Continuous financial fraud detection method based on dynamic feature space transformation

Abstract

The invention discloses a continuous financial fraud detection method based on dynamic feature space transformation, and belongs to the technical field of financial fraud detection. Dynamically adjusting the target dimension of the random projection according to the data volume, and carrying out dynamic feature space transformation; constructing a self-adaptive spherical decision boundary, and adapting to new data through a centroid calculation and radius updating mechanism; and performing financial fraud detection according to the decision boundary. Through dynamic feature space transformation, the feature space can be automatically expanded to capture more complex modes when data is sufficient; when the data is scarce, overfitting of the detection model can be avoided by compressing the feature space, the generalization ability of the model is improved, and good detection performance can be kept on new data. Meanwhile, the mass center of the normal transaction sample is updated according to the newly added transaction sample, the radius of the spherical decision boundary is dynamically adjusted, a financial dynamic detection scene can be continuously adapted, and interference of data noise and abnormal values is effectively reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of financial fraud detection, and in particular to a continuous financial fraud detection method based on dynamic feature space transformation. Background Art

[0002] In recent years, anomaly detection technology has been widely used in the field of financial fraud detection. The purpose of anomaly detection is to identify behaviors that do not conform to normal transaction patterns, which may indicate fraud or other malicious activities. However, existing anomaly detection methods mostly rely on supervised learning, which requires a large number of labeled normal transaction and fraud transaction samples for training. Obtaining these labeled data is time-consuming and expensive, and cannot cover all possible types of fraud. In addition, when encountering new types of fraud, supervised learning models are prone to overfitting, resulting in insufficient generalization ability of the model. In order to solve the problem of supervised learning's dependence on data annotation, unsupervised learning methods are proposed. However, although unsupervised learning methods do not need to rely on labeled data, they lack a clear definition of normal transaction boundaries and are easily disturbed by data noise and outliers, resulting in a high false alarm rate. In addition, the data feature dimensions processed by unsupervised methods are fixed, and it is difficult to dynamically adjust according to the amount of data, resulting in insufficient model generalization ability and inability to maintain good performance on new data. Summary of the invention

[0003] The purpose of the present invention is to overcome the problems of the prior art and provide a method for detecting continuous financial fraud based on dynamic feature space transformation.

[0004] The purpose of the present invention is to achieve the following technical solution: a method for detecting persistent financial fraud based on dynamic feature space transformation, the method comprising the following steps: Obtaining features of transaction samples, including transaction notes, chat records, social media information, and historical transaction records; Dynamically adjust the target dimension of random projection according to the data volume of transaction samples, and then perform dynamic feature space transformation; Calculate the centroid of all normal transaction samples; obtain the distance distribution from each normal transaction sample to the centroid, and then learn the boundary range of normal transaction samples; calculate the average distribution range of normal transaction samples, and construct an initial spherical decision boundary based on the average distribution range; update the centroid of normal transaction samples according to the newly added transaction samples, and dynamically adjust the radius of the spherical decision boundary; By judging whether the distance between the centroid of the transaction sample to be detected and the normal transaction sample is within the radius of the spherical decision boundary, financial fraud detection is performed and the detection result is output.

[0005] In one example, the features of the acquired transaction samples include: The features of the image transaction samples are extracted using an image detection model, and / or the features of the text transaction samples are extracted using a text detection model, and / or the features of the voice transaction samples are extracted using a voice detection model.

[0006] In one example, before the step of dynamically adjusting the target dimension of the random projection according to the data volume of the transaction sample, the step further includes: The global distance matrix of all transaction samples is calculated, and the distance relationship between samples is optimized using the distance-aware contrast loss function.

[0007] In one example, the distance-aware contrast loss function is expressed as: ; ;

[0008] in, represents the total distance-aware contrast loss of positive sample pairs; Represents a set of positive sample pairs, where positive samples are normal transaction samples; Represents a positive sample pair The distance between the perceived losses; Represents a positive sample pair The distance between represents a set of negative sample pairs, where negative samples are potential fraudulent transaction samples; represents a hyperparameter; Represents a positive sample With negative samples The distance between Represents a positive sample With negative samples The distance between.

