network. It includes an input layer, at least one hidden layer and an output layer. By connecting neurons (nodes) of each layer, a complex network structure is formed. Each neuron has a weight and a bias. An activation function is used to perform nonlinear transformation on the input data to improve the learning and expression ability of the model. In the financial account security monitoring method of the present invention, MLP can be used to comprehensively evaluate the risk level of an account. By learning multiple attributes and transaction history of the user, a probability distribution reflecting the risk level of the account is output, which helps banks identify potential high-risk accounts.

[0038] Log Likelihood Loss Function, a loss function, is suitable for classification tasks, especially in binary classification problems, such as logistic regression or neural network classifiers. In the account security monitoring method of the present invention, the log likelihood loss function can be used to train models such as MLP and gradient boosting trees to help the model learn how to accurately predict whether an account has abnormal login or transaction behavior.

[0039] Sparse Autoencoder is a variant of Autoencoder, which aims to make the encoder produce sparse representation when encoding data, that is, only a small number of neurons are activated in the encoding layer. In the account security monitoring method of the present invention, sparse autoencoder can be used to detect abnormal transactions. The model learns the sparse representation of normal transactions. When abnormal transactions are input, the reconstruction error of the model will increase significantly, which can be used as a basis for detecting abnormal transactions.

[0040] Long Short-Term Memory, or LSTM for short, is a method for solving the problem of gradient vanishing or gradient exploding in long sequence data, and can effectively handle time series and sequence-dependent tasks. In the account security monitoring method of the present invention, the LSTM neural network can be used to analyze the transaction time series of an account, learn transaction habits and patterns, and thus detect abnormal behaviors in transaction time or amount. By combining the attention mechanism, the LSTM model can pay more attention to the key parts of the transaction sequence and improve the accuracy and efficiency of anomaly detection.

[0041] It should be noted that the financial account security monitoring method and device thereof in the present disclosure can be used in the field of financial technology when security monitoring of financial accounts is achieved based on financial technology, and can also be used in any field other than the financial technology field when security monitoring of financial accounts is achieved based on financial technology. The present disclosure does not limit the application field of the financial account security monitoring method and device thereof.

[0042] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected by this disclosure are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0043] It should be noted that in the present disclosure, when collecting and analyzing customer information, corresponding operation entrances are provided for users to choose to agree or reject the automated decision results; if the user chooses to reject, the expert decision-making process is entered.

[0044] The following embodiments of the present invention can be applied to systems / applications / devices for security monitoring of various financial accounts. The present invention can monitor all financial transaction activities in real time, quickly identify suspicious transaction patterns or abnormal behaviors, and trigger an alarm mechanism. Once an abnormality is detected, it can quickly lock the target information and issue an alarm, thereby improving the response speed and processing capabilities for emergencies. At the same time, the present invention can also be updated in real time, dynamically evaluate the quality and risk level of the account, realize hierarchical management of user risks, adjust model parameters based on historical data and real-time information, use advanced algorithms to predict potential risks, and improve the accuracy and timeliness of early warnings.

[0045] In addition, the present invention can also more accurately identify abnormal behaviors, reduce false alarm rates and missed alarm rates, and enhance the anomaly detection capabilities of the entire system by constructing and optimizing account risk assessment models, abnormal login detection models, frequent transaction detection models, and transaction habit anomaly detection models.

[0046] In addition, the present invention supports dynamic assessment and classification of user risks, can adjust security policies according to the specific circumstances of each user, avoid a one-size-fits-all management approach, reduce interference with normal user transactions, and improve user experience.

[0047] The present invention is described in detail below in conjunction with various embodiments.

[0048] Embodiment 1

[0049] According to an embodiment of the present invention, an embodiment of a method for security monitoring of a financial account is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0050] The financial account security monitoring method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for security monitoring of financial accounts is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more ( Figure 1 The computer system 102 includes a processor 102 (the processor 102 may include but is not limited to a microprocessor MCU (Microcontroller Unit) or a programmable logic device FPGA (Field Programmable Gate Array) and other processing devices), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of the BUS), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0051] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0052] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the security monitoring method of financial accounts in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the security monitoring method of the financial account described above is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0053] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0054] The display may be, for example, a touch screen liquid crystal display (LCD), which may enable a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0055] It should be noted that the financial account security monitoring method and system of the present invention can be applied to various bank account security management scenarios in the field of financial technology, for example, real-time transaction monitoring scenarios: when users make online payments, transfers and other transactions, the system analyzes transaction data in real time, combines the user's historical transaction habits and the current account risk level, and quickly identifies suspicious transaction patterns, such as a large number of transactions in a short period of time, abnormal transaction amounts, transactions that do not conform to historical transaction patterns, etc., and promptly issues risk warnings to prevent fraudulent behavior. Transaction habit anomaly detection scenario: Based on the user's long-term transaction data, the LSTM neural network is used in combination with the attention mechanism to learn the user's transaction habits, such as transaction time, transaction amount, etc. When a transaction that is significantly different from the user's historical behavior is detected, the system can promptly trigger further verification to protect the user from fraud.

[0056] Under the above operating environment, this application provides Figure 2 The security monitoring method of the financial account is shown. Figure 2 is a flow chart of an optional method for security monitoring of a financial account according to an embodiment of the present invention, such as Figure 2 As shown, the method comprises the following steps:

[0057] In the process of dynamic security monitoring of bank accounts, first, the system needs to obtain the comprehensive identity information of the logged-in user, including but not limited to the user's biometrics, certificate information, login account and password. Optionally, before detecting the historical transaction data and login log of the target financial account, obtain the user's identity information of the logged-in user, where the user identity information includes: user biometrics, certificate information, login account and password; perform multiple verifications on the user's identity information to obtain the identity verification result; when the identity verification result indicates that the user's identity has been verified, start to detect the historical transaction data and login log of the target financial account. Ensure that only verified users can access their account information, thereby increasing the security of the account.

[0058] Among them, biometric identification is a technology that uses natural features of users (such as fingerprints, facial recognition, voiceprints, etc.) to authenticate users. In an embodiment of the present invention, the user's biometric data can be captured and analyzed, and compared with the user template stored in the system to confirm the authenticity and uniqueness of the user's identity, which significantly improves the security of identity authentication because biometrics are difficult to copy or forge. Then, the certificate information is scanned and verified, and the user's certificate information (ID card, passport, driver's license, etc.) is obtained through a camera or by uploading a file, and the key information is automatically read using OCR technology (Optical Character Recognition). The certificate information verification process includes checking the validity of the certificate, comparing the certificate information with the user information recorded in the system, and confirming the authenticity of the certificate through a third-party service or database query, further preventing identity theft and account fraud. It should be noted that the login account and password verification is also used in this embodiment, by checking whether the login account and password provided by the user match the information recorded in the system database. This step is usually used as the first line of defense for multiple verifications, and subsequent biometric identification and certificate information verification are used to increase security, especially in high-risk transactions or login situations.

