Payment fraud detection method based on behavior pattern analysis and multi-modal identity verification and related equipment

Abstract

The embodiment of the invention relates to the technical field of transaction security, and discloses a payment fraud detection method based on behavior pattern analysis and multi-modal identity verification, and the method comprises the steps: collecting the current original behavior data of a user in real time according to a transaction request when the transaction request of the user is received; respectively encrypting the current original behavior data of the user and the transaction request in real time to obtain the encrypted current behavior data and the encrypted transaction request, and simultaneously destroying the current original behavior data of the user and the transaction request; analyzing a behavior risk degree by adopting a behavior analysis model; according to the behavior risk degree, collecting current original biological data of the user, encrypting the current original biological data of the user, destroying the current original biological data, and verifying the encrypted current biological data by adopting a target verification strategy to obtain a verification result; and determining whether payment fraud exists or not according to the verification result. According to the embodiment of the invention, the effects of payment security and privacy protection are achieved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of currency exchange scheduling, and specifically to a payment fraud detection method, device, computer equipment and readable storage medium based on behavior pattern analysis and multimodal identity authentication. Background Art

[0002] At present, mobile payment is becoming more and more popular. Since there is no need to use physical media for payment verification, it brings great convenience to users. This also brings great challenges to the security verification in the mobile payment process. However, there are still security loopholes in the existing mobile payment, and there is no very effective management method for the user's privacy data during the verification process, which makes it easy to leak security and privacy, further reducing the security of mobile payment. Summary of the invention

[0003] In view of the above problems, an embodiment of the present invention provides a payment fraud detection method, apparatus, computer device and readable storage medium based on behavioral pattern analysis and multimodal identity authentication, which is used to solve the problems of low security of security verification and user privacy leakage in the payment process existing in the prior art.

[0004] According to one aspect of an embodiment of the present invention, a payment fraud detection method based on behavior pattern analysis and multimodal identity authentication is provided, the method comprising: When receiving a transaction request from a user, the user's current original behavior data is collected in real time according to the transaction request; the transaction request includes a user identifier, current transaction information, and current physical information; the user's current original behavior data includes at least a touch screen sliding track, a device holding posture, and input rhythm information; After respectively encrypting the user's current original behavior data and the transaction request in real time using a preset first encryption algorithm, the encrypted current behavior data and the encrypted transaction request are obtained, and the user's current original behavior data and the transaction request are destroyed at the same time; The encrypted current behavior data and the transaction request are analyzed using a behavior analysis model to obtain a behavior risk; the behavior analysis model is obtained by training a spatiotemporal graph convolutional network on the third-party storage end according to the user's historical behavior information and historical transaction information; the user's historical behavior information is obtained by encrypting the user's original historical behavior information using a preset first encryption algorithm; According to the behavior risk, the user's current original biometric data is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result; the target verification strategy is one of the multimodal identity authentication strategies; Based on the verification result, determine whether payment fraud exists.

[0005] In an optional manner, the first encryption algorithm includes a location offset algorithm and a differential privacy calculation; the current physical information includes current device information and current geographic location information; the current original behavior data of the user and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain encrypted current behavior data and encrypted transaction request, and the current original behavior data of the user and the transaction request are destroyed at the same time, including: After calculating the position offset of the current geographical location information according to the position offset algorithm, the current geographical location information after offset is obtained; Perform differential privacy calculation on the user's current original behavior data to obtain encrypted current behavior data.

[0006] In an optional manner, when the waiting time exceeds a preset time threshold, before predicting and obtaining at least one recommended exchange plan based on the first exchange request, current exchange rate fluctuation information and historical exchange data input into an exchange plan model, the method further includes: Obtaining historical exchange data; the historical exchange data includes the amount of historical exchange requests, exchange rate, historical exchange request time, number of requests at the historical exchange request time, historical exchange waiting time corresponding to the historical exchange request, and information on whether the exchange was successful; Inputting the historical exchange data into a preset time series prediction model for training to obtain an exchange duration prediction model; Obtaining historical exchange rate data; the historical exchange rate data includes historical exchange rate fluctuation information, historical macroeconomic data and historical exchange data; The historical exchange rate data is input into a deep learning model for training to obtain a trained optimal exchange timing prediction model.

[0007] In an optional manner, the spatiotemporal convolutional network is an STGCN model; the STGCN model includes a spatiotemporal convolutional block and a fully connected layer in which two temporal convolutional layers sandwich a spatial graph convolutional layer; the encrypted touch screen sliding trajectory, the encrypted device holding posture and the encrypted input rhythm information, the historical transaction request and the corresponding behavior risk label are input into the spatiotemporal convolutional network for training to obtain a trained behavior analysis model, including: The encrypted touch screen sliding trajectory, encrypted device holding posture and encrypted input rhythm information at each time point are respectively mapped into node features, and the spatial relationship between the user historical behavior information is represented by an adjacency matrix; The offset historical geographic location information in the historical transaction request is used as the node feature, and the spatial relationship between transactions is represented by the adjacency matrix; Features are extracted through the temporal convolution layer and the spatial graph convolution layer, and the risk prediction value is output through the fully connected layer; According to the risk prediction value and the behavior risk label, the loss function is calculated, and the parameters of the STGCN model are adjusted according to the loss function, and iterative training is continued to obtain the trained behavior analysis model.

[0008] In an optional manner, the multimodal identity authentication strategy includes a first verification strategy, a second verification strategy and a third verification strategy; the encrypted current original biometric data of the user includes at least current encrypted fingerprint data, current liveness detection encrypted information and current voiceprint encrypted data; the preset threshold includes a preset first threshold and a preset second threshold; according to the behavior risk, the current original biometric data of the user is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result, including: Acquire standard user encrypted biometric data encrypted by a preset second encryption algorithm from the third-party storage terminal; the standard user encrypted biometric data at least includes standard encrypted fingerprint data, standard voiceprint encrypted data and standard liveness detection encrypted information; When the behavior risk is lower than the first threshold, verification is performed according to a first verification strategy; the first verification strategy is to compare the current encrypted fingerprint data with the standard encrypted fingerprint data to obtain a verification result; When the behavior risk is higher than a preset first threshold and lower than a preset second threshold, verification is performed according to a second verification strategy; the second verification strategy is to perform verification according to any two of the current encrypted fingerprint data, the current liveness detection encrypted information or the current voiceprint encrypted data to obtain a verification result; When the behavior risk is higher than the second threshold, verification is performed according to a third verification strategy to obtain a verification result; the third verification strategy is to verify the current encrypted fingerprint data, the current liveness detection encrypted information and the current voiceprint encrypted data respectively to obtain a verification result.

