Abnormal transaction detection method and device
By combining the long and short-term memory network model and the dual attention mechanism, using the time and feature attention mechanism for abnormal transaction detection, the problem of inability to effectively capture complex data characteristics in the existing technology is solved, and the accuracy and efficiency of detection are improved.
Patent Information
- Application Number
- CN202510151611.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-02-11
- Publication Date
- 2025-05-30
AI Technical Summary
In the prior art, abnormal transaction detection methods rely on manual rules and machine learning models and cannot effectively capture complex data characteristics, resulting in a high rate of missed detection and false detection.
The long and short-term memory network (LSTM) model is used to combine it with the dual attention mechanism to detect abnormalities of transaction data through the time attention mechanism and characteristic attention mechanism.
It improves the accuracy and efficiency of abnormal transaction detection, can more effectively identify abnormal transactions at a specific time or with specific characteristics, and reduces the missed detection and false detection rates.
Smart Images
Figure CN120067944A_ABST
Abstract
Description
Technical Field
[0001] The embodiments of the present application relate to the field of fintech, and more particularly, to an abnormal transaction detection method and device. Background Art
[0002] In the field of fintech, fund transfers often conceal their true intentions through complex transaction patterns. Therefore, effective monitoring systems are needed in related technologies to identify abnormal transaction behaviors. Currently, the detection of abnormal transaction behaviors mainly has the following methods: rule-based methods and machine learning-based methods.
[0003] The rule-based abnormal transaction detection method usually detects based on a series of fixed rules formulated by experts, such as transaction amount, frequency, etc. However, these fixed rules have obvious defects: (1) Strong rule dependence: The rule-based method is difficult to adapt to the constantly changing fund transfer methods, which easily leads to missed detections; (2) Limited feature selection: Traditional methods usually only focus on a small number of features and fail to comprehensively consider multi-dimensional feature information; (3) Insufficient dynamic data processing ability: In the face of large-scale and complex time series data, the performance of traditional models is often not ideal.
[0004] The machine learning-based abnormal transaction detection method can alleviate the defects of the traditional rule-based method to a certain extent. These methods mostly use traditional time series analysis methods or simple machine learning models, such as decision trees, random forests, and support vector machines. However, the machine learning-based method depends on feature engineering and requires a large amount of manual participation. In addition, due to the time series characteristics of transaction data, it is difficult for the machine learning-based method to effectively capture the changes in transaction behaviors over time.
[0005] In summary, no effective solution has been proposed in related technologies. Summary of the Invention
[0006] The embodiments of the present application provide an abnormal transaction detection method and device, which at least solve the problem in related technologies that relying on manual rules and machine learning models cannot effectively capture complex data features, resulting in a high rate of missed detections and false detections of abnormal transactions, and thus achieve the effect of improving the efficiency of abnormal transaction detection.
[0007] According to an embodiment of the present application, an abnormal transaction detection method is provided. The method includes: training a long short-term memory network model according to a historical transaction data set to obtain a trained long short-term memory network model; performing abnormal transaction detection on a new transaction data set according to the trained long short-term memory network model in combination with a dual attention mechanism, where the dual attention mechanism includes a time attention mechanism and a feature attention mechanism.
[0008] According to another embodiment of the present application, an abnormal transaction detection device is provided. The device includes: a training module for training a long short-term memory network model based on a historical transaction data set to obtain a trained long short-term memory network model; a detection module for performing abnormal transaction detection on a new transaction data set according to the trained long short-term memory network model in combination with a dual attention mechanism, where the dual attention mechanism includes a time attention mechanism and a feature attention mechanism.
[0009] According to still another embodiment of the present application, a computer-readable storage medium is further provided. A computer program is stored in the computer-readable storage medium, where the computer program is configured to execute the steps in any one of the above method embodiments when running.
[0010] According to still another embodiment of the present application, an electronic device is further provided, including a memory and a processor. A computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in the above method embodiments.
[0011] According to still another embodiment of the present application, a computer program product is further provided, including a computer program that implements the steps in the above method embodiments when executed by a processor.