[0059] In order to improve security, this embodiment adopts a combination of multiple verification methods. This multiple verification mechanism can effectively prevent a single verification method from being bypassed or cracked. Once the user passes all the above verification steps, the system will confirm the user's identity and allow him to access the account. In addition, for VIP users or high-frequency trading users, the system may adopt a more stringent verification process, such as increasing the number of biometric identifications or requiring additional certificate information.

[0060] After the user has provided all necessary identity information, the system will immediately verify and generate an identity verification result. This result will clearly indicate whether the user's identity has been verified and the level of verification (for example, low risk, medium risk, high risk). Only when the identity verification result indicates that the user's identity has been verified and the risk level is within the preset security threshold, the system will continue to detect the historical transaction data and login logs of the target financial account. In the case of failure to pass the verification or the risk level is too high, the system will immediately take measures, such as restricting account access, requiring the user to provide additional verification information, or even notifying the bank's security team for manual review. Once the user passes the identity verification, the monitoring system will analyze the user's transaction data and login logs in real time. If anomalies are detected, such as abnormal account logins, frequent transactions, or abnormal transaction habits, the system will immediately trigger an alarm mechanism according to the preset rules, notify the user to check the account security, and take corresponding protective measures.

[0061] Step S201, detecting historical transaction data and login logs of a target financial account, and preprocessing the historical transaction data.

[0062] Optionally, the step of preprocessing the historical transaction data includes: cleaning the historical transaction data, wherein the cleaning includes: detecting the transaction data format, and according to the transaction data format, using the Z-Score standardization strategy to perform normal mapping processing on the historical transaction data, and using the Robust Sca ler strategy to delete extreme values ​​and outlier data in the historical transaction data; and performing transformation processing and balancing processing on the historical transaction data.

[0063] The preprocessing process mainly includes data cleaning, data conversion, data standardization / normalization and data balancing. Through data cleaning, noise and errors in the data set are removed to ensure high data quality. The specific process includes: detecting the transaction data format, checking whether the format of historical transaction data is consistent, for example, checking whether the date and time fields are in a unified format, whether the amount field is numeric, etc. Inconsistent formats may lead to data parsing errors and affect the accuracy of subsequent processing. Then the Z-Score standardization strategy is used to convert the data into a standard normal distribution, that is, a distribution with a mean of 0 and a standard deviation of 1, which can eliminate the influence of data dimensions and enable data of different dimensions to be compared and analyzed on the same scale. The formula can be: [Z = \frac{(x-\mu)}{\s igma}], where (x) is a transaction data point, (\mu) is the mean of the data set, and (\s igma) is the standard deviation of the data set. Through Z-Score standardization, the system can more accurately identify abnormal points in transaction data. In addition, in this embodiment, a Robust Sca ler strategy is also required to process data sets with outliers. The data is standardized based on the median and interquartile range (IQR, i.e., the gap between the upper quartile and the lower quartile) of the data. It is not very sensitive to extreme values ​​in the data set, so it can effectively process abnormally high or low values ​​in transaction data and avoid interference of these extreme values ​​on model training. Through the Robust Sca ler strategy, the system can process data more robustly and improve the accuracy of anomaly detection.

[0064] Furthermore, the present embodiment also needs to perform data conversion processing to convert the original transaction data into a format that the model can understand and analyze. For example, the categorical data (such as transaction type) is converted into numerical data, which is usually achieved through label encoding or one-hot encoding. Through data conversion, the system can ensure that all data input to the model are numerical, which is convenient for subsequent mathematical operations and model training. In addition, since the ratio of normal transaction data to abnormal transaction data may be seriously unbalanced, this will cause the model to tend to predict transactions as normal during training, thereby ignoring a small number of abnormal transactions. Data balancing processing usually involves oversampling (increasing minority class samples), undersampling (reducing majority class samples), or synthetic minority oversampling technique (SMOTE, Synthetic Minority Over-sampling Technique). Through data balancing processing, the system can ensure that the model can learn the characteristics of abnormal transactions during training, so as to more accurately identify abnormal transactions in practical applications.

[0065] Step S202, based on the pre-processed historical transaction data, a multi-layer perceptron model is used to perform risk rating on the target financial account to obtain the account risk level.

[0066] This embodiment can perform deep learning on the preprocessed historical transaction data by applying a multi-layer perceptron (MLP) model to assess the risk level of the relevant account. Optionally, the step of using the multi-layer perceptron model to perform risk rating on the target financial account and obtaining the account risk level includes: extracting basic information, account information and credit information of the user involved in the target financial account; inputting the basic information, account information and credit information of the user, as well as the preprocessed historical transaction data into the multi-layer perceptron model, and outputting the risk probability value of the associated target financial account and the account risk level corresponding to the risk probability value, wherein the multi-layer perceptron model includes: an input layer, two hidden layers, and an output layer, using ReLU as the activation function of the multi-layer perceptron model, and using the first log-likelihood loss function as the loss function of the multi-layer perceptron model.

[0067] In the above implementation steps, it is necessary to first extract feature information related to the target financial account from multiple dimensions. These features usually include the user's personal information (such as age, gender, occupation, education, region, etc.), account information (such as account type, number of accounts, etc.) and credit information (such as credit history, repayment record, etc.). By comprehensively considering these features, a comprehensive risk assessment framework can be constructed. The preprocessed historical transaction data is input into the MLP model together with the above extracted features. The MLP model consists of an input layer, two hidden layers and an output layer. It is a deep learning model that can learn and capture complex nonlinear relationships in data. At the input layer, the data is converted into a format acceptable to the model, for example, categorical data is converted into one-hot encoding or label encoding.

[0068] It should be noted that the two hidden layers in the MLP can contain 128 and 64 neurons respectively, and use ReLU (Rectified Linear Unit) as the activation function. The ReLU function can be defined as f(x) = max(0, x), which has a linear relationship when x>0 and outputs 0 when x≤0. The ReLU activation function is widely used in deep learning models because of its simple calculation and ability to alleviate the gradient vanishing problem. In the model training stage, the first log-likelihood loss function is used as the loss function of the multi-layer perceptron model to guide the adjustment of model parameters. The log-likelihood loss function is used for binary classification tasks and can evaluate the difference between the model's predicted probability and the true label. By minimizing this loss function, the model can learn how to more accurately predict the risk probability value of the account, that is, the probability distribution of different risk levels. The trained MLP model will output a risk probability value, indicating the possible probability that the target financial account belongs to high risk, medium risk or low risk level. These probability values ​​not only reflect the current risk status of the account, but also take into account the user's behavioral habits and financial status. Based on these probability values, the system automatically determines the risk level of the account, providing a basis for subsequent dynamic monitoring and security strategy formulation.

[0069] Once the risk level of an account is determined, the system will take appropriate measures based on pre-set rules. For example, for accounts with high risk levels, an immediate alarm mechanism may be triggered, certain sensitive operations may be suspended, or users may be required to perform additional identity verification. Medium risk levels may lead to enhanced monitoring and alarm strategies, while low risk levels may maintain regular monitoring and security strategies.