[0009] In an optional manner, after determining whether payment fraud exists according to the verification result, the method includes: When payment fraud is determined, the transaction payment is stopped and the user is prompted with the result of transaction failure.

[0010] According to another aspect of an embodiment of the present invention, there is provided a payment fraud detection device based on behavior pattern analysis and multimodal identity authentication, comprising: A collection module, for collecting the user's current original behavior data in real time according to the transaction request when receiving the transaction request from the user; the transaction request includes the user identification, current transaction information and current physical information; the user's current original behavior data includes at least the touch screen sliding track, device holding posture and input rhythm information; An encryption and destruction module, used to encrypt the current original behavior data of the user and the transaction request in real time using a preset first encryption algorithm to obtain the encrypted current behavior data and the encrypted transaction request, and to destroy the current original behavior data of the user and the transaction request at the same time; A risk calculation module is used to analyze the encrypted current behavior data and the transaction request using a behavior analysis model to obtain a behavior risk; the behavior analysis model is obtained by training a spatiotemporal graph convolutional network based on the user's historical behavior information and historical transaction information by a third-party storage end; the user's historical behavior information is obtained by encrypting the user's original historical behavior information using a preset first encryption algorithm; A multimodal verification module, for collecting the user's current original biometric data according to the behavior risk, encrypting the user's current original biometric data using a preset second encryption algorithm, destroying the current original biometric data, and verifying the encrypted current biometric data using a target verification strategy to obtain a verification result; the target verification strategy is one of the multimodal identity authentication strategies; The determination module is used to determine whether payment fraud exists according to the verification result.

[0011] According to another aspect of an embodiment of the present invention, there is provided a computer device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the operation of the payment fraud detection method based on behavioral pattern analysis and multimodal identity authentication.

[0012] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, wherein the storage medium stores at least one executable instruction, and when the executable instruction is executed on a computer device, the computer device executes the operations of the payment fraud detection method based on behavioral pattern analysis and multimodal identity authentication.

[0013] In an embodiment of the present invention, when a transaction request from a user is received, the current original behavior data of the user is collected in real time according to the transaction request, and the current original behavior data of the user and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain the encrypted current behavior data and the encrypted transaction request, and the current original behavior data of the user and the transaction request are destroyed at the same time; the encrypted current behavior data and the transaction request are analyzed using a behavior analysis model to obtain a behavior risk; according to the behavior risk, the current original biometric data of the user is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result; according to the verification result, it is determined whether there is payment fraud. Among them, by encrypting various types of user data at various links, destroying the original sensitive data, and encrypting the sensitive data and storing it in a third-party storage terminal, it is possible to effectively perform security verification through multi-modality during the transaction payment process, while not causing user privacy leakage due to excessive collection of user sensitive data.

[0014] The above description is only an overview of the technical solution of the embodiment of the present invention. In order to more clearly understand the technical means of the embodiment of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiment of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings are only used to illustrate the embodiments and are not to be considered as limiting the present invention. In addition, the same reference symbols are used to represent the same components throughout the accompanying drawings. In the accompanying drawings: Figure 1 A schematic diagram of a process of a payment fraud detection method based on behavior pattern analysis and multimodal identity authentication provided by an embodiment of the present invention is shown; Figure 2 A schematic diagram of the structure of a payment fraud detection device based on behavior pattern analysis and multimodal identity authentication provided by an embodiment of the present invention is shown; Figure 3 A schematic diagram of the structure of a computer device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0016] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0017] Figure 1The flowchart of the payment fraud detection method based on behavior pattern analysis and multi-modal identity authentication provided by an embodiment of the present invention is shown, and the method is executed by a computer device. The computer device may be a distributed device. Figure 1 As shown, the method comprises the following steps: Step 110: When receiving a transaction request from a user, the user's current original behavior data is collected in real time according to the transaction request.

[0018] In the embodiment of the present invention, when a user needs to make a payment, a transaction request is generated in real time according to the user identification, transaction amount, transaction merchant and transaction time.

[0019] The transaction request includes user identification, current transaction information and current physical information. The current transaction information includes transaction amount, transaction time and transaction merchant. The user's current original behavior data at least includes touch screen sliding trajectory, device holding posture and input rhythm information. Due to different devices, users' operating habits may be different, resulting in different operating behaviors, so the current physical information may specifically include current device information and current geographic location information.

[0020] Step 120: The user's current original behavior data and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain encrypted current behavior data and encrypted transaction request, and the user's current original behavior data and the transaction request are destroyed at the same time.

[0021] Among them, the first encryption algorithm includes a location offset algorithm and differential privacy calculation; the current physical information includes current device information and current geographic location information.

[0022] In the embodiment of the present invention, the current original behavior data of the user and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain the encrypted current behavior data and the encrypted transaction request, and the current original behavior data of the user and the transaction request are destroyed at the same time, specifically including: Step 1201: After calculating the position offset of the current geographical location information according to the position offset algorithm, the offset current geographical location information is obtained. The position offset algorithm uses spherical trigonometry formulas to calculate new latitude and longitude. Specifically, the longitude and latitude information in the current geographical location information is obtained.

[0023] Where R is the radius of the Earth, is the azimuth, θ_rad = θ × π / 180, the value after the current latitude lat radians conversion is: lat rad = lat ×π / 180. The new latitude is calculated by : , where lat is the current latitude, is the latitude increment, d is the offset distance; The value after converting the angle to radians.

[0024] Among them, the new longitude Calculated as: ,in, lon is the longitude increment. .

[0025] The embodiment of the present invention makes the latitude and longitude offset more accurate in this way. The third-party storage terminal also stores historical geographic location information, which is encrypted in the same way as above. Thus, the encryption methods of the two are the same, so that even if encrypted, it does not affect the comparison analysis.

[0026] Step 1202: Perform differential privacy calculation on the current original behavior data of the user to obtain encrypted current behavior data. In this embodiment of the present invention, a differential privacy algorithm is used to encrypt the touch screen sliding trajectory, device holding posture and input rhythm information in the current original behavior data of the user to obtain the encrypted current touch screen sliding trajectory, the encrypted current device holding posture and the encrypted current input rhythm information. Specifically, differential privacy calculation can be encrypted using the Laplace mechanism.

[0027] Step 130: Analyze the encrypted current behavior data and the transaction request using a behavior analysis model to obtain a behavior risk level.

[0028] The behavior analysis model is obtained by training the spatiotemporal graph convolutional network based on the user's historical behavior information and historical transaction information by the third-party storage end. The user's historical behavior information is obtained by encrypting the user's original historical behavior information using a preset first encryption algorithm.

