A Bank Abnormal Transaction Detection Method Based on Multimodal Data Fusion

Abstract

The present invention relates to the field of financial information security technology, and particularly relates to a method for detecting abnormal bank transactions based on multi-modal data fusion, comprising the following steps: S1: Real-time collect the multi-modal original data set of the bank transaction system; S2: Perform spatio-temporal alignment processing to generate a data association matrix with a unified time stamp; S3: Extract the volatility of the transaction amount, the discreteness of the operation behavior, and the abnormality degree of the device environment to generate a fusion feature vector; S4: Calculate the change gradient of the energy value of the fusion feature vector to generate a dynamic energy distribution map; S5: Establish a cross-modal association rule base for generating logical contradiction values; S6: Output a hierarchical abnormal warning signal. With the present invention, through multi-modal data fusion and dynamic analysis of the energy field model, accurate capture of transaction abnormal features and dynamic warning are achieved, thereby significantly improving the detection accuracy and real-time response ability, and enhancing the security of the bank transaction system.

Description

Technical Field

[0001] The present invention relates to the technical field of financial information security, and in particular, to a method for detecting abnormal bank transactions based on multi-modal data fusion. Background Art

[0002] In recent years, with the rapid development of electronic payment, online banking, and mobile finance, the transaction volume of bank transaction systems has increased significantly, accompanied by an increase in abnormal transactions and fraud risks; abnormal transactions usually involve malicious account takeover and illegal arbitrage, seriously affecting financial security; traditional methods for detecting abnormal bank transactions mainly rely on rule-based risk control strategies and statistical analysis models, which usually analyze only single-modal data (such as transaction flow records), making it difficult to comprehensively capture the complexity of transaction behaviors; in addition, with the continuous evolution of attack methods, detection methods based on fixed rules are easily circumvented, resulting in high false alarm rates and missed alarm rates, and it is difficult to effectively deal with new fraud patterns.

[0003] The existing technologies have the following main problems in detecting abnormal transactions: First, there is a lack of effective fusion of data in different modalities, resulting in the detection model being unable to comprehensively analyze transaction risks; second, it is difficult for existing methods to establish logical associations between cross-modal data and unable to effectively mine the inherent consistency features of transaction behaviors, resulting in some abnormal transactions not being accurately identified; in addition, current abnormal detection methods often lack a dynamic adjustment mechanism in judging the abnormal level and are unable to accurately determine the degree of abnormality according to changes in the real-time transaction environment. Therefore, there is an urgent need for a method for detecting abnormal bank transactions based on multi-modal data fusion to solve the above problems. Summary of the Invention

[0004] Based on the above objectives, the present invention provides a method for detecting abnormal bank transactions based on multi-modal data fusion.

[0005] A method for detecting abnormal bank transactions based on multi-modal data fusion includes the following steps:

[0006] S1: Real-time collect structured transaction flow data of the bank transaction system, unstructured behavior trajectory data of the user terminal, and device fingerprint feature data to form a multi-modal original data set;

[0007] S2: Perform spatio-temporal alignment processing on the multi-modal original data set to generate a data association matrix with a unified time stamp;

[0008] S3: Perform feature-level fusion based on the data association matrix, extract three core features of transaction amount volatility, operation behavior dispersion, and device environment abnormality, and generate a fusion feature vector;

[0009] S4: Construct a transaction behavior energy field model to calculate the energy value change gradient of the fusion feature vector and generate a dynamic energy distribution map;

[0010] S5: Establish a cross-modal association rule library to detect the logical contradiction values between the features of different data sources in the dynamic energy distribution map;

[0011] S6: Output a hierarchical anomaly warning signal according to the comparison result between the logical contradiction value and the preset dynamic threshold.

[0012] Optionally, the specific content of S1 includes:

[0013] S11: Through the transaction log monitoring module of the bank core system, capture structured transaction flow data in real time. The data fields include transaction timestamp, transaction amount, initiating party account, receiving party account, and transaction type code. Use the database transaction log generated when each transaction is completed as the data collection trigger event;

[0014] S12: Embed a behavior trajectory collection SDK in the user terminal application to record unstructured behavior trajectory data in real time, including the touch screen operation coordinate sequence, page stay duration, and triaxial gyroscope data of the biometric authentication process. When collecting, use the touch event trigger as the starting point and the click of the transaction confirmation button as the ending point to form a complete operation trajectory segment;

[0015] S13: Obtain device fingerprint feature data through the device fingerprint collection engine, including the hash combination value of the CPU serial number, MAC address, and Bluetooth address extracted from the hardware layer features.

