Real-time transaction risk detection and intelligent interception method and system based on multi-dimensional data and storage medium

Abstract

The invention provides a real-time transaction risk detection and intelligent interception method and system based on multi-dimensional data and a storage medium. The method comprises the steps that after a historical multi-dimensional data set related to a transaction is acquired, an initial privacy protection budget parameter epsilon is used for differential privacy processing; performing feature extraction on the differential privacy historical multi-dimensional data by using a feature extraction network to obtain a training sample feature set, and then training the graph neural network to obtain a first transaction detection model; testing the first transaction detection model by using the test sample set, and if an error is greater than or equal to a first threshold value, adjusting the initial privacy protection budget parameter based on the error; iterating the above steps until the error of the first test result is less than a first threshold value, and obtaining a second transaction detection model; and inputting the real-time transaction multi-dimensional data features into a second transaction detection model for risk detection and interception. According to the method, the model training efficiency is improved, and the data security is ensured.

Description

Technical Field

[0001] The present invention relates to the fields of data processing, bank risk prevention and control, and artificial intelligence technology, and in particular to a real-time transaction risk detection and intelligent interception method, system, and storage medium based on multidimensional data. Background Art

[0002] In the prior art, there is already the use of artificial intelligence to detect and intercept risks, and in order to reduce the risk of data privacy leakage during neural network model training, differential privacy computing has been introduced. However, in the prior art, whether the privacy protection budget parameters of differential privacy computing can meet the requirements of neural network training, that is, whether the data after differential privacy calculation can meet the training requirements of the neural network, it is difficult to accurately determine the privacy protection budget parameters in the prior art, or the method for determining the privacy protection budget parameters is too complicated and the iteration cycle is long.

[0003] In addition, there are methods in the prior art for risk detection and interception using graph neural networks. However, the composition method in the prior art organizes data using users as nodes, that is, various types of historical data are combined into a data vector as the historical data of a user. In this way, the collected historical data needs to be preprocessed into user data first, and some other collected historical data cannot be used. Moreover, it is difficult for the trained graph neural network to perform real-time monitoring and interception of risks based on some of the real-time data obtained. Summary of the invention

[0004] The present invention proposes the following technical solutions to address one or more technical deficiencies in the above-mentioned prior art.

[0005] A real-time transaction risk detection and intelligent interception method based on multi-dimensional data, the method comprising: An acquisition step, acquiring a historical multidimensional data set related to the transaction, wherein the historical multidimensional data set includes: historical transaction behavior data, historical user profile data, historical environment dynamic data, and historical cross-industry joint defense data; A processing step of performing differential privacy processing on the data in the historical multidimensional data set using an initial privacy protection budget parameter ε to obtain a processed differential privacy historical multidimensional data set; A training step, using a feature extraction network to extract features from the differential privacy historical multidimensional data to obtain a training sample feature set, and training a graph neural network based on the training sample feature set to obtain a trained first transaction detection model; an adjustment step, testing the first transaction detection model using a test sample set to obtain a first test result, and if an error of the first test result is greater than or equal to a first threshold, adjusting the initial privacy protection budget parameter based on the error to obtain an adjusted privacy protection budget parameter ε′; an iterative step, using the adjusted ε′ to replace the ε and then repeatedly performing the processing step, the training step and the adjustment step until the error of the first test result is less than a first threshold, thereby obtaining a second transaction detection model; The interception step is to input the acquired real-time transaction multidimensional data into the feature extraction network to obtain real-time transaction data features, and input the real-time transaction data features into the second transaction detection model to obtain a transaction risk index. If the transaction risk index is greater than a first threshold, the transaction is intercepted in real time.

[0006] Preferably, the operation of adjusting the initial privacy protection budget parameter based on the error to obtain the adjusted privacy protection budget parameter ε′ is: Obtain the number N1 of historical transaction behavior data, the number N2 of historical user portrait data, the number N3 of historical environment dynamic data, and the number N4 of historical cross-industry joint defense data in the historical multidimensional data set; Using k times of the error as the clustering distance, a clustering algorithm is used to cluster N1 pieces of historical transaction behavior data, N2 pieces of historical user portrait data, N3 pieces of historical environmental dynamic data, and N4 pieces of historical cross-industry joint defense data, and the number of clusters n1 of historical transaction behavior data, the number of clusters n2 of historical user portrait data, the number of clusters n3 of historical environmental dynamic data, and the number of clusters n4 of historical cross-industry joint defense data are obtained respectively; The adjusted privacy protection budget parameter ε′ is calculated as: , in, is the error, k≥1.

