Security monitoring methods and devices, electronic devices and storage media for financial accounts

Abstract

This invention discloses a method, device, electronic equipment, and storage medium for security monitoring of financial accounts, relating to the field of financial technology. The method includes: detecting historical transaction data and login logs of the financial account; using a multilayer perceptron model to perform risk rating on the target financial account based on preprocessed historical transaction data to obtain an account risk level; inputting the preprocessed historical transaction data and login logs into an anomaly model set; outputting abnormal transaction detection results and abnormal login status monitoring results; calculating the probability value of the current transaction activity of the financial account being an abnormal transaction based on the account risk level, abnormal transaction detection results, and abnormal login status monitoring results; and outputting transaction alarm information based on the probability value. This invention solves the technical problem in related technologies where financial account monitoring systems use static thresholds to determine whether transactions are abnormal, resulting in low flexibility and a tendency to generate false alarms or missed alarms.

Description

Technical Field

[0001] This invention relates to the field of financial technology or other related fields, and more specifically, to a method and apparatus for security monitoring of financial accounts, electronic devices and storage media. Background Technology

[0002] With the rapid development of financial technology, digital payments and online banking services have become commonplace in people's daily lives. Therefore, financial institutions urgently need to adopt more advanced technological means to ensure account security and prevent and respond quickly to potential illegal operations.

[0003] Traditional bank account security monitoring systems primarily rely on preset rules and thresholds, such as anomaly detection based on transaction amounts or monitoring based on login frequency. While these systems can identify and prevent some obvious illegal activities to a certain extent, they have significant drawbacks: existing security monitoring systems often focus on a specific aspect of an account, such as transaction amount or login frequency, while neglecting comprehensive analysis of account behavior. This results in limited ability to identify complex and multi-dimensional attack methods. Furthermore, most monitoring systems use static thresholds to judge anomalies, which is inflexible in the face of constantly changing attack methods and user behavior patterns, easily leading to false positives or false negatives.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a method, apparatus, electronic device, and storage medium for security monitoring of financial accounts, to at least solve the technical problems in related technologies where financial account monitoring systems use static thresholds to determine whether transactions are abnormal, resulting in low flexibility and a tendency to generate false alarms or missed alarms.

[0006] To achieve the above objectives, according to one aspect of this application, a method for security monitoring of a financial account is provided, comprising: detecting historical transaction data and login logs of a target financial account, and preprocessing the historical transaction data; based on the preprocessed historical transaction data, using a multilayer perceptron model to perform risk rating on the target financial account, obtaining an account risk level; inputting the preprocessed historical transaction data and the login logs into an anomaly model set, and outputting anomaly transaction detection results and anomaly login status monitoring results, wherein the anomaly model set includes: an account anomaly login detection model, a frequent transaction detection model, and an abnormal transaction habit detection model, the account anomaly login detection model being used to detect... The login logs are analyzed to determine if the target financial account has an abnormal login status. The frequent transaction detection model is used to analyze the transaction volume of the preprocessed historical transaction data to determine if the target financial account has abnormal transactions. The abnormal transaction habit detection model is used to analyze the transaction habits of the preprocessed historical transaction data to determine if the target financial account has abnormal transactions. Based on the account risk level, the abnormal transaction detection results, and the abnormal login status monitoring results, the probability value of the current transaction activity of the target financial account being an abnormal transaction is calculated. If the probability value indicates that the current transaction activity is an abnormal transaction, a transaction alarm message is output.

[0007] Optionally, the step of using a multilayer perceptron model to perform risk rating on the target financial account and obtain the account risk level includes: extracting basic information, account information, and credit information of the user involved in the target financial account; inputting the user's basic information, account information, and credit information, as well as the preprocessed historical transaction data, into the multilayer perceptron model, and outputting the risk probability value associated with the target financial account and the account risk level corresponding to the risk probability value. The multilayer perceptron model includes an input layer, two hidden layers, and an output layer, using ReLU as the activation function and a first log-likelihood loss function as the loss function.

[0008] Optionally, the abnormal account login detection model is trained as follows: financial account login data and user basic information are obtained within a specified historical time period, wherein the financial account login data includes at least one of the following: user login time, number of successful logins per unit time, number of failed logins per unit time, number of times user personal information is modified per unit time, and user login IP information; a gradient boosting tree is constructed; the gradient boosting tree is trained using the financial account login data and user information within the specified historical time period; the trained gradient boosting tree is used as the abnormal account login detection model, and the abnormal account login detection model outputs a probability value of abnormal login, confirming whether the financial account has an abnormal login status based on the probability value of abnormal login.

[0009] Optionally, the security monitoring method for financial accounts further includes: using a second log-likelihood loss function as the model loss function during the training of the gradient boosting tree; wherein the second log-likelihood loss function is: L(y,p)=-[y log(p)+(1-y)log(1-p)], y represents the true label of the data, the true label refers to the value 1 corresponding to abnormal account login or the value 0 corresponding to normal account login, and p is the probability value of abnormal financial account login output by the gradient boosting tree.

[0010] Optionally, the frequent transaction detection model is trained as follows: Firstly, historical transaction data of multiple financial accounts is detected, and the first type of historical transaction data is preprocessed to obtain training data, wherein the first type of historical transaction data includes at least one of the following: single transaction amount, number of account transactions, number of repeated transactions, and transaction method data; a sparse autoencoder anomaly detection model is constructed using a sparse autoencoder algorithm, wherein the sparse autoencoder anomaly detection model includes an encoder, a decoder, and a hidden layer; the training data is input into the encoder and decoder in the sparse autoencoder anomaly detection model, and the probability value of abnormal transactions in the account is output; the trained sparse autoencoder anomaly detection model is used as the frequent transaction detection model, and the probability value of abnormal transactions is output by the frequent transaction detection model, and the presence of abnormal transactions in the financial account is confirmed based on the probability value of abnormal transactions.

[0011] Optionally, the abnormal trading habit detection model is trained as follows: Detecting second-type historical trading data from multiple financial accounts and preprocessing the second-type historical trading data, wherein the second-type historical trading data includes at least one of the following: the time point of each financial transaction, and the amount of multiple transactions; constructing a Long Short-Term Memory (LSTM) neural network, wherein the architecture of the LSTM neural network includes an encoder, an attention module, and a decoder, the encoder using LSTM units to process the input sequence, the attention module adjusting the data that the LSTM neural network focuses on according to the attention score and attention weight, and the decoder decoding the received transaction data vector and the decoder state of the previous time step; inputting the preprocessed second-type historical trading data into the encoder and attention module, and the decoder outputting the trading time habit data and trading amount habit data of the financial accounts; after training, using the trained LSTM neural network as the abnormal trading habit detection model.

[0012] Optionally, the step of preprocessing the historical transaction data includes: cleaning the historical transaction data, wherein the cleaning process includes: detecting the transaction data format, and according to the transaction data format, performing normal mapping processing on the historical transaction data using a Z-Score normalization strategy, and deleting extreme values ​​and outliers in the historical transaction data using a Robust Scaler strategy; and performing transformation and balancing processing on the historical transaction data.

[0013] Optionally, before detecting the historical transaction data and login logs of the target financial account, the method further includes: obtaining the user identity information of the logged-in user, wherein the user identity information includes: user biometrics, identification information, login account and password; performing multiple verification processes on the user identity information to obtain an identity verification result; and, if the identity verification result indicates that the user's identity has been verified, starting to detect the historical transaction data and login logs of the target financial account.

[0014] According to another aspect of the present invention, a security monitoring device for a financial account is also provided, comprising: a transaction data detection unit, configured to detect historical transaction data and login logs of a target financial account, and preprocess the historical transaction data; a risk rating unit, configured to perform risk rating on the target financial account based on the preprocessed historical transaction data using a multilayer perceptron model to obtain an account risk level; and a transaction anomaly detection unit, configured to input the preprocessed historical transaction data and login logs into an anomaly model set, and output anomaly transaction detection results and anomaly login status monitoring results, wherein the anomaly model set includes: an account anomaly login detection model, a frequent transaction detection model, and a transaction habit anomaly detection model, and the account anomaly login... The login log detection model analyzes the login logs to determine if the target financial account has an abnormal login status. The frequent transaction detection model analyzes the transaction volume of the preprocessed historical transaction data to determine if the target financial account has abnormal transactions. The abnormal transaction habit detection model analyzes the transaction habits of the preprocessed historical transaction data to determine if the target financial account has abnormal transactions. The abnormal transaction discrimination unit identifies the probability value of the current transaction activity of the target financial account as an abnormal transaction based on the account risk level, the abnormal transaction detection results, and the abnormal login status monitoring results. If the probability value indicates that the current transaction activity is an abnormal transaction, it outputs a transaction alarm message.

