Abnormal transaction behavior identification method

Abstract

The invention discloses an abnormal transaction behavior identification method, which belongs to the technical field of data processing, and can learn an association relationship between historical data provided by a user and an abnormal transaction through a data mining and machine learning algorithm so as to form a machine learning model capable of automatically predicting a transaction abnormal risk. According to the method, potential abnormal transaction behaviors can be quickly and accurately identified, a user can be assisted in timely finding possible abnormal transaction behaviors, the abnormal transaction behaviors can be monitored and reported in real time, the risk management level of the user is effectively improved, and illegal behaviors such as financial fraud and money laundering are prevented.

Description

Technical Field

[0001] The present invention belongs to the technical field of data processing, and particularly relates to a method for identifying abnormal transaction behaviors. Background Art

[0002] With the rapid development of the financial market and the wide application of financial technology, the volume of financial transactions has been increasing, and abnormal behaviors in financial transactions have also been on the rise. These abnormal behaviors may include illegal acts such as financial fraud, money laundering, insider trading, etc., bringing huge risks and losses to the financial market. In order to prevent and combat these abnormal behaviors, financial institutions need to establish and improve an abnormal transaction behavior identification system.

[0003] In the prior art, there is usually no dedicated staff to analyze abnormal transactions, resulting in the knowledge of risks only after they occur, with poor risk resistance and difficulty in effectively reducing losses. If additional dedicated staff are added to evaluate these transactions, a large amount of labor costs need to be increased to identify a large amount of transaction data. Summary of the Invention

[0004] The present invention provides a method for identifying abnormal transaction behaviors to solve the technical problem of untimely discovery of abnormal transactions in the prior art.

[0005] A method for identifying abnormal transaction behaviors includes:

[0006] Obtaining a historical data set uploaded by a user; wherein, the historical data set includes historical transaction data and abnormal behavior labels of the transaction data at historical times;

[0007] After the user uploads the historical data set, calling a machine learning model from a database and deploying the machine learning model according to the historical data set to obtain a machine learning model corresponding to the user;

[0008] After deploying the machine learning model corresponding to the user, obtaining the current transaction data uploaded by the user and using the current transaction data as the data corresponding to the machine learning model corresponding to the user to obtain the predicted probability that the current transaction is abnormal;

[0009] When the predicted probability that the current transaction is abnormal is greater than the probability threshold preset by the user, it is determined that the current transaction is an abnormal transaction behavior, realizing the identification of abnormal transaction behaviors based on user data.

[0010] Further, before calling the machine learning model from the database, it further includes:

[0011] Performing data cleaning on the historical transaction data and the abnormal behavior labels of the transaction data at historical times to remove missing values.

[0012] Further, call a machine learning model from a database and deploy the machine learning model according to the historical data set to obtain a machine learning model corresponding to a user, including:

[0013] Call multiple machine learning models from the database to obtain candidate machine learning models;

[0014] Train each candidate machine learning model according to the historical data set to obtain a trained candidate machine learning model;

[0015] Deploy a machine learning model corresponding to a user according to the trained candidate machine learning model.

[0016] Further, deploying a machine learning model corresponding to a user according to the trained candidate machine learning model includes:

[0017] Determine the candidate machine learning model with the highest recognition accuracy as the machine learning model corresponding to the user according to the trained candidate machine learning model and deploy it;

[0018] Alternatively, determine a first association relationship between candidate machine learning models according to the trained candidate machine learning models, and deploy the candidate machine learning models according to the first association relationship to obtain a machine learning model corresponding to the user; wherein, the first association relationship is: determine the weight of each candidate machine learning model according to the trained candidate machine learning model, and after weighting the output of the candidate machine learning model with the weight, obtain a prediction probability;

[0019] Alternatively, determine a second association relationship between candidate machine learning models according to the trained candidate machine learning models, and deploy the candidate machine learning models according to the second association relationship to obtain a machine learning model corresponding to the user; wherein, the second association relationship is: construct a secondary classification model, use the output of the candidate machine learning model as the output of the secondary classification model, and enable the secondary classification model to output a prediction probability.