[0070] Step S203, input the pre-processed historical transaction data and login log into the abnormal model set, and output the abnormal transaction detection result and the abnormal login status monitoring result. The abnormal model set includes: an account abnormal login detection model, a frequent transaction detection model, and a transaction habit abnormality detection model. The account abnormal login detection model is used to analyze the login log to determine whether the target financial account has an abnormal login status. The frequent transaction detection model is used to analyze the transaction quantity of the pre-processed historical transaction data to determine whether the target financial account has abnormal transactions. The transaction habit abnormality detection model is used to analyze the transaction habits of the pre-processed historical transaction data to determine whether the target financial account has abnormal transactions.

[0071] This step S203 uses an abnormal model set to perform in-depth analysis on the pre-processed data, aiming to identify potential abnormal transactions and abnormal login status, thereby protecting account security. The abnormal model set covers three main models: account abnormal login detection model, frequent transaction detection model and transaction habit abnormality detection model. Each model focuses on different types of abnormal behaviors, and together they build a comprehensive monitoring system.

[0072] Optionally, the account abnormal login detection model is trained in the following manner: obtaining financial account login data and user basic information within a specified historical time period, wherein the financial account login data includes at least one of the following: user login time point, number of successful user logins per unit time, number of failed user logins per unit time, number of user personal information modifications per unit time, and user login IP information; constructing a gradient boosting tree; using the financial account login data and user information within a specified historical time period to train the gradient boosting tree; using the trained gradient boosting tree as the account abnormal login detection model, the account abnormal login detection model outputs a probability value of abnormal login, and confirming whether the financial account is in an abnormal login state based on the probability value of abnormal login.

[0073] The account abnormal login detection model is built based on the Gradient Boosting Tree (GBT), which trains a model that can predict the probability of abnormal account login by analyzing historical login data and basic user information. The Gradient Boosting Tree constructs a series of weak prediction models (usually decision trees) and then weights and combines the prediction results of these models to obtain stronger prediction performance.

[0074] In the process of training the model, it is first necessary to collect the financial account login data and user personal information within the specified historical time period. The login data specifically includes the user login time point, the number of successful logins per unit time, the number of failed logins per unit time, the number of personal information modifications per unit time, and the IP information of the user login. After the data is collected, the system preprocesses and extracts features of the data, encodes non-numerical features (such as IP information), ensures the consistency of the data format, and facilitates the processing of the GBT model. In addition, data cleaning is equally important, for example, processing missing values ​​and outliers to ensure the accuracy of model training. Then the model is built and trained: the GBT model is built, the model parameters such as the depth of the tree, the number of leaf nodes, and the regularization parameter are set, and the collected historical login data and user information are used for training. The goal of the training is to optimize the log-likelihood loss function to minimize the difference between the probability of predicting an abnormal login state and the actual state. The gradient boosting tree corrects the residual of the existing model by gradually adding decision trees. Each tree tries to reduce the prediction error of the previous tree, thereby building a more powerful prediction model. After the training is completed, the model needs to be evaluated to ensure its accuracy and generalization ability. In the application stage, when a user attempts to log in, the system inputs the real-time login data into the trained GBT model, and the model outputs the probability value of abnormal login. If the probability value exceeds the preset threshold, the system will determine that the account has an abnormal login status and trigger corresponding security measures, such as requiring secondary verification or temporarily freezing the account.

[0075] Through the above process, the account abnormal login detection model can learn the normal and abnormal patterns of login behavior. Even in the face of complex and changeable network environments and attack methods, it can accurately and quickly identify abnormal login status and provide timely and effective early warning for the entire security monitoring system.

[0076] Optionally, the security monitoring method for financial accounts also includes: in the process of training the gradient boosting tree, using a second log-likelihood loss function as a model loss function; wherein the second log-likelihood loss function is: L(y,p)=-[y log(p)+(1-y)log(1-p)], y represents the true label of the data, the true label refers to the value 1 corresponding to the abnormal account login or the value 0 corresponding to the normal account login, and p is the probability value of the abnormal login of the financial account output by the gradient boosting tree.

[0077] In the process of training the gradient boosted tree (GBT) model, using the second log-likelihood loss function as the loss function of the model is a key step. The log-likelihood loss function is one of the commonly used loss functions in binary classification problems. It can measure the difference between the probability distribution predicted by the model and the true label. Specifically, in the loss function, (y) is the true label of the data. For the detection of abnormal account login, (y) can be 1 (indicating abnormal login) or 0 (indicating normal login), and (p) is the probability value of abnormal login of the financial account output by the GBT model. The value of (p) is between 0 and 1. When the model predicts correctly, the value of the loss function is small; when the model predicts incorrectly, the value of the loss function is large. By minimizing this loss function, the parameters of the model can be optimized so that the model can learn effective features and patterns to distinguish normal logins from abnormal logins during the training process.

[0078] The log-likelihood loss function is chosen as the loss function of GBT because, on the one hand, it can accurately measure the difference between the predicted probability and the true label, which helps to improve the prediction accuracy and stability of the model; on the other hand, the log-likelihood loss function has advantages when processing unbalanced category data (such as when the abnormal login data is far less than the normal login data), and can better weigh the prediction errors of positive and negative samples, making the model more sensitive when predicting less common abnormal logins.

[0079] Optionally, the frequent transaction detection model is trained in the following manner: detecting a first category of historical transaction data of multiple financial accounts, and preprocessing the first category of historical transaction data to obtain training data, wherein the first category of historical transaction data includes at least one of the following: single transaction amount, number of account transactions, number of repeated transactions, and transaction method data; using a sparse autoencoding algorithm to construct a sparse autoencoding anomaly detection model, wherein the sparse autoencoding anomaly detection model includes: an encoder, a decoder, and a hidden layer; inputting the training data into the encoder and decoder in the sparse autoencoding anomaly detection model, and outputting a probability value of the existence of abnormal transactions in the account; using the trained sparse autoencoding anomaly detection model as a frequent transaction detection model, the frequent transaction detection model outputs the probability value of abnormal transactions, and confirming whether there are abnormal transactions in the financial account based on the probability value of abnormal transactions.

[0080] The frequent transaction detection model is implemented by constructing a sparse autoencoder anomaly detection model. First, the system detects the first-category historical transaction data of multiple financial accounts. These data may include single transaction amount, account transaction times, repeated transaction times, transaction method data, etc. By preprocessing these data, including data cleaning, conversion and standardization, a training data set for model training is generated.

[0081] It should be noted that the sparse autoencoder anomaly detection model in this embodiment generally includes an encoder, a decoder, and a hidden layer. In the model training phase, the encoder receives the preprocessed transaction data and encodes it into a feature representation of the hidden layer; the decoder attempts to reconstruct the original data from the feature representation of the hidden layer. The goal of the model is to make the reconstructed data as close to the original data as possible, while forcing the model to learn the most important features in the data by setting a sparse target for the hidden layer (for example, keeping the neurons in the hidden layer in a low activation state most of the time). This model is very effective in dealing with anomaly detection tasks because it distinguishes normal transactions from abnormal transactions through errors in data encoding and decoding.