[0012] Through the above embodiments of the present application, an abnormal transaction detection method is provided. By training a long short-term memory network model with a historical transaction data set, multi-feature data can be introduced into the historical transaction data set to train the long short-term memory network model to obtain a trained long short-term memory network model. Furthermore, by combining the trained long short-term memory network model with a dual attention mechanism, abnormal transactions can be more accurately identified. Specifically, abnormal transaction detection is performed on a new transaction data set through a time attention mechanism and a feature attention mechanism, so as to more effectively discover abnormal transactions at specific times or with specific features. Therefore, the problem in the related art that depends on manual rules and machine learning models and cannot effectively capture complex data features, resulting in a high rate of missed detection and false detection of abnormal transactions, can be solved, and the effect of improving the efficiency of abnormal transaction detection is achieved. Description of the Drawings
[0013] Figure 1 is a hardware structure block diagram of a computer terminal for the abnormal transaction detection method according to an embodiment of the present application;
[0014] Figure 2 is a disassembled schematic diagram of an RNN model in the related art;
[0015] Figure 3 is a flowchart of the abnormal transaction detection method according to an embodiment of the present application;
[0016] Figure 4 It is a structural comparison diagram of the RNN model and the LSTM model according to an embodiment of the present application;
[0017] Figure 5 It is a schematic diagram of the network structure of the LSTM model according to an embodiment of the present application;
[0018] Figure 6 It is a schematic diagram of the forget gate in the LSTM model according to an embodiment of the present application;
[0019] Figure 7 It is a schematic diagram of the input gate in the LSTM model according to an embodiment of the present application;
[0020] Figure 8 It is a schematic diagram of the output gate in the LSTM model according to an embodiment of the present application;
[0021] Figure 9 It is a schematic diagram of the attention mechanism operated by the abnormal transaction detection method according to an embodiment of the present application;
[0022] Figure 10 It is the overall operation flowchart of the LSTM model according to an embodiment of the present application;
[0023] Figure 11 It is a structural block diagram of the abnormal transaction detection device according to an embodiment of the present application. Detailed implementation manners
[0024] In the following, embodiments of the present application will be described in detail with reference to the drawings and in combination with the embodiments.
[0025] It should be noted that the terms "first", "second", etc. in the description and claims of the present application and the above drawings are used to distinguish similar objects, and do not necessarily need to be used to describe a specific order or sequence.
[0026] The method embodiments provided in the embodiments of the present application can be executed on a mobile terminal, a computer terminal, or a similar computing device. Taking running on a computer terminal as an example, Figure 1 It is a hardware structural block diagram of the computer terminal of the abnormal transaction detection method according to an embodiment of the present application. As Figure 1 shown, the computer terminal may include one or more ( Figure 1 only one is shown in Figure 1The structure shown is only schematic and does not limit the structure of the above computer terminal. For example, the computer terminal may further include more or fewer components than those shown in Figure 1 or different configurations from those shown in Figure 1 .
[0027] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the abnormal transaction detection method in the embodiments of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implements the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some instances, the memory 104 may further include a memory remotely provided relative to the processor 102, and these remote memories can be connected to the computer terminal through a network. Examples of the above networks include, but are not limited to, the Internet, enterprise intranets, local area networks, mobile communication networks, and combinations thereof.
[0028] The transmission device 106 is used to receive or send data via a network. Specific examples of the above network may include a wireless network provided by a communication provider of the computer terminal. In one instance, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station and thus can communicate with the Internet. In one instance, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.
[0029] In the related art, traditional abnormal transaction detection methods mostly adopt the following several methods:
[0030] (1) Abnormal transaction detection method based on artificial rules
[0031] The abnormal transaction detection method based on artificial rules usually detects based on a series of fixed rules formulated by experts, such as transaction amount, frequency, etc. However, these fixed rules have obvious defects: (1) Strong rule dependence: The rule-based method is difficult to adapt to the constantly changing money transfer methods and is prone to missed detections; (2) Limited feature selection: Traditional methods usually only focus on a small number of features and fail to comprehensively consider multi-dimensional feature information; (3) Insufficient dynamic data processing ability: In the face of large-scale and complex time series data, the performance of traditional models is often not ideal.
