Payment risk control anomaly detection method and system based on isolated forest algorithm, and storage medium

Abstract

The invention provides a payment risk control anomaly detection method based on an isolated forest algorithm, and the method comprises a model training process and a model application process, and the model training process comprises the steps: obtaining transaction detail sample data; performing data cleaning on the transaction detail sample data to generate a transaction data set; performing feature derivation according to existing data features; a data set of suspected abnormal transactions is preliminarily screened out according to data features; performing screening according to feature importance to form careful features, and further generating a data set of suspected abnormal transactions according to the careful features; an isolated forest abnormal transaction prediction model is trained based on enterprise historical data features, model evaluation is performed based on a test set, and a model with relatively high abnormal transaction recognition accuracy is generated; the model application process comprises the following steps: acquiring all latest transaction detail data; and applying the model with relatively high abnormal transaction recognition accuracy to latest transaction detail data to perform abnormal transaction data reasoning, and generating a data set of suspected abnormal transactions.

Description

Technical Field

[0001] The present invention belongs to the technical field of financial risk control systems, and in particular, relates to a payment risk control anomaly detection method, system and storage medium based on an isolation forest algorithm. Background Art

[0002] Currently, the methods for managing and controlling payment risk anomalies mainly rely on internal and external supervision.

[0003] Internal Supervision:

[0004] 1. Establish a management system: Establish strict transaction processes and review mechanisms to ensure the compliance of transactions.

[0005] 2. Risk assessment: Conduct transaction risk assessment based on the counterparty’s credit rating, market environment, industry risk, etc.

[0006] External supervision:

[0007] Laws enacted by the national legislature, regulations and other normative documents formulated by the State Financial Supervision and Administration Bureau.

[0008] This strategy can provide certain control functions beforehand and retrospective risk identification afterwards, but it cannot identify risks during the transaction process. Summary of the invention

[0009] The purpose of the present invention is to provide a payment risk control anomaly detection method, system and storage medium based on an isolation forest algorithm to solve the problems existing in the prior art.

[0010] In order to achieve the above-mentioned purpose, a payment risk control anomaly detection method, system and storage medium based on the isolation forest algorithm are provided. The method comprises a model training process and a model application process. The model training process comprises:

[0011] S11: Obtain a data set, and obtain sample transaction details data;

[0012] S12: Data cleaning: clean the transaction detail sample data to generate a transaction data set;

[0013] S13: Feature derivation calculation: derive features based on existing data features to form derivable features;

[0014] And preliminarily screen out data sets of suspected abnormal transactions based on the derived features;

[0015] S14: Feature screening: feature screening is performed according to feature importance to form selected features, and a data set of suspected abnormal transactions is further generated based on the selected features;

[0016] S15: Model generation: training the Isolation Forest abnormal transaction prediction model based on the company's historical data features, evaluating the model based on the test set, and finally generating a model with high accuracy in identifying abnormal transactions;

[0017] The model application process includes:

[0018] S21: Get all the latest transaction details;

[0019] S22: Data inference: Apply the model with high accuracy in identifying abnormal transactions described in S15 to the latest transaction details data to perform abnormal transaction data inference and generate a data set of suspected abnormal transactions.

[0020] Furthermore, the data cleaning described in S12 includes: removing canceled or erroneous transaction information in the transaction details; standardizing the date format field; removing special symbols, unifying characters, and unifying the former name and current name of the company.

[0021] Furthermore, the existing features described in S13 include transaction date, transaction amount, account type, transaction size, etc.;

[0022] The features that can be derived include whether it is a holiday, whether it is a weekend, average transaction amount, maximum transaction amount, minimum transaction amount, account type, transaction size, etc.

[0023] Furthermore, the feature derivatives described in S13 include whether it is a holiday, whether it is a weekend, average transaction amount, maximum transaction amount, minimum transaction amount, account type, and transaction scale.

[0024] Furthermore, the feature screening described in S14 to form selected features is to remove features that cannot cover most of the data.