[0082] It should be further explained that the sparse autoencoder anomaly detection model mentioned in this embodiment is first trained based on normal historical transaction data, and the transaction data of T period is selected. After data cleaning, conversion and normalization, the training data X is generated. The training data X is sequentially input into the encoder and decoder, and the encoding and decoding transformation is performed to obtain The purpose of training is to make the final output of the model as similar as possible to the original data. The objective function of the training is:

[0083]

[0084] L 重构误差 The calculation is as follows:

[0085]

[0086] Where n is the number of samples; L 稀疏性惩罚项 The calculation is as follows:

[0087] L 重构误差 = -ρlog(ρ j )-(1-ρ)log(1-ρ j )

[0088] where ρ is the desired sparse target, ρ j is the average activation value of neuron j in the hidden layer.

[0089] After training, the model can output the probability value of abnormal transactions in the account. For the frequent transaction detection model, abnormal transactions usually refer to transactions that are significantly different from the user's historical transaction pattern, such as a large number of transactions in a short period of time or an abnormally large transaction amount. By setting a threshold, when the probability value output by the model exceeds this threshold, the system will consider that there is abnormal transaction behavior, and then trigger corresponding security measures, such as real-time monitoring, restricting transactions, or notifying users to check account security.

[0090] Optionally, the transaction habit anomaly detection model is trained in the following manner: detecting the second category of historical transaction data of multiple financial accounts, and preprocessing the second category of historical transaction data, wherein the second category of historical transaction data includes at least one of the following: the time point of each financial transaction, and the amounts of multiple transactions; constructing a long short-term memory neural network LSTM, wherein the architecture of the long short-term memory neural network LSTM includes: an encoder, an attention module, and a decoder, the encoder uses LSTM units to process the input sequence, the attention module adjusts the data that the long short-term memory neural network LSTM pays attention to according to the attention score and the attention weight, and the decoder decodes the received transaction data vector and the decoder state of the previous time step; the preprocessed second category of historical transaction data is input into the encoder and the attention module, and the decoder outputs the transaction time habit data and the transaction amount habit data of the financial account; after training, the trained long short-term memory neural network LSTM is used as the transaction habit anomaly detection model.

[0091] The transaction habit anomaly detection model is based on the long short-term memory neural network (LSTM) architecture, which is used to detect the account's transaction time habit data and transaction amount habit data to identify transactions that are inconsistent with historical habits, thereby determining whether the transaction is abnormal. In the model construction phase, the LSTM neural network architecture includes an encoder, an attention module, and a decoder. The encoder uses LSTM units to process the input sequence and learn the time dependency in the sequence; the attention module adjusts the data part that the model focuses on based on the attention score and weight, so that the model can more effectively identify the part of the transaction sequence that is inconsistent with the habit; the decoder attempts to reconstruct the transaction data sequence based on the output of the encoder and attention module, and outputs the transaction time habit data and transaction amount habit data.

[0092] In this embodiment, during the model training process, the second type of historical transaction data of multiple financial accounts must first be preprocessed, including the standardization of time points and the normalization of amounts, to ensure the consistency and comparability of the data. Subsequently, the preprocessed data is input into the LSTM model, and the model parameters are optimized through the back propagation algorithm, so that the model can accurately distinguish between normal transaction sequences and abnormal transaction sequences during the encoding and decoding process. After training, the model can predict the probability value of abnormal transaction habits based on the input transaction data sequence. Based on this probability value, the system can determine whether there are abnormalities in the transactions of the financial account, so as to take timely measures to protect the account security.

[0093] It should be noted that the transaction habit anomaly detection model includes transaction time habit detection and transaction amount habit detection. The transaction habit anomaly detection model is constructed based on the LSTM neural network (for example, the LSTM is set to have two layers, the first layer has 128 and the second layer has 64), and the attention mechanism is introduced. The overall architecture includes an encoder, an attention module and a decoder. The user's transactions are analyzed and processed through the early warning model, and the account information of the detected abnormal transactions is sent to the account management module.

[0094] It should be further explained that the encoder uses LSTM units to process the input sequence as follows:

[0095] h t =LSTM(x t ,h t-1 )

[0096] where x t is the input at time step t, h t-1 is the hidden state at the previous time step;

[0097] The attention module enables the model to focus on the key parts of the input sequence according to the attention score and attention weight, where the attention score e t The calculation is as follows:

[0098] e t =V*tanh(W[h t ,s t ])

[0099] Where V and W are weight matrices, s t is the current decoder state, [h t ,s t ] means s t and h t splicing;

[0100] Attention weight α t The calculation is as follows:

[0101]

[0102] Where T is the length of the sequence.

[0103] It should be further explained that the decoder receives the context vector c t and the decoder state s at the previous time step t-1 Decode as follows:

[0104] s t =LSTM([c t ,y t-1 ],s t-1 )

[0105] The context vector c t Computed via weighted sum:

[0106] Step S204, based on the account risk level, abnormal transaction detection results and abnormal login status monitoring results, calculate the probability value of the current transaction activity of the target financial account being an abnormal transaction, and output transaction alarm prompt information when the probability value indicates that the current transaction activity is an abnormal transaction.

[0107] In the bank account dynamic security monitoring method, step S204 is a comprehensive application stage of risk assessment and anomaly detection. According to various risk and anomaly indicators previously obtained, a comprehensive assessment is made to determine whether the current transaction activity of the target account is an abnormal transaction, and then corresponding early warning or control measures are taken. The account risk level previously obtained by the multi-layer perceptron model, the abnormal transaction detection results obtained by the abnormal model set, and the abnormal login status monitoring results are used as input. These results reflect the static risk level of the account, the abnormal degree of real-time transactions, and the credibility of login behavior. On the basis of comprehensive consideration of the above information, the system calculates the probability value of the current transaction activity of the target financial account as an abnormal transaction. This calculation process may involve a variety of statistical methods and machine learning techniques, such as Bayesian networks, logistic regression, or integrated learning methods. The calculation of the probability value is intended to integrate multiple risk indicators and provide an intuitive abnormal transaction possibility indicator. It should be noted that in this embodiment, a probability threshold can be preset to determine whether the calculated abnormal transaction probability value reaches the warning level. If the probability value exceeds the preset threshold, the system will immediately trigger a transaction alarm prompt message to notify the bank's security team or send it directly to the account holder. The alarm information usually contains details of the abnormal transaction, potential risk warnings and recommended handling measures, such as temporarily freezing the account, requesting secondary verification or contacting the bank's customer service for consultation.

[0108] By implementing step S204, the present invention can realize real-time dynamic security monitoring of the target financial account, ensuring effective intervention at the first time when abnormal transactions occur. This method combines the intelligence of machine learning with the flexibility of bank security policies, significantly improving the efficiency and accuracy of account security monitoring, while also reducing interference with normal user transactions and improving the overall user experience.