[0009] In one example, dynamically adjusting the target dimension of random projection according to the data volume of the transaction sample, and then performing dynamic feature space transformation, includes: Orthogonal random projection is used to construct a random projection matrix. The target dimension in the random projection matrix is ​​dynamically adjusted according to the data volume of the transaction sample. If the data volume is greater than the threshold, the target dimension is increased in dimension; if the data volume is less than the threshold, the target dimension is decreased in dimension; if the data volume is equal to the threshold, the target dimension remains unchanged. The features of transaction samples are mapped to a new feature space according to the random projection matrix to achieve dynamic feature space transformation.

[0010] In one example, when constructing the initial spherical decision boundary, the risk of misjudging normal transaction samples as fraudulent transaction samples and misjudging fraudulent transaction samples as normal transaction samples is balanced by the spherical decision boundary loss function. The expression is: ; in, represents the total number of samples; An indicator indicating whether the sample exceeds the spherical decision boundary; Represent the feature representation of each transaction sample; For the The centroid of the samples; Indicates The radius of the spherical decision boundary.

[0011] In one example, the update expression of the radius of the spherical decision boundary is: ; in, Indicates The updated radius of the spherical decision boundary; Indicates The radius of the spherical decision boundary before updating; represents the gradient of the decision boundary loss function with respect to the radius; represents partial derivative.

[0012] In one example, the method of detecting financial fraud by determining whether the distance between the centroid of the transaction sample to be detected and the normal transaction sample is within the radius of the spherical decision boundary includes: If the distance between the centroid of the transaction sample to be detected and the normal transaction sample is less than or equal to the radius of the spherical decision boundary, the detection result of the normal transaction is output; If the distance between the centroid of the transaction sample to be detected and the normal transaction sample is greater than the radius of the spherical decision boundary, the detection result of the abnormal transaction is output and an alarm is triggered, and / or manual review and analysis are performed and the final detection result is output; The samples that are judged as normal transactions by the detection results are updated to the training data set, and the spherical decision boundary is optimized using the updated training data set.

[0013] It should be further explained that the technical features corresponding to the various examples of the above method can be combined or replaced with each other to form a new technical solution.

[0014] Compared with the prior art, the present invention has the following beneficial effects: 1. In one example, the dimension of random projection is dynamically adjusted by the amount of data to achieve dynamic feature space transformation, which can improve the adaptability of the model. That is, when the data is sufficient, the feature space is automatically expanded to capture more complex patterns, thereby improving the detection accuracy; when the data is scarce, the feature space is compressed to avoid overfitting of the detection model, improve the generalization ability of the model, maintain good detection performance on new data, and enhance the robustness of the model.

[0015] At the same time, the initial spherical decision boundary is defined by calculating the average distribution range of normal transaction samples, which can ensure that most normal transaction samples are included in the decision boundary, while avoiding the problem of increased false alarm rate due to excessively large decision boundaries; the centroid of normal transaction samples is updated according to the newly added transaction samples, and the radius of the spherical decision boundary is dynamically adjusted (expanded or reduced), which can continuously adapt to financial dynamic detection scenarios and effectively reduce the interference of data noise and outliers.

[0016] 2. In one example, since financial fraud accounts for a small proportion of transaction data, existing methods often find it difficult to effectively identify a small number of fraudulent transactions. The present invention optimizes the distance relationship between normal transactions and fraudulent transactions through a distance-aware contrastive learning method, minimizes the distance between positive sample pairs, and maximizes the distance between negative sample pairs, thereby optimizing the decision boundary between normal transaction samples and potential fraudulent transaction samples, so that the model can still efficiently identify fraud when dealing with data imbalance problems, significantly improving the detection accuracy of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The specific implementation methods of the present invention are further described in detail below in conjunction with the accompanying drawings. The accompanying drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The same reference numerals are used in these drawings to represent the same or similar parts. The schematic embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0018] Figure 1 A method flow chart provided for an example of the present invention; Figure 2 A method flow chart is provided for a preferred example of the present invention. DETAILED DESCRIPTION

[0019] The technical solution of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, "connection" should be understood in a broad sense, for example, it can be directly connected or indirectly connected through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood in specific circumstances.