[0015] Optionally, the risk rating unit includes: a user information extraction module, used to extract basic information, account information, and credit information of the user involved in the target financial account; and a risk assessment module, used to input the user's basic information, account information, and credit information, as well as the preprocessed historical transaction data, into the multilayer perceptron model, and output the risk probability value associated with the target financial account and the account risk level corresponding to the risk probability value. The multilayer perceptron model includes: an input layer, two hidden layers, and an output layer, using ReLU as the activation function of the multilayer perceptron model and a first log-likelihood loss function as the loss function of the multilayer perceptron model.

[0016] Optionally, the security monitoring device for the financial account, when training the abnormal login detection model, includes: a historical login data acquisition unit, used to acquire financial account login data and user basic information within a specified historical time period, wherein the financial account login data includes at least one of the following: user login time point, number of successful logins per unit time, number of failed logins per unit time, number of times user personal information is modified per unit time, and user login IP information; a gradient boosting tree construction unit, used to construct a gradient boosting tree; a first model training unit, used to train the gradient boosting tree using the financial account login data and user information within the specified historical time period; and an abnormal login detection unit, used to use the trained gradient boosting tree as the abnormal login detection model, and to output an abnormal login probability value based on the abnormal login probability value to confirm whether the financial account has an abnormal login status.

[0017] Optionally, the security monitoring device for financial accounts further includes: using a second log-likelihood loss function as the model loss function during the training of the gradient boosting tree; wherein the second log-likelihood loss function is: L(y,p)=-[y log(p)+(1-y)log(1-p)], y represents the true label of the data, the true label refers to the value 1 corresponding to abnormal account login or the value 0 corresponding to normal account login, and p is the probability value of abnormal financial account login output by the gradient boosting tree.

[0018] Optionally, the security monitoring device for the financial account, when training the frequent transaction detection model, includes: a first historical transaction data detection unit, used to detect a first type of historical transaction data from multiple financial accounts, and preprocess the first type of historical transaction data to obtain training data, wherein the first type of historical transaction data includes at least one of the following: single transaction amount, number of account transactions, number of repeated transactions, and transaction method data; a sparse autoencoder algorithm is used to construct a sparse autoencoder anomaly detection model, wherein the sparse autoencoder anomaly detection model includes: an encoder, a decoder, and a hidden layer; an abnormal transaction probability calculation unit, used to input the training data into the encoder and decoder in the sparse autoencoder anomaly detection model, and output the probability value of abnormal transactions in the account; and an abnormal transaction calculation unit, used to use the trained sparse autoencoder anomaly detection model as the frequent transaction detection model, and the frequent transaction detection model outputs the probability value of abnormal transactions, and based on the probability value of abnormal transactions, confirm whether there are abnormal transactions in the financial account.

[0019] Optionally, the security monitoring device for the financial account, when training the abnormal transaction habit detection model, includes: a second historical transaction data detection unit, used to detect a second type of historical transaction data from multiple financial accounts and preprocess the second type of historical transaction data, wherein the second type of historical transaction data includes at least one of the following: the time point of each financial transaction, and the amount of multiple transactions; a neural network construction unit, used to construct a Long Short-Term Memory (LSTM) neural network, wherein the architecture of the LSTM neural network includes: an encoder, an attention module, and a decoder, wherein the encoder uses the LSTM unit to process the input sequence, the attention module adjusts the data that the LSTM neural network focuses on according to the attention score and attention weight, and the decoder decodes the received transaction data vector and the decoder state of the previous time step; a transaction habit output unit, used to input the preprocessed second type of historical transaction data into the encoder and the attention module, and the decoder outputs the transaction time habit data and transaction amount habit data of the financial account; and an abnormal transaction habit detection unit, used to use the trained LSTM neural network as the abnormal transaction habit detection model after training is completed.

[0020] Optionally, the transaction data detection unit includes: a cleaning module for cleaning the historical transaction data, wherein the cleaning process includes: detecting the transaction data format, and according to the transaction data format, performing normalization processing on the historical transaction data using a Z-Score normalization strategy, and deleting extreme values ​​and outliers in the historical transaction data using a Robust Scaler strategy; and a transformation module for transforming and balancing the historical transaction data.

[0021] Optionally, the security monitoring device for financial accounts further includes: a user identity acquisition unit, used to acquire the user identity information of the logged-in user before detecting the historical transaction data and login logs of the target financial account, wherein the user identity information includes: user biometrics, identification information, login account and password; an identity verification unit, used to perform multi-factor authentication on the user identity information to obtain an identity verification result; and an identity verification pass module, used to start detecting the historical transaction data and login logs of the target financial account when the identity verification result indicates that the user identity has been verified.

[0022] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the security monitoring method for financial accounts described above.

[0023] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the financial account security monitoring method described above.

[0024] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the security monitoring method for financial accounts described in any one of the above embodiments.

[0025] In this disclosure, historical transaction data and login logs of a target financial account can be detected. The historical transaction data is preprocessed, and based on the preprocessed historical transaction data, a multilayer perceptron model is used to perform risk rating on the target financial account to obtain the account risk level. The preprocessed historical transaction data and login logs are input into an anomaly model set, and anomaly transaction detection results and anomaly login status monitoring results are output. The anomaly model set includes: an account anomaly login detection model, a frequent transaction detection model, and a transaction habit anomaly detection model. The account anomaly login detection model is used to analyze the login logs to determine whether there is an abnormal login status of the target financial account. The frequent transaction detection model is used to analyze the transaction quantity of the preprocessed historical transaction data to determine whether there are abnormal transactions in the target financial account. The transaction habit anomaly detection model is used to analyze the transaction habits of the preprocessed historical transaction data to determine whether there are abnormal transactions in the target financial account. Based on the account risk level, the anomaly transaction detection results, and the anomaly login status monitoring results, the probability value of the current transaction activity of the target financial account being an anomaly transaction is calculated. When the probability value indicates that the current transaction activity is an anomaly transaction, a transaction alarm message is output.

[0026] Based on the aforementioned publicly available information, the quality and risk level of accounts can be dynamically assessed, enabling tiered management of user risk. Simultaneously, it allows for real-time monitoring of transaction activities generated by each financial account, quickly identifying suspicious transaction patterns or abnormal transaction behaviors, and triggering alarm mechanisms. Once an anomaly is detected, the system can rapidly locate the target information and issue an alarm. By constructing and optimizing account risk assessment models, abnormal login detection models, frequent transaction detection models, and abnormal transaction habit detection models, it is possible to more accurately identify abnormal behavior, reduce false alarm rates and missed alarm rates, thereby solving the technical problem in related technologies where financial account monitoring systems use static thresholds to determine whether transactions are abnormal, resulting in low flexibility and a tendency to generate false alarms or missed alarms. Attached Figure Description

[0027] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0028] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for secure monitoring of financial accounts is shown.

[0029] Figure 2 This is a flowchart of an optional financial account security monitoring method according to an embodiment of the present invention;

[0030] Figure 3 This is a schematic diagram of the module connection of an optional dynamic security monitoring system for financial institution accounts according to an embodiment of the present invention;

[0031] Figure 4 This is an embodiment of the present invention, which describes a method for managing the security of user accounts on a financial platform based on artificial intelligence.

[0032] Figure 5 This is a schematic diagram of an optional financial account security monitoring device according to an embodiment of the present invention;

[0033] Figure 6 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0034] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0035] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0036] To facilitate understanding of the present invention by those skilled in the art, some terms or nouns involved in the various embodiments of the present invention are explained below:

[0037] A Multi-Layer Perceptron (MLP) is a type of feedforward artificial neural network. It consists of an input layer, at least one hidden layer, and an output layer. The neurons (nodes) connecting these layers form a complex network structure. Each neuron has weights and biases, and activation functions are used to perform non-linear transformations on the input data to improve the model's learning and expressive capabilities. In the financial account security monitoring method of this invention, MLP can be used to comprehensively assess the risk level of an account. By learning multiple user attributes and transaction history, it outputs a probability distribution reflecting the account's risk level, helping banks identify potentially high-risk accounts.

[0038] The log-likelihood loss function is a loss function suitable for classification tasks, especially binary classification problems such as logistic regression or neural network classifiers. In the account security monitoring method of this invention, the log-likelihood loss function can be used to train models such as MLPs and gradient boosting trees, helping the models learn how to accurately predict whether an account has abnormal login or transaction behavior.

[0039] A sparse autoencoder is a variant of an autoencoder designed to produce a sparse representation of data, meaning that only a small number of neurons are activated in the encoding layer. In the account security monitoring method of this invention, the sparse autoencoder can be used to detect abnormal transactions. The model learns sparse representations of normal transactions; when an abnormal transaction is input, the model's reconstruction error increases significantly, which can serve as a basis for detecting abnormal transactions.