[0029] In an embodiment of the present invention, the behavior analysis model is trained based on a spatiotemporal convolutional network, and the spatiotemporal convolutional network can be an STGCN model. The STGCN model includes a spatiotemporal convolutional block and a fully connected layer, in which two temporal convolutional layers sandwich a spatial graph convolutional layer. Among them, the behavior analysis model is used to analyze the encrypted current behavior data and the transaction request. Before obtaining the behavior risk, the behavior analysis model needs to be trained first, specifically, including the following steps: Step 001: The third-party storage end uses a differential privacy algorithm to encrypt the historical touch screen sliding trajectory, historical device holding posture and historical input rhythm information in the historical transaction request to obtain the encrypted touch screen sliding trajectory, encrypted device holding posture and encrypted input rhythm information.

[0030] Among them, the differential privacy algorithm adopted by the third-party storage end is the same as the aforementioned process of encrypting the user's current original behavior data, which will not be repeated here.

[0031] Step 002: The third-party storage terminal calculates the position offset of the historical geographical location information according to the position offset algorithm to obtain the historical geographical location information after offset.

[0032] The process in which the third-party storage end calculates the geographic location information in the transaction request according to the location offset algorithm is the same and will not be repeated here.

[0033] Step 003: The third-party storage terminal inputs the encrypted touch screen sliding trajectory, the encrypted device holding posture and the encrypted input rhythm information, the historical transaction requests and the corresponding behavior risk labels into the spatiotemporal convolutional network for training to obtain a trained behavior analysis model.

[0034] Among them, the encrypted touch screen sliding trajectory, encrypted device holding posture and encrypted input rhythm information at each time point are mapped to node features respectively, and the spatial relationship between the user's historical behavior information is represented by an adjacency matrix. Specifically, data preprocessing and graph structure construction are first performed: the historical behavior information and historical transaction information are converted into a format suitable for the STGCN model. For example, for the touch screen sliding trajectory, the sliding coordinate points (x, y) are recorded in chronological order to form time series data. For the device holding posture, the acceleration, gyroscope and other sensor data are recorded and arranged in chronological order. For the information input rhythm, the timestamp of the key or sliding event is recorded to form a time series. For historical transaction information, the transaction amount, transaction time, transaction location (latitude and longitude), etc. are recorded and arranged in chronological order. After the preprocessing is completed, the graph structure is constructed. Among them, the behavior or transaction event at each time point is taken as a node, and the edge is constructed according to the spatiotemporal relationship. For example, for time adjacency, an edge is established between behaviors or transactions at adjacent time points. For spatial adjacency, an edge is established between transactions or behaviors with similar geographical locations. Among them, the adjacency matrix represents the connection relationship between nodes and is used for spatial graph convolution. For spatial graph convolution, the role of the spatial graph convolution layer is to extract spatial features from the graph structure and capture the spatial relationship between nodes. The STGCN model extracts spatiotemporal features by alternating between spatial graph convolution and temporal convolution. Therefore, the offset historical geographic location information in the historical transaction request is used as the node feature, and the spatial relationship between transactions is represented by the adjacency matrix. Features are extracted respectively through the temporal convolution layer and the spatial graph convolution layer, and the risk prediction value is output through the fully connected layer. According to the risk prediction value and the behavior risk label, the loss function is calculated, and the parameters of the STGCN model are adjusted according to the loss function, and iterative training is continued to obtain the trained behavior analysis model. Among them, since it is necessary to train the encrypted data, in order to improve the training efficiency, the embodiment of the present invention trains the STGCN model based on the CrypTen framework.

[0035] After the training on the third-party storage end is completed, the behavior analysis model is deployed to the payment fraud detection system based on behavior pattern analysis and multimodal identity authentication of an embodiment of the present invention, so that historical behavior data and historical biological data, etc., are not leaked.

[0036] Step 140: According to the behavior risk, the user's current original biometric data is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed. The encrypted current biometric data is verified using a target verification strategy to obtain a verification result.

[0037] Wherein, the target verification strategy is one of the multimodal identity authentication strategies. The multimodal identity authentication strategy includes a first verification strategy, a second verification strategy, and a third verification strategy. In an embodiment of the present invention, the encrypted current original biometric data of the user includes at least current encrypted fingerprint data, current liveness detection encryption information, and current voiceprint encryption data; the preset threshold includes a preset first threshold and a preset second threshold. Wherein, the second threshold is greater than the first threshold.

[0038] In the embodiment of the present invention, according to the behavior risk, the user's current original biometric data is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed. The encrypted current biometric data is verified using a target verification strategy to obtain a verification result, which specifically includes: Acquire standard user encrypted biometric data encrypted by a preset second encryption algorithm from the third-party storage terminal; the standard user encrypted biometric data at least includes standard encrypted fingerprint data, standard voiceprint encrypted data and standard liveness detection encrypted information; When the behavior risk is lower than the first threshold, verification is performed according to the first verification strategy; the first verification strategy is to compare the current encrypted fingerprint data with the standard encrypted fingerprint data to obtain a verification result. When the current encrypted fingerprint data is consistent with the standard encrypted fingerprint data, the verification result is verification passed.

[0039] When the behavior risk is higher than the preset first threshold and lower than the preset second threshold, verification is performed according to the second verification strategy. The second verification strategy is to perform verification according to any two of the current encrypted fingerprint data, the current liveness detection encrypted information, or the current voiceprint encrypted data to obtain a verification result. When verification is performed according to any two of the current encrypted fingerprint data, the current liveness detection encrypted information, or the current voiceprint encrypted data, and both fail, the verification result is verification failure. When both verifications pass, the verification result is verification passing.

[0040] When the behavior risk is higher than the second threshold, verification is performed according to a third verification strategy to obtain a verification result; the third verification strategy is to verify the current encrypted fingerprint data, the current liveness detection encrypted information and the current voiceprint encrypted data respectively to obtain a verification result.

[0041] Step 150: Determine whether payment fraud exists based on the verification result.

[0042] In the embodiment of the present invention, when it is determined that payment fraud exists, the transaction payment is stopped and the result of transaction failure is prompted to the user. In the embodiment of the present invention, after the transaction is completed, user feedback is received, and the accuracy of the verification result is determined based on the user feedback. The encrypted current behavior data and the encrypted transaction request are stored in a third-party storage end for further training of the behavior analysis model. The encrypted current behavior data and the encrypted transaction request temporarily stored in the payment fraud detection system based on behavior pattern analysis and multimodal identity authentication are deleted.