[0021] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0022] In one example, if Figure 1 As shown, a method for detecting persistent financial fraud based on dynamic feature space transformation comprises the following steps: S1: Get the features of transaction samples.

[0023] Among them, the transaction samples can be different types of financial transaction samples, such as text, image, voice, etc. Specifically, the transaction samples include transaction notes, chat records, social media information, and historical transaction records. Specifically, the transaction samples include consumption records, bank loan records, securities trading records, etc., which can reflect the transaction time, transaction location, transaction frequency, transaction account, etc. Preferably, before extracting the features of the transaction samples, data preprocessing can also be performed, such as data cleaning, data normalization processing, data enhancement processing, etc.

[0024] S2: Dynamically adjust the target dimension of random projection according to the data volume of transaction samples, and then perform dynamic feature space transformation.

[0025] Specifically, through dynamic feature space transformation, the dimension of the feature space can be automatically adjusted according to the data volume of the transaction samples. When the data is sufficient, the feature space can be expanded to enhance the model's recognition ability. When the data is less, the robustness of the model is maintained through dimensionality reduction to avoid overfitting, thereby ensuring that the model can maintain stable performance under different data volume conditions.

[0026] S3: Calculate the centroid of all normal transaction samples; obtain the distance distribution from each normal transaction sample to the centroid, and then learn the boundary range of the normal transaction samples; after determining the boundary range of the normal transaction samples, calculate the average distribution range of the normal transaction samples, and construct the initial spherical decision boundary based on the average distribution range; update the centroid of the normal transaction samples according to the newly added transaction samples, and dynamically adjust the radius of the spherical decision boundary.

[0027] Among them, the centroid is used to represent the typical distribution of normal transaction samples, which can provide a basis for the subsequent construction of decision boundaries. The average distribution range is the average distance from each normal transaction sample to the centroid. The initial spherical decision boundary is constructed through the average distribution range, which can ensure that most normal transaction samples can be included in the decision boundary, while avoiding the problem of increased false alarm rate due to excessive decision boundaries. When new transaction samples are added, the latest normal transaction samples are analyzed regularly, the centroid represented by the normal transaction samples is updated, and the radius of the spherical decision boundary is expanded or reduced, so that the decision boundary can continue to adapt to different transaction scenarios and effectively reduce the interference of data noise and outliers.

[0028] S4: By determining whether the distance between the centroid of the transaction sample to be detected and the normal transaction sample is within the radius of the spherical decision boundary, financial fraud detection is performed and the detection result is output.

[0029] Specifically, when performing fraud detection, for the transaction sample to be detected, the distance between it and the centroid of the normal transaction sample is calculated, and whether it belongs to a normal transaction is determined based on the distance and the radius of the spherical decision boundary. If the data point of the transaction sample to be detected falls within the boundary, that is, the distance between the centroid of the transaction sample to be detected and the normal transaction sample is less than or equal to the radius of the spherical decision boundary, it is a normal transaction, and the detection result of the normal transaction is output. If the data point of the transaction sample to be detected falls outside the boundary, that is, the distance between the centroid of the transaction sample to be detected and the normal transaction sample is greater than the radius of the spherical decision boundary, it may be a fraudulent transaction, and the detection result of the fraudulent transaction is output.

[0030] In one example, the features of a transaction sample are obtained, including: The features of the image transaction samples are extracted using an image detection model, and / or the features of the text transaction samples are extracted using a text detection model, and / or the features of the voice transaction samples are extracted using a voice detection model.

[0031] Among them, the image detection model, the text detection model, and the speech detection model are all neural network models, among which the image detection model can be a convolutional neural network, a deep convolutional neural network, etc., the text detection model can be a BERT model, a Transformer model, etc., and the speech detection model can be a recurrent neural network, etc., and the speech transaction sample can also be converted into text information, and then the features of the transaction sample can be extracted through the text detection model. Preferably, when the transaction samples are samples of different types, after obtaining the features of the transaction samples through different types of detection models, multimodal data fusion processing technology can be used to integrate information from different modalities, thereby improving the accuracy and robustness of transaction detection.