[0109] Through the above steps, the historical transaction data and login log of the target financial account can be detected, and the historical transaction data can be preprocessed. Based on the preprocessed historical transaction data, the multi-layer perceptron model is used to perform risk rating on the target financial account to obtain the account risk level. The preprocessed historical transaction data and login log are input into the abnormal model set, and the abnormal transaction detection result and the abnormal login status monitoring result are output. The abnormal model set includes: an account abnormal login detection model, a frequent transaction detection model, and a transaction habit abnormality detection model. The account abnormal login detection model is used to analyze the login log to determine whether the target financial account has an abnormal login status. The frequent transaction detection model is used to perform transaction quantity analysis on the preprocessed historical transaction data to determine whether the target financial account has abnormal transactions. The transaction habit abnormality detection model is used to perform transaction habit analysis on the preprocessed historical transaction data to determine whether the target financial account has abnormal transactions. Based on the account risk level, the abnormal transaction detection result, and the abnormal login status monitoring result, the probability value of the current transaction activity of the target financial account being an abnormal transaction is calculated. When the probability value indicates that the current transaction activity is an abnormal transaction, the transaction alarm prompt information is output. In this embodiment, the quality and risk level of the account can be dynamically evaluated to achieve hierarchical management of user risks. At the same time, the transaction activities generated by each financial account can be monitored in real time, suspicious transaction patterns or abnormal transaction behaviors can be quickly identified, and the alarm mechanism can be triggered. Once an abnormality is detected, the target information can be quickly locked and an alarm can be issued. By constructing and optimizing account risk assessment models, abnormal login detection models, frequent transaction detection models, and transaction habit anomaly detection models, abnormal behaviors can be identified more accurately, and the false alarm rate and missed alarm rate can be reduced, thereby solving the technical problem in the related technology that the financial account monitoring system uses static thresholds to determine whether a transaction is abnormal, which has low flexibility and is prone to false alarms or missed alarms.

[0110] Another optional specific implementation is described in detail below.

[0111] Figure 3 FIG. 1 is a schematic diagram of module connections of an optional financial institution account dynamic security monitoring system according to an embodiment of the present invention. Figure 3 As shown, the monitoring system includes: a data management module, a transaction monitoring module, an account risk assessment module, an account management module and an identity verification module.

[0112] Among them, the data management module is connected to the account risk assessment module and the transaction monitoring module, the early warning model management module is connected to the transaction monitoring module, and the account management module is connected to the account risk assessment module, the transaction monitoring module, and the identity verification module.

[0113] Data management module: used to manage user basic information, mobile payment information, transaction records, login log data, and complete data storage, integration, cleaning, conversion, and balancing. Data cleaning first checks the data structure, defines the data format, manually supplements the missing basic information data, deletes the other data directly, and conducts a secondary review of the outliers. If the review is not possible, it will be deleted directly. Z-Score is used for standardization with few extreme values, and Robust Scaler is considered for data with many extreme points.

[0114] During the data transformation process, ordered categorical variables use label encoding, and unordered categorical variables use one-hot encoding.

[0115] Account risk assessment module: used to conduct a comprehensive assessment of the account, determine the quality and risk level of the account, and implement user risk grading. In an embodiment of the present invention, the account risk assessment module uses a multi-layer perceptron to grade user risk based on the account type, the user's age, gender, education, occupation, location, number of accounts, financial information, and credit history information. The risk level is divided into three categories: high, medium, and low. The present invention comprehensively considers multiple factors and uses a multi-layer perceptron to perform risk rating. By comprehensively considering multiple factors such as the user's personal information, financial status, and credit history, the user's risk level can be more comprehensively assessed, the accuracy and efficiency of risk assessment can be significantly improved, and more secure and reliable financial services can be provided to users.

[0116] Among them, the number of layers of the multi-layer perceptron (MLP) is input layer + two hidden layers (128 + 64 neurons) + output layer, the activation function uses ReLU, and the loss function is the log-likelihood loss function.

[0117] Early warning model management module: maintains the algorithm model used to predict potential risks, and adjusts the model parameters according to historical data and real-time information. In the embodiment of the present invention, the early warning model detects user account anomalies based on the user's basic information, mobile payment information, transaction records, and login log data. The anomaly model includes: account abnormal login detection model, frequent transaction detection model, and transaction habit anomaly detection model.

[0118] It should be noted that the account abnormal login detection model constructs a gradient boosting tree based on the user's age, user login time, number of successful user logins per unit time, number of failed user logins per unit time, number of user personal information modifications per unit time, and user login IP information (for example, setting the tree depth to 5, the number of leaf nodes to 15, and the L2 regularization parameter to 0.57), and uses historical data to train the model. The log-likelihood loss function is used during training, and the formula is as follows:

[0119] L(y,p)=-[y log(p)+(1-y)log(1-p)], where y represents the true label of the data and p is the probability of the model predicting an abnormal login.

[0120] It should be noted that the frequent transaction detection model constructs a sparse autoencoding anomaly detection model based on the amount of a single large transaction, the number of account transactions, the number of repeated transactions, and the transaction method data (for example, setting the encoder and decoder to a symmetrical structure, with 30 neurons respectively, 15 hidden layers, and the sparse target set value of 0.05). Since the number of normal transactions is much larger than the number of abnormal transactions, the model will learn more about the relationship between normal transaction features during the encoding and decoding process, and judge abnormal data through the errors after data encoding and decoding.

[0121] It should be further explained that the sparse autoencoder anomaly detection model is first trained based on normal historical transaction data. The transaction data of T cycles is selected, and the training data X is generated after data cleaning, conversion, and normalization. The training data X is sequentially input into the encoder and decoder, and the encoding and decoding transformations are obtained. The training objective is to make the final output of the model as similar as possible to the original data. The objective function balances the encoding and decoding errors by minimizing the mean square error. In the initial training stage, only transaction data marked as normal is used to train the model to ensure that the model first learns to capture the main patterns and characteristics of normal transactions. The objective function of the training refers to the function formula recorded in the above embodiment.

[0122] It should be noted that the transaction habit anomaly detection model includes transaction time habit detection and transaction amount habit detection. The transaction habit anomaly detection model is built based on the LSTM neural network (for example, LSTM is set to have two layers, one layer has 128 and the second layer has 64), and the attention mechanism is introduced. The overall architecture includes an encoder, an attention module and a decoder. The user's transaction is analyzed and processed by the early warning model, and the account information of the detected abnormal transaction is sent to the account management module. The calculation formula of the LSTM neural network refers to the formula recorded in the above embodiment.

[0123] Transaction monitoring module: monitors all transaction activities of the account in real time, identifies suspicious transaction patterns or abnormal behaviors, and immediately triggers the corresponding alarm mechanism. In a specific embodiment of the present invention, the transaction monitoring module monitors all transaction activities of the account in real time, and can identify suspicious transaction patterns or abnormal behaviors based on the anomaly detection model, and report them to the account management module. The present invention monitors transaction activities in real time, combines anomaly detection models, customizes monitoring strategies according to the user's transaction habits and historical data, can more accurately identify abnormal transactions, reduce false alarm rates and missed alarm rates, and at the same time, through automated monitoring and alarm mechanisms, reduce the pressure of manual monitoring and improve work efficiency.