[0007] Preferably, the feature extraction network is VGG or ResNet.

[0008] Preferably, the transaction behavior data includes: transaction time, transaction frequency, geographic location and device fingerprint; the user portrait data includes: historical behavior patterns, credit scores and social network associations; the environmental dynamic data includes: network delays, abnormal device status and real-time public opinion events; the cross-industry joint defense data includes: security collaboration data with communications and e-commerce platforms.

[0009] Preferably, the graph used by the graph neural network is formed in the following manner: transaction behavior, user portrait, environmental dynamics and industry characteristics are used as nodes of the graph; if the geographical location in the transaction behavior and the location in the abnormal state of the device in the environmental dynamics or the location of the real-time public opinion event are less than the second threshold, then there is an edge between the transaction behavior node and the environmental dynamics node; if the geographical location in the transaction behavior and the location of the security collaborative data with communications and e-commerce platforms in the cross-industry joint defense data are less than the third threshold, then there is an edge between the transaction behavior node and the industry characteristic node; if the location in the abnormal state of the device in the environmental dynamics or the location of the real-time public opinion event and the location of the security collaborative data with communications and e-commerce platforms in the cross-industry joint defense data are less than the fourth threshold, then there is an edge between the environmental dynamics node and the industry characteristic node; and the edges between the user portrait node and the transaction behavior node, the environmental dynamics node, and the industry characteristic node are determined based on the social network correlation in the user portrait.

[0010] The present invention also proposes a real-time transaction risk detection and intelligent interception system based on multi-dimensional data, the system comprising: An acquisition unit, which acquires a historical multidimensional data set related to a transaction, wherein the historical multidimensional data set includes: historical transaction behavior data, historical user profile data, historical environment dynamic data, and historical cross-industry joint defense data; A processing unit, performing differential privacy processing on the data in the historical multidimensional data set using an initial privacy protection budget parameter ε to obtain a processed differential privacy historical multidimensional data set; A training unit, using a feature extraction network to extract features from the differential privacy historical multidimensional data to obtain a training sample feature set, and training a graph neural network based on the training sample feature set to obtain a trained first transaction detection model; an adjusting unit, which tests the first transaction detection model using a test sample set to obtain a first test result, and if an error of the first test result is greater than or equal to a first threshold, adjusts the initial privacy protection budget parameter based on the error to obtain an adjusted privacy protection budget parameter ε′; an iterative unit, which replaces the ε with the adjusted ε′ and then repeatedly executes the operations of the processing unit, the training unit and the adjustment unit until the error of the first test result is less than a first threshold, thereby obtaining a second transaction detection model; The interception unit inputs the acquired real-time transaction multi-dimensional data into a feature extraction network to obtain real-time transaction data features, inputs the real-time transaction data features into the second transaction detection model to obtain a transaction risk index, and if the transaction risk index is greater than a first threshold, the transaction is intercepted in real time.

[0011] Preferably, the operation of adjusting the initial privacy protection budget parameter based on the error to obtain the adjusted privacy protection budget parameter ε′ is: Obtain the number N1 of historical transaction behavior data, the number N2 of historical user portrait data, the number N3 of historical environment dynamic data, and the number N4 of historical cross-industry joint defense data in the historical multidimensional data set; Using k times of the error as the clustering distance, a clustering algorithm is used to cluster N1 pieces of historical transaction behavior data, N2 pieces of historical user portrait data, N3 pieces of historical environmental dynamic data, and N4 pieces of historical cross-industry joint defense data, and the number of clusters n1 of historical transaction behavior data, the number of clusters n2 of historical user portrait data, the number of clusters n3 of historical environmental dynamic data, and the number of clusters n4 of historical cross-industry joint defense data are obtained respectively; The adjusted privacy protection budget parameter ε′ is calculated as: , in, is the error, k≥1.

[0012] Preferably, the feature extraction network is VGG or ResNet.

[0013] Preferably, the transaction behavior data includes: transaction time, transaction frequency, geographic location and device fingerprint; the user portrait data includes: historical behavior patterns, credit scores and social network associations; the environmental dynamic data includes: network delays, abnormal device status and real-time public opinion events; the cross-industry joint defense data includes: security collaboration data with communications and e-commerce platforms.