[0020] Further, training each candidate machine learning model according to the historical data set to obtain a trained candidate machine learning model includes:

[0021] Train the candidate machine learning models according to the historical data set in a multi-process parallel execution manner to obtain trained candidate machine learning models.

[0022] Further, training the candidate machine learning models includes:

[0023] Initialize the model parameters of the candidate machine learning models between the parameter upper limit and the parameter lower limit multiple times to obtain multiple model parameter individuals;

[0024] Based on the historical data set, obtain the loss function value corresponding to each model parameter individual, and determine the optimal parameter individual and the worst parameter individual according to the loss function value corresponding to each model parameter individual;

[0025] Based on the worst parameter individual, perform a local fine search on the model parameter individuals to obtain the model parameter individuals after the local fine search;

[0026] For the model parameter individuals after the local fine search, based on the optimal parameter individual, perform a solution space diffusion search on the model parameter individuals to obtain the model parameter individuals after the diffusion search;

[0027] For the model parameter individuals after the diffusion search, perform a global search of the solution space on the model parameter individuals to obtain the model parameter individuals after the global search;

[0028] Judge whether the current number of training times has reached the maximum number of training times. If so, use the model parameter individuals after the global search as the final model parameters corresponding to the candidate machine learning model to obtain the candidate machine learning model after training. Otherwise, return to the step of obtaining the loss function value.

[0029] Further, based on the worst parameter individual, perform a local fine search on the model parameter individuals to obtain the model parameter individuals after the local fine search, including:

[0030] For any model parameter individual, aim at the model parameter individual being far from the worst parameter individual, and determine the first update amount according to the worst parameter individual;

[0031] According to the first update amount, perform a local fine search on the model parameter individual to obtain the model parameter individual after the local fine search.

[0032] Further, for the model parameter individuals after the local fine search, based on the optimal parameter individual, perform a solution space diffusion search on the model parameter individuals to obtain the model parameter individuals after the diffusion search, including:

[0033] For the model parameter individuals after the local fine search, determine the average position of all model parameter individuals in the solution space;

[0034] According to the average position of all model parameter individuals in the solution space and the optimal parameter individual, perform a diffusion search on the model parameter individuals so that the model parameter individuals perform population cooperation search in the solution space to obtain the model parameter individuals after the diffusion search.

[0035] Further, for the individual model parameters after diffusion search, a global search of the solution space is performed on the individual model parameters to obtain the individual model parameters after global search, including:

[0036] For the individual model parameters after diffusion search, based on spiral flight and greedy strategy, a global search of the solution space is performed on the individual model parameters to obtain the individual model parameters after global search.

[0037] Further, after determining that the current transaction is an abnormal transaction behavior, it further includes:

[0038] Archive the abnormal transaction behavior data and generate an abnormal transaction behavior reminder message to enable the user to handle the abnormal transaction in a timely manner.

[0039] An abnormal transaction behavior recognition method provided by the present invention can, through data mining and machine learning algorithms, learn the correlation between historical data provided by users and abnormal transactions, thereby forming a machine learning model capable of automatically predicting the risk of transaction anomalies, can quickly and accurately identify potential abnormal transaction behaviors, can assist users in timely discovering potentially abnormal transaction behaviors, can monitor and report abnormal transaction behaviors in real time, effectively improve the user's risk management level, and prevent illegal behaviors such as financial fraud and money laundering. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings herein are incorporated into the specification and form a part of the specification, showing embodiments consistent with the present invention and used together with the specification to explain the principles of the present invention.

[0041] Figure 1 It is a flowchart of an abnormal transaction behavior recognition method provided by an embodiment of the present invention.

[0042] Figure 2 It is a flowchart of training a candidate machine learning model provided by an embodiment of the present invention.