[0032] Optionally, when the data type of the transaction sample is text, text transaction samples from different sources are integrated to construct a multi-dimensional text dataset to provide rich information support for subsequent fraud detection. In the present invention, all transaction samples used are only normal transaction samples, and no fraudulent transaction samples are included, ensuring that the model is trained and predicted only based on normal transaction behavior.

[0033] First, the BERT model is used to process and extract features from transaction samples. The BERT model uses a bidirectional context encoding method to capture deep semantic information in text and generate context representations for each word. Assume that the input transaction sample is a word sequence , the BERT model first maps these words to a high-dimensional word vector space to obtain the embedding representation of each word: [CLS, T 1 , T 2 , ⋯, T L ]∈ R (L+1)×H ; Among them, [CLS] represents a special classification tag, which is used to summarize the semantic information of the entire sentence; Represents the embedding representation of each token in the sequence; Indicates the length of the sequence; represents the dimension of embedding; Represents the set of real numbers.

[0034] In order to solve the variable length problem of BERT output sequence, the present invention uses pooling operation for processing. Specifically, the mean pooling method can be used or the output of the [CLS] tag can be directly used as the representation of the text. The mean pooling operation is as follows: ; in, It is the preliminary feature representation of the transaction sample, indicating the overall semantic information of the text-based transaction sample. Represents the mean pooling operation; the mean pooling operation averages the representations of all tokens to obtain a fixed-length text vector. Token is the basic unit of text data, which can be a word or a character. In this way, the BERT model can effectively extract the semantic information of the text and provide high-quality features for subsequent fraud detection.

[0035] After generating the preliminary feature representation of the text, the present invention further optimizes the preliminary feature representation through the fully connected layer and the ReLU activation function. Specifically, the feature representation after linear transformation is: ; in, , is the weight matrix of the fully connected layer; , is the bias term; is the dimension of the output space; is the optimized feature representation.

[0036] In order to enhance the model's ability to distinguish different texts, the present invention adopts the cross entropy loss function , used to reduce the difference between normal transaction categories and actual labels, cross entropy loss function The expression is: ; in, The total number of samples for normal transactions; represents a linear classifier; For the The classification score of the class; is the true label of the sample; is the total number of categories.

[0037] This example uses the BERT model to extract sample features, which can deeply understand the complex semantic relationships in transaction texts. In particular, it improves the ability to identify fraudulent behavior when processing unstructured data such as transaction notes and customer chat records.

[0038] In one example, before the step of dynamically adjusting the target dimension of the random projection according to the data volume of the transaction sample, the step further includes: The global distance matrix of all transaction samples is calculated, and the distance relationship between samples is optimized using the distance-aware contrast loss function.

[0039] Specifically, the distance between each transaction sample can be calculated by using metrics such as Euclidean distance, cosine similarity or Mahalanobis distance, and the similarity of each transaction sample in the high-dimensional feature space can be determined to construct a global distance matrix of the transaction samples. By calculating the relative distance between samples, it is possible to determine which transaction behaviors belong to the typical normal transaction mode and which transaction samples deviate from the normal transaction mode, thereby building an efficient fraud detection foundation.

[0040] Furthermore, a distance-aware contrast loss function is used to optimize the distance relationship between transaction samples, so that normal transaction samples are more closely aggregated in the feature space, while the distance between abnormal transaction (fraudulent transaction) samples and normal transaction samples remains large, thereby enhancing the recognition ability of the model. During the training process, the model will learn an optimal feature representation, so that the distribution of normal transactions in the embedding space is more concentrated, while the distribution of potential fraudulent transactions in the space is more dispersed due to their differences from normal transactions, thereby improving detection accuracy.

[0041] More specifically, the global distance matrix of all transaction samples is calculated, and the distance relationship between samples is optimized using the distance-aware contrast loss function, including the following steps: Construct a global distance matrix between transaction samples to achieve distance-aware contrastive learning. First, use the embedding representation output by the detection model Get the feature representation of each normal transaction sample. Then, calculate the Euclidean distance matrix between all samples. The calculation expression is: ; in, Represents a transaction sample and transaction samples The distance between.