[0014] Preferably, the graph used by the graph neural network is formed in the following manner: transaction behavior, user portrait, environmental dynamics and industry characteristics are used as nodes of the graph; if the geographical location in the transaction behavior and the location in the abnormal state of the device in the environmental dynamics or the location of the real-time public opinion event are less than the second threshold, then there is an edge between the transaction behavior node and the environmental dynamics node; if the geographical location in the transaction behavior and the location of the security collaborative data with communications and e-commerce platforms in the cross-industry joint defense data are less than the third threshold, then there is an edge between the transaction behavior node and the industry characteristic node; if the location in the abnormal state of the device in the environmental dynamics or the location of the real-time public opinion event and the location of the security collaborative data with communications and e-commerce platforms in the cross-industry joint defense data are less than the fourth threshold, then there is an edge between the environmental dynamics node and the industry characteristic node; and the edges between the user portrait node and the transaction behavior node, the environmental dynamics node, and the industry characteristic node are determined based on the social network correlation in the user portrait.

[0015] The present invention further provides a computer-readable storage medium, wherein the storage medium stores computer program code, and when the computer program code is executed by a computer, any of the above methods is executed.

[0016] The technical effect of the present invention is: a real-time transaction risk detection and intelligent interception method, system and storage medium based on multidimensional data of the present invention, the method comprising: an acquisition step S101, acquiring a historical multidimensional data set related to the transaction, the historical multidimensional data set comprising: historical transaction behavior data, historical user portrait data, historical environmental dynamic data and historical cross-industry joint defense data; a processing step S102, performing differential privacy processing on the data in the historical multidimensional data set using an initial privacy protection budget parameter ε to obtain a processed differential privacy historical multidimensional data set; a training step S103, using a feature extraction network to extract features from the differential privacy historical multidimensional data to obtain a training sample feature set, and training a graph neural network based on the training sample feature set to obtain a trained first transaction detection model; an adjustment step S104, performing differential privacy processing on the data in the historical multidimensional data set using an initial privacy protection budget parameter ε to obtain a processed differential privacy historical multidimensional data set; a training step S105, performing differential privacy processing on the historical multidimensional data using a feature extraction network to obtain a training sample feature set, and training a graph neural network based on the training sample feature set to obtain a trained first transaction detection model; and an adjustment step S106. 4. Use the test sample set to test the first transaction detection model to obtain a first test result. If the error of the first test result is greater than or equal to the first threshold, adjust the initial privacy protection budget parameter based on the error to obtain the adjusted privacy protection budget parameter ε′; iterative step S105, use the adjusted ε′ to replace the ε and then repeat the processing step S102, training step S103 and adjustment step S104 until the error of the first test result is less than the first threshold, so as to obtain a second transaction detection model; interception step S106, input the acquired real-time transaction multidimensional data into the feature extraction network to obtain real-time transaction data features, input the real-time transaction data features into the second transaction detection model to obtain a transaction risk index, and if the transaction risk index is greater than the first threshold, intercept the transaction in real time. The present invention obtains a first test result by testing the first transaction detection model using a test sample set. If the error of the first test result is greater than or equal to the first threshold, the initial privacy protection budget parameter is adjusted based on the error to obtain the adjusted privacy protection budget parameter ε′. That is, the present invention sets an adjustment of the initial privacy protection budget parameter based on the test error. After repeated iterations until the error of the first test result is less than the first threshold, the second transaction detection model is obtained, that is, the privacy protection budget parameter required for neural network training in differential privacy calculation is obtained more quickly, the training efficiency of the model is improved, and data security is ensured. Another innovation of the present invention is that: first, features are extracted using a feature extraction network, and then the extracted features are calculated as feature values ​​of the graph neural network, which improves the operating efficiency of the graph neural network and overcomes the defects in the prior art.The present invention innovatively proposes a composition method of a graph neural network that is not composed with users as nodes, but is composed according to the type of data obtained. The graph neural network constructed in this way can detect and intercept risks from multiple dimensions such as transaction behavior, user portraits, environmental dynamic data, and historical cross-industry joint defense data. Therefore, the trained transaction detection model can perform risk detection and interception by obtaining only one or more of the following data: transaction behavior, user portraits, environmental dynamic data, and historical cross-industry joint defense data, thereby improving the accuracy and reliability of risk detection and interception. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Other features, objects and advantages of the present application will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings.

[0018] Figure 1 It is a flow chart of a real-time transaction risk detection and intelligent interception method based on multi-dimensional data according to an embodiment of the present invention.

