A method for identifying abnormal trading behavior

Abstract

The present invention discloses a method for identifying abnormal transaction behavior, which belongs to the field of data processing technology. Through data mining and machine learning algorithms, the correlation between historical data provided by users and abnormal transactions can be learned, thereby forming a machine learning model with the ability to automatically predict the risk of abnormal transactions. The method can quickly and accurately identify potential abnormal transaction behaviors, assist users in promptly discovering possible abnormal transaction behaviors, monitor and report abnormal transaction behaviors in real time, effectively improve users' risk management level, and prevent illegal behaviors such as financial fraud and money laundering.

Description

Technical Field

[0001] The present invention belongs to the field of data processing technology, and in particular relates to a method for identifying abnormal transaction behavior. Background Art

[0002] With the rapid development of financial markets and the widespread application of financial technology, financial transaction volumes are increasing, and so are abnormal behaviors in these transactions. These abnormal behaviors may include illegal activities such as financial fraud, money laundering, and insider trading, bringing significant risks and losses to the financial market. To prevent and combat these abnormal behaviors, financial institutions need to establish and improve abnormal transaction behavior identification systems.

[0003] In existing technologies, there's typically no dedicated staff to analyze unusual transactions. This results in risks being identified only after they occur, resulting in poor risk mitigation and difficulty effectively mitigating losses. Adding dedicated staff to evaluate these transactions would require significant manpower costs to identify large amounts of transaction data. Summary of the Invention

[0004] The present invention provides a method for identifying abnormal transaction behavior, which is used to solve the technical problem of the prior art that abnormal transactions are not discovered in a timely manner.

[0005] A method for identifying abnormal transaction behavior, comprising:

[0006] Obtaining a historical data set uploaded by a user; wherein the historical data set includes historical transaction data and abnormal behavior labels of the transaction data over historical time;

[0007] After the user uploads the historical data set, the machine learning model is called from the database and deployed according to the historical data set to obtain the machine learning model corresponding to the user;

[0008] After deploying the machine learning model corresponding to the user, obtain the current transaction data uploaded by the user and use the current transaction data as the data corresponding to the machine learning model corresponding to the user to obtain the predicted probability of anomalies in the current transaction;

[0009] When the predicted probability of an abnormality in the current transaction is greater than the user-preset probability threshold, the current transaction is determined to be an abnormal transaction behavior, thereby realizing the identification of abnormal transaction behavior based on user data.

[0010] Furthermore, before calling the machine learning model from the database, it also includes:

[0011] Perform data cleaning on historical transaction data and abnormal behavior labels of the transaction data in historical time to remove missing values.

[0012] Furthermore, a machine learning model is called from the database and deployed according to the historical data set to obtain a machine learning model corresponding to the user, including:

[0013] Call multiple machine learning models from the database to obtain candidate machine learning models;

[0014] Training each candidate machine learning model according to the historical data set to obtain a trained candidate machine learning model;

[0015] Deploy the user's corresponding machine learning model based on the trained candidate machine learning model.

[0016] Furthermore, based on the trained candidate machine learning model, the user's corresponding machine learning model is deployed, including:

[0017] Based on the trained candidate machine learning models, the candidate machine learning model with the highest recognition accuracy is determined as the machine learning model corresponding to the user and deployed;

[0018] Alternatively, based on the trained candidate machine learning models, a first association relationship between the candidate machine learning models is determined, and the candidate machine learning models are deployed according to the first association relationship to obtain a machine learning model corresponding to the user; wherein the first association relationship is: based on the trained candidate machine learning models, a weight of each candidate machine learning model is determined, and the output of the candidate machine learning model is weighted by the weight to obtain a prediction probability;

[0019] Alternatively, based on the candidate machine learning models after training, a second association relationship between the candidate machine learning models is determined, and the candidate machine learning models are deployed according to the second association relationship to obtain the machine learning model corresponding to the user; wherein the second association relationship is: constructing a secondary classification model, using the output of the candidate machine learning model as the output of the secondary classification model, so that the secondary classification model outputs the prediction probability.

[0020] Furthermore, each candidate machine learning model is trained according to the historical data set to obtain a trained candidate machine learning model, including:

[0021] Based on the historical data set, the candidate machine learning model is trained by adopting a multi-process parallel execution method to obtain a trained candidate machine learning model.

[0022] Furthermore, the candidate machine learning model is trained, including:

[0023] Initializing the model parameters of the candidate machine learning model multiple times between the upper limit and the lower limit of the parameter to obtain multiple model parameter individuals;

[0024] Obtaining the loss function value corresponding to each model parameter individual according to the historical data set, and determining the optimal parameter individual and the worst parameter individual according to the loss function value corresponding to each model parameter individual;

[0025] Based on the worst parameter individual, a local fine search is performed on the model parameter individual to obtain a model parameter individual after the local fine search;

[0026] For the model parameter individuals after the local fine search, based on the optimal parameter individuals, the model parameter individuals are subjected to a solution space diffusion search to obtain the model parameter individuals after the diffusion search;

[0027] For the model parameter individuals after the diffusion search, a global search of the solution space is performed on the model parameter individuals to obtain the model parameter individuals after the global search;

[0028] Determine whether the current number of training times has reached the maximum number of training times. If so, use the model parameter individual after the global search as the final model parameter corresponding to the candidate machine learning model to obtain the candidate machine learning model after training. Otherwise, return to the step of obtaining the loss function value.

