Continuous abnormal transaction detection method and system for data dynamic change

Abstract

The invention discloses a continuous abnormal transaction detection method and system for data dynamic change, and belongs to the field of abnormal transaction detection.The method comprises the steps that a pseudo label is distributed to each data sample to be exited, and a new training pair is formed; adding an extended classification head on an output layer of the detection model; carrying out fine tuning training on the detection model by adopting a new training pair, and carrying out back propagation only according to an extended classification head; and cutting the extended classification head of the detection model, executing an abnormal transaction detection task, and outputting a transaction detection result. Through fine tuning training and back propagation only according to the extended classification head, the decision space corresponding to the pseudo category is moved to a position different from the original normal detection decision boundary of the model, and the decision space corresponding to the pseudo category is inactivated by cutting the extended classification head, so that the contribution of the to-be-exited data in the model is effectively erased. And the existing detection capability of the model can be prevented from being damaged, so that the detection accuracy and stability are ensured.

Description

Technical Field

[0001] The present invention relates to the field of abnormal transaction detection, and in particular to a method and system for continuous abnormal transaction detection targeting at dynamic changes in data. Background Art

[0002] In the field of financial technology, abnormal transaction detection is one of the important pillars to ensure risk prevention and compliance operations of financial institutions. It can identify various types of potential risky transactions. By monitoring transaction data in real time and promptly discovering possible fraudulent behavior, financial institutions can effectively protect customer assets and maintain the stability of the financial market. Existing abnormal transaction detection systems are usually only put online after training existing customer data once, which makes it difficult to meet the exit requirements of old customers. Specifically, in order to meet privacy protection or compliance requirements, old customers often want to completely delete their transaction records in the model when exiting, which further increases the requirements for model flexibility and scalability. For users who make exit requests, it is not enough to simply delete their corresponding data in the database, because the abstract knowledge contributed by these data has been accumulated in the model after the detection model training is completed, and becomes part of the learned feature space. If the old customer information is directly removed, it will damage the existing detection capabilities of the model, thereby affecting the accuracy and stability of the detection. Summary of the invention

[0003] The purpose of the present invention is to overcome the problems of the prior art and provide a method and system for continuous abnormal transaction detection targeting at dynamic changes in data.

[0004] The object of the present invention is to achieve the following technical solution: a method for detecting continuous abnormal transactions with dynamic changes in data, the method comprising abnormal transaction detection steps with dynamic exit of data: Assign a pseudo label to each data sample to be withdrawn, and form a new training pair with the corresponding data sample to be withdrawn; the data sample to be withdrawn is a historical transaction record, including the transaction time, transaction location, transaction amount, transaction frequency, and transaction account of each user's financial payment tool; Add an extended classification head to the output layer of the detection model to process pseudo labels, thereby expanding the decision space of the detection model; The new training pairs are used to fine-tune the detection model. The original classification head of the detection model remains unchanged, and only backpropagation is performed based on the extended classification head to update the parameters of the detection model. Crop the extended classification head of the detection model to obtain a first optimized detection model; The first optimized detection model is used to perform abnormal transaction detection tasks and output transaction detection results.

[0005] In one example, before using the first optimized detection model to perform the abnormal transaction detection task, the method further includes: Performing linear operations on the parameters of the first optimized detection model to obtain a second optimized detection model with updated parameters; The second optimized detection model is used to perform abnormal transaction detection tasks and output transaction detection results.

[0006] In one example, the calculation expression for fine-tuning the detection model using the new training pair is: ; in, represents the parameters of the detection model after fine-tuning training; represents the parameters of the detection model before fine-tuning training; Represents the parameters of the model used for optimization during fine-tuning training; represents the cross entropy loss function; A feature vector representing the data sample to be exited; represents a pseudo label; Indicates data label; Indicates the data sample set to be exited.

[0007] In one example, the fine-tuning training of the detection model using a new training pair and the trimming of the extended classification head of the detection model constitute a data forgetting process of the detection model. The constraint conditions of the data forgetting process are: ; in, represents the parameters of the detection model after fine-tuning training; A feature vector representing the data sample to be exited; Indicates data label; It means that after fine-tuning training and extended classification head pruning, the detection model can detect the input data The predicted output.

