Abnormal Detection Method, Device and Medium Based on POS Machine Transaction Information Processing

Abstract

This application relates to the field of POS machine transaction data processing, and in particular to an anomaly detection method, device, and medium based on POS machine transaction information processing. The method of this application includes the following steps: obtaining the transaction information flow of the transaction account in the POS machine, creating a sub-account for the transaction account according to the derived fee information in the transaction information flow, associating the transaction account as the parent account of the sub-account, sharing the principal between the parent account and the sub-account, and the sub-account deducts the derived fees of the parent account. Constructing a heterogeneous graph for the parent account and the sub-account, the heterogeneous graph includes a parent account node, a sub-account node, and a merchant node. Extracting the time series feature vector from the heterogeneous graph, judging the advance funding risk probability of the parent account according to the time series feature vector, and when the advance funding risk probability exceeds the threshold, performing anomaly interception processing on the transaction account. A method is provided that can effectively improve the ability to identify malicious use of advance funding behavior in POS machine transactions, and it is difficult for attackers to avoid detection through simple means.

Description

Technical Field

[0001] This application relates to the field of POS machine transaction data processing, and particularly to an anomaly detection method, device, and medium based on POS machine transaction information processing. Background Art

[0002] As the core device of the modern payment system, POS machines are widely used in offline transaction scenarios to complete fund settlement by reading bank card or mobile payment information. To improve transaction efficiency, payment companies often adopt a capital advance mechanism: when a transaction is completed, they advance funds to merchants first and then deduct money from the user's account later. Although this mechanism accelerates the flow of funds, there is a risk of being maliciously exploited.

[0003] Currently, the detection of capital advance risks mainly relies on rule engines or statistical analysis. Among them, the rule engine triggers interception based on preset thresholds (such as the upper limit of daily transaction times and the limit of single transaction amount), but attackers can easily bypass the rules by dispersing transaction times, splitting amounts, etc.; statistical analysis uses historical transaction data to build a risk scoring model, but traditional models are difficult to capture the implicit associations among accounts, merchants, and fund flows in complex transaction chains and lack the ability to dynamically adapt to new fraud patterns. In summary, it can be found that there is a lack of a method in the prior art that can effectively identify the behavior of maliciously exploiting the capital advance mechanism in POS machine transactions. Summary of the Invention

[0004] This application provides an anomaly detection method, device, and medium based on POS machine transaction information processing. In a first aspect, the anomaly detection method based on POS machine transaction information processing provided by this application includes the following steps:

[0005] Obtain the transaction information flow of the transaction account in the POS machine, create a sub-account for the transaction account according to the derived fee information in the transaction information flow, associate the transaction account as the parent account of the sub-account, the parent account and the sub-account share the principal, and the sub-account deducts the derived fees of the parent account;

[0006] Construct a heterogeneous graph for the parent account and the sub-account, where the heterogeneous graph includes a parent account node, a sub-account node, and a merchant node;

[0007] Extract the time-series feature vector from the heterogeneous graph, and judge the capital advance risk probability of the parent account according to the time-series feature vector. When the capital advance risk probability exceeds the threshold, perform anomaly interception processing on the transaction account. The time-series feature vector includes nodes, edges, weights, timestamps, and node addresses in the heterogeneous graph.

[0008] Specifically, the method for creating a sub-account for a transaction account according to the derived fee information in the transaction information flow is:

[0009] Use a semantic classification model to judge the probability of the occurrence of derivative fee types in the transaction information flow. When the probability exceeds the set value, generate the ID of the sub-account, and associate the ID of the sub-account with the ID of the transaction account, so that the transaction account serves as the parent account of the sub-account;

[0010] Obtain the current principal of the transaction account, deduct the derivative fee from the current principal, and update the remaining principal to the transaction account;

[0011] The semantic classification model is a model obtained by annotating the derivative fee fields of POS machine transaction data.

[0012] Specifically, the method for constructing a heterogeneous graph for the parent account and the sub-account is as follows:

[0013] Create parent account nodes, sub-account nodes, and merchant nodes in the heterogeneous graph space;

[0014] Establish a principal sharing edge between the parent account node and the sub-account node, record the change of the shared principal of the parent account node and the sub-account node, and the weight of the principal sharing edge is determined by the derivative fee corresponding to the sub-account node;

[0015] Establish a one-way fund flow edge between the sub-account node and the merchant node, and record the derivative fee paid by the sub-account node to the merchant node;

[0016] Establish a one-way fund flow edge between the parent account node and the merchant node, and record the non-derivative fee paid by the parent account node to the merchant node;

[0017] The weight of the one-way fund flow edge is determined by the proportion of the derivative fee or the non-derivative fee in the total amount of the transaction information.