[0043] Through the above accompanying drawings, specific embodiments of the present invention have been shown, and there will be more detailed descriptions hereinafter. These drawings and textual descriptions are not intended to limit the scope of the inventive concept in any way, but to illustrate the concept of the present invention to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0044] Here, the exemplary embodiments will be described in detail, and the examples are shown in the accompanying drawings. When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0045] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0046] As Figure 1 shown, the embodiments of the present invention provide a method for identifying abnormal transaction behaviors, including:

[0047] S101. Obtain the historical data set uploaded by the user. Among them, the historical data set includes historical transaction data and the abnormal behavior labels of the transaction data at historical times.

[0048] The historical data set is the data and events that actually existed at historical times. By performing machine learning on this kind of data, the probability of similar events occurring can be predicted, so as to realize risk warning. At the same time, it replaces manual analysis, which can effectively reduce labor costs and improve efficiency.

[0049] S102. After the user uploads the historical data set, call the machine learning model from the database and deploy the machine learning model according to the historical data set to obtain the machine learning model corresponding to the user.

[0050] This step can be deployed on a cloud server. The cloud server receives the historical data set uploaded by the user and then schedules the machine learning model to learn, which can help the user predict similar risks and play an auxiliary decision-making role.

[0051] S103. After deploying the machine learning model corresponding to the user, obtain the current transaction data uploaded by the user and use the current transaction data as the data corresponding to the machine learning model corresponding to the user to obtain the predicted probability that the current transaction is abnormal.

[0052] Since the machine learning model generally requires regular input data, the current transaction data needs to be sorted in the form of historical data, so as to achieve effective identification.

[0053] Optionally, in order to ensure the regularity of the data, the data format can also be unified for all data. For example: when constructing a data matrix with transaction data, the data dimensions of each transaction data are the same, while the number of transactions is different. Therefore, one transaction data can be used to construct one row of data, and a data matrix can be constructed according to the number of transactions. The data matrix can have a fixed number of rows. If there are more rows, they will be removed; if there are fewer rows, they will be filled with zeros to ensure the regularity of the data.

[0054] The non-numeric data in the transaction data can also be converted into numeric data, and after constructing the data matrix, the data can be normalized to reduce the complexity of the data.

[0055] S104. When the predicted probability of an abnormality in the current transaction is greater than the user - preset probability threshold, determine that the current transaction is an abnormal transaction behavior, thus realizing the identification of abnormal transaction behaviors based on user data.

[0056] An abnormal transaction behavior identification method provided by the present invention can, through data mining and machine - learning algorithms, learn the correlation between historical data provided by users and abnormal transactions, thereby forming a machine - learning model capable of automatically predicting transaction abnormal risks, quickly and accurately identifying potential abnormal transaction behaviors, assisting users in promptly discovering potentially abnormal transaction behaviors, real - time monitoring and reporting abnormal transaction behaviors, effectively improving the user's risk management level, and preventing illegal behaviors such as financial fraud and money laundering.

[0057] In an embodiment of the present invention, before calling the machine - learning model from the database, it further includes:

[0058] Clean the historical transaction data and the abnormal behavior labels of this transaction data at historical times to remove missing values.

[0059] For example, when there is missing information in the transaction data, this piece of transaction data should be removed.

[0060] In an embodiment of the present invention, call the machine - learning model from the database and deploy the machine - learning model according to the historical data set to obtain a machine - learning model corresponding to the user, including:

[0061] Call multiple machine - learning models from the database to obtain candidate machine - learning models.

[0062] Train each candidate machine - learning model according to the historical data set to obtain the candidate machine - learning models after training.

[0063] Deploy the machine - learning model corresponding to the user according to the candidate machine - learning models after training.

[0064] Optionally, since the data matrix is recognized in the embodiment of the present invention, a machine - learning model with an input form of a data matrix (such as a convolutional neural network) can be used as a candidate machine - learning model. The multiple machine - learning models can be the same or different.