[0032] (2) Abnormal transaction detection method based on machine learning
[0033] The anomaly transaction detection method based on machine learning can alleviate the defects of traditional rule-based methods to a certain extent. Most of these methods use traditional time series analysis methods or simple machine learning models, such as decision trees, random forests, and support vector machines. However, the machine learning-based methods rely on feature engineering and require a large amount of manual participation. In addition, due to the temporal characteristics of transaction data, it is difficult for machine learning-based methods to effectively capture the changes in transaction behavior over time.
[0034] To solve the above problems, the embodiment of this application combines the Long Short-Term Memory (LSTM) model with a dual attention mechanism, which can more accurately identify abnormal transaction behaviors. Among them, the LSTM model, as an advanced time series analysis model, has gradually become a tool for anomaly transaction detection. LSTM is a special recurrent neural network structure that solves the problems of gradient vanishing and gradient explosion existing in the traditional Recurrent Neural Network (RNN) model by introducing three gating units: an input gate, an output gate, and a forget gate. The dual attention mechanism is a mechanism that mimics the human visual and cognitive systems, allowing the LSTM model to focus on relevant parts when processing input data. By introducing the dual attention mechanism, it can automatically learn and selectively focus on important information in the input, improving the performance and generalization ability of the LSTM model.
[0035] The anomaly transaction detection based on the LSTM model is analyzed based on transaction data. First, historical transaction data records are converted into a time series data set through preprocessing such as numerical standardization. Secondly, the time series data set is divided into a training set and a test set according to a certain ratio. The training set is used for the iterative training of the LSTM model, and the test set is used for the effect test of the LSTM model. Furthermore, the trained LSTM model is used for real-time anomaly detection of transaction data.
[0036] Figure 2 It is a schematic diagram of the decomposition of the RNN model in the related art. As Figure 2 shown, the RNN model is a neural network structure with recurrent connections, which is used to process sequential data and data with time dependence. In a recurrent neural network, the connections between neurons form a recurrent path, enabling the network to process sequential data step by step and retain the previous information state. The main characteristics of the RNN model include the following points:
[0037] (1) Recurrent connection: The connections between neurons form a recurrent path, enabling the network to capture the time dependence relationship in sequential data, thereby being able to process variable-length sequential data;
[0038] (2) Shared weights: In an RNN, neurons in the same layer share the same weight parameters, which enables the network to learn patterns and features in sequential data by sharing parameters over time;
[0039] (3) State transfer: The output at each time step in an RNN depends not only on the current input but also on previous state information. Therefore, the network can maintain memory and use historical information to influence the current computation.
[0040] Although the RNN model has strong expressive power in processing sequential data, it is difficult to capture long-distance dependencies, and the problems of gradient vanishing and gradient explosion remain unsolved. Therefore, the LSMT model and the Gated Recurrent Unit (GRU) are used for anomaly transaction detection. The gated recurrent unit can learn to control the flow of information, which helps the LSTM model better handle long-term dependencies.
[0041] Figure 3 is a flowchart of the anomaly transaction detection method according to an embodiment of the present application. As Figure 3 shown, the method may specifically include the following steps:
[0042] Step S302: Train the long short-term memory network model according to the historical transaction data set to obtain a trained long short-term memory network model.
[0043] In this step, in order to reflect the data changes of historical transaction data in the time dimension, the long short-term memory network LSTM model is used for training. At the same time, in order to reflect the feature changes of historical transaction data in each dimension, features such as transaction amount, account balance, transaction location, account status, information of the trading party, and information of the counterparty are collected, that is, historical transaction data. In addition, features such as the change rate of the transaction amount and the trading geographical location can also be collected. Here, no specific limitations are imposed on the collected historical transaction data. By introducing more historical transaction data to enrich the features in the LSTM model, the accuracy of the LSTM model for anomaly transaction detection is further improved.