[0025] Furthermore, the feature screening forms selected features, and if the correlation between features is too high, one of the features is removed.

[0026] The present invention also provides a payment risk control anomaly detection system based on an isolation forest algorithm. The detection system includes a model training process module and a model application process module. The model training process module includes:

[0027] Get dataset module, used to get sample transaction details data;

[0028] The data cleaning module cleans the transaction detail sample data to generate a transaction data set;

[0029] The feature derivation calculation module derives features based on existing data features to form derivable features;

[0030] And preliminarily screen out data sets of suspected abnormal transactions based on the derived features;

[0031] The feature screening module screens features according to their importance, forms selected features, and further generates a data set of suspected abnormal transactions based on the selected features;

[0032] The model generation module trains the Isolation Forest abnormal transaction prediction model based on the characteristics of the company's historical data, evaluates the model based on the test set, and finally generates a model with high accuracy in identifying abnormal transactions;

[0033] The model application process module includes:

[0034] The latest transaction details data acquisition module is used to obtain all the latest transaction details data;

[0035] The data inference module applies the model with high accuracy in identifying abnormal transactions described in S15 to the latest transaction details data to perform abnormal transaction data inference and generate a data set of suspected abnormal transactions.

[0036] The present invention also provides a computer-readable storage medium, which stores computer program instructions. When the computer program instructions are executed by a computer, the computer executes the steps of any of the above-mentioned payment risk control anomaly detection methods based on the isolation forest algorithm.

[0037] By adopting the above technical solution, the present invention has the following beneficial effects:

[0038] 1. The prediction by isolated forest algorithm enhances the multi-dimensional cross-information verification capability, solving the problem that traditional rules are difficult to mine deep multi-dimensional feature laws;

[0039] 2. Using historical data to test abnormal transaction data improves the ability to prevent and control abnormal financial transaction risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 A schematic diagram of the model training process of the payment risk control anomaly detection method based on the isolation forest algorithm of the present invention;

[0042] Figure 2 It is a schematic diagram of the model application process of the payment risk control anomaly detection method based on the isolation forest algorithm of the present invention;

[0043] Figure 3 It is a schematic diagram of an embodiment of the present invention;

[0044] Figure 4 It is a schematic diagram of a payment risk control anomaly detection system based on an isolation forest algorithm of the present invention;

[0045] Figure 5 It is a schematic diagram of the model training process module of the payment risk control anomaly detection method based on the isolation forest algorithm of the present invention;

[0046] Figure 6 This is a schematic diagram of the model application process module of the payment risk control anomaly detection method based on the isolation forest algorithm of the present invention. DETAILED DESCRIPTION

[0047] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] Combination Figure 1 , Figure 2 As shown, a payment risk control anomaly detection method, system and storage medium based on the isolation forest algorithm, the method includes a model training process and a model application process, and the model training process includes:

[0049] S11: Obtain a data set, and obtain sample transaction details data;

[0050] S12: Data cleaning: clean the transaction detail sample data to generate a transaction data set;

[0051] S13: Feature derivation calculation: derive features based on existing data features to form derivable features;

[0052] And preliminarily screen out data sets of suspected abnormal transactions based on the derived features;

[0053] S14: Feature screening: feature screening is performed according to feature importance to form selected features, and a data set of suspected abnormal transactions is further generated based on the selected features;

[0054] S15: Model generation: training the Isolation Forest abnormal transaction prediction model based on the company's historical data features, evaluating the model based on the test set, and finally generating a model with high accuracy in identifying abnormal transactions;

[0055] The model application process includes:

[0056] S21: Get all the latest transaction details;

[0057] S22: Data inference: Apply the model with high accuracy in identifying abnormal transactions described in S15 to the latest transaction details data to perform abnormal transaction data inference and generate a data set of suspected abnormal transactions.

[0058] Specifically, the data cleaning described in S12 includes: removing canceled or erroneous transaction information in the transaction details; standardizing the date format field; removing special symbols, unifying characters, unifying the former name and current name of the company, etc.