[0008] In one example, the method further includes a step of detecting abnormal transactions with dynamically increasing data: Use old data samples to train the detection model on old tasks; Using new data samples, and based on a regularization method, a module optimization method, or a sample replay method, performing new task training on the detection model that has completed the old task training, and then updating the parameters of the detection model to obtain a third optimized detection model; The third optimized detection model is used to perform abnormal transaction detection tasks and output transaction detection results.

[0009] In one example, when training a detection model using a continuous learning method based on regularization, the following steps are included: During the training of the old task, the Fisher information matrix of each parameter of the detection model is calculated; During the training process of the new task, an elastic weight consolidation mechanism is used to introduce regularization terms in the loss function to constrain the important parameters of the detection model in the old task, so as to update the parameters of the detection model.

[0010] In one example, during the training of a new task, the loss function is expressed as: ; in, Represents the loss function for training new tasks by introducing an elastic weight consolidation mechanism; Represents the loss function of directly training the old task without introducing the elastic weight consolidation mechanism; is the regularization coefficient; represents the Fisher information matrix; Indicates data label; Represents the network parameters when training new tasks; Represents the optimal parameters obtained by completing the old task.

[0011] In one example, before using the first optimized detection model or the third optimized detection model to perform the abnormal transaction detection task, the method further includes: Performing linear operations on the parameters of the first optimized detection model and the parameters of the third optimized detection model to obtain a final detection model; The final detection model is used to perform abnormal transaction detection tasks and output transaction detection results.

[0012] It should be further explained that the technical features corresponding to the above examples can be combined or replaced with each other to form a new technical solution.

[0013] The present invention also includes a continuous abnormal transaction detection system for dynamic changes in data, the system comprising interconnected terminals and servers, the servers comprising storage servers and training servers; The terminal accesses the storage server and inputs the original historical transaction records to the storage server; the terminal accesses the training server and inputs the data increase and decrease identifier and the training data set to the training server, and the training data set includes the data samples to be withdrawn, the old data samples, and the new data samples; The training server is used to execute the step of training the detection model in the method for detecting continuous abnormal transactions with dynamic changes in data formed by any one of the above examples or a combination of multiple examples; The storage server is used to store the trained second optimized detection model, the third optimized detection model, or the final detection model; The terminal and / or the training server and / or the storage server uses the second optimized detection model or the third optimized detection model or the final detection model to perform the abnormal transaction detection task and output the transaction detection result.

[0014] Compared with the prior art, the present invention has the following beneficial effects: 1. In one example, pseudo labels are assigned to the data to be exited and fine-tuning training is performed. In the fine-tuning training, back propagation is performed only based on the extended classification head, so that the decision space corresponding to the pseudo category is moved to a position different from the original normal detection decision boundary of the model, and the decision space corresponding to the pseudo category is inactivated by trimming the extended classification head, thereby effectively erasing the contribution of the data to be exited in the model without affecting the model's judgment on normal transaction samples, that is, it can avoid damaging the existing detection capability of the model, thereby ensuring the accuracy and stability of the detection.

[0015] 2. In one example, by performing linear operations on the parameters of the first optimized detection model, the possibility of changes in the model's optimal parameter space caused by model fine-tuning can be minimized, thereby ensuring the model's detection performance for normal transaction samples that have not exited (remaining data).

[0016] 3. In one example, by designing constraints for the data forgetting process, the model can only forget the predictions for the data samples to be exited, thereby effectively deleting the performance of the data samples to be exited on the model and retaining the model's detection performance for other data samples.

[0017] 4. In one example, the introduction of regularization methods, module optimization methods, and sample replay methods to train the detection model for new tasks can enable the model to avoid "catastrophic forgetting" of the original detection capabilities during the dynamic update process, and effectively adapt to environmental changes caused by dynamic changes in data, which is more in line with the actual requirements of continuous abnormal transaction detection.

[0018] 5. In one example, the present invention measures the importance of each parameter in the old task through the Fisher information matrix, thereby ensuring that important parameters are constrained in the training of new tasks (tasks with newly added data samples) to avoid forgetting old knowledge, thereby ensuring the detection performance when new data samples are added.