[0016] Optionally, the specific content of S2 includes:

[0017] S21: Standardize the transaction timestamp in the structured transaction flow data, synchronize the clocks of each data source using the Network Time Protocol, and uniformly convert the original timestamp to the Coordinated Universal Time format to generate a unified timestamp with millisecond-level precision;

[0018] S22: Parse the geographical coordinate information in the unstructured behavior trajectory data, convert the data in different coordinate systems to the Universal Transverse Mercator projection coordinates, and establish a mapping relationship table between the transaction geographical location and the user operation location;

[0019] S23: Extract the device unique identifier from the device fingerprint feature data, generate a device fingerprint hash value through a preset hash mapping algorithm, and establish a binding relationship table between the device fingerprint hash value and the transaction account ID;

[0020] S24: Construct an N×4 - dimensional data association matrix, where N is the total number of transaction events. Each row of the matrix corresponds to a transaction event, and the column dimensions sequentially include a unified timestamp field, a UTM coordinate field, a device fingerprint hash value field, and an associated account ID field.

[0021] Optionally, the specific steps of S3 are as follows:

[0022] S31: Based on the unified timestamp field in the data association matrix, calculate the volatility of the transaction amount for each transaction event. By calculating the standard deviation of the transaction amounts of the same user within a specified time window, obtain the transaction amount volatility value for each transaction event as the transaction amount volatility feature.

[0023] S32: Based on the operation trajectory data in the data association matrix, extract the behavioral dispersion of each transaction operation. Specifically, calculate the behavioral dispersion of each operation trajectory segment according to the frequency and path length of the trajectory points of the user's operations during the transaction process, and generate the operation behavioral dispersion feature corresponding to each transaction.

[0024] S33: Based on the device fingerprint feature data in the data association matrix, analyze the device environment anomaly degree. Specifically, by comparing the historical binding relationship between the device fingerprint hash value and the transaction account ID, detect the change trend of the device fingerprint hash value, and determine whether the device has an environmental anomaly by setting a threshold, and calculate the device environment anomaly degree feature.

[0025] S34: Concatenate the three types of features of the transaction amount volatility, operation behavioral dispersion, and device environment anomaly degree calculated in S31 - S33 in sequence to generate a fused feature vector with M dimensions, where M is the number of extracted features.

[0026] Optionally, the specific steps of S33 are as follows:

[0027] S331: According to the historical binding relationship between the device fingerprint hash value and the transaction account ID in the data association matrix, extract the binding records of each device fingerprint hash value and its corresponding transaction account ID, and establish a historical binding relationship library of the device fingerprint hash value and the account ID.

[0028] S332: Based on the historical binding relationship library, calculate the change trend of the device fingerprint hash value for each transaction. ;

[0029] S333: Set a threshold to determine whether the device has an environmental anomaly. If the change trend of the device fingerprint hash value exceeds the threshold , it is determined that the device has an environmental anomaly.

[0030] S334: Calculate the abnormality degree of the device environment based on the relationship between the change trend and the set threshold value. The formula is: , where is the abnormality degree of the device environment, is the preset threshold value; Use the device environment abnormality degree as the feature of the device environment abnormality degree.

[0031] Optionally, the specific steps of S4 include:

[0032] S41: Construct a trading behavior energy field model, define each node in the energy field model as a trading event, and the energy value corresponding to each node is the fusion feature vector of this trading event;

[0033] S42: Construct the topological structure of the energy field model according to the spatio-temporal correlation of trading behaviors. Use the graph structure model in graph theory to represent the relationship between trading events as a directed graph. The edges in the graph represent the spatio-temporal correlation between different trading events; At the same time, define the relative energy transfer weight ;

[0034] S43: Calculate the energy value change gradient of the fusion feature vector according to the energy value of each trading event and the transfer weight between trading events. The formula is: , where is the energy value change gradient of the th trading event, is the energy transfer weight between the th trading event and the th trading event, and are the fusion feature vectors of the th and the th trading events respectively, is the total number of trading events;

[0035] S44: Generate a dynamic energy distribution map according to the energy value change gradient of each trading event. By visualizing the energy value change gradients of all trading events in chronological order, a dynamic energy distribution map reflecting the energy change of trading behaviors is obtained.