[0040] Long Short-Term Memory (LSTM) neural networks are used to solve the vanishing or exploding gradient problem in long data sequences, effectively handling time series and sequence-dependent tasks. In the account security monitoring method of this invention, the LSTM neural network can be used to analyze the transaction time series of an account, learn transaction habits and patterns, and thus detect abnormal behavior in transaction time or amount. By incorporating an attention mechanism, the LSTM model can focus more on key parts of the transaction sequence, improving the accuracy and efficiency of anomaly detection.

[0041] It should be noted that the financial account security monitoring method and device disclosed herein can be used in the financial technology field to achieve security monitoring of financial accounts based on financial technology, and can also be used in any field other than the financial technology field to achieve security monitoring of financial accounts based on financial technology. The application field of the financial account security monitoring method and device disclosed herein is not limited.

[0042] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected in this public disclosure are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.

[0043] It should be noted that in this disclosure, customer information is collected and analyzed, and users are provided with corresponding operation entry points to choose whether to agree to or reject the automated decision results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0044] The following embodiments of the present invention can be applied to various systems / applications / devices for security monitoring of financial accounts. The present invention can monitor all financial transaction activities in real time, quickly identify suspicious transaction patterns or abnormal behaviors, and trigger an alarm mechanism. Once an anomaly is detected, it can quickly lock onto the target information and issue an alarm, improving the response speed and handling capability to emergencies. Simultaneously, the present invention can also update in real time, dynamically assess the quality and risk level of accounts, realize hierarchical management of user risk, and adjust model parameters based on historical data and real-time information, using advanced algorithms to predict potential risks, improving the accuracy and timeliness of early warnings.

[0045] In addition, by constructing and optimizing account risk assessment models, abnormal login detection models, frequent transaction detection models, and abnormal transaction habit detection models, this invention can more accurately identify abnormal behavior, reduce false alarm rates and false negative rates, and improve the overall system's anomaly detection capabilities.

[0046] Furthermore, this invention supports dynamic assessment and classification of user risk, and can adjust security strategies according to the specific circumstances of each user, avoiding a one-size-fits-all management approach, reducing interference with normal user transactions, and improving user experience.

[0047] The present invention will now be described in detail with reference to various embodiments.

[0048] Example 1

[0049] According to an embodiment of the present invention, an embodiment of a security monitoring method for financial accounts is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0050] The financial account security monitoring method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a method for secure monitoring of financial accounts is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1 (Illustrated using 102a, 102b, ..., 102n) Processor 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), memory 104 for storing data, and transmission device 106 for communication functions. In addition, it may include: a display, input / output interface (I / O interface), Universal Serial Bus (USB) port (which may be included as one of the ports of a BUS bus), network interface, power supply, and / or camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0051] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0052] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the financial account security monitoring method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned financial account security monitoring method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0053] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0054] The display can be, for example, a touchscreen liquid crystal display (LCD), which allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0055] It should be noted that the financial account security monitoring method and system of the present invention can be applied to various bank account security management scenarios in the fintech field. For example, in real-time transaction monitoring scenarios: when users conduct online payments, transfers, and other transactions, the system analyzes transaction data in real time, combines the user's historical transaction habits with the current account risk level, and quickly identifies suspicious transaction patterns, such as a large number of transactions in a short period of time, abnormal transaction amounts, and transactions inconsistent with historical transaction patterns, and issues timely risk warnings to prevent fraudulent activities. In transaction habit anomaly detection scenarios: based on long-term user transaction data, an LSTM neural network combined with an attention mechanism is used to learn the user's transaction habits, such as transaction time and transaction amount. When a transaction that is significantly different from the user's historical behavior is detected, the system can promptly trigger further verification to protect the user from fraud.

[0056] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for security monitoring of financial accounts is shown. Figure 2 This is a flowchart of an optional financial account security monitoring method according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0057] In the process of dynamic security monitoring of bank accounts, the system first needs to obtain the login user's comprehensive identity information, including but not limited to the user's biometrics, identification information, login account, and password. Optionally, before detecting the target financial account's historical transaction data and login logs, the system obtains the login user's identity information, which includes: user biometrics, identification information, login account, and password; performs multi-factor authentication on the user's identity information to obtain the authentication result; and if the authentication result indicates that the user's identity has been verified, it begins to detect the target financial account's historical transaction data and login logs. This ensures that only verified users can access their account information, thereby increasing account security.

[0058] Biometric identification is a technology for user authentication based on natural characteristics (such as fingerprints, facial recognition, voiceprints, etc.). In this embodiment of the invention, the user's biometric data can be captured and analyzed, and compared with user templates stored in the system to confirm the authenticity and uniqueness of the user's identity, significantly improving the security of identity verification because biometric features are difficult to copy or forge. Then, document information scanning and verification are performed. The user's document information (ID card, passport, driver's license, etc.) is obtained through a camera or uploaded file, and key information is automatically read using OCR (Optical Character Recognition) technology. The document information verification process includes checking the validity of the document, comparing the document information with the user information recorded in the system, and confirming the authenticity of the document through third-party services or database queries, further preventing identity theft and account fraud. It should be noted that this embodiment also uses login account and password verification, checking whether the login account and password provided by the user match the information recorded in the system database. This step usually serves as the first line of defense in multi-factor authentication; subsequent biometric identification and document information verification are used to increase security, especially in high-risk transactions or login scenarios.

[0059] To enhance security, this embodiment employs a combination of multiple verification methods. This multi-factor verification mechanism effectively prevents a single verification method from being bypassed or cracked. Only after a user has passed all the aforementioned verification steps will the system confirm the user's identity and allow them access to their account. Furthermore, for VIP users or high-frequency trading users, the system may employ a more stringent verification process, such as increasing the number of biometric checks or requiring additional identification information.

[0060] After the user provides all necessary identity information, the system immediately verifies the identity and generates an authentication result. This result clearly indicates whether the user's identity has been verified and the verification level (e.g., low risk, medium risk, high risk). Only when the authentication result indicates that the user's identity has been verified and the risk level is within the preset security threshold will the system continue to monitor the target financial account's historical transaction data and login logs. For cases where verification fails or the risk level is too high, the system will take immediate measures, such as restricting account access, requiring the user to provide additional verification information, or even notifying the bank's security team for manual review. Once the user has passed authentication, the monitoring system will analyze the user's transaction data and login logs in real time. If anomalies are detected, such as abnormal account logins, frequent transactions, or unusual trading habits, the system will immediately trigger an alarm mechanism according to preset rules, notifying the user to check account security and take appropriate protective measures.

[0061] Step S201: Detect the historical transaction data and login logs of the target financial account, and preprocess the historical transaction data.

[0062] Optionally, the preprocessing steps for historical transaction data include: cleaning the historical transaction data, wherein the cleaning process includes: detecting the transaction data format, and according to the transaction data format, performing normal mapping processing on the historical transaction data using a Z-Score normalization strategy, and deleting extreme values ​​and outliers in the historical transaction data using a Robust Scaler strategy; and performing transformation and balancing processing on the historical transaction data.

[0063] The preprocessing process mainly includes data cleaning, data transformation, data standardization / normalization, and data balancing. Data cleaning removes noise and errors from the dataset to ensure high data quality. Specific steps include: checking the format of transaction data to ensure consistency in historical transaction data formats. For example, checking if date and time fields are in a uniform format and if amount fields are numeric. Inconsistent formats can lead to data parsing errors and affect the accuracy of subsequent processing. Then, a Z-Score standardization strategy is used to transform the data into a standard normal distribution, i.e., a distribution with a mean of 0 and a standard deviation of 1. This eliminates the influence of data units, allowing data with different units to be compared and analyzed on the same scale. The formula can be: [Z=\frac{(x-\mu)}{\s igma}], where (x) is a transaction data point, (\mu) is the mean of the dataset, and (\s igma) is the standard deviation of the dataset. Through Z-Score standardization, the system can more accurately identify outliers in the transaction data. In addition, this embodiment also requires the use of the Robust Scaller strategy to process datasets with outliers. The data is standardized based on the median and quartile range (IQR, i.e., the difference between the upper and lower quartiles). It is less sensitive to extreme values ​​in the dataset, so it can effectively handle abnormally high or low values ​​in transaction data and avoid these extreme values ​​from interfering with model training. Through the Robust Scaller strategy, the system can process data more robustly and improve the accuracy of anomaly detection.

[0064] Furthermore, this embodiment also requires data transformation processing to convert the raw transaction data into a format that the model can understand and analyze. For example, categorical data (such as transaction type) is converted into numerical data, which is usually achieved through label encoding or one-hot encoding. Through data transformation, the system can ensure that all data input into the model is numerical, facilitating subsequent mathematical operations and model training. In addition, since the ratio of normal transaction data to abnormal transaction data may be severely imbalanced, this can cause the model to tend to predict transactions as normal during training, thus ignoring the minority of abnormal transactions. Data balancing processing typically involves oversampling (increasing minority class samples), undersampling (reducing majority class samples), or the Synthetic Minority Over-sampling Technique (SMOTE). Through data balancing processing, the system can ensure that the model can learn the characteristics of abnormal transactions during training, thereby more accurately identifying abnormal transactions in practical applications.