[0044] In this embodiment, the LSTM model is a special type of neural network that can solve the problems of gradient vanishing or gradient explosion encountered by traditional RNN models when processing long sequence data. Specifically, as Figure 4 shown, the LSTM model has three additional key gated recurrent units σ compared to the RNN model. Figure 5 is a schematic diagram of the network structure of the LSTM model according to an embodiment of the present application. As Figure 5As shown, the gated recurrent unit includes an input gate, a forget gate, and an output gate respectively. There are two key variables in the LSTM model, namely the hidden state H and the cell state C. Among them, the hidden state H is responsible for memorizing short-term information, especially the information at the current time step, and the memory cell C is responsible for memorizing long-term information.
[0045] Figure 6 It is a schematic diagram of the forget gate in the LSTM model according to an embodiment of the present application. As Figure 6 shown, the forget gate can determine which information in the cell state of the LSTM model should be forgotten or discarded, that is, no longer used for subsequent time step calculations. The forget gate also calculates a gating signal (a value between 0 and 1) through a sigmoid function, which can effectively control the update of the cell state, avoid useless or outdated information from interfering with the calculation of the current time step, and reduce the noise in the learning process.
[0046] Figure 7 It is a schematic diagram of the input gate in the LSTM model according to an embodiment of the present application. As Figure 7 shown, the input gate can determine how much information in the input data at the current time step should be stored in the cell state of the LSTM model. By calculating the input data and the hidden state of the previous time step through a learnable sigmoid function, a value between 0 and 1 is obtained as the gating signal, which represents the influence degree of each feature of the input data on the current unit state. In addition, the input gate also generates a candidate cell state through another learnable tanh function, and this candidate cell state will be stored in the cell state according to the gating signal of the input gate. Through multiplication operation, the input gate can determine which parts of the new input data are added to the cell state and pass the operation result to the cell state.
[0047] Figure 8 It is a schematic diagram of the output gate in the LSTM model according to an embodiment of the present application. As Figure 8 shown, the output gate controls how the hidden state at the current time step and the cell state at the next moment affect the final output. By using a sigmoid activation function to determine which parts of the input data will be activated, the output gate also includes a tanh activation function, which is used to generate a value between -1 and 1, representing the candidate value of the cell state at the current time step. Through multiplication operation, the output gate sends the screened and updated information in the cell state to the hidden state of the next time step and generates the final output based on this hidden state, ensuring the accuracy and relevance of the output information.
[0048] Through the interactive cooperation among the above-mentioned gated recurrent units, the LSTM model can effectively handle the long-term dependence problem in time series data, control the information flow and memory storage, thereby improving the performance and generalization ability of the LSTM model.
[0049] Specifically, the steps for the LSTM model to process time series are as follows:
[0050] (1) Dataset processing.
[0051] Specifically, it is processed into a time step model dataset supported by the LSTM model, and at the same time, the hidden state H and cell state C of the LSTM model are initialized.
[0052] (2) Step-by-step prediction.
[0053] Specifically, during the prediction process, each time the input to the LSTM model is the input data of the current time step and the hidden state of the previous time step, and the output result of the current time step is calculated through the LSTM model. Then, the output result of the current time step is used as the input for the next time step, and this step is repeated until the preset number of loops is reached or the stop condition is satisfied.
[0054] (3) Iterative prediction.
[0055] Specifically, after each prediction, the prediction result is compared with the true value to evaluate the prediction error, and the prediction result is added to the input time series. By continuously iteratively adjusting the input data of the LSTM model, longer-term time series prediction is achieved.
[0056] It should be noted that in the actual application process, the preset number of loops or the stop condition needs to be selected according to the specific situation to balance the prediction accuracy and calculation efficiency.
[0057] In some embodiments, before training the long short-term memory network model based on the historical transaction dataset, the method further includes: obtaining historical transaction data and preprocessing the historical transaction data to obtain a historical transaction dataset, where the historical transaction data at least includes one of the following: transaction amount, account balance, transaction location, account status, transaction party information, and counterparty information.
[0058] In this embodiment, the preprocessing of the historical transaction data at least includes one of the following: mode filling and single-value filling.
[0059] Specifically, the historical transaction data for training the LSTM model is exported from the bank system and is specifically preprocessed according to each data feature type. As shown in Table 1 below:
[0060] Table 1
[0061]
[0062] Among them, for numerical features such as transaction amount or account balance, if there are null values for these features, they can be filled with 0.