[0019] 6. In one example, by performing linear operations on the parameters of the first optimized detection model and the parameters of the third optimized detection model, the parameter proportions before and after the model actively forgets can be flexibly adjusted, that is, whether to pay more attention to the anomaly detection performance of other non-exited transaction samples, or to pay more attention to the degree of deletion of the data samples to be exited in the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The specific implementation methods of the present invention are further described in detail below in conjunction with the accompanying drawings. The accompanying drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The same reference numerals are used in these drawings to represent the same or similar parts. The schematic embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0021] Figure 1 A flowchart of data dynamic exit processing provided for an example of the present invention; Figure 2 A data dynamic exit processing block diagram is provided for an example of the present invention; Figure 3 A CNN model architecture diagram provided for an example of the present invention; Figure 4 A schematic diagram of an elastic weight consolidation mechanism provided for an example of the present invention; Figure 5 A schematic diagram of dynamic changes in data provided by an example of the present invention; Figure 6 A system framework diagram provided for an example of the present invention.

[0022] In the figure: 101 - first terminal; 102 - second terminal; 103 - server. DETAILED DESCRIPTION

[0023] The technical solution of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] In the description of the present invention, ordinal numbers (e.g., "first and second", etc.) are used to distinguish objects, but are not limited to the order, and cannot be understood as indicating or implying relative importance. Unless otherwise clearly specified and limited, "interconnection" and "connection" should be understood in a broad sense, for example, it can be directly connected or indirectly connected through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0025] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0026] In one example, if Figure 1-Figure 2 As shown, a method for detecting continuous abnormal transactions with dynamic changes in data includes abnormal transaction detection steps with dynamic exit of data: S11: assign a pseudo label to each data sample to be exited, and form a new training pair with the corresponding data sample to be exited.

[0027] Specifically, in the financial field, the data samples to be exited, i.e., the data samples of customers (users) to be exited, are the historical transaction records of each customer, which may be life consumption records, bank loan records, securities trading records, and other transaction information records, etc., specifically including the transaction time, transaction location, transaction amount, transaction frequency, transaction account, etc. of each user's financial payment tool. The number of users here may be dozens, hundreds, or even larger, so the number of users is limited.

[0028] Furthermore, in step S11, the sample set of data to be exited is recorded as , assign a pseudo label to each sample in the sample set , forming a new training pair , Represents the feature vector of the data sample to be exited, the pseudo label It is not the true category label of the data sample to be exited.

[0029] S12: Add an extended classification head to the output layer of the detection model to process pseudo labels, thereby expanding the decision space of the detection model.

[0030] Specifically, by adding a new neuron to the output layer of the original detection model, an extended classification head is added to obtain the pseudo label Expand the model's decision space.

[0031] Furthermore, the detection model is preferably a deep learning model, which is capable of discovering intricate structures in empirical data for learning. By constructing a deep learning model containing multiple processing layers, multiple levels of abstract layers can be created to represent the data. Deep learning models include Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), Long Short-Term Memory (LSTM), Gated Recurrent Unit (GRU), Transformer models, etc. Convolutional neural networks are a type of deep learning model specifically designed to process grid-structured data (such as images). Its core mechanism is to extract features of input data through convolution operations. The architecture of a convolutional neural network usually consists of multiple layers, including convolutional layers, pooling layers, and fully connected layers. For example Figure 3As shown in the figure, the convolutional neural network used in this example includes sequentially connected convolutional layer 1, convolutional layer 2, pooling layer 1, convolutional layer 3, pooling layer 2, fully connected layer, Dropout layer and Softmax layer. In the convolutional layer, multiple filters (convolution kernels) are used to perform convolution operations on the input data to generate feature maps; the pooling layer is responsible for reducing the dimension of the feature map, reducing the computational complexity and preventing overfitting; the fully connected layer is used to perform weighted summation of the input features; the Dropout layer is used to randomly discard some neurons to reduce the overfitting of the model to the training data and improve the generalization ability of the model; the Softmax layer is used to convert the input value into a probability distribution and output the classification result. Taking continuous abnormal transaction detection as an example, CNN takes the customer's historical transaction records as input, and after multiple convolution and pooling processes, it outputs the prediction results (transaction detection results) about abnormal transactions.