[0059] Specifically, the existing features described in S13 include transaction date, transaction amount, account type, transaction size, etc.;

[0060] The features that can be derived include whether it is a holiday, whether it is a weekend, average transaction amount, maximum transaction amount, minimum transaction amount, account type, transaction size, etc.

[0061] Specifically, the feature derivatives described in S13 include whether it is a holiday, whether it is a weekend, average transaction amount, maximum transaction amount, minimum transaction amount, account type, and transaction scale.

[0062] Specifically, the feature screening described in S14 to form selected features is to remove features that cannot cover most of the data.

[0063] Specifically, the feature screening forms selected features, and if the correlation between features is too high, one of the features is removed.

[0064] See also Figure 3 As shown,

[0065] [[Member unit transaction amount…Transaction date counterparty deposit amount…],

[0066] After feature cleaning, the transaction data set of [A Research Institute 50000.00…2023-07-13 10:01:23B Company 78300300.00…] is obtained:

[0067] [[Member unit transaction amount…Transaction date counterparty deposit amount…],

[0068] [Institute A 50000.00…2023-07-13 10:01:23 Company B 78300300.00…], …].

[0069] After feature derivative calculation, the suspected abnormal transaction data set is obtained: [……2.58 5.97 12.733 55……].

[0070] Remove features that cannot cover most of the data. If the correlation between features is too high, remove one of the features. Then, further generate a data set of suspected abnormal transactions based on the selected features:

[0071] [……2.58 5.97 3 5……].

[0072] Next, according to the description of the above technical solution, enter the model application process: for obtaining all the latest transaction details, use the above generated abnormal transaction model to apply it to the latest transaction details, and finally generate a data set of suspected abnormal transactions.

[0073] See also Figure 4 , Figure 5 As shown, the present invention also provides a payment risk control anomaly detection system based on an isolation forest algorithm. The detection system includes a model training process module and a model application process module. The model training process module includes:

[0074] Get dataset module, used to get sample transaction details data;

[0075] The data cleaning module cleans the transaction detail sample data to generate a transaction data set;

[0076] The feature derivation calculation module derives features based on existing data features to form derivable features;

[0077] And preliminarily screen out data sets of suspected abnormal transactions based on the derived features;

[0078] The feature screening module screens features according to their importance, forms selected features, and further generates a data set of suspected abnormal transactions based on the selected features;

[0079] The model generation module trains the Isolation Forest abnormal transaction prediction model based on the characteristics of the company's historical data, evaluates the model based on the test set, and finally generates a model with high accuracy in identifying abnormal transactions;

[0080] See also Figure 4 , Figure 6 As shown, the model application process module includes:

[0081] The latest transaction details data acquisition module is used to obtain all the latest transaction details data;

[0082] The data inference module applies the model with high accuracy in identifying abnormal transactions described in S15 to the latest transaction details data to perform abnormal transaction data inference and generate a data set of suspected abnormal transactions.

[0083] The present invention adopts the isolation forest algorithm, which has the following advantages: compared with other outlier detection algorithms, the isolation forest algorithm has the following advantages: first, the algorithm does not require any preprocessing of the data, the data does not need to meet any specific distribution, and there is no need to clearly define the outliers; second, the algorithm is very fast when processing large amounts of data and has high accuracy; finally, the algorithm also has a good processing effect on high-dimensional data.

[0084] The application scenario characteristics of the present invention are as follows: it is necessary to identify and warn of abnormal transaction situations in real time during the process; in addition, when using the isolation forest algorithm to detect transaction anomalies, in addition to identifying abnormal transactions through vertical cross-time period comparison of past transactions between the two parties to the transaction; the algorithm can also invisible compare transactions of the same type and transactions in the same scenario, and identify abnormal transactions through horizontal comparison.

[0085] Of course, after obtaining the sample data of transaction details, feature cleaning is performed. If obvious features are missing, the missing feature values ​​can be filled, such as company name, transaction amount, etc.