[0124] Account management and control module: responsible for management and control operations on risky accounts. In a specific embodiment of the present invention, the account management and control module is responsible for management and control operations on accounts identified as risky, including limiting account functions, notifying users, calling the identity verification module for additional verification, and reporting suspicious activity functions. In the present invention, the account management and control module is closely integrated with the account risk assessment module, and determines which accounts need to be managed based on the risk assessment results. By timely managing high-risk accounts, potential financial risks and losses are effectively reduced, ensuring a rapid response to suspicious activities, preventing the spread of risks, protecting customer assets, and preventing financial losses caused by fraud or illegal activities.

[0125] Identity verification module: responsible for verifying whether the user's identity information is authentic and valid, including biometric recognition, document scanning, password and verification code function verification.

[0126] In a specific embodiment of the present invention, the identity verification module supports biometric recognition, document scanning, password and verification code functions, and also supports multi-factor authentication and supports proving the user's identity through additional identity verification processes.

[0127] The present invention can effectively reduce the risk of account theft or fraud through timely account management and control measures, and can reduce false positives for normal users and improve user experience through additional verification processes.

[0128] Figure 4 A financial platform user account security management method based on artificial intelligence according to an embodiment of the present invention is provided. Figure 4 As shown, it includes: data management, account risk assessment, early warning model management, transaction monitoring, account control, and identity verification functions.

[0129] Data management: realize multi-source user data collection, cleaning, and storage. That is, based on the user's basic information, mobile payment information, transaction records, and login log data, complete data storage, integration, cleaning, conversion, and balancing.

[0130] Account risk assessment: Conduct risk assessment on user accounts, determine the quality and risk level of accounts, and implement user risk grading.

[0131] Early warning model management: Match user transaction behaviors and user accounts based on models. Maintain algorithm models for predicting potential risks and adjust model parameters based on historical data and real-time information.

[0132] Transaction monitoring: monitor all transaction activities of the account in real time, identify suspicious transaction patterns or abnormal behaviors, and immediately trigger the corresponding alarm mechanism.

[0133] Account management and control: responsible for the management and control of risk accounts.

[0134] Identity verification: Call the identity verification module for secondary authentication. Responsible for verifying whether the user's identity information is authentic and valid, including biometric recognition, document scanning, password and verification code function verification. Through a variety of verification methods such as biometric recognition, document scanning, password and verification code, the authenticity of the user's identity information can be verified, and the account security can be improved.

[0135] Through the above implementation method, multiple data sources can be integrated and cleaned, such as user basic information, mobile payment information, transaction records and login logs, which can provide more accurate and comprehensive data support, provide a solid data foundation for account risk assessment and transaction monitoring, effectively integrate data from different sources, and support the selection of corresponding data according to different models.

[0136] At the same time, the account risk assessment module of the present invention can be updated in real time, dynamically assess the quality and risk level of the account, and realize hierarchical management of user risks. Compared with the traditional static assessment method, it can better adapt to the real-time changes of account risks. The early warning model management module of the present invention can adjust the model parameters according to historical data and real-time information, use advanced algorithms to predict potential risks, and improve the accuracy and timeliness of early warning.

[0137] Furthermore, the present invention can monitor all transaction activities in real time, quickly identify suspicious transaction patterns or abnormal behaviors, and trigger an alarm mechanism. This real-time performance is crucial in preventing fraud and illegal transactions. Once an anomaly is detected, the system can quickly lock on to the target information and issue an alarm, thereby improving the response speed and processing capabilities to emergencies.

[0138] The following is a detailed description in conjunction with another embodiment.

[0139] Embodiment 2

[0140] A financial account security monitoring device provided in this embodiment includes multiple implementation units, each implementation unit corresponds to each implementation step in the above-mentioned embodiment 1. Its specific implementation methods and beneficial effects can refer to the above-mentioned method embodiments and will not be repeated here.

[0141] Figure 5 is a schematic diagram of an optional financial account security monitoring device according to an embodiment of the present invention, such as Figure 5 As shown, the financial account security monitoring device may include: a transaction data detection unit 51, a risk rating unit 52, a transaction anomaly detection unit 53, and an abnormal transaction identification unit 54.

[0142] The transaction data detection unit 51 is used to detect the historical transaction data and login log of the target financial account and pre-process the historical transaction data.

[0143] The risk rating unit 52 is used to perform risk rating on the target financial account based on the pre-processed historical transaction data using a multi-layer perceptron model to obtain an account risk level;

[0144] The transaction anomaly detection unit 53 is used to input the pre-processed historical transaction data and login log into the anomaly model set, and output the abnormal transaction detection result and the abnormal login status monitoring result, wherein the anomaly model set includes: an account abnormal login detection model, a frequent transaction detection model, and a transaction habit anomaly detection model. The account abnormal login detection model is used to analyze the login log to determine whether the target financial account has an abnormal login status. The frequent transaction detection model is used to analyze the transaction quantity of the pre-processed historical transaction data to determine whether the target financial account has abnormal transactions. The transaction habit anomaly detection model is used to analyze the transaction habits of the pre-processed historical transaction data to determine whether the target financial account has abnormal transactions.

[0145] The abnormal transaction identification unit 54 is used to identify the probability value of the current transaction activity of the target financial account being an abnormal transaction based on the account risk level, the abnormal transaction detection result and the abnormal login status monitoring result, and output transaction alarm prompt information when the probability value indicates that the current transaction activity is an abnormal transaction.

[0146] The above-mentioned financial account security monitoring device can detect the historical transaction data and login log of the target financial account through the transaction data detection unit 51, and pre-process the historical transaction data. The risk rating unit 52 uses a multi-layer perceptron model to rate the risk of the target financial account based on the pre-processed historical transaction data to obtain the account risk level. The pre-processed historical transaction data and login log are input into the abnormal model set through the transaction anomaly detection unit 53, and the abnormal transaction detection result and the abnormal login status monitoring result are output. The abnormal transaction identification unit 54 identifies the probability value of the current transaction activity of the target financial account being an abnormal transaction based on the account risk level, the abnormal transaction detection result and the abnormal login status monitoring result. When the probability value indicates that the current transaction activity is an abnormal transaction, a transaction alarm prompt information is output. In this embodiment, the quality and risk level of the account can be dynamically evaluated to achieve hierarchical management of user risks. At the same time, the transaction activities generated by each financial account can be monitored in real time, suspicious transaction patterns or abnormal transaction behaviors can be quickly identified, and the alarm mechanism can be triggered. Once an abnormality is detected, the target information can be quickly locked and an alarm can be issued. By constructing and optimizing account risk assessment models, abnormal login detection models, frequent transaction detection models, and transaction habit anomaly detection models, abnormal behaviors can be identified more accurately, and the false alarm rate and missed alarm rate can be reduced, thereby solving the technical problem in the related technology that the financial account monitoring system uses static thresholds to determine whether a transaction is abnormal, which has low flexibility and is prone to false alarms or missed alarms.

[0147] Optionally, the risk rating unit includes: a user information extraction module, used to extract basic information, account information and credit information of users involved in the target financial account; a risk assessment module, used to input the user's basic information, account information and credit information, as well as pre-processed historical transaction data into a multi-layer perceptron model, and output a risk probability value associated with the target financial account and an account risk level corresponding to the risk probability value, wherein the multi-layer perceptron model includes: an input layer, two hidden layers, and an output layer, using ReLU as the activation function of the multi-layer perceptron model, and using the first log-likelihood loss function as the loss function of the multi-layer perceptron model.