[0036] Optionally, the specific steps of S5 include:

[0037] S51: Establish a cross-modal association rule library. The cross-modal association rule library includes the following specific rules:

[0038] Rule 1: The contradictory combination of high amount fluctuation and low operation dispersion;

[0039] Rule 2: The spatial contradiction between abnormal device environment and regular trading location

[0040] Rule 3: The time sequence contradiction between transactions during inactive periods and low energy gradients;

[0041] S52: Define the logical verification conditions for each rule according to the association rules in the cross-modal association rule library;

[0042] S53: During each transaction detection, for each transaction event in the dynamic energy distribution map, based on its fusion feature vector, search for the rules related to this event in the cross-modal association rule library for verification, and generate the logical contradiction value corresponding to the event.

[0043] Optionally, the logical verification conditions include:

[0044] Verification condition 1: When the transaction amount volatility is greater than the set volatility threshold and the operation behavior dispersion is less than the set dispersion threshold then, according to Rule 1, determine that this event is a contradiction combination;

[0045] Verification condition 2: When the device environment abnormality is greater than the set abnormality threshold and the spatial difference of the transaction location is greater than the set spatial threshold then, according to Rule 2, determine that this transaction event is a spatial contradiction;

[0046] Verification condition 3: When the transaction occurs within a preset inactive period and the energy value change gradient of this transaction event is lower than the set energy gradient threshold then, according to Rule 3, determine that this transaction event is a time sequence contradiction.

[0047] Optionally, the specific content of S53 includes:

[0048] S531: For each transaction event, perform matching verification based on its fusion feature vector and the rules in the association rule library. If the verification condition of a certain rule is violated, assign a logical contradiction value to this transaction event. The calculation formula for the logical contradiction value is: , where is the logical contradiction value, is the number of rules in the association rule library, is the weight coefficient violated by the th rule, is the th rule violation degree; during the calculation, the violated rules will be assigned different weight coefficients according to their severity .

[0049] Optionally, S6 specifically includes:

[0050] S61: Compare the logical contradiction value with a preset dynamic threshold. Specifically, set multiple dynamic thresholds , where is the number of threshold levels, and each threshold corresponds to a different anomaly level;

[0051] S62: Output a corresponding graded anomaly warning signal according to the comparison result between the logical contradiction value and the dynamic threshold;

[0052] When , output a mild anomaly warning signal;

[0053] When , output a moderate anomaly warning signal;

[0054] When , output a high anomaly warning signal.

[0055] Advantages of the present invention:

[0056] In the present invention, through multi-modal fusion of structured transaction flow data in the bank transaction system, unstructured behavior trajectory data of the user terminal, and device fingerprint feature data, spatio-temporal alignment and feature-level fusion can be achieved to form high-quality fusion feature vectors; by using the transaction behavior energy field model and the cross-modal association rule library, the internal characteristics of transaction behaviors can be comprehensively captured, and comprehensive evaluation of transaction amount fluctuations, discreteness of operation behaviors, and device environment anomalies can be realized, thereby improving the accuracy and timeliness of abnormal transaction detection and effectively reducing the risks of false alarms and missed alarms caused by single data source analysis.

[0057] In the present invention, by calculating the change gradient of the energy value for the fusion feature vector and combining it with a preset dynamic threshold to achieve graded anomaly warning, the anomaly judgment criteria can be dynamically adjusted according to the changes in the real-time transaction environment; it not only has high robustness and flexibility, but also can accurately identify various anomaly patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings in the following description are only those of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without creative efforts.

[0059] Figure 1Schematic diagram of the bank abnormal transaction detection method according to an embodiment of the present invention;

[0060] Figure 2 Schematic diagram of the process of generating a fused feature vector according to an embodiment of the present invention. Detailed implementation manners

[0061] The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted here that, in order to make the embodiments more detailed, the following embodiments are the best and preferred embodiments. For some well-known technologies, those skilled in the art can also adopt other alternative methods for implementation; moreover, the accompanying drawings are only for more specific description of the embodiments, and are not intended to specifically limit the present invention.

[0062] It should be noted that in the specification, it is mentioned that "one embodiment", "embodiment", "exemplary embodiment", "some embodiments", etc. indicate that the described embodiment may include specific features, structures or characteristics, but not necessarily each embodiment includes the specific feature, structure or characteristic. In addition, when combining an embodiment to describe a specific feature, structure or characteristic, implementing such a feature, structure or characteristic in combination with other embodiments (whether explicitly described or not) should be within the knowledge scope of those skilled in the relevant art.