[0042] During the training phase, the detection model only uses normal transaction samples for learning, and does not use fraudulent transaction samples. On the one hand, this is because fraudulent samples are usually scarce and difficult to obtain. On the other hand, relying on normal transaction samples for model training can reduce the cost of data annotation while ensuring the efficiency of the training process. In addition, by learning the distribution of normal behaviors in normal transaction samples, the model can effectively identify fraudulent behaviors that are significantly different from them.

[0043] Furthermore, by optimizing the distance between normal transaction samples, the model can ensure that the feature distance of samples of the same category is as small as possible, while the distance between samples of different categories (i.e., normal transaction samples and potential fraudulent transaction samples) is as large as possible. Specifically, the loss function optimizes the decision boundary between normal transactions and potential fraudulent transactions by minimizing the distance between positive sample pairs and maximizing the distance between negative sample pairs. For all positive sample pairs , the distance-aware contrast loss is defined as: ; in, represents the total distance-aware contrast loss of positive sample pairs; Represents a set of positive sample pairs, where positive samples are normal transaction samples; Represents a positive sample pair The distance-aware loss between , is expressed as: ; in, represents a set of negative sample pairs, where negative samples are potential fraudulent transaction samples; is a hyperparameter used to control the degree of separation between normal transaction samples and fraudulent transaction samples; Represents a positive sample With negative samples The distance between Represents a positive sample With negative samples The loss function adopts a contrastive learning strategy to minimize , that is: make the normal transaction sample The distance between them is as small as possible, making similar transactions closer; maximizing and , that is: make the normal transaction sample Sample fraudulent transactions The distance between them is as large as possible to improve the classification ability.

[0044] During the training process, the model optimizes the loss function so that normal transaction samples are more concentrated in the feature space, while fraudulent transaction samples are relatively dispersed, thereby improving the detection accuracy of fraudulent transactions in the testing phase.

[0045] This example uses an optimization method based on distance-aware contrastive learning to optimize the distance relationship between samples. The model can accurately distinguish normal transactions from potential fraud transactions, thereby improving the robustness and accuracy of fraud detection.

[0046] In one example, the target dimension of the random projection is dynamically adjusted according to the data volume of the transaction sample, and then the dynamic feature space transformation is performed, including: Orthogonal random projection is used to construct a random projection matrix. The target dimension in the random projection matrix is ​​dynamically adjusted according to the data volume of the transaction sample. If the data volume is greater than the threshold, the target dimension is increased in dimension; if the data volume is less than the threshold, the target dimension is decreased in dimension; if the data volume is equal to the threshold, the target dimension remains unchanged. The features of transaction samples are mapped to a new feature space according to the random projection matrix to achieve dynamic feature space transformation.

[0047] Specifically, the detection model maps the input features by using the random projection technique. Mapping to a new feature space means the transformation from the original feature space to the new feature space: ; in, is the transformed feature representation; , is the projection weight matrix, which obeys the normal distribution, is the original dimension, It is the dimension after projection; are input features, is the bias term.

[0048] The present invention uses orthogonal random projection to construct a random projection matrix , ensuring that high-dimensional data is mapped to low-dimensional space and maintaining the distance relationship between samples as much as possible. Random projection matrix The specific generation rules are as follows: ; Among them, the normalization factor Ensure the consistency of feature scale after projection; represents the target dimension; , is a random Gaussian matrix whose elements satisfy: ; in, Representation Matrix Middle Line Elements of a column; Represents a standard normal distribution with a mean of 0 and a standard deviation of 1.

[0049] The dynamic feature space transformation of the present invention is not static, but adaptively adjusted. During the training process, the dimension of the feature space is dynamically adjusted according to the amount of data, that is, the model will automatically decide whether to expand or compress the feature space, thereby improving the adaptability of the model, thereby ensuring that the model can effectively handle different data volume conditions. Specifically, when the data is sufficient, the model automatically expands the feature space to capture more complex patterns, ensuring that the resolution ability can be improved when the data is sufficient; when the data is scarce, the model compresses the feature space to avoid overfitting, maintains the robustness of the model, and avoids overfitting.