[0019] Figure 2 It is a structural diagram of a real-time transaction risk detection and intelligent interception system based on multi-dimensional data according to an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0021] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0022] Figure 1 A real-time transaction risk detection and intelligent interception method based on multi-dimensional data of the present invention is shown, and the method comprises: Acquisition step S101, acquiring a historical multidimensional data set related to the transaction, the historical multidimensional data set including: historical transaction behavior data, historical user portrait data, historical environment dynamic data and historical cross-industry joint defense data; Processing step S102, performing differential privacy processing on the data in the historical multidimensional data set using the initial privacy protection budget parameter ε to obtain a processed differential privacy historical multidimensional data set; Training step S103, using a feature extraction network to extract features from the differential privacy historical multidimensional data to obtain a training sample feature set, and training a graph neural network based on the training sample feature set to obtain a trained first transaction detection model; Adjustment step S104, using the test sample set to test the first transaction detection model to obtain a first test result, if the error of the first test result is greater than or equal to a first threshold, adjusting the initial privacy protection budget parameter based on the error to obtain an adjusted privacy protection budget parameter ε′; Iteration step S105, using the adjusted ε′ to replace the ε and then repeatedly executing the processing step S102, the training step S103 and the adjustment step S104 until the error of the first test result is less than a first threshold, thereby obtaining a second transaction detection model; In the interception step S106, the acquired real-time transaction multi-dimensional data is input into the feature extraction network to obtain the real-time transaction data features, and the real-time transaction data features are input into the second transaction detection model to obtain the transaction risk index. If the transaction risk index is greater than the first threshold, the transaction is intercepted in real time.

[0023] An important inventive concept of the present invention is that in order to reduce the risk of data privacy leakage during neural network model training, differential privacy computing is introduced. However, whether the privacy protection budget parameters of differential privacy computing can meet the requirements of neural network training, that is, whether the data after differential privacy computing can meet the training requirements of the neural network, it is difficult to accurately determine the privacy protection budget parameters in the prior art. The present invention obtains a first test result by testing the first transaction detection model using a test sample set. If the error of the first test result is greater than or equal to the first threshold, the initial privacy protection budget parameter is adjusted based on the error to obtain the adjusted privacy protection budget parameter ε′, that is, the present invention sets an adjustment of the initial privacy protection budget parameter based on the test error, and after repeated iterations until the error of the first test result is less than the first threshold, the second transaction detection model is obtained, that is, the privacy protection budget parameters required for neural network training in differential privacy computing are obtained more quickly, the training efficiency of the model is improved, and data security is ensured. Another innovative point of the present invention is that the feature extraction network is first used to extract features, and then the extracted features are used as feature values ​​of the graph neural network for calculation, which improves the operation efficiency of the graph neural network and overcomes the defects in the prior art.

[0024] In one embodiment, the operation of adjusting the initial privacy protection budget parameter based on the error to obtain the adjusted privacy protection budget parameter ε′ is: Obtain the number N1 of historical transaction behavior data, the number N2 of historical user portrait data, the number N3 of historical environment dynamic data, and the number N4 of historical cross-industry joint defense data in the historical multidimensional data set; Using k times of the error as the clustering distance, a clustering algorithm is used to cluster N1 pieces of historical transaction behavior data, N2 pieces of historical user portrait data, N3 pieces of historical environmental dynamic data, and N4 pieces of historical cross-industry joint defense data, and the number of clusters n1 of historical transaction behavior data, the number of clusters n2 of historical user portrait data, the number of clusters n3 of historical environmental dynamic data, and the number of clusters n4 of historical cross-industry joint defense data are obtained respectively; The adjusted privacy protection budget parameter ε′ is calculated as: , in, is the error, k≥1, and N1, N2, N3, N4 are all integers greater than 10, and n1, n2, n3, n4 are also integers.

[0025] Since k times of the error is used as the clustering distance, if the error is large, the clustering distance is also large, so the number of clusters obtained by clustering is small, and is also a decreasing function, so that It is quickly reduced, ensuring that the differential privacy historical multidimensional data generated subsequently can quickly reduce the error. After actual testing, generally 5-10 iterations are required to generate differential privacy historical multidimensional data that meets the requirements, thereby improving the training efficiency of the neural network model. That is, the present invention innovatively constructs a privacy protection budget parameter based on the relationship between the test error and the training data. Since the present application involves transaction risk detection and real-time interception, generally speaking, the data characteristics of risky transactions and normal transactions are different. The characteristics of normal and abnormal transactions can be reflected by clustering various types of historical data, thereby using k times the error as the clustering distance. If the error is large, the clustering distance is also large, so that the number of clusters obtained by clustering is small, and is also a decreasing function, so that Rapidly reduce to obtain the privacy protection budget parameters required for neural network training, which is the embodiment of the important invention point of the present invention. Generally speaking, in practical applications, the k value is between 5 and 20, which depends on the requirements for the accuracy of the neural network.

[0026] In the present invention, the feature extraction network is VGG or ResNet, and of course other feature extraction networks and the like may also be used.