[0032] S13: Using new training pairs The detection model is fine-tuned and trained. The original classification head of the detection model (other classification heads except the extended classification head) remains unchanged. Backpropagation is performed only based on the extended classification head, and the model parameters are adjusted.

[0033] Through the active forgetting fine-tuning training in step S13, the decision space of the data samples to be forgotten will be mapped to the specified new Label space. It is worth noting that the pseudo-label The corresponding decision space is far away from the decision space of existing normal customer data, that is, pseudo label The positions of the representative data points and the normal transaction data points in the feature space are quite different and belong to different categories.

[0034] S14: Crop the extended classification head of the detection model to obtain a first optimized detection model.

[0035] By trimming and extending the classification head to make it inactive, the model can predict the failure of the exiting data samples. The prediction failure is considered that the model no longer remembers the information of the exiting data samples, ensuring that the model can actively forget these no longer needed data, while ensuring the ability to detect the remaining user transaction information (normal transaction samples, that is, other non-exiting data samples).

[0036] Through the above steps S11 to S14, the model training is completed in the case of dynamic exit of data samples, and this task is defined as task B. Specifically, this example specifically adopts the decision boundary migration method to effectively erase the model memory of the data sample to be exited. In this process, the data sample to be exited is first processed as a pseudo-category, and then the training is Fine-tune the model, move its decision space to a position different from the model's original normal detection decision boundary, and inactivate the decision space corresponding to this pseudo-category. This way, the contribution of the specified data (data samples to be exited) in the model can be effectively erased without affecting the model's judgment of normal transaction samples, ensuring uninterrupted and effective anomaly detection.

[0037] S15: Use the first optimized detection model to perform abnormal transaction detection tasks and output transaction detection results.

[0038] In the case of dynamic exit of data samples, after completing the detection model training in the above steps S11-S14, the trained optimized detection model is used to perform continuous abnormal transaction detection on the input data samples, and then output (abnormal) transaction detection results, such as repeated transactions, market operations, etc.

[0039] In one example, before using the first optimized detection model to perform the abnormal transaction detection task, the method further includes: Performing linear operations on the parameters of the first optimized detection model to obtain a second optimized detection model with updated parameters; The second optimized detection model is used to perform abnormal transaction detection tasks and output transaction detection results.

[0040] After fine-tuning the detection model, the optimal parameter space of the model for other non-exited data samples may change, thereby reducing the model performance. Therefore, the present invention performs linear operations on the parameters of the fine-tuned model to maximize the performance of the model for other non-exited data samples and effectively delete the data samples to be exited.

[0041] In one example, a new training pair The forgetting process of fine-tuning the detection model can be described by the following expression: ; in, represents the parameters of the detection model after fine-tuning training; represents the parameters of the detection model before fine-tuning training; Indicates the parameters of the model used for optimization during fine-tuning training; model parameters include weights, biases, etc. represents the cross entropy loss function; A feature vector representing the data sample to be exited; represents a pseudo label; Indicates data label; Represents the set of data samples to be withdrawn. Through the above-mentioned fine-tuning training process, the contribution of all the data samples to be withdrawn can be effectively deleted from the model, so that the model no longer remembers how to correctly predict this part of the data samples, thereby achieving the purpose of withdrawing user information protection.

[0042] In one example, a new training pair is used to fine-tune the detection model and the extended classification head of the detection model is pruned to form a data forgetting process of the detection model. The constraints of the data forgetting process are: ; in, represents the parameters of the detection model after fine-tuning training; A feature vector representing the data sample to be exited; Indicates data label; It means that after fine-tuning training and extended classification head pruning, the detection model can detect the input data It should be noted that the forgetting process is only applied to the sample set of customers to be exited. , without changing the model's prediction layer for the original anomaly type.

[0043] In one example, a method for detecting continuous abnormal transactions with dynamic changes in data further includes a step of detecting abnormal transactions with dynamic increases in data, including: S01: Use old data samples to train the detection model on old tasks.