[0018] Specifically, the method for extracting the time series feature vector from the heterogeneous graph includes:

[0019] Sample the weights of each node in the heterogeneous graph according to a set sliding time window, and calculate the variance of the change rate by combining the sampled weights with the timestamp;

[0020] Fuse the variance of the change rate and the node address to obtain the time series feature vector.

[0021] Specifically, the calculation method of the advance payment risk probability is:

[0022] Input the time series feature vector into an LSTM neural network, and capture the abnormal fund flow features at different timestamps through an attention mechanism;

[0023] Calculate the risk probability value of the parent account node based on the hidden state vector output by the LSTM neural network;

[0024] The training data of the LSTM neural network includes the heterogeneous graph sequences of historical normal transaction chains and labeled abnormal transaction chains.

[0025] Specifically, the abnormal interception processing includes:

[0026] When it is detected that multiple parent account nodes associated with the same merchant node are simultaneously triggered with abnormalities, reduce the threshold according to the historical abnormality rate of the merchant node, and the amplitude of the threshold reduction is calculated by the abnormal account ratio and the growth rate of abnormal transaction amount of the merchant node.

[0027] Specifically, the transaction information flow of the transaction account in the POS machine is the historical transaction information flow, and the abnormal interception processing is to mark the transaction account as an abnormal account, close the payment function of the abnormal account, and send an abnormal account warning.

[0028] Specifically, the transaction information flow of the transaction account in the POS machine is the real-time transaction information flow, and the abnormal interception processing is to mark the transaction account as an abnormal account, intercept the current transaction of the transaction account, close the payment function of the abnormal account, and send an abnormal account warning.

[0029] In a second aspect, the present application provides a computing device, including:

[0030] A memory for storing program instructions;

[0031] A processor for calling the program instructions stored in the memory and executing the abnormal detection method as described above according to the obtained program.

[0032] In a third aspect, the present application provides a computer-readable storage medium, in which a computer program is stored, and the computer program can be executed by at least one processor to implement the abnormal detection method as described above.

[0033] The present application has the following technical effects:

[0034] Provided is a method that can effectively improve the recognition ability of malicious use of capital advance behavior in POS machine transactions, realizes earlier and more comprehensive risk warnings in complex transaction scenarios, and it is difficult for attackers to avoid detection by simple means such as adjusting transaction time or amount distribution. Description of the Drawings

[0035] By reading the following detailed description with reference to the accompanying drawings, the above and other objects, features, and advantages of the exemplary embodiments of the present application will become readily understandable. In the drawings, several embodiments of the present application are shown in an exemplary rather than restrictive manner, and the same or corresponding reference numerals represent the same or corresponding parts.

[0036] Figure 1 is a flowchart of an anomaly detection method based on POS machine transaction information processing in an embodiment of the present application. Detailed implementation manners

[0037] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application.

[0038] In an embodiment of the present invention, as Figure 1 shown, the anomaly detection method based on POS machine transaction information processing includes the following steps:

[0039] S1. Obtain the transaction information flow of the transaction account in the POS machine, create a sub-account for the transaction account according to the derived fee information in the transaction information flow, associate the transaction account as the parent account of the sub-account, the parent account and the sub-account share the principal, and the sub-account executes the deduction of the derived fees of the parent account.

[0040] Specifically, in this embodiment, a transaction information flow of a catering merchant is obtained through the real-time communication interface between the payment gateway and the POS machine. The semantic classification model used in this embodiment is constructed based on the pre-trained BERT architecture and is obtained by training after annotating the derivative fee fields in the POS machine transaction data. Its input layer receives the Token sequence of the transaction remarks text, and the output layer calculates the probability distribution of eight types of derivative fees (such as handling fees, installment service fees, cross-border settlement fees) through the Softmax function. When the probability of the handling fee category is detected to exceed the preset threshold, the system triggers the sub-account generation process. The generation rule of the sub-account ID is a combination of the parent account ID and the SHA-256 hash value. The hash input includes the transaction timestamp and the derivative fee amount to ensure global uniqueness. For example, if a parent account ID is ACCT_123456 and a handling fee transaction of 200 yuan occurs at 10:00 on October 1, 2023, the sub-account ID generated by the system is: ACCT_123456_6a2c3e8f (the hash value is calculated from the timestamp 202310011000 and the amount 200). The splitting of the parent account principal adopts a two-phase commit protocol: first, lock the total current principal of the parent account, and then transfer the derivative fee amount from the parent account to the dedicated fund pool of the sub-account, and the remaining principal is updated to the parent account through an atomic operation. If the initial principal of the parent account is 10,000 yuan and the derivative fee is 200 yuan, the initial amount of the sub-account is 200 yuan, and the balance of the parent account is updated synchronously to 9,800 yuan. The fund transfer permission of the sub-account is strictly restricted to only pay the corresponding derivative fees and shares the credit limit of the same principal pool with the parent account.