[0065] Step S202: Based on the preprocessed historical transaction data, a multilayer perceptron model is used to perform risk rating on the target financial account to obtain the account risk level.

[0066] This embodiment can assess the risk level of relevant accounts by applying a multilayer perceptron (MLP) model to perform deep learning on preprocessed historical transaction data. Optionally, the step of using a multilayer perceptron model to perform risk rating on a target financial account and obtain the account risk level includes: extracting the basic information, account information, and credit information of the user involved in the target financial account; inputting the user's basic information, account information, and credit information, as well as the preprocessed historical transaction data, into the multilayer perceptron model, and outputting the risk probability value associated with the target financial account and the account risk level corresponding to the risk probability value. The multilayer perceptron model includes an input layer, two hidden layers, and an output layer, using ReLU as the activation function of the multilayer perceptron model and a first log-likelihood loss function as the loss function of the multilayer perceptron model.

[0067] The above implementation steps require extracting feature information related to the target financial account from multiple dimensions. These features typically include the user's personal information (such as age, gender, occupation, education, and location), account information (such as account type and number of accounts), and credit information (such as credit history and repayment records). By comprehensively considering these features, a comprehensive risk assessment framework can be constructed. The preprocessed historical transaction data, along with the extracted features, is input into the MLP model. The MLP model consists of an input layer, two hidden layers, and an output layer. It is a deep learning model capable of learning and capturing complex nonlinear relationships in data. In the input layer, the data is transformed into a format acceptable to the model; for example, categorical data is converted into one-hot encoding or label encoding.

[0068] It should be noted that the two hidden layers in the MLP can contain 128 and 64 neurons respectively, using ReLU (Rectified Linear Unit) as the activation function. The ReLU function can be defined as f(x) = max(0,x), which has a linear relationship when x>0 and outputs 0 when x≤0. The ReLU activation function is widely used in deep learning models because of its simple computation and ability to alleviate the gradient vanishing problem. During the model training phase, the first log-likelihood loss function is used as the loss function of the multilayer perceptron model to guide the adjustment of model parameters. The log-likelihood loss function is used for binary classification tasks and can evaluate the difference between the model's predicted probability and the true label. By minimizing this loss function, the model can learn how to more accurately predict the risk probability value of an account, that is, the probability distribution of belonging to different risk levels. The trained MLP model will output a risk probability value, which represents the probability that the target financial account belongs to the high-risk, medium-risk, or low-risk level. These probability values ​​not only reflect the current risk status of the account, but also take into account the user's behavioral habits and financial situation. Based on these probability values, the system automatically determines the risk level of the account, providing a basis for subsequent dynamic monitoring and security strategy formulation.

[0069] Once an account's risk level is determined, the system will take corresponding measures according to pre-set rules. For example, for high-risk accounts, an immediate alarm mechanism may be triggered, certain sensitive operations may be suspended, or users may be required to perform additional authentication. Medium-risk accounts may be subject to enhanced monitoring and alarm policies, while low-risk accounts may maintain regular monitoring and security policies.

[0070] Step S203: Input the preprocessed historical transaction data and login logs into the anomaly model set, and output the anomaly transaction detection results and anomaly login status monitoring results. The anomaly model set includes: an account anomaly login detection model, a frequent transaction detection model, and a transaction habit anomaly detection model. The account anomaly login detection model analyzes the login logs to determine if the target financial account has an abnormal login status. The frequent transaction detection model analyzes the transaction volume of the preprocessed historical transaction data to determine if the target financial account has abnormal transactions. The transaction habit anomaly detection model analyzes the transaction habits of the preprocessed historical transaction data to determine if the target financial account has abnormal transactions.

[0071] Step S203 involves in-depth analysis of the preprocessed data using an anomaly model set to identify potential abnormal transactions and login states, thereby protecting account security. The anomaly model set encompasses three main models: an abnormal account login detection model, a frequent transaction detection model, and an abnormal transaction habit detection model. Each model focuses on different types of abnormal behavior, collectively constructing a comprehensive monitoring system.

[0072] Optionally, the abnormal account login detection model is trained as follows: Financial account login data and user basic information are obtained within a specified historical time period. The financial account login data includes at least one of the following: user login time, number of successful logins per unit time, number of failed logins per unit time, number of times user personal information is modified per unit time, and user login IP information; a gradient boosting tree is constructed; the gradient boosting tree is trained using the financial account login data and user information within the specified historical time period; the trained gradient boosting tree is used as the abnormal account login detection model, which outputs the probability value of abnormal login, and the model is used to confirm whether the financial account has an abnormal login status.

[0073] The abnormal login detection model is built using Gradient Boosting Tree (GBT). It analyzes historical login data and user information to train a model capable of predicting the probability of abnormal logins. GBT builds a series of weak prediction models (usually decision trees) and then weights and combines their predictions to achieve stronger predictive performance.

[0074] During model training, the first step is to collect historical financial account login data and user personal information within a specified time period. This login data specifically includes user login time, number of successful logins per unit time, number of failed logins per unit time, number of personal information modifications per unit time, and user login IP information. After data collection, the system preprocesses and extracts features, encoding non-numerical features (such as IP information) to ensure consistent data format for processing by the GBT model. Data cleaning is also crucial, handling missing and outlier values ​​to ensure model training accuracy. Next, model building and training proceed: a GBT model is constructed, setting parameters such as tree depth, number of leaf nodes, and regularization parameters. Training is performed using collected historical login data and user information. The training objective is to optimize the log-likelihood loss function to minimize the difference between the predicted probability of abnormal login states and the actual state. Gradient boosting trees correct the residuals of the existing model by progressively adding decision trees; each tree attempts to reduce the prediction error of the previous tree, thus building a more powerful prediction model. After training, the model needs to be evaluated to ensure its accuracy and generalization ability. During the application phase, when a user attempts to log in, the system inputs real-time login data into the trained GBT model, and the model outputs a probability value for abnormal login. If the probability value exceeds a preset threshold, the system will determine that the account has an abnormal login status and trigger corresponding security measures, such as requiring secondary verification or temporarily freezing the account.

[0075] Through the above process, the abnormal login detection model can learn the normal and abnormal login behavior patterns. Even when facing complex and ever-changing network environments and attack methods, it can accurately and quickly identify abnormal login states, providing timely and effective early warnings for the entire security monitoring system.

[0076] Optionally, the security monitoring method for financial accounts also includes: using the second log-likelihood loss function as the model loss function during the training of the gradient boosting tree; wherein, the second log-likelihood loss function is: L(y,p)=-[y log(p)+(1-y)log(1-p)], y represents the true label of the data, the true label is the value 1 corresponding to abnormal account login or the value 0 corresponding to normal account login, and p is the probability value of abnormal financial account login output by the gradient boosting tree.

[0077] In training a Gradient Boosting Tree (GBT) model, using the second log-likelihood loss function is a crucial step. The log-likelihood loss function is commonly used in binary classification problems, measuring the difference between the model's predicted probability distribution and the true label. Specifically, in the loss function, (y) represents the true label of the data; for detecting abnormal account logins, (y) can be 1 (indicating abnormal login) or 0 (indicating normal login), while (p) is the probability value of abnormal financial account login output by the GBT model, with a value between 0 and 1. The loss function is smaller when the model predicts correctly and larger when it predicts incorrectly. By minimizing this loss function, the model parameters can be optimized, enabling the model to learn effective features and patterns that distinguish between normal and abnormal logins during training.

[0078] The log-likelihood loss function was chosen as the loss function for GBT because, on the one hand, it can accurately measure the difference between the predicted probability and the true label, which helps to improve the prediction accuracy and stability of the model; on the other hand, the log-likelihood loss function has advantages in dealing with imbalanced class data (such as abnormal login data being far less than normal login data), and can better balance the prediction error of positive and negative samples, making the model more sensitive to predicting less common abnormal logins.

[0079] Optionally, the frequent transaction detection model is trained as follows: First-class historical transaction data of multiple financial accounts are detected, and the first-class historical transaction data is preprocessed to obtain training data, wherein the first-class historical transaction data includes at least one of the following: single transaction amount, number of account transactions, number of repeated transactions, and transaction method data; a sparse autoencoder anomaly detection model is constructed using a sparse autoencoder algorithm, wherein the sparse autoencoder anomaly detection model includes an encoder, a decoder, and a hidden layer; the training data is input into the encoder and decoder in the sparse autoencoder anomaly detection model, and the probability value of abnormal transactions in the account is output; the trained sparse autoencoder anomaly detection model is used as the frequent transaction detection model, and the probability value of abnormal transactions is output by the frequent transaction detection model, and the presence of abnormal transactions in the financial account is confirmed based on the probability value of abnormal transactions.