[0065] In an embodiment of the present invention, deploying the machine - learning model corresponding to the user according to the candidate machine - learning models after training includes:

[0066] According to the candidate machine - learning models after training, determine the candidate machine - learning model with the highest recognition accuracy as the machine - learning model corresponding to the user and deploy it.

[0067] There may be certain biases in the training process of the machine learning model. Therefore, the candidate machine learning model with the highest recognition accuracy can be selected as the machine learning model corresponding to the user, which can resist training biases to a certain extent.

[0068] Alternatively, based on the candidate machine learning models after training, determine the first association relationship between the candidate machine learning models, and deploy the candidate machine learning models according to the first association relationship to obtain the machine learning model corresponding to the user. Among them, the first association relationship is: determine the weight of each candidate machine learning model based on the candidate machine learning models after training, and after weighting the output of the candidate machine learning model with the weight, obtain the prediction probability.

[0069] Optionally, since the recognition accuracies of different candidate machine learning models after training are not very different, the weights of each candidate machine learning model in the embodiments of the present invention are set to the same value. For example, the weights of 4 candidate machine learning models can all be set to 0.25.

[0070] Alternatively, based on the candidate machine learning models after training, determine the second association relationship between the candidate machine learning models, and deploy the candidate machine learning models according to the second association relationship to obtain the machine learning model corresponding to the user. Among them, the second association relationship is: construct a secondary classification model, use the output of the candidate machine learning model as the output of the secondary classification model, and enable the secondary classification model to output the prediction probability. For example, historical data can be used as the input of the candidate machine learning model, the outputs of multiple candidate machine learning models are used as the input of the secondary classification model, and the label corresponding to the historical data is used as the expected output, so as to realize the training of the secondary classification model and enable the secondary classification model to output the prediction probability.

[0071] Even if the best parameters are found in the training process, there is still a phenomenon of misrecognition in the process of recognizing the machine learning model. Although the probability is extremely small, it is still possible to occur. Therefore, in the embodiments of the present invention, the machine learning model is deployed through the second and third methods, which can effectively resist recognition errors.

[0072] In the embodiments of the present invention, training each candidate machine learning model according to the historical data set to obtain the candidate machine learning model after training includes:

[0073] Training the candidate machine learning model according to the historical data set in a multi-process parallel execution manner to obtain the candidate machine learning model after training.

[0074] As Figure 2 shown, training the candidate machine learning model includes:

[0075] S201. Initialize the model parameters of the candidate machine learning model multiple times between the parameter upper limit and the parameter lower limit to obtain multiple model parameter individuals.

[0076] It should be noted that in the embodiments of the present invention, the model parameters refer to one or more parameters of the candidate machine learning model. That is to say, only one parameter (such as weight) can be optimized, or multiple parameters (such as weight and threshold) can be optimized simultaneously.

[0077] Initializing the model parameters of the candidate machine learning model multiple times between the parameter upper limit and the parameter lower limit may include: initializing the model parameters of the candidate machine learning model between the parameter upper limit and the parameter lower limit to obtain a model parameter individual, and then repeating to obtain multiple model parameter individuals.

[0078] S202. According to the historical data set, obtain the loss function value corresponding to each model parameter individual, and determine the optimal parameter individual and the worst parameter individual according to the loss function value corresponding to each model parameter individual.

[0079] Optionally, in the embodiments of the present invention, the root mean square error loss, the mean square error loss, and the cross entropy loss are used to obtain the loss function value corresponding to each model parameter individual.

[0080] S203. Based on the worst parameter individual, perform a local fine search on the model parameter individuals to obtain the model parameter individuals after the local fine search.

[0081] S204. For the model parameter individuals after the local fine search, based on the optimal parameter individual, perform a solution space diffusion search on the model parameter individuals to obtain the model parameter individuals after the diffusion search.

[0082] S205. For the model parameter individuals after the diffusion search, perform a solution space global search on the model parameter individuals to obtain the model parameter individuals after the global search.