[0041] S2. Construct a heterogeneous graph for the parent account and the sub-account. The heterogeneous graph includes a parent account node, a sub-account node, and a merchant node.

[0042] Specifically, the construction of the heterogeneous graph is realized relying on a distributed graph database. The node types include three types of entities: the parent account node, the sub-account node, and the merchant node. The definition of the edges is divided into two categories: the principal sharing edge and the fund flow edge. The principal sharing edge connects the parent account node with all its sub-account nodes, and the weight coefficient of the edge α is dynamically calculated through the formula: α= The initial amount of the sub-account / (the remaining principal of the parent account + the initial amount of the sub-account). This design makes the behavior of frequently creating small sub-accounts cause α a sharp fluctuation in the value, thus exposing abnormal patterns. For example, initially, the principal of the parent account is 10,000 yuan. After transferring 200 yuan to the sub-account, the weight coefficient is 0.0204. If three sub-accounts (with amounts of 200 yuan, 300 yuan, and 500 yuan respectively) are continuously created by this parent account within the next 1 hour, the α value after the third transfer will become approximately equal to 0.0556. α The significant increase in the value makes this principal sharing edge contribute more in anomaly detection.

[0043] The fund flow edges are divided into the derivative fee payment edges from the sub - account to the merchant node and the non - derivative fee payment edges from the parent account to the merchant node, and their weights β are calculated by the formula: β= Current transaction amount / (Total transaction amount of the merchant in the past seven days + smoothing coefficient). The attributes of the edge also include the transaction timestamp, the fund flow identifier, and the IP address of the transaction terminal. The graph database adopts an incremental update strategy, and each new transaction triggers the real - time refresh of the corresponding node attributes and the recalculation of the edge weights.

[0044] S3. Extract the temporal feature vectors in the heterogeneous graph, and judge the risk probability of the parent account's advance - payment based on the temporal feature vectors. When the advance - payment risk probability exceeds the threshold, perform abnormal interception processing on the transaction account. The temporal feature vectors include nodes, edges, weights, timestamps, and node addresses in the heterogeneous graph.

[0045] Specifically, the temporal feature extraction module adopts a sliding window mechanism. The initial length of the window is 24 hours, and the sliding step of the window is 5 minutes. For the change in the weights of the nodes within each window period, calculate its second - order difference variance:

[0046] ,

[0047] where w t represents the mean value of the edge weights in the t - th time segment. The node address information is converted into a 32 - bit feature vector through GeoHash encoding and spliced with the variance value to form the final temporal feature vector.

[0048] In this embodiment, a dual - channel LSTM architecture is used to predict risks for the temporal feature vectors. The main channel processes the temporal changes of node attributes, and the input dimension is 128; the auxiliary channel analyzes the evolution trend of edge weights, and the input dimension is 64. The hidden state vectors of the two channels are fused in the attention layer, and the attention weights are calculated by a position - sensitive algorithm:

[0049] ,

[0050] where Q is the query vector at the current time step, K is the key vector matrix at the historical time step, d k is the scaling factor. The model training adopts a transfer learning strategy. First, optimize the parameters on a pre - training set containing millions of simulated transaction graphs, and then fine - tune with the labeled data in the real - world scenario. When it is detected that multiple parent - account nodes associated with the same merchant node trigger anomalies simultaneously, lower the threshold according to the historical anomaly rate of the merchant node. The amplitude of lowering the threshold is calculated by the proportion of abnormal accounts and the growth rate of abnormal transaction amounts of the merchant node.

[0051] The anomaly detection method of this embodiment can be applied to real-time transaction scenarios or transaction data anomaly traceability scenarios. When the transaction information flow of the transaction account in the POS machine is historical transaction information flow, the anomaly interception process is to mark the transaction account as an abnormal account, close the payment function of the abnormal account, and send an early warning for the abnormal account. When the transaction information flow of the transaction account in the POS machine is real-time transaction information flow, the anomaly interception process is to mark the transaction account as an abnormal account, intercept the current transaction of the transaction account, close the payment function of the abnormal account, and send an early warning for the abnormal account.