[0063] Generally, the terms can be understood at least in part from their use in the context. For example, at least in part depending on the context, the term "one or more" used herein can be used to describe any feature, structure or characteristic in a singular sense, or can be used to describe a combination of features, structures or characteristics in a plural sense. In addition, the term "based on" can be understood as not necessarily intended to convey a set of exclusive factors, but rather, at least in part depending on the context, allowing the existence of other factors that may not be explicitly described.

[0064] As Figure 1 - Figure 2 shown, a bank abnormal transaction detection method based on multimodal data fusion includes the following steps:

[0065] S1: Real-time collect the structured transaction flow data of the bank transaction system, the unstructured behavior track data of the user terminal, and the device fingerprint feature data to form a multimodal original data set;

[0066] S2: Perform spatio-temporal alignment processing on the multimodal original data set to generate a data association matrix with unified timestamps;

[0067] S3: Based on the data association matrix, perform feature-level fusion, extract three core features of transaction amount volatility, operation behavior discreteness, and device environment abnormality, and generate a fused feature vector;

[0068] S4: Construct a trading behavior energy field model to calculate the energy value change gradient of the fused feature vector and generate a dynamic energy distribution map;

[0069] S5: Establish a cross-modal association rule library to detect the logical contradiction values between the features of different data sources in the dynamic energy distribution map;

[0070] S6: Output a hierarchical anomaly warning signal according to the comparison result between the logical contradiction value and the preset dynamic threshold.

[0071] S1 specifically includes:

[0072] S11: Through the transaction log monitoring module of the bank's core system, capture structured transaction flow data in real time. The data fields include transaction timestamp, transaction amount, initiating party account, receiving party account, and transaction type code. Use the database transaction log generated when each transaction is completed as the data collection trigger event;

[0073] S12: Embed a behavior trajectory collection SDK in the user terminal application to record unstructured behavior trajectory data in real time, including the touch screen operation coordinate sequence, page stay duration, and three-axis gyroscope data of the biometric authentication process. When collecting, use the touch event trigger as the starting point and the click of the transaction confirmation button as the ending point to form a complete operation trajectory segment;

[0074] S13: Obtain device fingerprint feature data through the device fingerprint collection engine, including the hash combination value of the CPU serial number, MAC address, and Bluetooth address extracted from the hardware layer features.

[0075] S2 specifically includes:

[0076] S21: Standardize the transaction timestamp in the structured transaction flow data. Use the Network Time Protocol (NTP) to synchronize the clocks of each data source, and uniformly convert the original timestamp to the Coordinated Universal Time (UTC) format to generate a unified timestamp with millisecond-level accuracy;

[0077] S22: Parse the geographical coordinate information in the unstructured behavior trajectory data, convert the data in different coordinate systems to the Universal Transverse Mercator (UTM) coordinates, and establish a mapping relationship table between the trading geographical location and the user operation location;

[0078] S23: Extract the device unique identifier from the device fingerprint feature data, generate a device fingerprint hash value through a preset hash mapping algorithm, and establish a binding relationship table between the device fingerprint hash value and the trading account ID;

[0079] S24: Construct an N×4-dimensional data association matrix, where N is the total number of transaction events. Each row of the matrix corresponds to a transaction event, and the column dimensions sequentially include a unified timestamp field, a UTM coordinate field, a device fingerprint hash value field, and an associated account ID field. Each element value in the data association matrix is the normalized eigenvalue of the corresponding dimension. The above steps use the NTP protocol to enforce a unified clock source, eliminate the time drift error between multiple devices, and make the time alignment accuracy of cross-modal data reach the millisecond level, providing a reliable timing benchmark for subsequent feature fusion. The UTM coordinate conversion solves the problem of coordinate system differences between different terminal devices, maps the user's operation location and transaction location to the same spatial reference system, and improves the accuracy of abnormal transaction spatial analysis. The hash mapping algorithm ensures the irreversible association between the device fingerprint and the account ID, prevents device spoofing attacks, and enhances the credibility of the data association matrix. By constructing a structured association matrix with the preset 4-dimensional normalized eigenvalues, it provides a standardized input that can be directly calculated for subsequent multi-modal feature fusion and reduces the data processing complexity.