[0044] Among them, the old data samples are the collected customer data samples. At this time, no customer data is withdrawn or added. They are the historical transaction records of each customer (the transaction records of old customers), which can be life consumption records, bank loan records, securities trading records, and other transaction information records, etc. Specifically, they include the transaction time, transaction location, transaction amount, transaction frequency, transaction account, etc. of each user's financial payment tool. The old task training here is to input the old data samples into the detection model, calculate the model output, and use the loss function to calculate the difference between the model prediction value and the true label, and update the model parameters through the back propagation algorithm to optimize the model performance until convergence.

[0045] S02: Using new data samples, and performing new task training on the detection model that has completed the old task training based on a regularization method, a module optimization method, or a sample replay method, and then updating the parameters of the detection model to obtain a third optimized detection model.

[0046] Among them, the new data sample is the newly added data sample, that is, the newly added customer (user) data sample. At this time, new customer data is added. The new data sample is the historical transaction record of each customer, which can be a life consumption record, bank loan record, securities trading record and other transaction information records, etc., specifically including the transaction time, transaction location, transaction amount, transaction frequency, transaction account, etc. of each user's financial payment tool.

[0047] Furthermore, the regularization method, the module optimization method, and the sample playback method are all continuous learning methods. Continual Learning (CL) refers to training a model on a data stream of a task sequence, and the training goal is that the trained model can achieve good performance on all learned tasks. Each task has its own separate training set, validation set, and test set. When training a model, only the data of the current training task can be accessed. The main challenge is to avoid catastrophic forgetting during learning, that is: as new tasks or fields are added, the performance of previously learned tasks or fields should not (significantly) decrease over time. At this time, if the model is trained directly on the newly added data without taking constraints, the existing model will train a new parameter space on the newly added data samples to ensure the anomaly detection performance on the newly added data samples. However, due to the change in the parameter space, the optimal parameter space learned on the previous old data samples will be destroyed, and then the model detection performance on the historical data will also drop sharply, resulting in catastrophic forgetting of old knowledge in the model. In order to solve this technical problem, the present invention adopts the above three continuous learning methods to train the detection model that has completed the old task training for new tasks. Among them, the regularization method avoids forgetting old tasks by adding regularization terms to the loss function to limit the changes in model parameters; the module optimization method reduces interference between tasks by constructing task-specific parameters or dynamically adjusting the model structure, thereby avoiding catastrophic forgetting; the sample replay method alleviates catastrophic forgetting by storing or generating data of old tasks. In this way, through the above-mentioned continuous learning method, the detection model can avoid the "catastrophic forgetting" of the original detection ability of old tasks during the dynamic update process, and can effectively adapt to the environmental changes brought about by customer flow, that is, it can continuously learn new data sample information and maintain the ability to monitor the latest transaction risks.

[0048] S03: Use the third optimized detection model to perform abnormal transaction detection tasks and output transaction detection results.

[0049] In this example, regularization methods, module optimization methods, and sample replay methods are introduced to train the detection model on new tasks in order to update the model parameters and optimize the model. This allows the model to avoid "catastrophic forgetting" of the original detection capabilities during the dynamic update process and effectively adapt to environmental changes caused by dynamic changes in data, which is more in line with the actual requirements for continuous abnormal transaction detection.

[0050] In one example, when training a detection model using a continuous learning method based on regularization, the following steps are included:

[0051] During the old task training process, the Fisher information matrix of each parameter of the detection model is calculated.

[0052] The Fisher information matrix is ​​a measure of the amount of information. Assume that according to the distribution of the random variable, the parameters used for modeling are , then Fisher information measures the probability that a random variable carries Therefore, when the fixed When the value is taken as the random variable, the Fisher information will indicate that the value of this random variable can contribute to The larger the value of Fisher information, the more likely the random variable is to be The greater the amount of information. On the contrary, it means that the random variable is Based on this intuitive definition, the Elastic Weight Consolidation (EWC) mechanism uses the Fisher information matrix to calculate the important parameters at the end of model training.

[0053] During the training process of the new task, an elastic weight consolidation mechanism is used to introduce regularization terms in the loss function to constrain the important parameters of the detection model in the old task, so as to update the parameters of the detection model.

[0054] Specifically, in regularization methods, the elastic weight consolidation mechanism is widely used because it can remember important parameter information and effectively constrain new tasks. Figure 4 As shown, the important parameters corresponding to different tasks are also different, and EWC can remember the important parameters of the old tasks and constrain the training of new tasks under the premise of unchanged memory overhead. For this reason, the present invention preferably uses EWC as a constraint method for continuous modeling of the detection model.