[0050] Furthermore, the present invention sets a threshold As a criterion for whether the data is sufficient, and introduces feature expansion factors : ; in, Represents the total number of current samples. Then according to Dynamically adjust the dimension of the feature space: ; Among them: (sufficient data) , , that is, increasing the dimension, improving the model's ability to represent complex situations; when (Insufficient data) , , that is, dimension reduction, to avoid overfitting of the model; when hour, , keeping the original feature dimension unchanged.

[0051] Finally, the dynamic adjustment of the feature space is achieved through the following formula: ; in, It represents the adaptive feature transformation function, which can automatically adjust the operation of the feature space according to the data sample size. Through this adaptive adjustment method, the model can always maintain high performance in different data environments.

[0052] In one example, step S3 constructs an initial spherical decision boundary and dynamically adjusts the radius of the spherical decision boundary, including the following sub-steps: First, in the feature space, all normal transaction samples are processed and the centroid of normal transaction samples is calculated. The centroid is calculated by taking a weighted average of the feature vectors of all normal transaction samples to obtain a point representing the center of the normal transaction sample distribution. Specifically, the centroid The calculation formula is as follows: ; in, Yes Category Normal transaction sample set; is the total number of samples in this category.

[0053] Use the calculated centroid , further analyze the distance from the normal transaction sample to the centroid, and thus define an initial spherical decision boundary. The radius of the decision boundary Initially, it is set according to the average distribution range of normal transaction samples. This boundary needs to ensure that most normal transaction samples are within the boundary, while avoiding excessive expansion that causes an increase in false positive rate. The Euclidean distance from the normal transaction sample to the centroid does not exceed the radius of the decision boundary. The calculation formula is as follows: ; in, Indicates that for each, it is used to quantify all elements in the set. In the process of constructing the spherical decision boundary, it is necessary to balance the internal risk and the external open space risk. The internal risk refers to the risk that a normal transaction sample is misclassified as a fraudulent transaction sample, and the external risk refers to the risk that a fraudulent transaction sample is misclassified as a normal transaction. This balance is achieved through the spherical decision boundary loss function. The expression is: ; in, For the The centroid of the samples; Indicates The radius of the spherical decision boundary; An indicator indicating whether a sample exceeds the spherical decision boundary is defined as follows: ; When new transaction samples arrive, the centroid of normal transaction samples is updated regularly, and the radius of the decision boundary is recalculated based on the latest transaction samples. This process involves dynamic adjustment of the current radius to ensure that the decision boundary can adapt to different transaction scenarios. The radius update formula is as follows: ; in, Indicates The updated radius of the spherical decision boundary; Indicates The radius of the spherical decision boundary before updating; represents the learning rate; is the decision boundary loss function Gradient with respect to radius; represents the partial derivative. This process ensures that the decision boundary remains flexible and adaptable when faced with new samples. The calculation formula is as follows: ; in, Indicates whether the category of the sample is An indicator for filtering samples belonging to a specific category; if , ;otherwise Through the spherical decision boundary loss function, a suitable decision boundary can be learned.

[0054] In one example, during the fraudulent transaction sample detection process, the model flexibly distinguishes between normal transactions and potential fraudulent transactions by constructing and updating a spherical decision boundary. However, the data distribution in the financial market is usually dynamically changing, and the characteristics of normal transactions and fraudulent transactions may shift, so real-time and accurate classification is required. The present invention analyzes each transaction sample based on the previously learned spherical decision boundary. The radius and center of mass of the decision boundary define the typical distribution of normal transactions. The distribution of all normal transaction samples in the feature space should be concentrated within the decision boundary. That is, at this time, by judging whether the distance between the transaction sample to be detected and the center of mass of the normal transaction sample is within the radius of the spherical decision boundary, financial fraud detection is performed, including the following sub-steps:

[0055] If the distance between the centroid of the transaction sample to be detected and the normal transaction sample is less than or equal to the radius of the spherical decision boundary, the transaction is considered to be in line with the normal mode and the detection result of the normal transaction is output. At this point, further operations can be performed, including: ① recording transaction information; ② continuing to enhance the normal transaction sample data set through this sample to improve the system's ability to identify normal transaction features; ③ marking the transaction as a "passed" normal transaction.