[0043] In an embodiment of the present invention, when a transaction request from a user is received, the current original behavior data of the user is collected in real time according to the transaction request, and the current original behavior data of the user and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain the encrypted current behavior data and the encrypted transaction request, and the current original behavior data of the user and the transaction request are destroyed at the same time; the encrypted current behavior data and the transaction request are analyzed using a behavior analysis model to obtain a behavior risk; according to the behavior risk, the current original biometric data of the user is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result; according to the verification result, it is determined whether there is payment fraud. Among them, by encrypting various types of user data at various links, destroying the original sensitive data, and encrypting the sensitive data and storing it in a third-party storage terminal, it is possible to effectively perform security verification through multi-modality during the transaction payment process, while not causing user privacy leakage due to excessive collection of user sensitive data.

[0044] Figure 2 The schematic diagram of the structure of the payment fraud detection device based on behavior pattern analysis and multi-modal identity authentication provided by the embodiment of the present invention is shown. Figure 2 As shown, the device 200 includes: The collection module 210 is used to collect the user's current original behavior data in real time according to the transaction request when receiving the user's transaction request; the transaction request includes the user identification, current transaction information and current physical information; the user's current original behavior data at least includes the touch screen sliding trajectory, device holding posture and input rhythm information.

[0045] The encryption and destruction module 220 is used to encrypt the user's current original behavior data and the transaction request in real time using a preset first encryption algorithm to obtain the encrypted current behavior data and the encrypted transaction request, and destroy the user's current original behavior data and the transaction request at the same time.

[0046] The risk calculation module 230 is used to analyze the encrypted current behavior data and the transaction request using a behavior analysis model to obtain a behavior risk; the behavior analysis model is obtained by training a spatiotemporal graph convolutional network at a third-party storage end based on the user's historical behavior information and historical transaction information; the user's historical behavior information is obtained by encrypting the user's original historical behavior information using a preset first encryption algorithm.

[0047] The multimodal verification module 240 is used to collect the user's current original biometric data according to the behavior risk, encrypt the user's current original biometric data using a preset second encryption algorithm, destroy the current original biometric data, and verify the encrypted current biometric data using a target verification strategy to obtain a verification result; the target verification strategy is one of the multimodal identity authentication strategies.

[0048] The determination module 250 is used to determine whether payment fraud exists according to the verification result.

[0049] In an optional manner, the first encryption algorithm includes a location offset algorithm and a differential privacy calculation; the current physical information includes current device information and current geographic location information; the current original behavior data of the user and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain encrypted current behavior data and encrypted transaction request, and the current original behavior data of the user and the transaction request are destroyed at the same time, including: After calculating the position offset of the current geographical location information according to the position offset algorithm, the current geographical location information after offset is obtained; Perform differential privacy calculation on the user's current original behavior data to obtain encrypted current behavior data.

[0050] In an optional manner, when the waiting time exceeds a preset time threshold, before predicting and obtaining at least one recommended exchange plan based on the first exchange request, current exchange rate fluctuation information and historical exchange data input into an exchange plan model, the method further includes: Obtaining historical exchange data; the historical exchange data includes the amount of historical exchange requests, exchange rate, historical exchange request time, number of requests at the historical exchange request time, historical exchange waiting time corresponding to the historical exchange request, and information on whether the exchange was successful; Inputting the historical exchange data into a preset time series prediction model for training to obtain an exchange duration prediction model; Obtaining historical exchange rate data; the historical exchange rate data includes historical exchange rate fluctuation information, historical macroeconomic data and historical exchange data; The historical exchange rate data is input into a deep learning model for training to obtain a trained optimal exchange timing prediction model.

[0051] In an optional manner, the spatiotemporal convolutional network is an STGCN model; the STGCN model includes a spatiotemporal convolutional block and a fully connected layer in which two temporal convolutional layers sandwich a spatial graph convolutional layer; the encrypted touch screen sliding trajectory, the encrypted device holding posture and the encrypted input rhythm information, the historical transaction request and the corresponding behavior risk label are input into the spatiotemporal convolutional network for training to obtain a trained behavior analysis model, including: The encrypted touch screen sliding trajectory, encrypted device holding posture and encrypted input rhythm information at each time point are respectively mapped into node features, and the spatial relationship between the user historical behavior information is represented by an adjacency matrix; The offset historical geographic location information in the historical transaction request is used as the node feature, and the spatial relationship between transactions is represented by the adjacency matrix; Features are extracted through the temporal convolution layer and the spatial graph convolution layer, and the risk prediction value is output through the fully connected layer; According to the risk prediction value and the behavior risk label, the loss function is calculated, and the parameters of the STGCN model are adjusted according to the loss function, and iterative training is continued to obtain the trained behavior analysis model.

[0052] In an optional manner, the multimodal identity authentication strategy includes a first verification strategy, a second verification strategy and a third verification strategy; the encrypted current original biometric data of the user includes at least current encrypted fingerprint data, current liveness detection encrypted information and current voiceprint encrypted data; the preset threshold includes a preset first threshold and a preset second threshold; according to the behavior risk, the current original biometric data of the user is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result, including: Acquire standard user encrypted biometric data encrypted by a preset second encryption algorithm from the third-party storage terminal; the standard user encrypted biometric data at least includes standard encrypted fingerprint data, standard voiceprint encrypted data and standard liveness detection encrypted information; When the behavior risk is lower than the first threshold, verification is performed according to a first verification strategy; the first verification strategy is to compare the current encrypted fingerprint data with the standard encrypted fingerprint data to obtain a verification result; When the behavior risk is higher than a preset first threshold and lower than a preset second threshold, verification is performed according to a second verification strategy; the second verification strategy is to perform verification according to any two of the current encrypted fingerprint data, the current liveness detection encrypted information or the current voiceprint encrypted data to obtain a verification result; When the behavior risk is higher than the second threshold, verification is performed according to a third verification strategy to obtain a verification result; the third verification strategy is to verify the current encrypted fingerprint data, the current liveness detection encrypted information and the current voiceprint encrypted data respectively to obtain a verification result.

[0053] In an optional manner, after determining whether payment fraud exists according to the verification result, the method includes: When payment fraud is determined, the transaction payment is stopped and the user is prompted with the result of transaction failure.