[0055] Preferably, the customer addition (dynamic data addition) task A is regarded as a dual-task process, which is specifically divided into old task A1 and new task A2. A convolutional neural network is used for training in this process to optimize the detection of customer transactions. Before starting training, the transaction records of old customers are collected, and the data cleaning method is used to improve the generalization ability of the model.

[0056] In the construction of CNN models, the network usually consists of multiple convolutional layers and pooling layers, which are responsible for extracting features from the input data. For Task A1, the transaction records of old customers are used as the input of the model during training. The forward propagation formula of CNN can be expressed as: ; in, is the output of the network; is the activation function (such as ReLU); is the weight matrix; It is the input data, i.e., the characteristics of transaction records of multiple old customers; is the bias term. In the process of updating weights through the back-propagation algorithm, the cross entropy loss is used to evaluate the model performance, and the loss function can be expressed as: ; in, represents the loss function for directly training the old task A1; Represents the parameters of the model; represents the total number of samples; Represents the true label of the model; Represents the model prediction label.

[0057] After completing the training of task A1, the training of new task A2 will begin. During the training of new task A2, the parameters of the detection model need to be fine-tuned to adapt to the characteristics of the newly added data samples. The present invention introduces an elastic weight consolidation mechanism, which aims to ensure that the important parameters of the old task A1 are constrained in the training of the new task A2 by remembering the important parameters of the old task A1, so as to avoid forgetting the old knowledge.

[0058] Specifically, the present invention uses the Fisher information matrix to measure the importance of each parameter in the old task A1, combined with the L2 penalty as a penalty term. When using EWC to train the new customer task A2, the loss function can be expressed as: ; Among them, among them, Represents the loss function for training new tasks by introducing an elastic weight consolidation mechanism; Represents the loss function of directly training the old task without introducing the elastic weight consolidation mechanism; is the regularization coefficient; represents the Fisher information matrix; Indicates data label; Represents the network parameters when training new tasks; represents the optimal parameters obtained by completing the old task. In this way, the CNN model can still maintain the ability to recognize the old customer patterns while learning new transaction features, thereby effectively improving the accuracy and stability of the system. In order to make the subsequent technical description clearer, after completing task A, the parameters of the current model are recorded as .

[0059] In one example, before using the first optimized detection model or the third optimized detection model to perform the abnormal transaction detection task, the method further includes:

[0060] Perform linear operations on the parameters of the first optimized detection model and the parameters of the third optimized detection model to obtain a final detection model; use the final detection model to execute the abnormal transaction detection task and output the transaction detection result.

[0061] Specifically, the calculation expressions for the parameters of the first optimized detection model and the parameters of the third optimized detection model are: ; in, The optimized model parameters when data is dynamically increased, i.e., the parameters of the third optimized detection model; are the model parameters optimized under the condition of dynamic data exit, i.e., the parameters of the first optimized detection model; is an integer, and the parameter ratio before and after the active forgetting of the detection model can be adjusted according to the actual situation and evaluation indicators. The larger the value is, the more the model focuses on the abnormal transaction detection performance of other non-exit transaction samples. The smaller it is, the more the model focuses on the cleanliness of deletion of exiting data samples in the model, thereby improving the flexibility and adjustability of the detection model.

[0062] Through the abnormal transaction detection steps and linear operation steps of the above-mentioned dynamic data exit, it can be ensured that during the customer exit process of abnormal transaction detection, the model can not only successfully remove the memory of the data samples to be exited, but also continue to maintain high sensitivity and accuracy for the remaining transaction data.