[0080] The frequent transaction detection model is implemented by constructing a sparse autoencoder anomaly detection model. First, the system detects the first type of historical transaction data of multiple financial accounts. This data may include single transaction amount, number of account transactions, number of repeated transactions, transaction method data, etc. By preprocessing this data, including data cleaning, transformation and standardization, a training dataset for model training is generated.

[0081] It should be noted that the sparse autoencoder anomaly detection model in this embodiment typically includes an encoder, a decoder, and a hidden layer. During the model training phase, the encoder receives preprocessed transaction data and encodes it into feature representations for the hidden layer; the decoder then attempts to reconstruct the original data from these hidden layer feature representations. The model's goal is to make the reconstructed data as close as possible to the original data, while simultaneously forcing the model to learn the most important features in the data by setting a sparsity objective for the hidden layer (e.g., keeping the neurons in the hidden layer in a low-activation state most of the time). This model is highly effective in handling anomaly detection tasks because it distinguishes between normal and abnormal transactions based on the errors in data encoding and decoding.

[0082] It should be further explained that the sparse autoencoder anomaly detection model mentioned in this embodiment is first trained based on normal historical transaction data. Transaction data from period T is selected, and after data cleaning, transformation, and normalization, training data X is generated. Training data X is then sequentially input into the encoder and decoder, and after encoding and decoding transformations, the model is obtained... The training objective is to make the model's final output as similar as possible to the original data. The training objective function is:

[0083]

[0084] L 重构误差 The calculation is as follows:

[0085]

[0086] Where n is the number of samples; L 稀疏性惩罚项 The calculation is as follows:

[0087] L 重构误差 =-ρlog(ρ j )-(1-ρ)log(1-ρ j )

[0088] Where ρ is the desired sparse objective, ρ j It is the average activation value of neuron j in the hidden layer.

[0089] After training, this model can output the probability value of abnormal transactions in an account. For frequent transaction detection models, abnormal transactions usually refer to transactions that are significantly different from the user's historical transaction patterns, such as a large number of transactions in a short period of time or abnormally large transaction amounts. By setting a threshold, when the probability value output by the model exceeds this threshold, the system will consider abnormal transaction behavior to exist, and thus trigger corresponding security measures, such as real-time monitoring, transaction restrictions, or notifying the user to check account security.

[0090] Optionally, the abnormal trading habit detection model is trained as follows: It detects second-type historical trading data from multiple financial accounts and preprocesses this data, wherein the second-type historical trading data includes at least one of the following: the time point of each financial transaction, and the amount of multiple transactions; it constructs a Long Short-Term Memory (LSTM) neural network, wherein the LSTM architecture includes an encoder, an attention module, and a decoder. The encoder processes the input sequence using LSTM units, the attention module adjusts the data that the LSTM focuses on based on the attention score and attention weight, and the decoder decodes the received transaction data vector and the decoder state of the previous time step; it inputs the preprocessed second-type historical trading data into the encoder and attention module, and the decoder outputs the trading time habit data and trading amount habit data of the financial accounts; after training, the trained LSTM neural network is used as the abnormal trading habit detection model.

[0091] The trading habit anomaly detection model is based on a Long Short-Term Memory (LSTM) neural network architecture. It detects account trading time and amount habits to identify transactions that deviate from historical patterns, thus determining whether a transaction is abnormal. During model construction, the LSTM neural network architecture includes an encoder, an attention module, and a decoder. The encoder uses LSTM units to process the input sequence, learning the temporal dependencies within the sequence. The attention module adjusts the data parts the model focuses on based on attention scores and weights, enabling the model to more effectively identify parts of the trading sequence that deviate from established habits. The decoder, based on the outputs of the encoder and attention module, attempts to reconstruct the trading data sequence, outputting trading time and amount habit data.

[0092] In this embodiment, during model training, the second type of historical transaction data from multiple financial accounts first needs to be preprocessed, including time point standardization and amount normalization, to ensure data consistency and comparability. Subsequently, the preprocessed data is input into the LSTM model, and the model parameters are optimized through backpropagation, enabling the model to accurately distinguish between normal and abnormal transaction sequences during encoding and decoding. After training, the model can predict the probability of abnormal trading habits based on the input transaction data sequence. Based on this probability value, the system can determine whether there are any anomalies in the financial account's transactions, thereby taking timely measures to protect account security.

[0093] It should be noted that the transaction habit anomaly detection model includes transaction time habit detection and transaction amount habit detection. The transaction habit anomaly detection model is built on an LSTM neural network (for example, the LSTM is set to have two layers, one with 128 and the other with 64), and an attention mechanism is introduced. The overall architecture includes an encoder, an attention module and a decoder. The user's transactions are analyzed and processed by the early warning model, and the account information of the detected abnormal transactions is sent to the account management module.

[0094] It should be further noted that the encoder uses an LSTM unit to process the input sequence, as detailed below:

[0095] h t =LSTM(x t ,h t-1 )

[0096] Where x t It is the input for time step t, h t-1 It is the hidden state of the previous time step;

[0097] The attention module enables the model to focus on key parts of the input sequence based on attention scores and attention weights, where the attention score e t The calculation is as follows:

[0098] e t =V*tanh(W[h t ,s t ])

[0099] Where V and W are weight matrices, s t This is the current state of the decoder, [h t ,s t ] indicates s t and h t splicing;

[0100] Attention weight α t The calculation method is as follows:

[0101]

[0102] Where T is the length of the sequence.

[0103] It should be further explained that the decoder receives the context vector c. t The decoder state s of the previous time step t-1 Decoding is performed as follows:

[0104] s t =LSTM([c t ,y t-1 ],s t-1 )

[0105] Where the context vector c t Calculations are performed using weighted summation:

[0106] Step S204: Based on the account risk level, abnormal transaction detection results, and abnormal login status monitoring results, calculate the probability value of the current transaction activity of the target financial account being an abnormal transaction. If the probability value indicates that the current transaction activity is an abnormal transaction, output a transaction alarm message.

[0107] In the dynamic security monitoring method for bank accounts, step S204 is the comprehensive application stage of risk assessment and anomaly detection. Based on various previously obtained risk and anomaly indicators, the system comprehensively assesses and determines whether the current transaction activity of the target account is an abnormal transaction, and then takes corresponding early warning or control measures. The system takes as input the account risk level obtained through the multilayer perceptron model, the abnormal transaction detection results obtained through the anomaly model set, and the abnormal login status monitoring results. These results reflect the static risk level of the account, the degree of anomaly in real-time transactions, and the credibility of login behavior. Based on a comprehensive consideration of the above information, the system calculates the probability value of the current transaction activity of the target financial account being an abnormal transaction. This calculation process may involve various statistical methods and machine learning techniques, such as Bayesian networks, logistic regression, or ensemble learning methods. The calculation of the probability value aims to integrate multiple risk indicators to provide an intuitive indicator of the likelihood of an abnormal transaction. It should be noted that this embodiment can preset a probability threshold to determine whether the calculated abnormal transaction probability value reaches the early warning level. If the probability value exceeds the preset threshold, the system will immediately trigger a transaction alarm message, notifying the bank's security team or sending it directly to the account holder. Alarm messages typically include details of the unusual transaction, potential risk warnings, and suggested actions, such as temporarily freezing the account, requiring secondary verification, or contacting the bank's customer service for assistance.

[0108] By implementing step S204, this invention enables real-time dynamic security monitoring of target financial accounts, ensuring effective intervention at the first sign of abnormal transactions. This method combines the intelligence of machine learning with the flexibility of bank security strategies, significantly improving the efficiency and accuracy of account security monitoring while reducing interference with normal user transactions and enhancing the overall user experience.

[0109] Through the above steps, historical transaction data and login logs of the target financial account can be detected. The historical transaction data is preprocessed, and based on the preprocessed historical transaction data, a multilayer perceptron model is used to perform risk rating on the target financial account to obtain the account risk level. The preprocessed historical transaction data and login logs are input into an anomaly model set, and anomaly transaction detection results and anomaly login status monitoring results are output. The anomaly model set includes: an account anomaly login detection model, a frequent transaction detection model, and a transaction habit anomaly detection model. The account anomaly login detection model is used to analyze the login logs to determine whether there is an abnormal login status of the target financial account. The frequent transaction detection model is used to analyze the transaction volume of the preprocessed historical transaction data to determine whether there are abnormal transactions in the target financial account. The transaction habit anomaly detection model is used to analyze the transaction habits of the preprocessed historical transaction data to determine whether there are abnormal transactions in the target financial account. Based on the account risk level, anomaly transaction detection results, and anomaly login status monitoring results, the probability value of the current transaction activity of the target financial account being an anomaly transaction is calculated. If the probability value indicates that the current transaction activity is an anomaly transaction, a transaction alarm message is output. In this embodiment, the quality and risk level of accounts can be dynamically assessed, enabling tiered management of user risk. Simultaneously, it can monitor transaction activities generated by each financial account in real time, quickly identify suspicious transaction patterns or abnormal transaction behaviors, and trigger an alarm mechanism. Once an anomaly is detected, the target information can be quickly located and an alarm issued. By constructing and optimizing account risk assessment models, abnormal login detection models, frequent transaction detection models, and abnormal transaction habit detection models, abnormal behavior can be identified more accurately, reducing false alarm and missed alarm rates. This solves the technical problem in related technologies where financial account monitoring systems use static thresholds to determine whether transactions are abnormal, resulting in low flexibility and a tendency to generate false alarms or missed alarms.