[0054] In an embodiment of the present invention, when a transaction request from a user is received, the current original behavior data of the user is collected in real time according to the transaction request, and the current original behavior data of the user and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain the encrypted current behavior data and the encrypted transaction request, and the current original behavior data of the user and the transaction request are destroyed at the same time; the encrypted current behavior data and the transaction request are analyzed using a behavior analysis model to obtain a behavior risk; according to the behavior risk, the current original biometric data of the user is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result; according to the verification result, it is determined whether there is payment fraud. Among them, by encrypting various types of user data at various links, destroying the original sensitive data, and encrypting the sensitive data and storing it in a third-party storage terminal, it is possible to effectively perform security verification through multi-modality during the transaction payment process, while not causing user privacy leakage due to excessive collection of user sensitive data.

[0055] Figure 3 The schematic diagram of the structure of the computer device provided by the embodiment of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the computer device.

[0056] like Figure 3 As shown, the computer device may include: a processor (processor) 302 , a communication interface (Communications Interface) 304 , a memory (memory) 306 , and a communication bus 308 .

[0057] The processor 302, the communication interface 304, and the memory 306 communicate with each other via the communication bus 308. The communication interface 304 is used to communicate with other devices such as a client or other server network elements. The processor 302 is used to execute the program 310, which can specifically execute the relevant steps in the above-mentioned embodiment of the method for detecting payment fraud based on behavior pattern analysis and multi-modal identity authentication.

[0058] Specifically, the program 310 may include program code including computer executable instructions.

[0059] The processor 302 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiment of the present invention. The one or more processors included in the computer device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0060] The memory 306 is used to store the program 310. The memory 306 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0061] The program 310 can be specifically called by the processor 302 to enable the computer device to perform the following operations: When receiving a transaction request from a user, the user's current original behavior data is collected in real time according to the transaction request; the transaction request includes a user identifier, current transaction information, and current physical information; the user's current original behavior data includes at least a touch screen sliding track, a device holding posture, and input rhythm information; After respectively encrypting the user's current original behavior data and the transaction request in real time using a preset first encryption algorithm, the encrypted current behavior data and the encrypted transaction request are obtained, and the user's current original behavior data and the transaction request are destroyed at the same time; The encrypted current behavior data and the transaction request are analyzed using a behavior analysis model to obtain a behavior risk; the behavior analysis model is obtained by training a spatiotemporal graph convolutional network on the third-party storage end according to the user's historical behavior information and historical transaction information; the user's historical behavior information is obtained by encrypting the user's original historical behavior information using a preset first encryption algorithm; According to the behavior risk, the user's current original biometric data is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result; the target verification strategy is one of the multimodal identity authentication strategies; Based on the verification result, determine whether payment fraud exists.

[0062] In an optional manner, the first encryption algorithm includes a location offset algorithm and a differential privacy calculation; the current physical information includes current device information and current geographic location information; the current original behavior data of the user and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain encrypted current behavior data and encrypted transaction request, and the current original behavior data of the user and the transaction request are destroyed at the same time, including: After calculating the position offset of the current geographical location information according to the position offset algorithm, the current geographical location information after offset is obtained; Perform differential privacy calculation on the user's current original behavior data to obtain encrypted current behavior data.

[0063] In an optional manner, when the waiting time exceeds a preset time threshold, before predicting and obtaining at least one recommended exchange plan based on the first exchange request, current exchange rate fluctuation information and historical exchange data input into an exchange plan model, the method further includes: Obtaining historical exchange data; the historical exchange data includes the amount of historical exchange requests, exchange rate, historical exchange request time, number of requests at the historical exchange request time, historical exchange waiting time corresponding to the historical exchange request, and information on whether the exchange was successful; Inputting the historical exchange data into a preset time series prediction model for training to obtain an exchange duration prediction model; Obtaining historical exchange rate data; the historical exchange rate data includes historical exchange rate fluctuation information, historical macroeconomic data and historical exchange data; The historical exchange rate data is input into a deep learning model for training to obtain a trained optimal exchange timing prediction model.

[0064] In an optional manner, the spatiotemporal convolutional network is an STGCN model; the STGCN model includes a spatiotemporal convolutional block and a fully connected layer in which two temporal convolutional layers sandwich a spatial graph convolutional layer; the encrypted touch screen sliding trajectory, the encrypted device holding posture and the encrypted input rhythm information, the historical transaction request and the corresponding behavior risk label are input into the spatiotemporal convolutional network for training to obtain a trained behavior analysis model, including: The encrypted touch screen sliding trajectory, encrypted device holding posture and encrypted input rhythm information at each time point are respectively mapped into node features, and the spatial relationship between the user historical behavior information is represented by an adjacency matrix; The offset historical geographic location information in the historical transaction request is used as the node feature, and the spatial relationship between transactions is represented by the adjacency matrix; Features are extracted through the temporal convolution layer and the spatial graph convolution layer, and the risk prediction value is output through the fully connected layer; According to the risk prediction value and the behavior risk label, the loss function is calculated, and the parameters of the STGCN model are adjusted according to the loss function, and iterative training is continued to obtain the trained behavior analysis model.

[0065] In an optional manner, the encrypted current original biometric data of the user includes at least current encrypted fingerprint data, current liveness detection encrypted information and current voiceprint encrypted data; the preset threshold includes a preset first threshold and a preset second threshold; according to the behavior risk, the current original biometric data of the user is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result, including: Acquire standard user encrypted biometric data encrypted by a preset second encryption algorithm from the third-party storage terminal; the standard user encrypted biometric data at least includes standard encrypted fingerprint data, standard voiceprint encrypted data and standard liveness detection encrypted information; When the behavior risk is lower than a first threshold, comparing the current encrypted fingerprint data with the standard encrypted fingerprint data to obtain a verification result; When the behavior risk is higher than a preset first threshold and lower than a preset second threshold, verification is performed according to any two of the current encrypted fingerprint data, the current liveness detection encrypted information, or the current voiceprint encrypted data to obtain a verification result; When the behavior risk is higher than a second threshold, the current encrypted fingerprint data, the current liveness detection encrypted information and the current voiceprint encrypted data are verified respectively to obtain a verification result.

[0066] In an optional manner, after determining whether payment fraud exists according to the verification result, the method includes: When it is determined that there is payment fraud, the transaction payment is stopped and the user is prompted with the result of transaction failure. When a transaction request from a user is received, the user's current original behavior data is collected in real time according to the transaction request; the transaction request includes the user identification, current transaction information and current physical information; the user's current original behavior data includes at least the touch screen sliding track, the device holding posture and the input rhythm information; After respectively encrypting the user's current original behavior data and the transaction request in real time using a preset first encryption algorithm, the encrypted current behavior data and the encrypted transaction request are obtained, and the user's current original behavior data and the transaction request are destroyed at the same time; The encrypted current behavior data and the transaction request are analyzed using a behavior analysis model to obtain a behavior risk; the behavior analysis model is obtained by training a spatiotemporal graph convolutional network on the third-party storage end according to the user's historical behavior information and historical transaction information; the user's historical behavior information is obtained by encrypting the user's original historical behavior information using a preset first encryption algorithm; According to the behavior risk, the user's current original biometric data is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result; the target verification strategy is one of the multimodal identity authentication strategies; Based on the verification result, determine whether payment fraud exists.