[0063] For text features such as the name of the trading counterparty, if there are null values for these features, the mode can be used to fill the null values.
[0064] For enumerated features such as transaction location, the processing method is similar to that of text features, and the mode is used to fill the missing values.
[0065] For other features such as account status, these features may contain binary information (such as whether the account is activated) or a small amount of categorical information, and appropriate filling is also required to ensure that the LSTM model can effectively process these features.
[0066] In some embodiments, the long short-term memory network model is trained according to the historical transaction data set to obtain a trained long short-term memory network model, including: converting each transaction data in the historical transaction data set into a feature vector through one-hot encoding or numerical normalization, and constructing a time series data set, where the feature vector corresponding to each transaction data is used as a time step; training the long short-term memory network model according to the time series data set to obtain a trained long short-term memory network model.
[0067] In this embodiment, each transaction data is converted into a feature vector that can be input into the LSTM model by means of numerical normalization (Normalization) and one-hot encoding (One-Hot Encoding).
[0068] Specifically, one-hot encoding is used to process categorical features such as transaction location and trading counterparty type. One-hot encoding converts each categorical value into a binary vector, where each bit in the vector represents a category, and only one bit is 1, and the rest are 0. This encoding method can input categorical information into the neural network in binary form, facilitating the model to learn the relationships between categorical features.
[0069] Numerical normalization is used to process numerical features such as transaction amount and account balance. Numerical normalization scales the feature values to a specific range, usually between 0 and 1, to eliminate the influence of the dimension of different features and avoid a certain feature dominating the model learning process due to a large magnitude. Common numerical normalization methods include min-max scaling (Min-Max Scaling), Z-Score normalization, etc.
[0070] Arrange the feature vectors in the order of transaction occurrence to construct a time series dataset. For each user or account, use the records of its recent thirty transactions to construct a sequence, and the feature vector of each transaction becomes a time step in the sequence. The time series dataset not only contains the feature information of each transaction but also maintains the temporal relationship between transactions, providing the necessary context information for the subsequent learning of the LSTM model. Furthermore, train the LSTM model according to the constructed time series dataset. The trained LSTM model is the trained long short-term memory network model, which can accurately identify potential abnormal transaction behaviors based on the input transaction sequence data. In this process, the LSTM model can capture the long-term dependencies in the transaction data by using its internal memory units (cell states) and gated recurrent units, thus showing better performance in the abnormal transaction detection task.
[0071] Step S304: Perform abnormal transaction detection on the new transaction dataset according to the trained long short-term memory network model and in combination with a dual attention mechanism, where the dual attention mechanism includes a temporal attention mechanism and a feature attention mechanism.
[0072] In this step, to provide interpretability for the importance of different data features and time steps, the dual attention mechanism (temporal attention mechanism and feature attention mechanism) is used to calculate the weights of features and time steps respectively, enabling the LSTM model to assign different weights at different positions in the time series so as to focus on the most relevant parts when processing each time series.
[0073] Figure 9 is a schematic diagram of the attention mechanism operated according to the abnormal transaction detection method of the embodiment of the present application. As Figure 9 shown, if calculating the weight values for a set of input data H = [h1, h2, h3,..., hn] through the attention mechanism, a query vector q related to this calculation task is often required. Calculate the correlation between the query variable q and each input data h i through a scoring function S to obtain a score, and then normalize these scores through the softmax function. The normalized result is the attention distribution a = [a1, a2, a3,..., an] of the query variable q on each input data h i where each value corresponds one-to-one with the score of the input h i Taking the attention distribution a i as an example, the calculation formula is as follows:
[0074]
[0075] where, h iis the input data in the input attention mechanism, q is the query vector related to the computing task, and s(h i , q) is the attention score at the (i)-th time step, is the exponential sum of the attention scores at all time steps, which is used for the normalization of the Softmax function to ensure that the weights are between 0 and 1.