[0148] Optionally, when training an abnormal account login detection model, the security monitoring device for a financial account includes: a historical login data acquisition unit, used to acquire the financial account login data and basic user information within a specified historical time period, wherein the financial account login data includes at least one of the following: the user login time point, the number of successful user logins per unit time, the number of failed user logins per unit time, the number of user personal information modifications per unit time, and the IP information of the user login; a gradient boosting tree construction unit, used to construct a gradient boosting tree; a first model training unit, used to train the gradient boosting tree using the financial account login data and user information within a specified historical time period; and an abnormal login detection unit, used to use the trained gradient boosting tree as an abnormal account login detection model, the abnormal account login detection model outputs a probability value of abnormal login, and confirms whether the financial account is in an abnormal login state based on the probability value of abnormal login.

[0149] Optionally, the security monitoring device for financial accounts also includes: in the process of training the gradient boosting tree, using a second log-likelihood loss function as a model loss function; wherein the second log-likelihood loss function is: L(y,p)=-[y log(p)+(1-y)log(1-p)], y represents the true label of the data, the true label refers to the value 1 corresponding to the abnormal account login or the value 0 corresponding to the normal account login, and p is the probability value of the abnormal login of the financial account output by the gradient boosting tree.

[0150] Optionally, when training a frequent transaction detection model, the security monitoring device for financial accounts includes: a first historical transaction data detection unit, used to detect a first type of historical transaction data of multiple financial accounts, and pre-process the first type of historical transaction data to obtain training data, wherein the first type of historical transaction data includes at least one of the following: a single transaction amount, number of account transactions, number of repeated transactions, and transaction method data; a sparse autoencoding algorithm is used to construct a sparse autoencoding anomaly detection model, wherein the sparse autoencoding anomaly detection model includes: an encoder, a decoder, and a hidden layer; an abnormal transaction probability calculation unit, used to input the training data into the encoder and decoder in the sparse autoencoding anomaly detection model, and output a probability value of the existence of abnormal transactions in the account; an abnormal transaction calculation unit, used to use the trained sparse autoencoding anomaly detection model as a frequent transaction detection model, the frequent transaction detection model outputs the probability value of abnormal transactions, and confirms whether the financial account has abnormal transactions based on the probability value of abnormal transactions.

[0151] Optionally, when training a transaction habit anomaly detection model, the security monitoring device for financial accounts includes: a second historical transaction data detection unit, used to detect the second type of historical transaction data of multiple financial accounts, and pre-process the second type of historical transaction data, wherein the second type of historical transaction data includes at least one of the following: the time point of each financial transaction and the amounts of multiple transactions; a neural network construction unit, used to construct a long short-term memory neural network LSTM, wherein the architecture of the long short-term memory neural network LSTM includes: an encoder, an attention module and a decoder, the encoder uses an LSTM unit to process an input sequence, the attention module adjusts the data that the long short-term memory neural network LSTM pays attention to according to the attention score and the attention weight, and the decoder decodes the received transaction data vector and the decoder state of the previous time step; a transaction habit output unit, used to input the pre-processed second type of historical transaction data into the encoder and the attention module, and the decoder outputs the transaction time habit data and the transaction amount habit data of the financial account; an abnormal transaction habit detection unit, used to use the trained long short-term memory neural network LSTM as a transaction habit anomaly detection model after training.

[0152] Optionally, the transaction data detection unit includes: a cleaning module, used to perform cleaning processing on historical transaction data, wherein the cleaning processing includes: detecting the transaction data format, and according to the transaction data format, using the Z-Score standardization strategy to perform normal mapping processing on the historical transaction data, and using the Robust Sca ler strategy to delete extreme values ​​and outlier data in the historical transaction data; a conversion module, used to perform conversion processing and balancing processing on the historical transaction data.

[0153] Optionally, the security monitoring device for financial accounts also includes: a user identity acquisition unit, used to obtain user identity information of the logged-in user before detecting the historical transaction data and login log of the target financial account, wherein the user identity information includes: user biometrics, certificate information, login account and password; an identity authentication unit, used to perform multiple verification processes on the user identity information to obtain an identity authentication result; an identity authentication pass module, used to start detecting the historical transaction data and login log of the target financial account when the identity authentication result indicates that the user identity has passed the verification.

[0154] The security monitoring device for the above-mentioned financial account may also include a processor and a memory. The above-mentioned transaction data detection unit 51, risk rating unit 52, transaction anomaly detection unit 53, abnormal transaction identification unit 54, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0155] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the security monitoring of financial accounts based on artificial intelligence can be achieved by adjusting kernel parameters.

[0156] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory (fl ash RAM), and the memory includes at least one storage chip.

[0157] Embodiment 3

[0158] An embodiment of the present application may provide an electronic device, Figure 6 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 (only one is shown) processor 602, memory 604, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0159] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the security monitoring method and device of the financial account in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the security monitoring method of the financial account mentioned above. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0160] The processor can call the information and application program stored in the memory through the transmission device to perform the following steps: detect the historical transaction data and login log of the target financial account, and pre-process the historical transaction data; based on the pre-processed historical transaction data, use the multi-layer perceptron model to perform risk rating on the target financial account to obtain the account risk level; input the pre-processed historical transaction data and login log into the abnormal model set, and output the abnormal transaction detection result and the abnormal login status monitoring result, wherein the abnormal model set includes: an account abnormal login detection model, a frequent transaction detection model, and a transaction habit abnormality detection model, the account abnormal login detection model is used to analyze the login log to determine whether the target financial account has an abnormal login status, the frequent transaction detection model is used to analyze the transaction quantity of the pre-processed historical transaction data to determine whether the target financial account has abnormal transactions, and the transaction habit abnormality detection model is used to analyze the transaction habits of the pre-processed historical transaction data to determine whether the target financial account has abnormal transactions; based on the account risk level, the abnormal transaction detection result and the abnormal login status monitoring result, calculate the probability value that the current transaction activity of the target financial account is an abnormal transaction, and output the transaction alarm prompt information when the probability value indicates that the current transaction activity is an abnormal transaction.

[0161] It can be understood by those skilled in the art that Figure 6 The structure shown is for illustration only, and the electronic device may also be a terminal device such as a smart phone, a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, etc. Figure 6 The structure of the electronic device is not limited. Figure 6 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 6 Different configurations shown.

[0162] A person of ordinary skill in the art can understand that all or part of the steps in the security monitoring methods for various financial accounts in the above-mentioned embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0163] Embodiment 4

[0164] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the financial account security monitoring method provided in the first embodiment.

[0165] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, the computer-readable storage medium including a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the financial account security monitoring method of any one of the above-mentioned embodiments one.

[0166] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0167] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the financial account security monitoring method described in each embodiment of the present application.

[0168] The present application also provides a computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the financial account security monitoring method described in each embodiment of the present application are implemented.