[0080] S3 specifically includes:

[0081] S31: Based on the unified timestamp field in the data association matrix, calculate the volatility of the transaction amount for each transaction event. By calculating the standard deviation of the transaction amounts of the same user within a specified time window, obtain the transaction amount volatility value for each transaction event as the transaction amount volatility feature. Its calculation formula is: , where is the average value of the transaction amount, represents the th transaction amount, is the number of transactions of the same user within the time window, represents the transaction amount volatility;

[0082] S32: Based on the operation trajectory data in the data association matrix, extract the behavior dispersion of each transaction operation. Specifically, according to the frequency and path length of the trajectory points of the user's operation during the transaction, calculate the behavior dispersion of each operation trajectory segment and generate the operation behavior dispersion feature corresponding to each transaction. Specifically, set the operation trajectory point sequence as , where represents the th operation point coordinate, the path length is , the operation frequency is , and the operation behavior dispersion is denoted as . Its calculation formula is: ;

[0083] S33: Analyze the device environment anomaly degree based on the device fingerprint feature data in the data association matrix. Specifically, by comparing the historical binding relationship between the device fingerprint hash value and the transaction account ID, detect the change trend of the device fingerprint hash value, and determine whether there is an environment anomaly for the device by setting a threshold, and calculate the device environment anomaly degree feature;

[0084] S34: Concatenate the three types of features of the transaction amount volatility, operation behavior dispersion degree, and device environment anomaly degree calculated in S31 - S33 in sequence to generate a fusion feature vector with M - dimensional features, where M is the number of features extracted; Through the above - mentioned step - by - step solution, the feature - level fusion of multi - modal data is achieved, and three core features related to transaction anomalies are accurately extracted, providing a high - quality input feature vector for subsequent anomaly detection.

[0085] S33 specifically includes:

[0086] S331: According to the historical binding relationship between the device fingerprint hash value and the transaction account ID in the data association matrix, extract the binding records of each device fingerprint hash value and its corresponding transaction account ID, and establish a historical binding relationship library of the device fingerprint hash value and the account ID;

[0087] S332: Based on the historical binding relationship library, calculate the change trend of the device fingerprint hash value for each transaction , and its calculation formula is: , where, is the device fingerprint hash value for the th transaction, is the historically - bound device fingerprint hash value, is the historically - bound number of transactions, represents the change trend of the device fingerprint hash value;

[0088] S333: Set a threshold to determine whether there is an environment anomaly for the device. If the change trend of the device fingerprint hash value exceeds the threshold , it is determined that the device has an environment anomaly;

[0089] S334: Calculate the device environment anomaly degree according to the relationship between the change trend and the set threshold. The formula is: , where, is the device environment anomaly degree, is the preset threshold. If exceeds the threshold , then the value increases to reflect the anomaly degree of the device environment; The device environment anomaly degree As the device environment anomaly degree feature; through the above steps, by analyzing the historical change trend of the device fingerprint hash value and combining with the set threshold, it can accurately judge whether there is an environmental anomaly in the device and calculate the device environment anomaly degree feature, providing an important basis for subsequent anomaly detection.

[0090] S4 specifically includes:

[0091] S41: Construct a transaction behavior energy field model, define each node in the energy field model as a transaction event, and the energy value corresponding to each node is the fusion feature vector of the transaction event; set the fusion feature vector of each transaction event as , where, is the transaction amount volatility, is the operation behavior discreteness, is the device environment anomaly degree, forming the energy node of each transaction event;

[0092] S42: Construct the topological structure of the energy field model according to the spatio-temporal correlation of transaction behaviors, and use the graph structure model in graph theory to represent the relationship between transaction events as a directed graph. The edges in the graph represent the spatio-temporal correlation between different transaction events; at the same time, define the weight of each edge as the weighted sum of the time difference and spatial difference between transaction events, and calculate the relative energy transfer weight between each transaction event and other transaction events , and the expression is: , where, is the th transaction event and the th transaction event is the time difference between two transaction events, is the spatial difference between two transaction events, and are weight coefficients, reflecting the influence degree of time and space in energy transfer;

[0093] S43: Calculate the energy value change gradient of the fusion feature vector according to the energy value of each transaction event and the transfer weight between transaction events. The specific method is: calculate the energy value change gradient of each transaction event according to the energy transfer weight and the difference of the fusion feature vector. The formula is: , where, is the energy value change gradient of the th transaction event, is the th transaction event and the th transaction event and are respectively the th and the The fusion feature vector of a trading event, is the total number of trading events;

[0094] S44: Generate a dynamic energy distribution map based on the gradient of the energy value change of each trading event. By visualizing the gradients of the energy value changes of all trading events in chronological order, a dynamic energy distribution map reflecting the energy change of trading behavior is obtained. Through the above solution, step S4 realizes the construction of a trading behavior energy field model, calculates the gradient of the energy value change of the fusion feature vector, and generates a dynamic energy distribution map, providing important spatio-temporal energy features for subsequent abnormal trading detection.