[0027] In one embodiment, the transaction behavior data includes: transaction time, transaction frequency, geographic location and device fingerprint; the user portrait data includes: historical behavior patterns, credit scores and social network relevance; the environmental dynamic data includes: network delay, abnormal device status and real-time public opinion events; the cross-industry joint defense data includes: security coordination data with communications and e-commerce platforms. The present invention uses a variety of transaction risk-related data to comprehensively analyze transaction risks, thereby improving the accuracy of risk detection and interception.

[0028] In one embodiment, the graph used by the graph neural network is formed in the following manner: transaction behavior, user portrait, environmental dynamics and industry characteristics are used as nodes of the graph; if the geographical location in the transaction behavior and the location in the abnormal state of the device in the environmental dynamics or the location of the real-time public opinion event are less than the second threshold, then there is an edge between the transaction behavior node and the environmental dynamics node; if the geographical location in the transaction behavior and the location of the security collaborative data with communications and e-commerce platforms in the cross-industry joint defense data are less than the third threshold, then there is an edge between the transaction behavior node and the industry characteristic node; if the location in the abnormal state of the device in the environmental dynamics or the location of the real-time public opinion event and the location of the security collaborative data with communications and e-commerce platforms in the cross-industry joint defense data are less than the fourth threshold, then there is an edge between the environmental dynamics node and the industry characteristic node; and the edges between the user portrait node and the transaction behavior node, the environmental dynamics node, and the industry characteristic node are determined based on the social network correlation in the user portrait.

[0029] In the present invention, such a method of constructing a graph can solve the inconsistency of various historical quantities in the background technology, resulting in only a minimum amount of data being used as samples in neural network training, that is, the traditional training method can only use the number of historical transaction behavior data N1, the number of historical user portrait data N2, the number of historical environmental dynamic data N3 and the number of historical cross-industry joint defense data N4. MIN (N1, N2, N3, N4) pieces of data are aligned to form training samples for training. That is, the traditional training method organizes data with users as nodes, that is, various types of historical data are combined into a data vector as the historical data of a user. In this way, the collected historical data needs to be preprocessed into user data first, and some other collected historical data cannot be used. The present invention innovatively proposes a graph neural network The composition method is not to compose the graph with users as nodes, but to compose the graph according to the acquired data type. The graph neural network constructed in this way can detect and intercept risks from multiple dimensions such as transaction behavior, user portrait, environmental dynamic data and historical cross-industry joint defense data, so that the trained transaction detection model can detect and intercept risks by acquiring only one or more of the transaction behavior, user portrait, environmental dynamic data and historical cross-industry joint defense data, thereby improving the accuracy and reliability of risk detection and interception. For example, this graph neural network can detect the following risks based on only one of the transaction behavior, user portrait and environmental dynamic data: an account initiates a large transfer in Beijing and Chongqing within 2 minutes, and the system can determine the risk of physical inaccessibility based on the distance between the two places and the traffic data. This is another important inventive concept of the present invention.

[0030] In the present invention, the data features extracted by the feature extraction network are used as the feature values ​​of each node of the graph neural network. If there is an edge between the nodes, the weight of the edge is set to 1, which improves the operating efficiency of the graph neural network and overcomes the defects in the prior art.

[0031] Figure 2 The present invention shows a real-time transaction risk detection and intelligent interception system based on multi-dimensional data, comprising: An acquisition unit 201 acquires a historical multidimensional data set related to a transaction, wherein the historical multidimensional data set includes: historical transaction behavior data, historical user portrait data, historical environment dynamic data, and historical cross-industry joint defense data; The processing unit 202 performs differential privacy processing on the data in the historical multidimensional data set using an initial privacy protection budget parameter ε to obtain a processed differential privacy historical multidimensional data set; A training unit 203, using a feature extraction network to extract features from the differential privacy historical multidimensional data to obtain a training sample feature set, and training a graph neural network based on the training sample feature set to obtain a trained first transaction detection model; An adjusting unit 204 tests the first transaction detection model using a test sample set to obtain a first test result, and if an error of the first test result is greater than or equal to a first threshold, adjusts the initial privacy protection budget parameter based on the error to obtain an adjusted privacy protection budget parameter ε′; An iterative unit 205, which replaces the ε with the adjusted ε′ and then repeatedly executes the operations of the processing unit 202, the training unit 203 and the adjustment unit 204 until the error of the first test result is less than a first threshold, thereby obtaining a second transaction detection model; The interception unit 206 inputs the acquired real-time transaction multi-dimensional data into a feature extraction network to obtain real-time transaction data features, inputs the real-time transaction data features into the second transaction detection model to obtain a transaction risk index, and if the transaction risk index is greater than a first threshold, the transaction is intercepted in real time.