[0083] S206. Determine whether the current number of training times has reached the maximum number of training times. If so, use the model parameter individuals after the global search as the final model parameters corresponding to the candidate machine learning model to obtain the candidate machine learning model after training; otherwise, return to the step of obtaining the loss function value.

[0084] In the embodiments of the present invention, based on the worst parameter individual, performing a local fine search on the model parameter individuals to obtain the model parameter individuals after the local fine search includes:

[0085] For any model parameter individual, aiming at the model parameter individual being far from the worst parameter individual, and determining a first update amount according to the worst parameter individual.

[0086] Perform a local fine search on the individual model parameters according to the first update amount to obtain the individual model parameters after the local fine search.

[0087] Optionally, an embodiment of the present invention provides a method for local fine search, which may include:

[0088]

[0089] Among them, represents the d-th dimension parameter in the i-th individual model parameter during the t-th training process, where i = 1, 2,..., N, N represents the total number of individual model parameters, d = 1, 2,..., D, and D represents the total dimension of the parameters in the individual model parameters. represents the d-th dimension parameter in the individual model parameter after the local fine search. K represents the step size control coefficient, and K belongs to [-1, 1]. β represents a random number generated between (0, 1). id represents between (0, 1). for generating a random number, i represents the d-th dimension parameter in the worst individual parameter, and F w represents the fitness corresponding to the i-th individual model parameter, and F

[0090] represents the fitness corresponding to the worst individual parameter. ε represents the noise term, which is set to 0.0001. The fitness can be set to 1 / (loss function value + ε).

[0091] In an embodiment of the present invention, for the individual model parameter after the local fine search, based on the optimal individual parameter, perform a solution space diffusion search on the individual model parameter to obtain the individual model parameter after the diffusion search, including:

[0092] For the individual model parameter after the local fine search, determine the average position of all individual model parameters in the solution space.

[0093] According to the average position of all individual model parameters in the solution space and the optimal individual parameter, perform a diffusion search on the individual model parameter so that the individual model parameter performs a population cooperation search in the solution space to obtain the individual model parameter after the diffusion search.

[0094] Optionally, an embodiment of the present invention provides a solution space diffusion search method, which may include:

[0095]

[0096] Among them, Denote the d - th dimension parameter in the j - th individual of model parameters after the j - th local fine search in the t - th training process, where j = 1, 2, …, N, R 1 Denote a random number between [0, 2π], R 2 Denote a random number between [0, π], Denote the d - th dimension parameter in the optimal parameter individual, ξ 1 = - π+(1 - τ)*2π, ξ 1 Denote the first update factor, π denotes the pi, τ denotes the golden ratio, and ξ 2 = - π+τ*2π, ξ 2 Denote the second update factor, Denote the d - th dimension parameter in the average position, and each dimension parameter in the average position is the mean value of all model parameter individuals in this dimension.

[0097] Perform diffusion search on the model parameter individuals, enabling the model parameter individuals to conduct population cooperation search in the solution space. Compared with the search of a single individual, it can more effectively search for a better position, expand the search range in the solution space, and thus improve the global search ability and convergence accuracy of the algorithm.

[0098] In the embodiment of the present invention, for the model parameter individuals after diffusion search, perform global search in the solution space on the model parameter individuals to obtain the model parameter individuals after global search, including:

[0099] For the model parameter individuals after diffusion search, based on spiral flight and greedy strategy, perform global search in the solution space on the model parameter individuals to obtain the model parameter individuals after global search.

[0100] Optionally, the embodiment of the present invention provides a method for global search in the solution space, which may include:

[0101] First, perform the search as:

[0102]

[0103] Among them, Denote the d - th dimension parameter in the m - th individual of model parameters after the m - th diffusion search in the t - th training process, where m = 1, 2, …, N, Denote after the search X dlevy Denote the step size of the Levy flight corresponding to the d - th dimension parameter, λ denotes the upper limit value λ max And the lower limit value λ min The random coefficient between, l denotes a random number between [-1, 1], ξ denotes a random number between [-1, 1], A tIt represents the adaptive adjustment of the step size, μ represents the first random flight coefficient, v represents the second random flight coefficient, η represents a random number between (0, 2], and both μ and v follow a normal distribution, that is, v ~ N(0, 1). σ μ It represents an intermediate parameter, and Γ represents the gamma function.