[0067] In an optional manner, the first encryption algorithm includes a location offset algorithm and a differential privacy calculation; the current physical information includes current device information and current geographic location information; the current original behavior data of the user and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain encrypted current behavior data and encrypted transaction request, and the current original behavior data of the user and the transaction request are destroyed at the same time, including: After calculating the position offset of the current geographical location information according to the position offset algorithm, the current geographical location information after offset is obtained; Perform differential privacy calculation on the user's current original behavior data to obtain encrypted current behavior data.

[0068] In an optional manner, when the waiting time exceeds a preset time threshold, before predicting and obtaining at least one recommended exchange plan based on the first exchange request, current exchange rate fluctuation information and historical exchange data input into an exchange plan model, the method further includes: Obtaining historical exchange data; the historical exchange data includes the amount of historical exchange requests, exchange rate, historical exchange request time, number of requests at the historical exchange request time, historical exchange waiting time corresponding to the historical exchange request, and information on whether the exchange was successful; Inputting the historical exchange data into a preset time series prediction model for training to obtain an exchange duration prediction model; Obtaining historical exchange rate data; the historical exchange rate data includes historical exchange rate fluctuation information, historical macroeconomic data and historical exchange data; The historical exchange rate data is input into a deep learning model for training to obtain a trained optimal exchange timing prediction model.

[0069] In an optional manner, the spatiotemporal convolutional network is an STGCN model; the STGCN model includes a spatiotemporal convolutional block and a fully connected layer in which two temporal convolutional layers sandwich a spatial graph convolutional layer; the encrypted touch screen sliding trajectory, the encrypted device holding posture and the encrypted input rhythm information, the historical transaction request and the corresponding behavior risk label are input into the spatiotemporal convolutional network for training to obtain a trained behavior analysis model, including: The encrypted touch screen sliding trajectory, encrypted device holding posture and encrypted input rhythm information at each time point are respectively mapped into node features, and the spatial relationship between the user historical behavior information is represented by an adjacency matrix; The offset historical geographic location information in the historical transaction request is used as the node feature, and the spatial relationship between transactions is represented by the adjacency matrix; Features are extracted through the temporal convolution layer and the spatial graph convolution layer, and the risk prediction value is output through the fully connected layer; According to the risk prediction value and the behavior risk label, the loss function is calculated, and the parameters of the STGCN model are adjusted according to the loss function, and iterative training is continued to obtain the trained behavior analysis model.

[0070] In an optional manner, the multimodal identity authentication strategy includes a first verification strategy, a second verification strategy and a third verification strategy; the encrypted current original biometric data of the user includes at least current encrypted fingerprint data, current liveness detection encrypted information and current voiceprint encrypted data; the preset threshold includes a preset first threshold and a preset second threshold; according to the behavior risk, the current original biometric data of the user is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result, including: Acquire standard user encrypted biometric data encrypted by a preset second encryption algorithm from the third-party storage terminal; the standard user encrypted biometric data at least includes standard encrypted fingerprint data, standard voiceprint encrypted data and standard liveness detection encrypted information; When the behavior risk is lower than the first threshold, verification is performed according to a first verification strategy; the first verification strategy is to compare the current encrypted fingerprint data with the standard encrypted fingerprint data to obtain a verification result; When the behavior risk is higher than a preset first threshold and lower than a preset second threshold, verification is performed according to a second verification strategy; the second verification strategy is to perform verification according to any two of the current encrypted fingerprint data, the current liveness detection encrypted information or the current voiceprint encrypted data to obtain a verification result; When the behavior risk is higher than the second threshold, verification is performed according to a third verification strategy to obtain a verification result; the third verification strategy is to verify the current encrypted fingerprint data, the current liveness detection encrypted information and the current voiceprint encrypted data respectively to obtain a verification result.

[0071] In an optional manner, after determining whether payment fraud exists according to the verification result, the method includes: When payment fraud is determined, the transaction payment is stopped and the user is prompted with the result of transaction failure.

[0072] In an embodiment of the present invention, when a transaction request from a user is received, the current original behavior data of the user is collected in real time according to the transaction request, and the current original behavior data of the user and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain the encrypted current behavior data and the encrypted transaction request, and the current original behavior data of the user and the transaction request are destroyed at the same time; the encrypted current behavior data and the transaction request are analyzed using a behavior analysis model to obtain a behavior risk; according to the behavior risk, the current original biometric data of the user is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result; according to the verification result, it is determined whether there is payment fraud. Among them, by encrypting various types of user data at various links, destroying the original sensitive data, and encrypting the sensitive data and storing it in a third-party storage terminal, it is possible to effectively perform security verification through multi-modality during the transaction payment process, while not causing user privacy leakage due to excessive collection of user sensitive data.

[0073] An embodiment of the present invention provides a computer-readable storage medium, which stores at least one executable instruction. When the executable instruction is executed on a computer device, the computer device executes the payment fraud detection method based on behavioral pattern analysis and multimodal identity authentication in any of the above method embodiments.

[0074] The executable instructions can be specifically used to cause the computer device to perform the following operations: When receiving a transaction request from a user, the user's current original behavior data is collected in real time according to the transaction request; the transaction request includes a user identifier, current transaction information, and current physical information; the user's current original behavior data includes at least a touch screen sliding track, a device holding posture, and input rhythm information; After respectively encrypting the user's current original behavior data and the transaction request in real time using a preset first encryption algorithm, the encrypted current behavior data and the encrypted transaction request are obtained, and the user's current original behavior data and the transaction request are destroyed at the same time; The encrypted current behavior data and the transaction request are analyzed using a behavior analysis model to obtain a behavior risk; the behavior analysis model is obtained by training a spatiotemporal graph convolutional network on the third-party storage end according to the user's historical behavior information and historical transaction information; the user's historical behavior information is obtained by encrypting the user's original historical behavior information using a preset first encryption algorithm; According to the behavior risk, the user's current original biometric data is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result; the target verification strategy is one of the multimodal identity authentication strategies; Based on the verification result, determine whether payment fraud exists.