[0076] According to the attention distribution a i , information can be selectively extracted from the input h i . In the embodiment of the present application, according to the attention distribution a i , the input h i is weighted and summed. The final result context reflects the content that the LSTM model should currently focus on. The calculation formula of the final result context is as follows:
[0077]
[0078] where a i is the attention weight at the i-th time step, and the sum of all attention weights is 1. h i is the input data in the input attention mechanism.
[0079] In this embodiment, according to the trained long short-term memory network model and combined with the dual attention mechanism, abnormal transaction detection is performed on the new transaction dataset, including: calculating each feature vector in the new transaction dataset according to the time attention mechanism in the trained long short-term memory network model to obtain the first weight value corresponding to each feature vector, and determining the transaction data corresponding to the feature vector with the highest first weight value as the time abnormal transaction data; calculating each feature of the feature vector in the time abnormal transaction data according to the feature attention mechanism in the trained long short-term memory network model to obtain the second weight value corresponding to each feature, and determining the transaction data corresponding to the feature with the highest second weight value as the feature abnormal transaction data.
[0080] In some embodiments, calculating each feature vector in the new transaction dataset according to the time attention mechanism in the trained long short-term memory network model to obtain the first weight value corresponding to each feature vector includes: obtaining the first query vector corresponding to the new transaction dataset; calculating the first score of each feature vector in the new transaction dataset according to the time attention mechanism in the trained long short-term memory network model, the first query vector, and the scoring function; and normalizing the first score of each feature vector through the softmax function to obtain the first weight value corresponding to each feature vector.
[0081] Specifically, the scoring function S includes at least one of the following:
[0082] (1) Additive function
[0083] s(h, q) = v T tanh(Wh + Uq)
[0084] (2) Dot product function
[0085] s(h, q) = h T q
[0086] (3) Scaled dot product function
[0087]
[0088] (4) Bilinear function
[0089] s(h, q) = h T Wq
[0090] where Wh, Wq, Uq are weight matrices, v T , h T are input vectors, and D is the dimension of the input vectors.
[0091] In this embodiment, Figure 10 is the overall operation flowchart of the LSTM model according to the embodiment of the present application. As Figure 10 shown, a set of input data X = [x1, x2, x3,..., xn] is input into the LSTM model, and after processing, the input data H = [h1, h2, h3,..., hn] that can be input into the time attention mechanism ( Figure 10 the attention layer 1 in it) is obtained.
[0092] In the LSTM model, for the new transaction data set, a corresponding first query vector is generated. In the time attention mechanism of the LSTM, the query vector usually comes from the hidden state of the model, especially the hidden state of the last time step, which can be regarded as the summary of the model for historical transaction information or the preliminary identification of abnormal transaction patterns. The first query vector can be used to calculate the weight value of each time step.
[0093] Calculate the first score for each feature vector in the new transaction dataset through a scoring function S (such as an additive function) and the first query vector to determine the importance of each time step (i.e., each transaction data). After obtaining the first score, normalize it through the Softmax function to obtain the first weight value corresponding to each feature vector. Among them, the Softmax function converts the first score of each feature vector into a probability value, ensuring that the sum of all weight values is 1 while maintaining the relative ratio between the weight values unchanged. The larger the first weight value, the more important the transaction data represented by the feature vector is in detecting anomalies, and the LSTM model will assign a higher attention weight to such transaction data.
[0094] Through the above, the time attention mechanism can identify the key transaction information in the new transaction dataset and the importance of this information for detecting abnormal transactions. For example, if a certain transaction has significant differences from the historical pattern in terms of geographical location, counterparty, or transaction time, the LSTM model will automatically assign a higher first weight value to this transaction, prompting relevant personnel to focus on it. This not only improves the performance of the LSTM model but also enhances the interpretability of the LSTM model, making the detection results more accurate.
[0095] In some embodiments, calculate the second weight value corresponding to each feature of the feature vector in the time abnormal transaction data according to the feature attention mechanism in the trained long short-term memory network model, including: obtaining the second query vector corresponding to the time abnormal transaction data; calculating the second score of each feature of the feature vector in the time abnormal transaction data according to the feature attention mechanism, the second query vector, and the scoring function in the trained long short-term memory network model; normalizing the second score of each feature through the Softmax function to obtain the second weight value corresponding to each feature.