[0104] Then, it is judged whether the value of the loss function after the global search of the solution space decreases. If so, this search is accepted; otherwise, this search is rejected.

[0105] The solution space global search method provided in this embodiment searches at a certain rotation angle, which maximally avoids generating duplicate individuals, can effectively improve the local development ability of the algorithm. At the same time, the Levy flight is added, and long jumps may occasionally occur during the random walk process. During the search process, the Levy flight can expand the group search range, assist the algorithm to jump out of the local optimum when necessary, and can effectively assist the algorithm to jump out of the local optimum to achieve global search, thereby improving the search performance of the algorithm.

[0106] In the embodiment of the present invention, after determining that the current transaction is an abnormal transaction behavior, it further includes:

[0107] Archive the abnormal transaction behavior data and generate an abnormal transaction behavior reminder message to enable the user to process the abnormal transaction in a timely manner.

[0108] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present invention can be implemented in various computer languages. For example, object-oriented programming languages such as Java and interpreted scripting languages such as JavaScript.

[0109] The present invention is described with reference to the flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, and the combination of processes and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate for implementing the process Figure 1one or more processes and / or blocks Figure 1 means for the functions specified in one or more blocks

[0110] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to work in a particular manner, such that the instructions stored in the computer-readable memory produce a manufacture including an instruction means that implements the functions in the process Figure 1 one or more processes and / or blocks Figure 1 the functions specified in one or more blocks

[0111] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus, such that a series of operational steps are performed on the computer or other programmable apparatus to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable apparatus provide steps for implementing the functions in the process Figure 1 one or more processes and / or blocks Figure 1 the functions specified in one or more blocks

[0112] Although the preferred embodiments of the present invention have been described, additional changes and modifications can be made by those skilled in the art once they learn the basic creative concept. Therefore, the appended claims are intended to be construed to include the preferred embodiments as well as all changes and modifications falling within the scope of the present invention

[0113] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention is also intended to include these modifications and variations

Claims

1. A method for identifying abnormal transaction behavior, characterized in that: include: Obtaining a historical data set uploaded by a user; wherein the historical data set includes historical transaction data and abnormal behavior labels of the transaction data at historical time; After the user uploads the historical data set, the machine learning model is called from the database, and the machine learning model is deployed according to the historical data set to obtain the machine learning model corresponding to the user; After deploying the machine learning model corresponding to the user, obtain the current transaction data uploaded by the user, and use the current transaction data as the data corresponding to the machine learning model corresponding to the user to obtain the predicted probability that the current transaction is abnormal; When the predicted probability of an abnormality in the current transaction is greater than the user-preset probability threshold, the current transaction is determined to be an abnormal transaction behavior, thereby realizing the identification of abnormal transaction behavior based on user data.

2. The abnormal transaction behavior identification method according to claim 1, characterized in that: Before calling the machine learning model from the database, it also includes: Perform data cleaning on historical transaction data and abnormal behavior labels of the transaction data in historical time to remove missing values.

3. The abnormal transaction behavior identification method according to claim 1, characterized in that: The machine learning model is called from the database, and the machine learning model is deployed according to the historical data set to obtain the machine learning model corresponding to the user, including: Call multiple machine learning models from the database to obtain candidate machine learning models; Training each candidate machine learning model according to the historical data set to obtain a trained candidate machine learning model; Deploy the user's corresponding machine learning model based on the trained candidate machine learning model.