[0063] It should be noted that customer addition (dynamic data addition) and customer exit (dynamic data exit) are regarded as two tasks that the detection model needs to train, which are defined as Task A (steps S01-S02) and Task B (steps S11-S14) respectively. Task A or Task B can be executed separately according to the specific scenario requirements. In actual scenarios, Figure 5 As shown, the increase of customers and the exit of customers are continuous, so the detection model needs to perform real-time detection on the increase of new user data and the exit of user requests, that is, at this time, it is preferred to execute task A and task B in parallel, and the method includes the following steps: S100: read the historical transaction records in the private data set provided by the new customer and submit it to the global database; S200: Perform model training for abnormal transaction detection based on the global database updated at the current moment to obtain the latest CNN model; S300: When the CNN model training is completed, the Fisher information matrix of the model parameters is calculated, which is used to characterize the different importance of the model parameters; S400: When the user data in the new period increases, a new training loss function is designed based on the Fisher information matrix to update the previous CNN model with the new data samples. At this time, the model parameters are recorded as .

[0064] S500: When a historical user applies to quit, the decision space of the CNN model is first expanded (away from the normal decision space), and then the data of these quitting users is used to fine-tune the model and migrate the data contribution to the additional decision space; S600: After the CNN model is fine-tuned and trained, the model is pruned, that is, the extra decision space part is pruned so that the CNN model is reduced to its original size, thereby achieving the purpose of forgetting the specified user data in the model; the parameters of the model are recorded as .

[0065] S700: Yes and Perform linear operations, optimize model parameters, and obtain the target detection model to achieve accurate deletion of exiting users and correct retention of remaining data; S800: While processing the customer's withdrawal request, completely delete the private data of the withdrawing customer from the global database and build a new database; S900: Use the target detection model to detect the input existing customer private transaction data and output abnormal transaction detection results.

[0066] The present invention proposes a method for continuous abnormal transaction detection for dynamic increase and exit of data, which can take into account the abnormal transaction detection of new customers and old customers exiting at any time. On the one hand, the model can continuously absorb new customer information and maintain the ability to monitor the latest transaction risks. On the other hand, it can actively forget the exiting customers and effectively delete the exited customer samples and their impact on the model from the model. This improvement allows the model to avoid the "catastrophic forgetting" of the original detection capabilities and effectively adapt to the environmental changes brought about by customer mobility during the dynamic update process, and can actively forget some users to meet the needs of users who want to exit. Therefore, while ensuring the accuracy of abnormal transaction detection, the present invention realizes the flexible management of dynamic increase and decrease of customers and the safe use of data, and rationally utilizes memory and computing resources.

[0067] The present invention also includes a continuous abnormal transaction detection system for dynamic changes in data, such as Figure 6As shown, the system includes terminals and a server 103, the terminals include a first terminal 101 and a second terminal 102, the server 103 includes a storage server and a training server, and the first terminal 101 and the second terminal 102 are both connected to the storage server and the training server.

[0068] In this example, the first terminal is a terminal for applying to withdraw, and the second terminal is a terminal for applying to join, which can be a desktop computer, a smart phone, a tablet computer, a laptop computer, etc., but is not limited to this. The first terminal and the second terminal transmit basic training information to the training server through the SSH protocol, including data increase and decrease identifiers and training data sets. The training data set is a historical transaction sample that has undergone data preprocessing, including data samples to be withdrawn, old data samples, and new data samples. The first terminal and the second terminal directly or indirectly access the storage server through a wired connection or a wireless network, and input the original historical transaction records into the storage server.

[0069] Furthermore, the storage server and the training server can be independent physical servers or server clusters. The training server is used to perform the continuous abnormal transaction detection model training steps of data addition and data withdrawal of the present invention, and it trains the target model based on the basic information provided by the terminal. The storage server is used to save the trained detection model, which is accessed by the first terminal and the second terminal. At this time, the terminal and / or the training server and / or the storage server uses the second optimized detection model or the third optimized detection model or the final detection model to perform the abnormal transaction detection task and output the transaction detection result. Optionally, the server can be equipped with a Linux operating system and GPU computing resources.

[0070] The above specific implementation methods are detailed descriptions of the present invention. It cannot be determined that the specific implementation methods of the present invention are limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions and substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. A method for detecting continuous abnormal transactions with dynamic data changes, characterized in that: The method includes the abnormal transaction detection step of data dynamic exit: Assign a pseudo label to each data sample to be withdrawn, and form a new training pair with the corresponding data sample to be withdrawn; the data sample to be withdrawn is a historical transaction record, including the transaction time, transaction location, transaction amount, transaction frequency, and transaction account of each user's financial payment tool; Add an extended classification head to the output layer of the detection model to process pseudo labels, thereby expanding the decision space of the detection model; The new training pairs are used to fine-tune the detection model. The original classification head of the detection model remains unchanged, and only backpropagation is performed based on the extended classification head to update the parameters of the detection model. Crop the extended classification head of the detection model to obtain a first optimized detection model; The first optimized detection model is used to perform abnormal transaction detection tasks and output transaction detection results.