[0075] In an optional manner, the first encryption algorithm includes a location offset algorithm and a differential privacy calculation; the current physical information includes current device information and current geographic location information; the current original behavior data of the user and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain encrypted current behavior data and encrypted transaction request, and the current original behavior data of the user and the transaction request are destroyed at the same time, including: After calculating the position offset of the current geographical location information according to the position offset algorithm, the current geographical location information after offset is obtained; Perform differential privacy calculation on the user's current original behavior data to obtain encrypted current behavior data.

[0076] In an optional manner, when the waiting time exceeds a preset time threshold, before predicting and obtaining at least one recommended exchange plan based on the first exchange request, current exchange rate fluctuation information and historical exchange data input into an exchange plan model, the method further includes: Obtaining historical exchange data; the historical exchange data includes the amount of historical exchange requests, exchange rate, historical exchange request time, number of requests at the historical exchange request time, historical exchange waiting time corresponding to the historical exchange request, and information on whether the exchange was successful; Inputting the historical exchange data into a preset time series prediction model for training to obtain an exchange duration prediction model; Obtaining historical exchange rate data; the historical exchange rate data includes historical exchange rate fluctuation information, historical macroeconomic data and historical exchange data; The historical exchange rate data is input into a deep learning model for training to obtain a trained optimal exchange timing prediction model.

[0077] In an optional manner, the spatiotemporal convolutional network is an STGCN model; the STGCN model includes a spatiotemporal convolutional block and a fully connected layer in which two temporal convolutional layers sandwich a spatial graph convolutional layer; the encrypted touch screen sliding trajectory, the encrypted device holding posture and the encrypted input rhythm information, the historical transaction request and the corresponding behavior risk label are input into the spatiotemporal convolutional network for training to obtain a trained behavior analysis model, including: The encrypted touch screen sliding trajectory, encrypted device holding posture and encrypted input rhythm information at each time point are respectively mapped into node features, and the spatial relationship between the user historical behavior information is represented by an adjacency matrix; The offset historical geographic location information in the historical transaction request is used as the node feature, and the spatial relationship between transactions is represented by the adjacency matrix; Features are extracted through the temporal convolution layer and the spatial graph convolution layer, and the risk prediction value is output through the fully connected layer; According to the risk prediction value and the behavior risk label, the loss function is calculated, and the parameters of the STGCN model are adjusted according to the loss function, and iterative training is continued to obtain the trained behavior analysis model.

[0078] In an optional manner, the encrypted current original biometric data of the user includes at least current encrypted fingerprint data, current liveness detection encrypted information and current voiceprint encrypted data; the preset threshold includes a preset first threshold and a preset second threshold; according to the behavior risk, the current original biometric data of the user is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result, including: Acquire standard user encrypted biometric data encrypted by a preset second encryption algorithm from the third-party storage terminal; the standard user encrypted biometric data at least includes standard encrypted fingerprint data, standard voiceprint encrypted data and standard liveness detection encrypted information; When the behavior risk is lower than a first threshold, comparing the current encrypted fingerprint data with the standard encrypted fingerprint data to obtain a verification result; When the behavior risk is higher than a preset first threshold and lower than a preset second threshold, verification is performed according to any two of the current encrypted fingerprint data, the current liveness detection encrypted information, or the current voiceprint encrypted data to obtain a verification result; When the behavior risk is higher than a second threshold, the current encrypted fingerprint data, the current liveness detection encrypted information and the current voiceprint encrypted data are verified respectively to obtain a verification result.

[0079] In an optional manner, after determining whether payment fraud exists according to the verification result, the method includes: When payment fraud is determined, the transaction payment is stopped and the user is prompted with the result of transaction failure.

[0080] In an embodiment of the present invention, when a transaction request from a user is received, the current original behavior data of the user is collected in real time according to the transaction request, and the current original behavior data of the user and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain the encrypted current behavior data and the encrypted transaction request, and the current original behavior data of the user and the transaction request are destroyed at the same time; the encrypted current behavior data and the transaction request are analyzed using a behavior analysis model to obtain a behavior risk; according to the behavior risk, the current original biometric data of the user is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result; according to the verification result, it is determined whether there is payment fraud. Among them, by encrypting various types of user data at various links, destroying the original sensitive data, and encrypting the sensitive data and storing it in a third-party storage terminal, it is possible to effectively perform security verification through multi-modality during the transaction payment process, while not causing user privacy leakage due to excessive collection of user sensitive data.

[0081] An embodiment of the present invention provides a payment fraud detection device based on behavior pattern analysis and multimodal identity authentication, which is used to execute the above-mentioned payment fraud detection method based on behavior pattern analysis and multimodal identity authentication.

[0082] An embodiment of the present invention provides a computer program, which can be called by a processor to enable a computer device to execute the payment fraud detection method based on behavioral pattern analysis and multimodal identity authentication in any of the above method embodiments.

[0083] An embodiment of the present invention provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are run on a computer, the computer executes the payment fraud detection method based on behavioral pattern analysis and multimodal identity authentication in any of the above method embodiments.

[0084] The algorithm or display provided herein is not inherently related to any particular computer, virtual system or other equipment. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious to construct the structure required for this type of system. In addition, the embodiment of the present invention is not directed to any specific programming language yet. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description made to specific languages ​​above is for disclosing the best mode of the present invention.

[0085] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0086] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the embodiments of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this method of disclosure should not be interpreted as reflecting an intention that the claimed invention requires more features than those expressly recited in each claim.

[0087] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and set in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature that provides the same, equivalent or similar purpose.

[0088] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be understood as limitations on the order of execution.

Claims

1. A payment fraud detection method based on behavioral pattern analysis and multimodal identity authentication, characterized in that: The method comprises: When receiving a transaction request from a user, the user's current original behavior data is collected in real time according to the transaction request; the transaction request includes a user identifier, current transaction information, and current physical information; the user's current original behavior data includes at least a touch screen sliding track, a device holding posture, and input rhythm information; After respectively encrypting the user's current original behavior data and the transaction request in real time using a preset first encryption algorithm, the encrypted current behavior data and the encrypted transaction request are obtained, and the user's current original behavior data and the transaction request are destroyed at the same time; The encrypted current behavior data and the transaction request are analyzed using a behavior analysis model to obtain a behavior risk; the behavior analysis model is obtained by training a spatiotemporal graph convolutional network on the third-party storage end according to the user's historical behavior information and historical transaction information; the user's historical behavior information is obtained by encrypting the user's original historical behavior information using a preset first encryption algorithm; According to the behavior risk, the user's current original biometric data is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result; the target verification strategy is one of the multimodal identity authentication strategies; Based on the verification result, determine whether payment fraud exists.