4. The abnormal transaction behavior identification method according to claim 3 is characterized in that: Deploy the user's corresponding machine learning model based on the trained candidate machine learning model, including: Based on the trained candidate machine learning models, determine the candidate machine learning model with the highest recognition accuracy as the machine learning model corresponding to the user and deploy it; Alternatively, according to the candidate machine learning models after training, a first association relationship between the candidate machine learning models is determined, and the candidate machine learning models are deployed according to the first association relationship to obtain a machine learning model corresponding to the user; wherein the first association relationship is: according to the candidate machine learning models after training, a weight of each candidate machine learning model is determined, and after weighting the output of the candidate machine learning model with the weight, a prediction probability is obtained; Alternatively, based on the candidate machine learning models after training, a second association relationship between the candidate machine learning models is determined, and the candidate machine learning models are deployed according to the second association relationship to obtain a machine learning model corresponding to the user; wherein the second association relationship is: constructing a secondary classification model, using the output of the candidate machine learning model as the output of the secondary classification model, so that the secondary classification model outputs a predicted probability.

5. The abnormal transaction behavior identification method according to claim 3 is characterized in that: Training each candidate machine learning model according to the historical data set to obtain a trained candidate machine learning model includes: According to the historical data set, the candidate machine learning model is trained by adopting a multi-process parallel execution method to obtain a trained candidate machine learning model.

6. The abnormal transaction behavior identification method according to claim 5, characterized in that: Training candidate machine learning models, including: Initializing the model parameters of the candidate machine learning model between the upper limit and the lower limit of the parameter multiple times to obtain multiple model parameter individuals; According to the historical data set, the loss function value corresponding to each model parameter individual is obtained, and according to the loss function value corresponding to each model parameter individual, the optimal parameter individual and the worst parameter individual are determined; Based on the worst parameter individual, a local fine search is performed on the model parameter individual to obtain the model parameter individual after the local fine search; For the model parameter individuals after the local fine search, based on the optimal parameter individuals, the model parameter individuals are subjected to a diffusion search in the solution space to obtain the model parameter individuals after the diffusion search; For the model parameter individuals after the diffusion search, a global search is performed on the solution space of the model parameter individuals to obtain the model parameter individuals after the global search; Determine whether the current number of training times has reached the maximum number of training times. If so, use the model parameter individuals after global search as the final model parameters corresponding to the candidate machine learning model to obtain the candidate machine learning model after training. Otherwise, return to the step of obtaining the loss function value.

7. The abnormal transaction behavior identification method according to claim 6, characterized in that: Based on the worst parameter individual, a local fine search is performed on the model parameter individual to obtain the model parameter individual after the local fine search, including: For any model parameter individual, the goal is to make the model parameter individual away from the worst parameter individual, and determine the first update amount according to the worst parameter individual; According to the first update amount, a local fine search is performed on the individual model parameters to obtain the individual model parameters after the local fine search.

8. The abnormal transaction behavior identification method according to claim 7, characterized in that: For the model parameter individuals after the local fine search, based on the optimal parameter individuals, the model parameter individuals are subjected to solution space diffusion search to obtain the model parameter individuals after the diffusion search, including: For the individual model parameters after the local fine search, determine the average position of all individual model parameters in the solution space; According to the average position of all model parameter individuals in the solution space and the optimal parameter individual, a diffusion search is performed on the model parameter individuals so that the model parameter individuals perform a population cooperative search in the solution space to obtain the model parameter individuals after the diffusion search.

9. The abnormal transaction behavior identification method according to claim 8, characterized in that: For the model parameter individuals after the diffusion search, a global search of the solution space is performed on the model parameter individuals to obtain the model parameter individuals after the global search, including: For the model parameter individuals after the diffusion search, based on the spiral flight and greedy strategies, a global search of the solution space is performed on the model parameter individuals to obtain the model parameter individuals after the global search.

10. The abnormal transaction behavior identification method according to claim 1, characterized in that: After determining that the current transaction is an abnormal transaction behavior, it also includes: The abnormal transaction behavior data is archived and abnormal transaction behavior reminder information is generated to enable users to handle abnormal transactions in a timely manner.

Images