[0096] Specifically, the scoring function includes at least one of the following: additive function; dot product function; scaled dot product function; bilinear function. The specific function formula is the same as the previous formula and will not be repeated here.
[0097] In this embodiment, as Figure 10 shown, input the time abnormal transaction data determined by the time attention mechanism into the feature attention mechanism ( Figure 10 attention layer 2 therein) to calculate the weight value and generate the corresponding second query vector, and the second query vector can be used to calculate the weight value of each feature.
[0098] For each feature, a second score is calculated through a scoring function S (such as an additive function) and a second query vector to determine the importance of each feature. After obtaining the second score, it is normalized through the Softmax function to obtain the second weight value corresponding to each feature. Among them, the Softmax function converts the second score of each feature into a probability value, ensuring that the sum of all weight values is 1 while maintaining the relative ratio between the weight values unchanged. The larger the second weight value, the more important the transaction data represented by this feature is in detecting anomalies, and the LSTM model will assign a higher attention weight to such transaction data.
[0099] According to the weights corresponding to different features in the attention layer 2 of the LSTM model, abnormal transaction points can be located, such as abnormal transaction locations, abnormal transaction counterparts, abnormal transaction amounts, etc.
[0100] It should be noted that according to the actual requirements of the LSTM model, the first query vector and the second query vector can be the same or different, and no specific limitation is made here.
[0101] Through the above embodiments of the present application, an abnormal transaction detection method is provided. By training a long short-term memory network model with a historical transaction data set, multi-feature data can be introduced into the historical transaction data set to train the long short-term memory network model to obtain a trained long short-term memory network model. Furthermore, by combining the trained long short-term memory network model with a dual attention mechanism, abnormal transactions can be more accurately identified. Specifically, abnormal transaction detection is performed on a new transaction data set through a time attention mechanism and a feature attention mechanism, so as to more effectively discover abnormal transactions at a specific time or with specific features. Therefore, it is possible to solve the problem in the related art that relying on artificial rules and machine learning models cannot effectively capture complex data features, resulting in a high rate of missed detection and false detection of abnormal transactions, and thus achieving the effect of improving the efficiency of abnormal transaction detection.
[0102] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions for causing a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application.
[0103] The embodiments of the present application also provide an abnormal transaction detection deviceFigure 11 is a structural block diagram of an abnormal transaction detection device according to an embodiment of the present application. As Figure 11 shown, the abnormal transaction detection device 1100 includes: a training module 1110 and a detection module 1120.
[0104] The training module 1110 is configured to train a long short-term memory network model according to a historical transaction data set to obtain a trained long short-term memory network model;
[0105] The detection module 1120 is configured to perform abnormal transaction detection on a new transaction data set according to the trained long short-term memory network model in combination with a dual attention mechanism, where the dual attention mechanism includes a time attention mechanism and a feature attention mechanism.
[0106] It should be noted that the above-mentioned respective modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above-mentioned modules are all located in the same processor; or, the above-mentioned respective modules are separately located in different processors in any combination form.
[0107] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, where the computer program is configured to execute the steps in any one of the above method embodiments when running.
[0108] In an exemplary embodiment, the above computer-readable storage medium may include, but is not limited to: a USB flash drive, a read-only memory (ROM for short), a random access memory (RAM for short), a mobile hard disk, a magnetic disk, or an optical disc and other various media that can store a computer program.
[0109] An embodiment of the present application further provides an electronic device, including a memory and a processor, where a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.
[0110] In an exemplary embodiment, the above electronic device may further include a transmission device and an input / output device, where the transmission device is connected to the above processor, and the input / output device is connected to the above processor.
[0111] According to another embodiment of the present disclosure, there is also provided a computer program product, including a computer program, where the computer program implements the steps of the methods described in the respective embodiments of the present disclosure when executed by a processor.
[0112] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary embodiments, and details thereof will not be repeated here.