2. The method according to claim 1, characterized in that The first encryption algorithm includes a location shift algorithm and a differential privacy calculation; the current physical information includes current device information and current geographic location information; the current original behavior data of the user and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain the encrypted current behavior data and the encrypted transaction request, and the current original behavior data of the user and the transaction request are destroyed at the same time, including: After calculating the position offset of the current geographical location information according to the position offset algorithm, the current geographical location information after offset is obtained; Perform differential privacy calculation on the user's current original behavior data to obtain encrypted current behavior data.

3. The method according to claim 2, characterized in that The current transaction information includes the transaction amount and transaction time; the user historical behavior information includes historical transaction requests, historical device information and historical geographic location information; before analyzing the encrypted current behavior data and the transaction request using a behavior analysis model to obtain the behavior risk, the method further includes: The third-party storage end uses a differential privacy algorithm to encrypt the historical touch screen sliding trajectory, the historical device holding posture, and the historical input rhythm information in the historical transaction request to obtain the encrypted touch screen sliding trajectory, the encrypted device holding posture, and the encrypted input rhythm information; The third-party storage end calculates the position offset of the historical geographical location information according to the position offset algorithm to obtain the historical geographical location information after offset; The third-party storage end inputs the encrypted touch screen sliding trajectory, encrypted device holding posture and encrypted input rhythm information, historical transaction requests and corresponding behavioral risk labels into the spatiotemporal convolutional network for training to obtain a trained behavior analysis model.

4. The method according to claim 2, characterized in that: The spatiotemporal convolutional network is an STGCN model; the STGCN model includes a spatiotemporal convolutional block and a fully connected layer, in which two temporal convolutional layers sandwich a spatial graph convolutional layer; the encrypted touch screen sliding trajectory, the encrypted device holding posture and the encrypted input rhythm information, the historical transaction request and the corresponding behavior risk label are input into the spatiotemporal convolutional network for training, and a trained behavior analysis model is obtained, including: The encrypted touch screen sliding trajectory, encrypted device holding posture and encrypted input rhythm information at each time point are respectively mapped into node features, and the spatial relationship between the user historical behavior information is represented by an adjacency matrix; The offset historical geographic location information in the historical transaction request is used as the node feature, and the spatial relationship between transactions is represented by the adjacency matrix; Features are extracted through the temporal convolution layer and the spatial graph convolution layer, and the risk prediction value is output through the fully connected layer; According to the risk prediction value and the behavior risk label, the loss function is calculated, and the parameters of the STGCN model are adjusted according to the loss function, and iterative training is continued to obtain the trained behavior analysis model.

5. The method according to claim 4, characterized in that The multimodal identity authentication strategy includes a first authentication strategy, a second authentication strategy and a third authentication strategy; the encrypted user's current original biometric data includes at least current encrypted fingerprint data, current liveness detection encrypted information and current voiceprint encrypted data; The preset threshold includes a preset first threshold and a preset second threshold; according to the behavior risk, the user's current original biometric data is collected and encrypted using a preset second encryption algorithm, and the current original biometric data is destroyed, and the encrypted current biometric data is verified using a target verification strategy to obtain a verification result, including: Acquire standard user encrypted biometric data encrypted by a preset second encryption algorithm from the third-party storage terminal; the standard user encrypted biometric data at least includes standard encrypted fingerprint data, standard voiceprint encrypted data and standard liveness detection encrypted information; When the behavior risk is lower than the first threshold, verification is performed according to a first verification strategy; the first verification strategy is to compare the current encrypted fingerprint data with the standard encrypted fingerprint data to obtain a verification result; When the behavior risk is higher than a preset first threshold and lower than a preset second threshold, verification is performed according to a second verification strategy; the second verification strategy is to perform verification according to any two of the current encrypted fingerprint data, the current liveness detection encrypted information or the current voiceprint encrypted data to obtain a verification result; When the behavior risk is higher than the second threshold, verification is performed according to a third verification strategy to obtain a verification result; the third verification strategy is to verify the current encrypted fingerprint data, the current liveness detection encrypted information and the current voiceprint encrypted data respectively to obtain a verification result.

6. The method according to any one of claims 1 to 5, characterized in that: After determining whether payment fraud exists according to the verification result, the method includes: When payment fraud is determined, the transaction payment is stopped and the user is prompted with the result of transaction failure.

7. A payment fraud detection device based on behavioral pattern analysis and multimodal identity authentication, characterized in that: The device comprises: A collection module, for collecting the user's current original behavior data in real time according to the transaction request when receiving the transaction request from the user; the transaction request includes the user identification, current transaction information and current physical information; the user's current original behavior data includes at least the touch screen sliding track, device holding posture and input rhythm information; An encryption and destruction module, used to encrypt the current original behavior data of the user and the transaction request in real time using a preset first encryption algorithm to obtain the encrypted current behavior data and the encrypted transaction request, and to destroy the current original behavior data of the user and the transaction request at the same time; A risk calculation module is used to analyze the encrypted current behavior data and the transaction request using a behavior analysis model to obtain a behavior risk; the behavior analysis model is obtained by training a spatiotemporal graph convolutional network based on the user's historical behavior information and historical transaction information by a third-party storage end; the user's historical behavior information is obtained by encrypting the user's original historical behavior information using a preset first encryption algorithm; A multimodal verification module, for collecting the user's current original biometric data according to the behavior risk, encrypting the user's current original biometric data using a preset second encryption algorithm, destroying the current original biometric data, and verifying the encrypted current biometric data using a target verification strategy to obtain a verification result; the target verification strategy is one of the multimodal identity authentication strategies; The determination module is used to determine whether payment fraud exists according to the verification result.

8. The device according to claim 7, characterized in that The first encryption algorithm includes a location shift algorithm and a differential privacy calculation; the current physical information includes current device information and current geographic location information; the current original behavior data of the user and the transaction request are encrypted in real time using a preset first encryption algorithm to obtain the encrypted current behavior data and the encrypted transaction request, and the current original behavior data of the user and the transaction request are destroyed at the same time, including: After calculating the position offset of the current geographical location information according to the position offset algorithm, the current geographical location information after offset is obtained; Perform differential privacy calculation on the user's current original behavior data to obtain encrypted current behavior data.

9. A computer device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform the operation of the payment fraud detection method based on behavioral pattern analysis and multimodal identity authentication as described in any one of claims 1-6.

10. A computer-readable storage medium, characterized in that: The storage medium stores at least one executable instruction, and when the executable instruction is executed on a computer device, the computer device executes the operation of the payment fraud detection method based on behavioral pattern analysis and multimodal identity authentication as described in any one of claims 1-6.

Images