[0095] S5 specifically includes:

[0096] S51: Establish a cross-modal association rule base. First, extract the association rules between different data sources (including transaction amount, user operation behavior, device fingerprint, etc.) according to historical trading data and known trading anomaly patterns. By statistically analyzing the relationship between historical trading behavior and abnormal events, construct the logical rules between each data source feature and other features, and store these rules in the association rule base. The cross-modal association rule base includes the following specific rules:

[0097] Rule 1: The contradictory combination of high amount volatility and low operation dispersion;

[0098] Rule 2: The spatial contradiction between an abnormal device environment and a regular trading location;

[0099] Rule 3: The temporal contradiction between trading during inactive periods and low energy gradients;

[0100] S52: Define the logical verification conditions for each rule according to the association rules in the cross-modal association rule base;

[0101] S53: During each trading detection, for each trading event in the dynamic energy distribution map, based on its fusion feature vector, find the relevant rules in the cross-modal association rule base for verification, and generate the logical contradiction value for the corresponding event. Through the above solution, step S5 realizes the establishment of the cross-modal association rule base, and combines the data source features in the dynamic energy distribution map to detect the logical contradiction between features, providing an accurate judgment basis for subsequent abnormal trading detection.

[0102] The logical verification conditions include:

[0103] Verification condition 1: When the transaction amount volatility is greater than the set volatility threshold and the operation behavior dispersion is less than the set dispersion threshold then, according to Rule 1, determine that this event is a contradictory combination;

[0104] Verification condition 2: When the device environment abnormality is greater than the set abnormality threshold and the spatial difference of the transaction location is greater than the set spatial threshold then, according to Rule 2, this transaction event is determined to be a spatial contradiction;

[0105] Verification condition 3: When the transaction occurs within a preset inactive period and the energy value change gradient of this transaction event is lower than the set energy gradient threshold then, according to Rule 3, this transaction event is determined to be a temporal contradiction.

[0106] The logical contradiction values generated in S53 specifically include:

[0107] S531: For each transaction event, it is matched and verified according to its fused feature vector and the rules in the associated rule library. If the verification condition of a certain rule is violated, a logical contradiction value is assigned to this transaction event. The calculation formula of the logical contradiction value is: , where is the logical contradiction value, is the number of rules in the associated rule library, is the weight coefficient of the violation of the th rule, is the th rule violation degree (i.e., the degree of non - satisfaction of the rule verification condition); when calculating, the violated rules will be assigned different weight coefficients according to their severity ; specifically, when calculating the logical contradiction value, if a certain rule is satisfied, then , if a certain rule is violated, then the value of and is the degree of violation, which can be quantified by setting a standard. For example, if the value of and can be obtained by calculating the difference between them; the above - mentioned scheme provides a specific numerical determination basis for subsequent abnormal transaction detection.

[0108] S6 specifically includes:

[0109] S61: Compare the logical contradiction value with the preset dynamic threshold. Specifically, set multiple dynamic thresholds , where is the threshold classification number, and each threshold corresponds to a different abnormal level; according to the logical contradiction value Comparison with each threshold value to determine the abnormal level of the transaction event ; When the following conditions are met: it is determined that the abnormal level of the transaction event is , where ranges from 1 to , and it is agreed that can be regarded as infinity after the highest level or a preset maximum threshold;

[0110] S62: Output a corresponding hierarchical abnormal warning signal according to the comparison result between the logical contradiction value and the dynamic threshold value;

[0111] When , a mild abnormal warning signal is output;

[0112] When , a moderate abnormal warning signal is output;

[0113] When , a high abnormal warning signal is output;

[0114] If there are more threshold levels, corresponding hierarchical abnormal warning signals are output in the same way as above.

[0115] The present invention covers any substitutions, modifications, equivalent methods, and solutions made to the essence and scope of the present invention. For the public to have a thorough understanding of the present invention, specific details are described in detail in the following preferred embodiments of the present invention, and those skilled in the art can fully understand the present invention without the description of these details. In addition, well-known methods, processes, procedures, components, and circuits are not described in detail to avoid unnecessary confusion to the essence of the present invention.