[0113] Obviously, those skilled in the art should understand that the various modules or steps of the present application described above can be implemented by a general-purpose computing device. They can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. They can be implemented by program code executable by the computing device, so that they can be stored in a storage device and executed by the computing device. And in some cases, the steps shown or described can be executed in a different order from here, or they can be separately fabricated into individual integrated circuit modules, or multiple modules or steps among them can be fabricated into a single integrated circuit module for implementation. In this way, the present application is not limited to any specific combination of hardware and software.
[0114] The above are only the preferred embodiments of the present application and are not used to limit the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the principle of the present application shall be included in the protection scope of the present application.
Claims
1. A method for detecting abnormal transactions, characterized in that: include: The long short-term memory network model is trained according to the historical transaction data set to obtain a trained long short-term memory network model; Abnormal transactions are detected on a new transaction data set based on the trained long short-term memory network model and in combination with a dual attention mechanism, wherein the dual attention mechanism includes a time attention mechanism and a feature attention mechanism.
2. The method according to claim 1, characterized in that Before training the long short-term memory network model according to the historical transaction data set, the method further includes: Acquire historical transaction data, and preprocess the historical transaction data to obtain a historical transaction data set, wherein the historical transaction data includes at least one of the following: transaction amount, account balance, transaction location, account status, transaction party information, and transaction counterparty information.
3. The method according to claim 2, characterized in that The preprocessing of the historical transaction data includes at least one of the following: mode filling and single value filling.
4. The method according to claim 1, characterized in that The long short-term memory network model is trained according to the historical transaction data set to obtain a trained long short-term memory network model, including: Convert each transaction data in the historical transaction data set into a feature vector by one-hot encoding or numerical standardization to construct a time series data set, wherein the feature vector corresponding to each transaction data is used as a time step; The long short-term memory network model is trained according to the time series data set to obtain a trained long short-term memory network model.
5. The method according to claim 1, characterized in that: According to the trained long short-term memory network model and combined with the dual attention mechanism, abnormal transaction detection is performed on the new transaction data set, including: Calculate each feature vector in the new transaction data set according to the time attention mechanism in the trained long short-term memory network model to obtain a first weight value corresponding to each feature vector, and determine the transaction data corresponding to the feature vector with the highest first weight value as the time-abnormal transaction data; According to the feature attention mechanism in the trained long short-term memory network model, each feature of the feature vector in the time-abnormal transaction data is calculated to obtain a second weight value corresponding to each feature, and the transaction data corresponding to the feature with the highest second weight value is determined as the feature-abnormal transaction data.
6. The method according to claim 5, characterized in that The step of calculating each feature vector in the new transaction data set according to the time attention mechanism in the trained long short-term memory network model to obtain a first weight value corresponding to each feature vector includes: Acquire a first query vector corresponding to the new transaction data set; Calculate a first score for each feature vector in the new transaction dataset according to the temporal attention mechanism in the trained long short-term memory network model, the first query vector and a scoring function; The first score of each eigenvector is normalized by a soft maximum function to obtain a first weight value corresponding to each eigenvector.
7. The method according to claim 5, characterized in that The step of calculating each feature of the feature vector in the time-abnormal transaction data according to the feature attention mechanism in the trained long short-term memory network model to obtain a second weight value corresponding to each feature includes: Acquire a second query vector corresponding to the time-abnormal transaction data; Calculate a second score for each feature of the feature vector in the time-abnormal transaction data according to the feature attention mechanism in the trained long short-term memory network model, the second query vector and the scoring function; The second score of each feature is normalized by a soft maximum function to obtain a second weight value corresponding to each feature.
8. The method according to any one of claims 6 to 7, characterized in that: in, The scoring function includes at least one of the following: Additive functions; Dot product function; Scaling the dot product function; Bilinear function.
9. An abnormal transaction detection device, characterized in that: include: A training module is used to train the long short-term memory network model based on the historical transaction data set to obtain a trained long short-term memory network model; A detection module is used to perform abnormal transaction detection on a new transaction data set based on the trained long short-term memory network model and in combination with a dual attention mechanism, wherein the dual attention mechanism includes a time attention mechanism and a feature attention mechanism.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 8 when executed by a processor.
11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 8 are implemented.
12. A computer program product, comprising a computer program and instructions, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method described in any one of claims 1 to 8 are implemented.