[0110] The following describes in detail another optional implementation method.

[0111] Figure 3 This is a schematic diagram of the module connections of an optional dynamic security monitoring system for financial institution accounts according to an embodiment of the present invention, as shown below. Figure 3 As shown, the monitoring system includes: a data management module, a transaction monitoring module, an account risk assessment module, an account control module, and an identity verification module.

[0112] The data management module is connected to the account risk assessment module and the transaction monitoring module; the early warning model management module is connected to the transaction monitoring module; and the account control module is connected to the account risk assessment module, the transaction monitoring module, and the identity verification module.

[0113] The data management module manages user basic information, mobile payment information, transaction records, and login log data, performing data storage, integration, cleaning, transformation, and balancing. Data cleaning begins by examining the data structure and defining the data format. Missing basic information is manually supplemented, while other valid data is deleted. Outliers undergo a second review; if a second review is not possible, the outlier is deleted. Data with few extreme values ​​is standardized using Z-Score, while data with many extreme values ​​is considered for Robust Scaler.

[0114] During the data transformation process, ordered categorical variables are encoded using labels, while unordered categorical variables are encoded using one-hot encoding.

[0115] Account Risk Assessment Module: This module comprehensively assesses accounts, determining their quality and risk level to achieve user risk classification. In this embodiment, the module uses a multi-layer perceptron to rate user risk based on account type, user age, gender, education level, occupation, location, number of accounts, financial information, and credit history. Risk levels are categorized as high, medium, and low. This invention, by comprehensively considering multiple factors and using a multi-layer perceptron for risk rating, and by taking into account users' personal information, financial situation, and credit history, can more comprehensively assess users' risk levels, significantly improving the accuracy and efficiency of risk assessment and providing users with safer and more reliable financial services.

[0116] The Multilayer Perceptron (MLP) consists of an input layer, two hidden layers (128+64 neurons), and an output layer. The activation function used is ReLU, and the loss function is the log-likelihood loss function.

[0117] The early warning model management module maintains the algorithm model used to predict potential risks and adjusts the model parameters based on historical data and real-time information. In this embodiment of the invention, the early warning model detects abnormal user accounts based on the user's basic information, mobile payment information, transaction records, and login log data. The abnormality models include: an abnormal account login detection model, a frequent transaction detection model, and an abnormal transaction habit detection model.

[0118] It should be noted that the abnormal login detection model constructs a gradient boosting tree based on user age, login time, number of successful logins per unit time, number of failed logins per unit time, number of times user personal information is modified per unit time, and user login IP information (for example, setting the tree depth to 5, the number of leaf nodes to 15, and the L2 regularization parameter to 0.57). The model is trained using historical data, employing a log-likelihood loss function, as shown in the following formula:

[0119] L(y,p)=-[y log(p)+(1-y)log(1-p)], where y represents the true label of the data and p is the probability of abnormal login predicted by the model.

[0120] It should be noted that the frequent transaction detection model is based on data such as the amount of a single large transaction, the number of transactions by the account, the number of repeated transactions, and the transaction method. It constructs a sparse autoencoder anomaly detection model (for example, setting the encoder and decoder to a symmetrical structure with 30 neurons each, 15 hidden layers, and a sparse target value of 0.05). Since the number of normal transactions is much greater than the number of abnormal transactions, the model will learn more about the relationship between normal transaction features during the encoding and decoding process, and judge abnormal data by the error after data encoding and decoding.

[0121] It should be further explained that the sparse autoencoder anomaly detection model is first trained on normal historical transaction data. Transaction data from period T is selected, and after data cleaning, transformation, and normalization, training data X is generated. Training data X is then sequentially input into the encoder and decoder, and after encoding and decoding transformations, the model obtains... The training objective is to make the model's final output as similar as possible to the original data. The objective function balances the encoding and decoding errors by minimizing the mean squared error. In the initial training phase, only transaction data labeled as normal is used to train the model, ensuring that the model first learns to capture the main patterns and characteristics of normal transactions. The training objective function is as described in the function formula in the above embodiment.

[0122] It should be noted that the abnormal transaction habit detection model includes transaction time habit detection and transaction amount habit detection. The model is built on an LSTM neural network (for example, setting the LSTM to have two layers, one with 128 layers and the other with 64 layers), and incorporates an attention mechanism. The overall architecture includes an encoder, an attention module, and a decoder. User transactions are analyzed and processed by the early warning model, and account information for detected abnormal transactions is sent to the account management module. The calculation formula for the LSTM neural network is as described in the above embodiment.

[0123] Transaction Monitoring Module: This module monitors all transaction activities of an account in real time, identifies suspicious transaction patterns or abnormal behaviors, and immediately triggers corresponding alarm mechanisms. In a specific embodiment of this invention, the transaction monitoring module monitors all transaction activities of an account in real time and identifies suspicious transaction patterns or abnormal behaviors based on an anomaly detection model, reporting them to the account management module. This invention, by monitoring transaction activities in real time, combining anomaly detection models, and customizing monitoring strategies based on user trading habits and historical data, can more accurately identify abnormal transactions, reduce false alarm rates and false negative rates, and simultaneously alleviate the pressure of manual monitoring and improve work efficiency through automated monitoring and alarm mechanisms.

[0124] Account Management Module: Responsible for managing and controlling risky accounts. In a specific embodiment of this invention, the account management module is responsible for managing and controlling accounts identified as risky, including restricting account functions, notifying users, invoking the identity verification module for additional verification, and reporting suspicious activities. In this invention, the account management module is tightly integrated with the account risk assessment module. Based on the risk assessment results, it determines which accounts need to be managed. By promptly managing high-risk accounts, it effectively reduces potential financial risks and losses, ensures rapid response to suspicious activities, prevents the spread of risks, protects customer assets, and prevents financial losses due to fraud or illegal activities.

[0125] Identity verification module: responsible for verifying whether the user's identity information is true and valid, including biometric recognition, document scanning, password and verification code functions.

[0126] In a specific embodiment of the present invention, the identity verification module supports biometric recognition, document scanning, password and verification code functions, and also supports multi-factor authentication, and supports proving the user's identity through additional identity verification processes.

[0127] This invention can effectively reduce the risk of account theft or fraud through timely account control measures. By implementing additional verification processes, it can reduce false alarms to legitimate users and improve user experience.

[0128] Figure 4 This is an embodiment of an artificial intelligence-based user account security management method for financial platforms according to an embodiment of the present invention, such as... Figure 4 As shown, it includes: data management, account risk assessment, early warning model management, transaction monitoring, account control, and identity verification functions.

[0129] Data Management: Enables the collection, cleaning, and storage of multi-source user data. Specifically, it involves data storage, integration, cleaning, transformation, and balancing based on user basic information, mobile payment information, transaction records, and login logs.

[0130] Account risk assessment: Conduct risk assessments on user accounts to determine the quality and risk level of the accounts, thereby achieving user risk classification.

[0131] Early warning model management: Based on model matching of user transaction behavior and user accounts. Maintain the algorithm model used to predict potential risks, and adjust model parameters according to historical data and real-time information.

[0132] Transaction monitoring: Monitors all transaction activities of the account in real time, identifies suspicious transaction patterns or abnormal behavior, and immediately triggers the corresponding alarm mechanism.

[0133] Account Management: Responsible for managing and controlling risky accounts.

[0134] Identity Verification: This function invokes the identity verification module for secondary authentication. It verifies the authenticity and validity of the user's identity information, including biometric recognition, document scanning, password verification, and CAPTCHA verification. By employing multiple verification methods such as biometric recognition, document scanning, password verification, and CAPTCHA, it strengthens the verification of the authenticity of user identity information and improves account security.

[0135] The above implementation method can integrate and clean multiple data sources, such as user basic information, mobile payment information, transaction records and login logs, to provide more accurate and comprehensive data support, provide a solid data foundation for account risk assessment and transaction monitoring, effectively integrate data from different sources, and support the selection of corresponding data according to different models.

[0136] Meanwhile, the account risk assessment module of this invention can be updated in real time, dynamically assessing the quality and risk level of accounts, and realizing hierarchical management of user risk. Compared with traditional static assessment methods, it is more adaptable to real-time changes in account risk. The early warning model management module of this invention can adjust model parameters based on historical data and real-time information, using advanced algorithms to predict potential risks, thereby improving the accuracy and timeliness of early warnings.