[0116] The above are only the preferred embodiments of the present invention. It should be noted that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and refinements can be made, and these improvements and refinements should also be regarded as the protection scope of the present invention.

Claims

1. A method for detecting abnormal bank transactions based on multi-modal data fusion, characterized in that, It includes the following steps: S1: Real-time collect the structured transaction flow data of the bank transaction system, the unstructured behavior track data of the user terminal, and the device fingerprint feature data to form a multi-modal original data set; S2: Perform spatio-temporal alignment processing on the multi-modal original data set to generate a data association matrix with unified timestamps; S3: Based on the data association matrix, perform feature-level fusion, extract three core features: transaction amount volatility, operation behavior dispersion, and device environment anomaly, and generate a fusion feature vector; S4: Construct a transaction behavior energy field model to calculate the energy value change gradient of the fusion feature vector and generate a dynamic energy distribution map; The specific content of S4 includes: S41: Construct a transaction behavior energy field model, define each node in the energy field model as a transaction event, and the energy value corresponding to each node is the fusion feature vector of the transaction event; S42: Construct a topological structure for the energy field model according to the spatio-temporal correlation of trading behaviors. Use the graph structure model in graph theory to represent the relationships between trading events as a directed graph, where the edges in the graph represent the spatio-temporal correlations between different trading events; meanwhile, define the relative energy transfer weights between trading events and other trading events ; S43: Calculate the energy value change gradient of the fused feature vector based on the energy value of each transaction event and the transfer weight between transaction events. The formula is: , where is the energy value change gradient of the -th transaction event, is the energy transfer weight between the -th transaction event and the -th transaction event, and are the fused feature vectors of the -th and -th transaction events respectively, is the total number of transaction events; S44: Generate a dynamic energy distribution map according to the energy value change gradient of each transaction event. By visualizing the energy value change gradients of all transaction events in chronological order, a dynamic energy distribution map reflecting the energy change of transaction behavior is obtained; S5: Establish a cross-modal association rule library to detect the logical contradiction values between the features of different data sources in the dynamic energy distribution map; The specific content of S5 includes: S51: Establish a cross-modal association rule library, and the cross-modal association rule library includes the following specific rules: Rule 1: The contradictory combination of high amount volatility and low operation dispersion; Rule 2: The spatial contradiction between an abnormal device environment and a regular transaction location; Rule 3: The temporal contradiction between transactions during inactive periods and low energy gradients; S52: According to the association rules in the cross-modal association rule library, define the logical verification conditions for each rule; S53: During each transaction detection, for each transaction event in the dynamic energy distribution map, based on its fusion feature vector, find the rules related to this event in the cross-modal association rule library for verification, and generate the logical contradiction value of the corresponding event; The specific content of S53 includes: S531: For each transaction event, match and verify it according to its fusion feature vector and the rules in the association rule base. If the verification condition of a certain rule is violated, assign a logical contradiction value to this transaction event. The calculation formula of the logical contradiction value is: , where L is the logical contradiction value, is the number of rules in the association rule base, is the weight coefficient of the violation of the -th rule, is the degree of violation of the -th rule; when calculating, the rules that violate the conditions will be assigned different weight coefficients according to their severity ; S6: According to the comparison result between the logical contradiction value and the preset dynamic threshold, output a graded abnormal warning signal.

2. The method for detecting abnormal bank transactions based on multi-modal data fusion according to claim 1, wherein The specific content of S1 includes: S11: Through the transaction log monitoring module of the bank core system, real-time capture the structured transaction flow data. The data fields include transaction timestamp, transaction amount, initiating party account, receiving party account, and transaction type code. Use the database transaction log generated when each transaction is completed as the data collection trigger event; S12: Embed a behavior track collection SDK in the user terminal application program to real-time record the unstructured behavior track data, including the touch screen operation coordinate sequence, page stay duration, and three-axis gyroscope data of the biometric authentication process. When collecting, use the touch event trigger as the starting point and the click of the transaction confirmation button as the end point to form a complete operation track segment; S13: Obtain the device fingerprint feature data through the device fingerprint collection engine, including the hash combination value of the CPU serial number, MAC address, and Bluetooth address extracted from the hardware layer features.