2. The method for detecting continuous abnormal transactions according to claim 1, characterized in that: Before the first optimized detection model is used to perform the abnormal transaction detection task, the method further includes: Performing linear operations on the parameters of the first optimized detection model to obtain a second optimized detection model with updated parameters; The second optimized detection model is used to perform abnormal transaction detection tasks and output transaction detection results.

3. The method for detecting continuous abnormal transactions according to claim 1, characterized in that: The calculation expression for fine-tuning the detection model using the new training pair is: ； in, represents the parameters of the detection model after fine-tuning training; represents the parameters of the detection model before fine-tuning training; Represents the parameters of the model used for optimization during fine-tuning training; represents the cross entropy loss function; A feature vector representing the data sample to be exited; represents a pseudo label; Indicates data label; Indicates the data sample set to be exited.

4. The method for detecting continuous abnormal transactions according to claim 1, characterized in that: The use of new training pairs to fine-tune the detection model and the trimming of the extended classification head of the detection model constitute the data forgetting process of the detection model. The constraints of the data forgetting process are: ； in, represents the parameters of the detection model after fine-tuning training; A feature vector representing the data sample to be exited; Indicates data label; It means that after fine-tuning training and extended classification head pruning, the detection model can detect the input data The predicted output.

5. The method for detecting continuous abnormal transactions according to claim 1, characterized in that: The method also includes the step of detecting abnormal transactions with dynamically increasing data: Use old data samples to train the detection model on old tasks; Using new data samples, and based on a regularization method, a module optimization method, or a sample replay method, performing new task training on the detection model that has completed the old task training, and then updating the parameters of the detection model to obtain a third optimized detection model; The third optimized detection model is used to perform abnormal transaction detection tasks and output transaction detection results.

6. The method for detecting continuous abnormal transactions according to claim 5, characterized in that: When training the detection model based on the continuous learning method in a regularized manner, it includes: During the training of the old task, the Fisher information matrix of each parameter of the detection model is calculated; During the training process of the new task, an elastic weight consolidation mechanism is used to introduce regularization terms in the loss function to constrain the important parameters of the detection model in the old task, so as to update the parameters of the detection model.

7. The method for detecting continuous abnormal transactions according to claim 6, characterized in that: During the training of a new task, the loss function is expressed as: ； in, Represents the loss function for training new tasks by introducing an elastic weight consolidation mechanism; Represents the loss function of directly training the old task without introducing the elastic weight consolidation mechanism; is the regularization coefficient; represents the Fisher information matrix; Indicates data label; Represents the network parameters when training new tasks; Represents the optimal parameters obtained by completing the old task.

8. The method for detecting continuous abnormal transactions according to claim 5, characterized in that: Before using the first optimized detection model or the third optimized detection model to perform the abnormal transaction detection task, the method further includes: Performing linear operations on the parameters of the first optimized detection model and the parameters of the third optimized detection model to obtain a final detection model; The final detection model is used to perform abnormal transaction detection tasks and output transaction detection results.

9. A continuous abnormal transaction detection system for dynamic data changes, characterized in that: The system includes interconnected terminals and servers, and the servers include storage servers and training servers; The terminal accesses the storage server and inputs the original historical transaction records to the storage server; the terminal accesses the training server and inputs the data increase and decrease identifier and the training data set to the training server, and the training data set includes the data samples to be withdrawn, the old data samples, and the new data samples; The training server is used to perform the step of training the detection model in the method for detecting continuous abnormal transactions with dynamic changes in data as described in any one of claims 1 to 8; The storage server is used to store the trained second optimized detection model, the third optimized detection model, or the final detection model; The terminal and / or the training server and / or the storage server uses the second optimized detection model or the third optimized detection model or the final detection model to perform the abnormal transaction detection task and output the transaction detection result.

Images