[0137] Furthermore, this invention can monitor all transaction activities in real time, quickly identify suspicious transaction patterns or abnormal behaviors, and trigger an alarm mechanism. This real-time capability is crucial in preventing fraud and illegal transactions. Once an anomaly is detected, the system can also quickly lock onto the target information and issue an alarm, improving the response speed and processing capability to emergencies.

[0138] The following is a detailed description with reference to another embodiment.

[0139] Example 2

[0140] The security monitoring device for a financial account provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in Embodiment 1 above. The specific implementation method and its beneficial effects can be referred to the aforementioned method embodiment, and will not be repeated here.

[0141] Figure 5 This is a schematic diagram of an optional financial account security monitoring device according to an embodiment of the present invention, such as... Figure 5 As shown, the security monitoring device for the financial account may include: a transaction data detection unit 51, a risk rating unit 52, a transaction anomaly detection unit 53, and an abnormal transaction discrimination unit 54.

[0142] The transaction data detection unit 51 is used to detect the historical transaction data and login logs of the target financial account and to preprocess the historical transaction data.

[0143] Risk rating unit 52 is used to perform risk rating on the target financial account based on preprocessed historical transaction data and using a multilayer perceptron model to obtain the account risk level.

[0144] The transaction anomaly detection unit 53 is used to input preprocessed historical transaction data and login logs into the anomaly model set, and output anomaly transaction detection results and anomaly login status monitoring results. The anomaly model set includes: an account anomaly login detection model, a frequent transaction detection model, and a transaction habit anomaly detection model. The account anomaly login detection model is used to analyze login logs to determine whether the target financial account has an abnormal login status. The frequent transaction detection model is used to analyze the transaction quantity of preprocessed historical transaction data to determine whether the target financial account has abnormal transactions. The transaction habit anomaly detection model is used to analyze transaction habits of preprocessed historical transaction data to determine whether the target financial account has abnormal transactions.

[0145] The abnormal transaction discrimination unit 54 is used to identify the probability value of the current transaction activity of the target financial account as an abnormal transaction based on the account risk level, abnormal transaction detection results and abnormal login status monitoring results. When the probability value indicates that the current transaction activity is an abnormal transaction, it outputs transaction alarm prompt information.

[0146] The aforementioned security monitoring device for financial accounts can detect historical transaction data and login logs of the target financial account through the transaction data detection unit 51, preprocess the historical transaction data, and use a multilayer perceptron model to perform risk rating on the target financial account based on the preprocessed historical transaction data through the risk rating unit 52 to obtain the account risk level. The transaction anomaly detection unit 53 inputs the preprocessed historical transaction data and login logs into the anomaly model set and outputs the abnormal transaction detection result and abnormal login status monitoring result. The abnormal transaction discrimination unit 54 identifies the probability value of the current transaction activity of the target financial account as an abnormal transaction based on the account risk level, the abnormal transaction detection result, and the abnormal login status monitoring result. When the probability value indicates that the current transaction activity is an abnormal transaction, a transaction alarm message is output. In this embodiment, the quality and risk level of accounts can be dynamically assessed, enabling tiered management of user risk. Simultaneously, it can monitor transaction activities generated by each financial account in real time, quickly identify suspicious transaction patterns or abnormal transaction behaviors, and trigger an alarm mechanism. Once an anomaly is detected, the target information can be quickly located and an alarm issued. By constructing and optimizing account risk assessment models, abnormal login detection models, frequent transaction detection models, and abnormal transaction habit detection models, abnormal behavior can be identified more accurately, reducing false alarm and missed alarm rates. This solves the technical problem in related technologies where financial account monitoring systems use static thresholds to determine whether transactions are abnormal, resulting in low flexibility and a tendency to generate false alarms or missed alarms.

[0147] Optionally, the risk rating unit includes: a user information extraction module, used to extract basic information, account information, and credit information of users involved in the target financial account; and a risk assessment module, used to input the user's basic information, account information, and credit information, as well as preprocessed historical transaction data, into the multilayer perceptron model, and output the risk probability value of the associated target financial account and the account risk level corresponding to the risk probability value. The multilayer perceptron model includes: an input layer, two hidden layers, and an output layer, using ReLU as the activation function of the multilayer perceptron model and the first log-likelihood loss function as the loss function of the multilayer perceptron model.

[0148] Optionally, the security monitoring device for financial accounts, when training the abnormal login detection model, includes: a historical login data acquisition unit, used to acquire financial account login data and user basic information within a specified historical time period, wherein the financial account login data includes at least one of the following: user login time point, number of successful logins per unit time, number of failed logins per unit time, number of times user personal information is modified per unit time, and user login IP information; a gradient boosting tree construction unit, used to construct a gradient boosting tree; a first model training unit, used to train the gradient boosting tree using the financial account login data and user information within the specified historical time period; and an abnormal login detection unit, used to use the trained gradient boosting tree as the abnormal login detection model, output the probability value of abnormal login, and confirm whether the financial account has an abnormal login status based on the probability value of abnormal login.

[0149] Optionally, the security monitoring device for financial accounts further includes: using a second log-likelihood loss function as the model loss function during the training of the gradient boosting tree; wherein, the second log-likelihood loss function is: L(y,p)=-[y log(p)+(1-y)log(1-p)], y represents the true label of the data, the true label is the value 1 corresponding to abnormal account login or the value 0 corresponding to normal account login, and p is the probability value of abnormal financial account login output by the gradient boosting tree.

[0150] Optionally, the security monitoring device for financial accounts, when training a frequent transaction detection model, includes: a first historical transaction data detection unit, used to detect a first type of historical transaction data from multiple financial accounts, and preprocess the first type of historical transaction data to obtain training data, wherein the first type of historical transaction data includes at least one of the following: single transaction amount, number of account transactions, number of repeated transactions, and transaction method data; a sparse autoencoder algorithm is used to construct a sparse autoencoder anomaly detection model, wherein the sparse autoencoder anomaly detection model includes: an encoder, a decoder, and a hidden layer; an abnormal transaction probability calculation unit, used to input the training data into the encoder and decoder in the sparse autoencoder anomaly detection model, and output the probability value of an account having abnormal transactions; and an abnormal transaction calculation unit, used to use the trained sparse autoencoder anomaly detection model as a frequent transaction detection model, and the frequent transaction detection model outputs the probability value of abnormal transactions, and based on the probability value of abnormal transactions, confirm whether there are abnormal transactions in the financial account.

[0151] Optionally, the security monitoring device for financial accounts, when training the abnormal transaction habit detection model, includes: a second historical transaction data detection unit, used to detect a second type of historical transaction data for multiple financial accounts and preprocess the second type of historical transaction data, wherein the second type of historical transaction data includes at least one of the following: the time point of each financial transaction, and the amount of multiple transactions; a neural network construction unit, used to construct a Long Short-Term Memory (LSTM) neural network, wherein the architecture of the LSTM neural network includes: an encoder, an attention module, and a decoder, the encoder uses the LSTM unit to process the input sequence, the attention module adjusts the data that the LSTM neural network focuses on according to the attention score and attention weight, and the decoder decodes the received transaction data vector and the decoder state of the previous time step; a transaction habit output unit, used to input the preprocessed second type of historical transaction data into the encoder and the attention module, and the decoder outputs the transaction time habit data and transaction amount habit data of the financial accounts; and an abnormal transaction habit detection unit, used to use the trained LSTM neural network as the abnormal transaction habit detection model after training is completed.

[0152] Optionally, the transaction data detection unit includes: a cleaning module for cleaning historical transaction data, wherein the cleaning process includes: detecting the transaction data format, and according to the transaction data format, performing normal mapping processing on the historical transaction data using a Z-Score normalization strategy, and deleting extreme values ​​and outliers in the historical transaction data using a Robust Scaler strategy; and a transformation module for transforming and balancing the historical transaction data.

[0153] Optionally, the security monitoring device for financial accounts further includes: a user identity acquisition unit, used to acquire the user identity information of the logged-in user before detecting the historical transaction data and login logs of the target financial account, wherein the user identity information includes: user biometrics, identification information, login account and password; an identity verification unit, used to perform multi-factor authentication on the user identity information to obtain the identity verification result; and an identity verification pass module, used to start detecting the historical transaction data and login logs of the target financial account when the identity verification result indicates that the user identity has been verified.

[0154] The aforementioned security monitoring device for financial accounts may also include a processor and a memory. The aforementioned transaction data detection unit 51, risk rating unit 52, transaction anomaly detection unit 53, and abnormal transaction discrimination unit 54 are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0155] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can enable AI-based financial account security monitoring.

[0156] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory, and the memory includes at least one memory chip.