[0032] An important inventive concept of the present invention is that in order to reduce the risk of data privacy leakage during neural network model training, differential privacy computing is introduced. However, whether the privacy protection budget parameters of differential privacy computing can meet the requirements of neural network training, that is, whether the data after differential privacy computing can meet the training requirements of the neural network, it is difficult to accurately determine the privacy protection budget parameters in the prior art. The present invention obtains a first test result by testing the first transaction detection model using a test sample set. If the error of the first test result is greater than or equal to the first threshold, the initial privacy protection budget parameter is adjusted based on the error to obtain the adjusted privacy protection budget parameter ε′, that is, the present invention sets an adjustment of the initial privacy protection budget parameter based on the test error, and after repeated iterations until the error of the first test result is less than the first threshold, the second transaction detection model is obtained, that is, the privacy protection budget parameters required for neural network training in differential privacy computing are obtained more quickly, the training efficiency of the model is improved, and data security is ensured. Another innovative point of the present invention is that the feature extraction network is first used to extract features, and then the extracted features are used as feature values ​​of the graph neural network for calculation, which improves the operation efficiency of the graph neural network and overcomes the defects in the prior art.

[0033] In one embodiment, the operation of adjusting the initial privacy protection budget parameter based on the error to obtain the adjusted privacy protection budget parameter ε′ is: Obtain the number N1 of historical transaction behavior data, the number N2 of historical user portrait data, the number N3 of historical environment dynamic data, and the number N4 of historical cross-industry joint defense data in the historical multidimensional data set; Using k times of the error as the clustering distance, a clustering algorithm is used to cluster N1 pieces of historical transaction behavior data, N2 pieces of historical user portrait data, N3 pieces of historical environmental dynamic data, and N4 pieces of historical cross-industry joint defense data, and the number of clusters n1 of historical transaction behavior data, the number of clusters n2 of historical user portrait data, the number of clusters n3 of historical environmental dynamic data, and the number of clusters n4 of historical cross-industry joint defense data are obtained respectively; The adjusted privacy protection budget parameter ε′ is calculated as: , in, is the error, k≥1, and N1, N2, N3, N4 are all integers greater than 10, and n1, n2, n3, n4 are also integers.

[0034] Since k times of the error is used as the clustering distance, if the error is large, the clustering distance is also large, so the number of clusters obtained by clustering is small, and is also a decreasing function, so that It is quickly reduced, ensuring that the differential privacy historical multidimensional data generated subsequently can quickly reduce the error. After actual testing, generally 5-10 iterations are required to generate differential privacy historical multidimensional data that meets the requirements, thereby improving the training efficiency of the neural network model. That is, the present invention innovatively constructs a privacy protection budget parameter based on the relationship between the test error and the training data. Since the present application involves transaction risk detection and real-time interception, generally speaking, the data characteristics of risky transactions and normal transactions are different. The characteristics of normal and abnormal transactions can be reflected by clustering various types of historical data, thereby using k times the error as the clustering distance. If the error is large, the clustering distance is also large, so that the number of clusters obtained by clustering is small, and is also a decreasing function, so that Rapidly reduce to obtain the privacy protection budget parameters required for neural network training, which is the embodiment of the important invention point of the present invention. Generally speaking, in practical applications, the k value is between 5 and 20, which depends on the requirements for the accuracy of the neural network.

[0035] In the present invention, the feature extraction network is VGG or ResNet, and of course other feature extraction networks and the like may also be used.

[0036] In one embodiment, the transaction behavior data includes: transaction time, transaction frequency, geographic location and device fingerprint; the user portrait data includes: historical behavior patterns, credit scores and social network relevance; the environmental dynamic data includes: network delay, abnormal device status and real-time public opinion events; the cross-industry joint defense data includes: security coordination data with communications and e-commerce platforms. The present invention uses a variety of transaction risk-related data to comprehensively analyze transaction risks, thereby improving the accuracy of risk detection and interception.