3. A method for detecting abnormal bank transactions based on multimodal data fusion according to claim 1, characterized in that, The specific content of S2 includes: S21: Standardize the transaction timestamps in the structured transaction flow data. Synchronize the clocks of each data source using the Network Time Protocol, and uniformly convert the original timestamps into Coordinated Universal Time (UTC) format to generate a unified timestamp with millisecond-level precision. S22: Parse the geographical coordinate information in the unstructured behavioral trajectory data, convert data in different coordinate systems into Universal Transverse Mercator (UTM) projection coordinates, and establish a mapping relationship table between the trading geographical locations and the user operation locations. S23: Extract the device unique identifiers from the device fingerprint feature data, generate device fingerprint hash values through a preset hash mapping algorithm, and establish a binding relationship table between the device fingerprint hash values and the trading account IDs. S24: Construct an N×4-dimensional data association matrix, where N is the total number of trading events. Each row of the matrix corresponds to a trading event, and the column dimensions sequentially include a unified timestamp field, a UTM coordinate field, a device fingerprint hash value field, and an associated account ID field.

4. A method for detecting abnormal bank transactions based on multi-modal data fusion according to claim 1, characterized in that, The specific steps of S3 are as follows: S31: Based on the unified timestamp field in the data association matrix, calculate the volatility of the trading amount for each trading event. By calculating the standard deviation of the trading amounts of the same user within a specified time window, obtain the trading amount volatility value for each trading event as the trading amount volatility feature. S32: Based on the operation trajectory data in the data association matrix, extract the behavioral dispersion of each trading operation. Specifically, according to the frequency and path length of the trajectory points of the user's operations during the trading process, calculate the behavioral dispersion of each operation trajectory segment to generate the operation behavior dispersion feature corresponding to each transaction. S33: Based on the device fingerprint feature data in the data association matrix, analyze the device environment anomaly degree. Specifically, by comparing the historical binding relationship between the device fingerprint hash value and the trading account ID, detect the change trend of the device fingerprint hash value, and determine whether there is an environment anomaly for the device by setting a threshold, and calculate the device environment anomaly degree feature. S34: Concatenate the three types of features, namely, the trading amount volatility, the operation behavior dispersion, and the device environment anomaly degree calculated in S31 - S33 in sequence to generate a fused feature vector with M dimensions, where M is the number of features extracted.

5. The method for detecting abnormal bank transactions based on multimodal data fusion according to claim 4, wherein, The specific steps of S33 are as follows: S331: According to the historical binding relationship between the device fingerprint hash value and the trading account ID in the data association matrix, extract the binding records of each device fingerprint hash value and its corresponding trading account ID, and establish a historical binding relationship database between the device fingerprint hash values and the account IDs. S332: Calculate the trend of the change in the device fingerprint hash value for each transaction based on the historical binding relationship library ; S333: Set the threshold Determine whether there is an environmental anomaly in the device. If the change trend of the device fingerprint hash value exceeds the threshold , it is determined that there is an environmental anomaly in the device; S334: Calculate the equipment environment abnormality degree according to the relationship between the change trend and the set threshold value. The formula is: , where E is the equipment environment abnormality degree, is the preset threshold value; Take the equipment environment abnormality degree E as the equipment environment abnormality degree feature.

6. The method for detecting abnormal bank transactions based on multi-modal data fusion according to claim 1, wherein The logical verification conditions include: Verification condition 1: When the transaction amount volatility is greater than the set volatility threshold and the operation behavior dispersion D is less than the set dispersion threshold then, according to Rule 1, this event is determined to be a contradiction combination; Verification condition 2: When the device environment abnormality degree E is greater than the set abnormality degree threshold and the spatial difference of the transaction location is greater than the set spatial threshold then according to Rule 2, this transaction event is determined to be a spatial contradiction; Verification condition 3: When a transaction occurs during a preset inactive period and the energy value change gradient of this transaction event is lower than the set energy gradient threshold then according to Rule 3, this transaction event is determined to have a timing contradiction.

7. A method for detecting abnormal bank transactions based on multi-modal data fusion according to claim 1, characterized in that, The specific steps of S6 are as follows: S61: Compare the logical contradiction value L with a preset dynamic threshold. Specifically, set multiple dynamic thresholds , where Z is the number of threshold levels, and each threshold corresponds to a different anomaly level; S62: Output the corresponding hierarchical anomaly warning signal according to the comparison result between the logical contradiction value L and the dynamic threshold. When output a mild abnormal warning signal; When output a medium anomaly warning signal; When output a height anomaly warning signal.

Images