[0157] Example 3

[0158] Embodiments of this application may provide an electronic device. Figure 6 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 (Only one is shown) processor 602, memory 604, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0159] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the financial account security monitoring method and device in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned financial account security monitoring method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0160] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: Detecting historical transaction data and login logs of the target financial account, and preprocessing the historical transaction data; Based on the preprocessed historical transaction data, using a multilayer perceptron model to perform risk rating on the target financial account, obtaining the account risk level; Inputting the preprocessed historical transaction data and login logs into an anomaly model set, outputting anomaly transaction detection results and anomaly login status monitoring results. The anomaly model set includes: an account anomaly login detection model, a frequent transaction detection model, and a transaction habit anomaly detection model. The account anomaly login detection model analyzes login logs to determine if the target financial account has an abnormal login status; the frequent transaction detection model analyzes the transaction volume of the preprocessed historical transaction data to determine if the target financial account has abnormal transactions; the transaction habit anomaly detection model analyzes transaction habits in the preprocessed historical transaction data to determine if the target financial account has abnormal transactions; Based on the account risk level, the anomaly transaction detection results, and the anomaly login status monitoring results, calculating the probability value of the target financial account's current transaction activity being an anomaly transaction; and outputting a transaction alarm message when the probability value indicates that the current transaction activity is an anomaly transaction.

[0161] Those skilled in the art will understand that Figure 6 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 6 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 6 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 6 The different configurations shown.

[0162] Those skilled in the art will understand that all or part of the steps in the various financial account security monitoring methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0163] Example 4

[0164] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the financial account security monitoring method provided in Embodiment 1.

[0165] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the financial account security monitoring method of any one of the above embodiments.

[0166] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0167] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the security monitoring method for financial accounts described in various embodiments of this application.

[0168] This application also provides a computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the security monitoring method for financial accounts described in various embodiments of this application.

[0169] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0170] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0171] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0172] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0173] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for security monitoring of financial accounts, characterized in that, include: Detect the historical transaction data and login logs of the target financial account, and preprocess the historical transaction data; Based on the preprocessed historical transaction data, a multilayer perceptron model is used to perform risk rating on the target financial account to obtain the account risk level. The preprocessed historical transaction data and login logs are input into an anomaly model set, and anomaly transaction detection results and anomaly login status monitoring results are output. The anomaly model set includes: an account anomaly login detection model, a frequent transaction detection model, and a transaction habit anomaly detection model. The account anomaly login detection model is used to analyze the login logs to determine whether the target financial account has an abnormal login status. The frequent transaction detection model is used to analyze the transaction quantity of the preprocessed historical transaction data to determine whether the target financial account has abnormal transactions. The transaction habit anomaly detection model is used to analyze the transaction habits of the preprocessed historical transaction data to determine whether the target financial account has abnormal transactions. Based on the account risk level, the abnormal transaction detection results, and the abnormal login status monitoring results, calculate the probability value that the current transaction activity of the target financial account is an abnormal transaction. If the probability value indicates that the current transaction activity is an abnormal transaction, output a transaction alarm message.

2. The method for security monitoring of financial accounts according to claim 1, characterized in that, The steps for using a multilayer perceptron model to perform risk rating on the target financial account and obtain the account risk level include: Extract basic information, account information, and credit information of users involved in the target financial account; The user's basic information, account information, and credit information, along with the preprocessed historical transaction data, are input into the multilayer perceptron model. The model outputs a risk probability value associated with the target financial account and the account risk level corresponding to the risk probability value. The multilayer perceptron model includes an input layer, two hidden layers, and an output layer. ReLU is used as the activation function of the multilayer perceptron model, and a first log-likelihood loss function is used as the loss function of the multilayer perceptron model.

3. The method for security monitoring of financial accounts according to claim 1, characterized in that, The abnormal account login detection model was trained in the following way: Obtain financial account login data and user basic information within a specified historical time period. The financial account login data includes at least one of the following: user login time, number of successful logins per unit time, number of failed logins per unit time, number of times user personal information was modified per unit time, and user login IP information. Construct a gradient boosting tree; The gradient boosting tree is trained using financial account login data and user information within the specified historical time period. The trained gradient boosting tree is used as the account abnormal login detection model. The account abnormal login detection model outputs the probability value of abnormal login, and the financial account is confirmed to have an abnormal login status based on the probability value of abnormal login.

4. The method for security monitoring of financial accounts according to claim 3, characterized in that, include: During the training of the gradient boosting tree, the second log-likelihood loss function is used as the model loss function; Wherein, the second log-likelihood loss function is: L(y,p)=-[ylog(p)+(1-y)log(1-p)], y represents the true label of the data, the true label refers to the value 1 corresponding to abnormal account login or the value 0 corresponding to normal account login, and p is the probability value of abnormal financial account login output by the gradient boosting tree.

5. The method for security monitoring of financial accounts according to claim 1, characterized in that, The frequent transaction detection model was trained in the following way: The system detects first-type historical transaction data from multiple financial accounts and preprocesses the first-type historical transaction data to obtain training data. The first-type historical transaction data includes at least one of the following: single transaction amount, number of account transactions, number of repeated transactions, and transaction method data. A sparse autoencoder anomaly detection model is constructed using a sparse autoencoder algorithm, wherein the sparse autoencoder anomaly detection model includes an encoder, a decoder, and a hidden layer; The training data is input into the encoder and decoder of the sparse autoencoder anomaly detection model, and the output is the probability value of abnormal transactions in the account. The trained sparse autoencoder anomaly detection model is used as the frequent transaction detection model. The frequent transaction detection model outputs the probability value of abnormal transactions, and the presence of abnormal transactions in the financial account is confirmed based on the probability value of abnormal transactions.

6. The method for security monitoring of financial accounts according to claim 1, characterized in that, The abnormal trading habit detection model was trained in the following way: The system detects second-type historical transaction data from multiple financial accounts and preprocesses the second-type historical transaction data, wherein the second-type historical transaction data includes at least one of the following: the time point of each financial transaction, and the amount of multiple transactions; A Long Short-Term Memory (LSTM) neural network is constructed. The architecture of the LSTM includes an encoder, an attention module, and a decoder. The encoder uses LSTM units to process the input sequence. The attention module adjusts the data that the LSTM focuses on based on the attention score and attention weight. The decoder decodes the received transaction data vector and the decoder state of the previous time step. The preprocessed second type of historical transaction data is input into the encoder and attention module, and the decoder outputs the transaction time habit data and transaction amount habit data of the financial account. After training, the trained Long Short-Term Memory (LSTM) neural network is used as the trading habit anomaly detection model.

7. The method for security monitoring of financial accounts according to claim 1, characterized in that, The steps for preprocessing the historical transaction data include: The historical transaction data is cleaned, wherein the cleaning process includes: detecting the transaction data format, and according to the transaction data format, performing normal mapping processing on the historical transaction data using a Z-Score normalization strategy, and deleting extreme values ​​and outliers in the historical transaction data using a Robust Scaler strategy; The historical transaction data is then transformed and balanced.

8. The method for security monitoring of financial accounts according to claim 1, characterized in that, Before examining the target financial account's historical transaction data and login logs, the process also includes: Obtain the user identity information of the logged-in user, wherein the user identity information includes: user biometrics, identification information, login account and password; The user identity information is subjected to multiple verification processes to obtain the identity verification result; If the authentication result indicates that the user's identity has been verified, the system begins to detect the target financial account's historical transaction data and login logs.

9. A security monitoring device for a financial account, characterized in that, include: The transaction data detection unit is used to detect the historical transaction data and login logs of the target financial account, and to preprocess the historical transaction data. The risk rating unit is used to perform risk rating on the target financial account based on the preprocessed historical transaction data and using a multilayer perceptron model to obtain the account risk level. The transaction anomaly detection unit is used to input the preprocessed historical transaction data and login logs into an anomaly model set, and output anomaly transaction detection results and anomaly login status monitoring results. The anomaly model set includes: an account anomaly login detection model, a frequent transaction detection model, and a transaction habit anomaly detection model. The account anomaly login detection model is used to analyze the login logs to determine whether the target financial account has an abnormal login status. The frequent transaction detection model is used to analyze the transaction quantity of the preprocessed historical transaction data to determine whether the target financial account has abnormal transactions. The transaction habit anomaly detection model is used to analyze the transaction habits of the preprocessed historical transaction data to determine whether the target financial account has abnormal transactions. The abnormal transaction identification unit is used to identify the probability value of the current transaction activity of the target financial account being an abnormal transaction based on the account risk level, the abnormal transaction detection result, and the abnormal login status monitoring result, and output transaction alarm prompt information when the probability value indicates that the current transaction activity is an abnormal transaction.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the security monitoring method for financial accounts as described in any one of claims 1 to 8.

11. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the financial account security monitoring method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the security monitoring method for financial accounts as described in any one of claims 1 to 8.

Images