[0056] If the distance between the centroid of the transaction sample to be detected and the normal transaction sample is greater than the radius of the spherical decision boundary, that is, the sample falls outside the decision boundary, the model determines that the transaction is an abnormal behavior and outputs the detection result of the abnormal transaction. At this point, further operations can be performed, including: ① marking the transaction as a potential fraudulent transaction and triggering an alarm; ② sending the transaction sample to the manual review system for manual analysis and processing; ③ updating the model based on the manual review results. If the transaction is confirmed to be a fraudulent transaction, the transaction is terminated; if the transaction is confirmed to be a normal transaction, the model will include this transaction sample in the training data to build a more accurate decision boundary.

[0057] Financial fraud detection does not only rely on static decision boundaries, but also continuously learns through a dynamic update mechanism to adapt to emerging frauds in financial markets. Whenever new data is processed, especially when fraud is confirmed, the model will make appropriate adjustments to the decision boundary based on the new sample information.

[0058] Combining the above examples, we can obtain a preferred example of the present invention, such as Figure 2 As shown, at this time, the detection method includes the following steps: S10: Obtaining features of transaction samples; S20: Calculate the global distance matrix of all transaction samples and use the distance-aware contrast loss function to optimize the distance relationship between samples; S30: dynamically adjusting the target dimension of random projection according to the data volume of the transaction sample, and then performing dynamic feature space transformation; S40: Construct an adaptive spherical decision boundary to adapt to newly added transaction samples through centroid calculation and radius update mechanism; S50: Determine whether the transaction is fraudulent based on the decision boundary and issue a real-time warning.

[0059] In the process of financial fraud detection, the present invention first extracts the features of normal transaction samples through the detection model, and uses the contrast loss function to optimize the distance relationship between samples, so that normal transaction samples are easy to aggregate and fraudulent transaction samples are far away; in response to changes in the number of data samples, the dynamic feature space transformation is used to adjust the feature space dimension, so that the feature space can be adaptively adjusted to ensure that the model's resolution ability is enhanced when the data is sufficient, and the robustness of the model is maintained when the data is less. At the same time, an adaptive spherical decision boundary is constructed, and the centroid calculation and radius update mechanism are used to ensure that the detection model can flexibly respond to new data changes. In actual application, this method classifies transactions by decision boundaries: if the sample is within the normal transaction boundary, it is judged as a normal transaction; if it exceeds the boundary, it is used as a fraudulent transaction warning, and the model is updated in combination with the manual review results to continuously optimize the detection capability.

[0060] In summary, the method of the present invention can divide financial transaction behaviors into normal transactions and potential fraud transactions. For potential fraud transactions, the method can effectively identify new types of fraud that are currently unlabeled, making up for the shortcomings of traditional methods when facing unknown fraud types. This method can not only accurately identify fraudulent behaviors in financial transactions, but also effectively respond to changes in fraud methods in dynamic environments. It has strong adaptability and robustness, and can provide financial institutions with more accurate and reliable fraud detection solutions, thereby improving the fraud prevention capabilities of financial institutions. At the same time, the method of the present invention supports dynamic updating of the model, can adapt to new types of fraud, reduce dependence on large-scale labeled data, and improve the timeliness and accuracy of detection.

[0061] The above specific implementation methods are detailed descriptions of the present invention. It cannot be determined that the specific implementation methods of the present invention are limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions and substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. A method for detecting persistent financial fraud based on dynamic feature space transformation, characterized in that: The following steps are involved: Obtaining features of transaction samples, including transaction notes, chat records, social media information, and historical transaction records; Dynamically adjust the target dimension of random projection according to the data volume of transaction samples, and then perform dynamic feature space transformation; Calculate the centroid of all normal transaction samples; Obtain the distance distribution from each normal transaction sample to the centroid, and then learn the boundary range of the normal transaction samples; calculate the average distribution range of the normal transaction samples, and construct the initial spherical decision boundary based on the average distribution range; update the centroid of the normal transaction samples according to the newly added transaction samples, and dynamically adjust the radius of the spherical decision boundary; By judging whether the distance between the centroid of the transaction sample to be detected and the normal transaction sample is within the radius of the spherical decision boundary, financial fraud detection is performed and the detection result is output.