[0037] In one embodiment, the graph used by the graph neural network is formed in the following manner: transaction behavior, user portrait, environmental dynamics and industry characteristics are used as nodes of the graph; if the geographical location in the transaction behavior and the location in the abnormal state of the device in the environmental dynamics or the location of the real-time public opinion event are less than the second threshold, then there is an edge between the transaction behavior node and the environmental dynamics node; if the geographical location in the transaction behavior and the location of the security collaborative data with communications and e-commerce platforms in the cross-industry joint defense data are less than the third threshold, then there is an edge between the transaction behavior node and the industry characteristic node; if the location in the abnormal state of the device in the environmental dynamics or the location of the real-time public opinion event and the location of the security collaborative data with communications and e-commerce platforms in the cross-industry joint defense data are less than the fourth threshold, then there is an edge between the environmental dynamics node and the industry characteristic node; and the edges between the user portrait node and the transaction behavior node, the environmental dynamics node, and the industry characteristic node are determined based on the social network correlation in the user portrait.

[0038] In the present invention, such a method of constructing a graph can solve the inconsistency of various historical quantities in the background technology, resulting in only a minimum amount of data being used as samples in neural network training, that is, the traditional training method can only use the number of historical transaction behavior data N1, the number of historical user portrait data N2, the number of historical environmental dynamic data N3 and the number of historical cross-industry joint defense data N4. MIN (N1, N2, N3, N4) pieces of data are aligned to form training samples for training. That is, the traditional training method organizes data with users as nodes, that is, various types of historical data are combined into a data vector as the historical data of a user. In this way, the collected historical data needs to be preprocessed into user data first. The present invention innovatively proposes a graph neural network composition method that is not composed with users as nodes, but is composed according to the type of data obtained. The graph neural network constructed in this way can detect and intercept risks from multiple dimensions such as transaction behavior, user portraits, environmental dynamic data and historical cross-industry joint defense data. Therefore, the trained transaction detection model can perform risk detection and interception by acquiring only one or more of the transaction behavior, user portraits, environmental dynamic data and historical cross-industry joint defense data, thereby improving the accuracy and reliability of risk detection and interception. This is another important inventive concept of the present invention.

[0039] In the present invention, the data features extracted by the feature extraction network are used as the feature values ​​of each node of the graph neural network. If there is an edge between the nodes, the weight of the edge is set to 1, which improves the operating efficiency of the graph neural network and overcomes the defects in the prior art.

[0040] For the convenience of description, the above system is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0041] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a storage medium, such as ROM / RAM, a disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the system described in each embodiment of the present application or some parts of the embodiments.

[0042] Finally, it should be noted that the above embodiments are only intended to illustrate rather than limit the technical solutions of the present invention. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the present invention can still be modified or replaced by equivalents. Any modification or partial replacement that does not depart from the spirit and scope of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A real-time transaction risk detection and intelligent interception method based on multi-dimensional data, characterized in that: The method includes: An acquisition step, acquiring a historical multidimensional data set related to the transaction, wherein the historical multidimensional data set includes: historical transaction behavior data, historical user profile data, historical environment dynamic data, and historical cross-industry joint defense data; A processing step of performing differential privacy processing on the data in the historical multidimensional data set using an initial privacy protection budget parameter ε to obtain a processed differential privacy historical multidimensional data set; A training step, using a feature extraction network to extract features from the differential privacy historical multidimensional data to obtain a training sample feature set, and training a graph neural network based on the training sample feature set to obtain a trained first transaction detection model; an adjustment step, testing the first transaction detection model using a test sample set to obtain a first test result, and if an error of the first test result is greater than or equal to a first threshold, adjusting the initial privacy protection budget parameter based on the error to obtain an adjusted privacy protection budget parameter ε′; an iterative step, using the adjusted ε′ to replace the ε and then repeatedly performing the processing step, the training step and the adjustment step until the error of the first test result is less than a first threshold, thereby obtaining a second transaction detection model; The interception step is to input the acquired real-time transaction multidimensional data into the feature extraction network to obtain real-time transaction data features, and input the real-time transaction data features into the second transaction detection model to obtain a transaction risk index. If the transaction risk index is greater than a first threshold, the transaction is intercepted in real time.

2. The method according to claim 1, characterized in that The operation of adjusting the initial privacy protection budget parameter based on the error to obtain the adjusted privacy protection budget parameter ε′ is: Obtain the number N1 of historical transaction behavior data, the number N2 of historical user portrait data, the number N3 of historical environment dynamic data, and the number N4 of historical cross-industry joint defense data in the historical multidimensional data set; Using k times of the error as the clustering distance, a clustering algorithm is used to cluster N1 pieces of historical transaction behavior data, N2 pieces of historical user portrait data, N3 pieces of historical environmental dynamic data, and N4 pieces of historical cross-industry joint defense data, and the number of clusters n1 of historical transaction behavior data, the number of clusters n2 of historical user portrait data, the number of clusters n3 of historical environmental dynamic data, and the number of clusters n4 of historical cross-industry joint defense data are obtained respectively; The adjusted privacy protection budget parameter ε′ is calculated as: ， in, is the error, k≥1.