[0169] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0170] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0171] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0172] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0173] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for security monitoring of a financial account, characterized in that: include: Detecting historical transaction data and login logs of the target financial account, and preprocessing the historical transaction data; Based on the preprocessed historical transaction data, a multi-layer perceptron model is used to perform risk rating on the target financial account to obtain an account risk level; Input the preprocessed historical transaction data and the login log into an abnormal model set, and output abnormal transaction detection results and abnormal login status monitoring results, wherein the abnormal model set includes: an account abnormal login detection model, a frequent transaction detection model, and a transaction habit abnormality detection model, the account abnormal login detection model is used to analyze the login log to determine whether the target financial account has an abnormal login status, the frequent transaction detection model is used to perform transaction quantity analysis on the preprocessed historical transaction data to determine whether the target financial account has abnormal transactions, and the transaction habit abnormality detection model is used to perform transaction habit analysis on the preprocessed historical transaction data to determine whether the target financial account has abnormal transactions; Based on the account risk level, the abnormal transaction detection result and the abnormal login status monitoring result, a probability value that the current transaction activity of the target financial account is an abnormal transaction is calculated, and when the probability value indicates that the current transaction activity is an abnormal transaction, a transaction alarm prompt information is output.

2. The method for security monitoring of financial accounts according to claim 1, characterized in that: The step of using a multi-layer perceptron model to perform risk rating on the target financial account to obtain the account risk level includes: Extracting basic information, account information, and credit information of users involved in the target financial account; The basic information, account information and credit information of the user, and the preprocessed historical transaction data are input into the multi-layer perceptron model, and the risk probability value associated with the target financial account and the account risk level corresponding to the risk probability value are output, wherein the multi-layer perceptron model includes: an input layer, two hidden layers, and an output layer, ReLU is used as the activation function of the multi-layer perceptron model, and the first log-likelihood loss function is used as the loss function of the multi-layer perceptron model.

3. The method for security monitoring of financial accounts according to claim 1, characterized in that: The account abnormal login detection model is trained in the following way: Obtaining financial account login data and basic user information within a specified historical time period, wherein the financial account login data includes at least one of the following: user login time, number of successful user logins per unit time, number of failed user logins per unit time, number of user personal information modifications per unit time, and user login IP information; Build a gradient boosted tree; Using the financial account login data and user information within the historical specified time period to train the gradient boosting tree; The trained gradient boosting tree is used as the account abnormal login detection model, and the account abnormal login detection model outputs the probability value of abnormal login, and based on the probability value of abnormal login, it is confirmed whether the financial account has an abnormal login status.

4. The method for security monitoring of financial accounts according to claim 3, characterized in that: include: In the process of training the gradient boosting tree, using a second log-likelihood loss function as a model loss function; Among them, the second log-likelihood loss function is: L(y,p)=-[ylog(p)+(1-y)log(1-p)], y represents the true label of the data, the true label refers to the value 1 corresponding to the abnormal account login or the value 0 corresponding to the normal account login, and p is the probability value of the abnormal login of the financial account output by the gradient boosting tree.

5. The method for security monitoring of financial accounts according to claim 1, characterized in that: The frequent transaction detection model is trained in the following way: Detecting first-category historical transaction data of multiple financial accounts, and preprocessing the first-category historical transaction data to obtain training data, wherein the first-category historical transaction data includes at least one of the following: single transaction amount, account transaction number, repeated transaction number, and transaction method data; A sparse autoencoding algorithm is used to construct a sparse autoencoding anomaly detection model, wherein the sparse autoencoding anomaly detection model includes: an encoder, a decoder, and a hidden layer; Input the training data into the encoder and decoder in the sparse autoencoder anomaly detection model, and output the probability value of the account having abnormal transactions; The trained sparse autoencoder anomaly detection model is used as the frequent transaction detection model, the frequent transaction detection model outputs a probability value of abnormal transactions, and based on the probability value of abnormal transactions, it is confirmed whether there is an abnormal transaction in the financial account.

6. The method for security monitoring of financial accounts according to claim 1, characterized in that: The transaction habit anomaly detection model is trained in the following way: Detecting the second type of historical transaction data of multiple financial accounts and preprocessing the second type of historical transaction data, wherein the second type of historical transaction data includes at least one of the following: the time point of each financial transaction and the amount of multiple transactions; Constructing a long short-term memory neural network LSTM, wherein the architecture of the long short-term memory neural network LSTM includes: an encoder, an attention module and a decoder, wherein the encoder uses an LSTM unit to process an input sequence, the attention module adjusts the data that the long short-term memory neural network LSTM pays attention to according to the attention score and the attention weight, and the decoder decodes the received transaction data vector and the decoder state of the previous time step; The pre-processed second-category historical transaction data is input into the encoder and the attention module, and the decoder outputs the transaction time habit data and the transaction amount habit data of the financial account; After the training is completed, the trained long short-term memory neural network LSTM is used as the trading habit anomaly detection model.

7. The method for security monitoring of financial accounts according to claim 1, characterized in that: The step of preprocessing the historical transaction data includes: Cleaning the historical transaction data, wherein the cleaning process includes: detecting the transaction data format, and according to the transaction data format, performing normal mapping processing on the historical transaction data using a Z-Score normalization strategy, and removing extreme values ​​and outlier data in the historical transaction data using a Robust Scaler strategy; The historical transaction data is converted and balanced.

8. The method for security monitoring of financial accounts according to claim 1, characterized in that: Before detecting the historical transaction data and login logs of the target financial account, it also includes: Obtaining user identity information of the logged-in user, wherein the user identity information includes: user biometrics, certificate information, login account number and password; Perform multiple verification processes on the user identity information to obtain an identity verification result; When the identity verification result indicates that the user identity is verified, the historical transaction data and login log of the target financial account are detected.

9. A security monitoring device for a financial account, characterized in that: include: A transaction data detection unit, used to detect historical transaction data and login logs of a target financial account, and pre-process the historical transaction data; A risk rating unit, configured to perform risk rating on the target financial account using a multi-layer perceptron model based on the pre-processed historical transaction data to obtain an account risk level; a transaction anomaly detection unit, configured to input the preprocessed historical transaction data and the login log into an anomaly model set, and output an abnormal transaction detection result and an abnormal login status monitoring result, wherein the anomaly model set includes: an account abnormal login detection model, a frequent transaction detection model, and a transaction habit anomaly detection model; the account abnormal login detection model is configured to analyze the login log to determine whether the target financial account has an abnormal login status; the frequent transaction detection model is configured to perform a transaction quantity analysis on the preprocessed historical transaction data to determine whether the target financial account has an abnormal transaction; and the transaction habit anomaly detection model is configured to perform a transaction habit analysis on the preprocessed historical transaction data to determine whether the target financial account has an abnormal transaction; The abnormal transaction identification unit is used to identify the probability value of the current transaction activity of the target financial account being an abnormal transaction based on the account risk level, the abnormal transaction detection result and the abnormal login status monitoring result, and output transaction alarm prompt information when the probability value indicates that the current transaction activity is an abnormal transaction.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the financial account security monitoring method according to any one of claims 1 to 8.

11. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the financial account security monitoring method described in any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the financial account security monitoring method described in any one of claims 1 to 8 are implemented.

Images