2. The method for detecting persistent financial fraud based on dynamic feature space transformation according to claim 1, characterized in that: The characteristics of obtaining transaction samples include: The features of the image transaction samples are extracted using an image detection model, and / or the features of the text transaction samples are extracted using a text detection model, and / or the features of the voice transaction samples are extracted using a voice detection model.

3. The method for detecting persistent financial fraud based on dynamic feature space transformation according to claim 1, characterized in that: Before the step of dynamically adjusting the target dimension of random projection according to the data volume of the transaction sample, the method further includes: The global distance matrix of all transaction samples is calculated, and the distance relationship between samples is optimized using the distance-aware contrast loss function.

4. The method for detecting persistent financial fraud based on dynamic feature space transformation according to claim 3 is characterized in that: The expression of the distance-aware contrast loss function is: ； ； in, represents the total distance-aware contrast loss of positive sample pairs; Represents a set of positive sample pairs, where positive samples are normal transaction samples; Represents a positive sample pair The distance between the perceived losses; Represents a positive sample pair The distance between represents a set of negative sample pairs, where negative samples are potential fraudulent transaction samples; represents a hyperparameter; Represents a positive sample With negative samples The distance between Represents a positive sample With negative samples The distance between.

5. The method for detecting persistent financial fraud based on dynamic feature space transformation according to claim 1, characterized in that: The method of dynamically adjusting the target dimension of random projection according to the data volume of the transaction sample and then performing dynamic feature space transformation includes: Orthogonal random projection is used to construct a random projection matrix. The target dimension in the random projection matrix is ​​dynamically adjusted according to the data volume of the transaction sample. If the data volume is greater than the threshold, the target dimension is increased in dimension; if the data volume is less than the threshold, the target dimension is decreased in dimension; if the data volume is equal to the threshold, the target dimension remains unchanged. The features of transaction samples are mapped to a new feature space according to the random projection matrix to achieve dynamic feature space transformation.

6. The method for detecting persistent financial fraud based on dynamic feature space transformation according to claim 1, characterized in that: When constructing the initial spherical decision boundary, the risk of misjudging normal transaction samples as fraudulent transaction samples and misjudging fraudulent transaction samples as normal transaction samples is balanced by the spherical decision boundary loss function. The expression is: ； in, represents the total number of samples; An indicator indicating whether the sample exceeds the spherical decision boundary; Represent the feature representation of each transaction sample; For the The centroid of the samples; Indicates The radius of the spherical decision boundary.

7. The method for detecting persistent financial fraud based on dynamic feature space transformation according to claim 6, characterized in that: The update expression of the radius of the spherical decision boundary is: ； in, Indicates The updated radius of the spherical decision boundary; Indicates The radius of the spherical decision boundary before updating; represents the gradient of the decision boundary loss function with respect to the radius; represents partial derivative.

8. The method for detecting persistent financial fraud based on dynamic feature space transformation according to claim 1, characterized in that: The method of detecting financial fraud by judging whether the distance between the centroid of the transaction sample to be detected and the normal transaction sample is within the radius of the spherical decision boundary includes: If the distance between the centroid of the transaction sample to be detected and the normal transaction sample is less than or equal to the radius of the spherical decision boundary, the detection result of the normal transaction is output; If the distance between the centroid of the transaction sample to be detected and the normal transaction sample is greater than the radius of the spherical decision boundary, the detection result of the abnormal transaction is output and an alarm is triggered, and / or manual review and analysis are performed and the final detection result is output; The samples that are judged as normal transactions by the detection results are updated to the training data set, and the spherical decision boundary is optimized using the updated training data set.

Images