[0052] Obviously, the embodiments described above are some, but not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without creative efforts fall within the scope of protection of this application.

[0053] It should be understood that when terms such as "first" and "second" are used in the claims, the description, and the drawings of this application, they are only used to distinguish different objects and not to describe a specific order. The terms "including" and "comprising" used in the description and claims of this application indicate the presence of the described features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components, and / or their combinations.

Claims

1. An abnormality detection method based on POS transaction information processing, characterized in that: The following steps are involved: Acquire the transaction information flow of the transaction account in the POS machine, create a sub-account for the transaction account according to the derivative fee information in the transaction information flow, associate the transaction account as the parent account of the sub-account, the parent account and the sub-account share the principal, and the sub-account executes the deduction of the derivative fee of the parent account; Constructing a heterogeneous graph for the parent account and the sub-account, wherein the heterogeneous graph includes a parent account node, a sub-account node, and a merchant node; Extracting a time series feature vector from the heterogeneous graph, judging the risk probability of the backing of the parent account according to the time series feature vector, and performing abnormal interception processing on the transaction account when the risk probability of the backing of the parent account exceeds a threshold, wherein the time series feature vector includes nodes, edges, weights, timestamps, and node addresses in the heterogeneous graph; The method for constructing a heterogeneous graph for the parent account and the sub-account is: Create parent account nodes, sub-account nodes, and merchant nodes in the heterogeneous graph space; Establishing a principal sharing edge between the parent account node and the sub-account node, recording changes in the shared principal between the parent account node and the sub-account node, wherein the weight of the principal sharing edge is determined by the derivative fee corresponding to the sub-account node; Establishing a one-way funds flow edge between the sub-account node and the merchant node, and recording the derivative fees paid by the sub-account node to the merchant node; Establishing a one-way funds flow edge between the parent account node and the merchant node, and recording the non-derivative fees paid by the parent account node to the merchant node; The weight of the one-way capital flow edge is determined by the proportion of the derivative fee or the non-derivative fee to the total amount of the transaction information.

2. The anomaly detection method according to claim 1, characterized in that: The method for creating a sub-account for a transaction account according to the derivative fee information in the transaction information flow is: Using a semantic classification model to determine the probability of the type of derivative fees appearing in the transaction information flow, when the probability exceeds a set value, generating an ID of the sub-account, and associating the ID of the sub-account with the ID of the transaction account, so that the transaction account serves as the parent account of the sub-account; Obtaining the current principal of the trading account, deducting the derivative fee from the current principal, and updating the remaining principal to the trading account; The semantic classification model is a model obtained by labeling the derived cost fields of POS machine transaction data.

3. The anomaly detection method according to claim 1, characterized in that: The method for extracting the time series feature vector in the heterogeneous graph includes: The weight of each node in the heterogeneous graph is sampled according to a set sliding time window, and the variance of the change rate is calculated by combining the sampled weight with the timestamp; The time series feature vector is obtained by fusing the change rate variance and the node address.

4. The anomaly detection method according to claim 1, characterized in that: The calculation method of the advance payment risk probability is: The time series feature vector is input into the LSTM neural network, and the abnormal fund flow characteristics of different timestamps are captured through the attention mechanism; Calculate the risk probability value of the parent account node based on the hidden state vector output by the LSTM neural network; The training data of the LSTM neural network includes heterogeneous graph sequences of historical normal transaction chains and marked abnormal transaction chains.

5. The anomaly detection method according to claim 1, characterized in that: The exception interception process includes: When it is detected that multiple parent account nodes associated with the same merchant node trigger anomalies at the same time, the threshold is lowered according to the historical anomaly rate of the merchant node, and the extent of the threshold reduction is calculated by the abnormal account ratio and abnormal transaction amount growth rate of the merchant node.

6. The anomaly detection method according to claim 1, characterized in that: The transaction information flow of the transaction account in the POS machine is a historical transaction information flow, and the abnormal interception processing is to mark the transaction account as an abnormal account, close the payment function of the abnormal account, and send an abnormal account warning.

7. The anomaly detection method according to claim 1, characterized in that: The transaction information flow of the transaction account in the POS machine is a real-time transaction information flow, and the abnormal interception process is to mark the transaction account as an abnormal account, intercept the current transaction of the transaction account, close the payment function of the abnormal account, and send an abnormal account warning.

8. A computing device, characterized in that include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory and execute the anomaly detection method according to any one of claims 1 to 7 according to the obtained program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program can be executed by at least one processor to implement the anomaly detection method according to any one of claims 1 to 7.

Images