3. The method according to claim 2, characterized in that The feature extraction network is VGG or ResNet.

4. The method according to claim 3, characterized in that The transaction behavior data includes: transaction time, transaction frequency, geographic location and device fingerprint; the user portrait data includes: historical behavior patterns, credit scores and social network associations; the environmental dynamic data includes: network delays, abnormal device status and real-time public opinion events; the cross-industry joint defense data includes: security collaboration data with communications and e-commerce platforms.

5. The method according to claim 4, characterized in that The graph used by the graph neural network is formed in the following way: transaction behavior, user portrait, environmental dynamics and industry characteristics are used as nodes of the graph; if the geographical location in the transaction behavior and the location in the abnormal state of the device in the environmental dynamics or the location of the real-time public opinion event are less than the second threshold, then there is an edge between the transaction behavior node and the environmental dynamics node; if the geographical location in the transaction behavior and the location of the security collaborative data with communications and e-commerce platforms in the cross-industry joint defense data are less than the third threshold, then there is an edge between the transaction behavior node and the industry characteristic node; if the location in the abnormal state of the device in the environmental dynamics or the location of the real-time public opinion event and the location of the security collaborative data with communications and e-commerce platforms in the cross-industry joint defense data are less than the fourth threshold, then there is an edge between the environmental dynamics node and the industry characteristic node; and the edges between the user portrait node and the transaction behavior node, the environmental dynamics node, and the industry characteristic node are determined based on the social network correlation in the user portrait.

6. A real-time transaction risk detection and intelligent interception system based on multi-dimensional data, characterized in that: The system includes: An acquisition unit, which acquires a historical multidimensional data set related to a transaction, wherein the historical multidimensional data set includes: historical transaction behavior data, historical user profile data, historical environment dynamic data, and historical cross-industry joint defense data; A processing unit, performing differential privacy processing on the data in the historical multidimensional data set using an initial privacy protection budget parameter ε to obtain a processed differential privacy historical multidimensional data set; A training unit, using a feature extraction network to extract features from the differential privacy historical multidimensional data to obtain a training sample feature set, and training a graph neural network based on the training sample feature set to obtain a trained first transaction detection model; an adjusting unit, which tests the first transaction detection model using a test sample set to obtain a first test result, and if an error of the first test result is greater than or equal to a first threshold, adjusts the initial privacy protection budget parameter based on the error to obtain an adjusted privacy protection budget parameter ε′; an iterative unit, which replaces the ε with the adjusted ε′ and then repeatedly executes the operations of the processing unit, the training unit and the adjustment unit until the error of the first test result is less than a first threshold, thereby obtaining a second transaction detection model; The interception unit inputs the acquired real-time transaction multi-dimensional data into a feature extraction network to obtain real-time transaction data features, inputs the real-time transaction data features into the second transaction detection model to obtain a transaction risk index, and if the transaction risk index is greater than a first threshold, the transaction is intercepted in real time.

7. The system according to claim 6, characterized in that The operation of adjusting the initial privacy protection budget parameter based on the error to obtain the adjusted privacy protection budget parameter ε′ is: Obtain the number N1 of historical transaction behavior data, the number N2 of historical user portrait data, the number N3 of historical environment dynamic data, and the number N4 of historical cross-industry joint defense data in the historical multidimensional data set; Using k times of the error as the clustering distance, a clustering algorithm is used to cluster N1 pieces of historical transaction behavior data, N2 pieces of historical user portrait data, N3 pieces of historical environmental dynamic data, and N4 pieces of historical cross-industry joint defense data, and the number of clusters n1 of historical transaction behavior data, the number of clusters n2 of historical user portrait data, the number of clusters n3 of historical environmental dynamic data, and the number of clusters n4 of historical cross-industry joint defense data are obtained respectively; The adjusted privacy protection budget parameter ε′ is calculated as: ， in, is the error, k≥1.

8. The system according to claim 7, characterized in that The feature extraction network is VGG or ResNet.

9. The system according to claim 8, characterized in that The transaction behavior data includes: transaction time, transaction frequency, geographic location and device fingerprint; the user portrait data includes: historical behavior patterns, credit scores and social network associations; the environmental dynamic data includes: network delays, abnormal device status and real-time public opinion events; the cross-industry joint defense data includes: security collaboration data with communications and e-commerce platforms.

10. A computer-readable storage medium having a computer program code stored thereon, wherein when the computer program code is executed by a computer, the method of any one of claims 1 to 5 is executed.

Images