[0086] The present invention also provides a computer-readable storage medium, which stores computer program instructions. When the computer program instructions are executed by a computer, the computer executes the steps of any of the above-mentioned payment risk control anomaly detection methods based on the isolation forest algorithm.

[0087] It should be noted that the storage medium shown in the embodiment of the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any storage medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the storage medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0088] The accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present invention. Each box in the figure can represent a module, program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that each box in the block diagram or flow chart, and the combination of boxes in the block diagram or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0089] The units involved in the embodiments of the present invention may be implemented by software or hardware, and the units described may also be arranged in a processor. The names of these units do not, in some cases, limit the units themselves.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A payment risk control anomaly detection method based on an isolation forest algorithm, comprising a model training process and a model application process, characterized in that: The model training process includes: S11: Obtain a data set, and obtain sample transaction details data; S12: Data cleaning: clean the transaction detail sample data to generate a transaction data set; S13: Feature derivation calculation: derive features based on existing data features to form derivable features; And preliminarily screen out data sets of suspected abnormal transactions based on the derived features; S14: Feature screening: feature screening is performed according to feature importance to form selected features, and a data set of suspected abnormal transactions is further generated based on the selected features; S15: Model generation: training the Isolation Forest abnormal transaction prediction model based on the company's historical data features, evaluating the model based on the test set, and finally generating a model with high accuracy in identifying abnormal transactions; The model application process includes: S21: Get all the latest transaction details; S22: Data inference: Apply the model with high accuracy in identifying abnormal transactions described in S15 to the latest transaction details data to perform abnormal transaction data inference and generate a data set of suspected abnormal transactions.

2. According to claim 1, a payment risk control anomaly detection method based on isolation forest algorithm is characterized in that: The data cleaning described in S12 includes: removing canceled or erroneous transaction information in the transaction details; standardizing the date format field; removing special symbols, unifying characters, and unifying the former name and current name of the company.

3. According to claim 1, a payment risk control anomaly detection method based on isolation forest algorithm is characterized in that: The existing characteristics described in S13 include transaction date, transaction amount, account type, transaction size, etc.; The features that can be derived include whether it is a holiday, whether it is a weekend, average transaction amount, maximum transaction amount, minimum transaction amount, account type, transaction size, etc.

4. According to claim 1, a payment risk control anomaly detection method based on isolation forest algorithm is characterized in that: The derived features described in S13 include whether it is a holiday, whether it is a weekend, average transaction amount, maximum transaction amount, minimum transaction amount, account type, and transaction size.

5. The payment risk control anomaly detection method based on the isolation forest algorithm according to claim 1 is characterized in that: The feature screening described in S14 forms selected features, which is to remove features that cannot cover most of the data.

6. A payment risk control anomaly detection method based on isolation forest algorithm according to claim 5, characterized in that: The feature screening described in S14 forms selected features, and if the correlation between features is too high, one of the features is removed.

7. A payment risk control anomaly detection system based on isolation forest algorithm, characterized in that: The detection system includes a model training process module and a model application process module, and the model training process module includes: Get dataset module, used to get sample transaction details data; The data cleaning module cleans the transaction detail sample data to generate a transaction data set; The feature derivation calculation module derives features based on existing data features to form derivable features; And preliminarily screen out data sets of suspected abnormal transactions based on the derived features; The feature screening module screens features according to their importance, forms selected features, and further generates a data set of suspected abnormal transactions based on the selected features; The model generation module trains the Isolation Forest abnormal transaction prediction model based on the characteristics of the company's historical data, evaluates the model based on the test set, and finally generates a model with high accuracy in identifying abnormal transactions; The model application process module includes: The latest transaction details data acquisition module is used to obtain all the latest transaction details data; The data inference module applies the model with high accuracy in identifying abnormal transactions described in S15 to the latest transaction details data to perform abnormal transaction data inference and generate a data set of suspected abnormal transactions.

8. A computer-readable storage medium storing computer program instructions. When the computer program instructions are executed by a computer, the computer executes the steps of the payment risk control anomaly detection method based on the isolation forest algorithm as described in any one of claims 1 to 6.

Images