[0029] Furthermore, based on the worst parameter individual, a local fine search is performed on the model parameter individual to obtain the model parameter individual after the local fine search, including:

[0030] For any model parameter individual, the goal is to make the model parameter individual away from the worst parameter individual, and determine the first update amount based on the worst parameter individual;

[0031] According to the first update amount, a local fine search is performed on the individual model parameters to obtain the individual model parameters after the local fine search.

[0032] Furthermore, for the model parameter individuals after the local fine search, based on the optimal parameter individuals, a solution space diffusion search is performed on the model parameter individuals to obtain the model parameter individuals after the diffusion search, including:

[0033] For the individual model parameters after local fine search, determine the average position of all individual model parameters in the solution space;

[0034] According to the average position of all model parameter individuals in the solution space and the optimal parameter individual, the model parameter individuals are diffused and searched, so that the model parameter individuals can conduct population cooperative search in the solution space and obtain the model parameter individuals after the diffusion search.

[0035] Furthermore, for the individual model parameters after the diffusion search, a global search of the solution space is performed on the individual model parameters to obtain the individual model parameters after the global search, including:

[0036] For the model parameter individuals after the diffusion search, based on the spiral flight and greedy strategies, a global search of the solution space is performed on the model parameter individuals to obtain the model parameter individuals after the global search.

[0037] Furthermore, after determining that the current transaction is an abnormal transaction behavior, the following is also included:

[0038] Archive abnormal transaction behavior data and generate abnormal transaction behavior reminder information to enable users to handle abnormal transactions in a timely manner.

[0039] The present invention provides a method for identifying abnormal transaction behavior. Through data mining and machine learning algorithms, it can learn the correlation between historical data provided by users and abnormal transactions, thereby forming a machine learning model with the ability to automatically predict the risk of abnormal transactions. It can quickly and accurately identify potential abnormal transaction behaviors, assist users in promptly discovering possible abnormal transaction behaviors, monitor and report abnormal transaction behaviors in real time, effectively improve users' risk management level, and prevent illegal activities such as financial fraud and money laundering. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0041] Figure 1 A flowchart of a method for identifying abnormal transaction behavior provided by an embodiment of the present invention.

[0042] Figure 2 A flowchart for training a candidate machine learning model is provided in an embodiment of the present invention.

[0043] The above drawings illustrate specific embodiments of the present invention, which will be described in more detail below. These drawings and the accompanying description are not intended to limit the scope of the present invention in any way, but rather to illustrate the concept of the present invention to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0044] Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. In the following description, when referring to the drawings, like numbers in different figures represent like or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present invention. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present invention, as detailed in the appended claims.

[0045] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0046] like Figure 1 As shown, an embodiment of the present invention provides a method for identifying abnormal transaction behavior, including:

[0047] S101: Obtain a historical data set uploaded by a user, wherein the historical data set includes historical transaction data and abnormal behavior labels of the transaction data over historical time.

[0048] Historical data sets are data and events that actually existed in historical time. By performing machine learning on this data, the probability of similar events occurring can be predicted, thereby achieving risk warning. At the same time, it replaces manual analysis, effectively reducing labor costs and improving efficiency.

[0049] S102. After the user uploads the historical data set, the machine learning model is called from the database, and the machine learning model is deployed according to the historical data set to obtain the machine learning model corresponding to the user.

[0050] This step can be deployed on a cloud server, which receives historical data sets uploaded by users and then schedules the machine learning model for learning, thereby helping users predict similar risks and assisting decision-making.

[0051] S103. After deploying the machine learning model corresponding to the user, obtain the current transaction data uploaded by the user, and use the current transaction data as the data corresponding to the machine learning model corresponding to the user to obtain the predicted probability of anomaly in the current transaction.

[0052] Since machine learning models generally require regular input data, current transaction data needs to be organized in the form of historical data so that effective identification can be achieved.

[0053] Optionally, to ensure data regularity, all data can be standardized. For example, when constructing a data matrix using transaction data, the data dimensions of each transaction are the same, but the number of transactions varies. Therefore, a row of data can be constructed for each transaction, and a data matrix can be constructed based on the number of transactions. This data matrix can have a fixed number of rows, with excess rows removed and fewer rows padded with zeros to ensure data regularity.

[0054] It is also possible to convert non-numeric data in transaction data into digital data and normalize the data after constructing the data matrix to reduce the complexity of the data.

[0055] S104: When the predicted probability of the current transaction being abnormal is greater than a user-preset probability threshold, the current transaction is determined to be an abnormal transaction behavior, thereby realizing abnormal transaction behavior identification based on user data.

[0056] The present invention provides a method for identifying abnormal transaction behavior. Through data mining and machine learning algorithms, it can learn the correlation between historical data provided by users and abnormal transactions, thereby forming a machine learning model with the ability to automatically predict the risk of abnormal transactions. It can quickly and accurately identify potential abnormal transaction behaviors, assist users in promptly discovering possible abnormal transaction behaviors, monitor and report abnormal transaction behaviors in real time, effectively improve users' risk management level, and prevent illegal activities such as financial fraud and money laundering.

[0057] In an embodiment of the present invention, before calling the machine learning model from the database, the method further includes:

[0058] Perform data cleaning on historical transaction data and abnormal behavior labels of the transaction data in historical time to remove missing values.

[0059] For example, when there is missing information in transaction data, the transaction data should be removed.

[0060] In an embodiment of the present invention, a machine learning model is called from a database and deployed according to the historical data set to obtain a machine learning model corresponding to the user, including:

[0061] Call multiple machine learning models from the database to obtain candidate machine learning models.

[0062] Each candidate machine learning model is trained according to the historical data set to obtain a trained candidate machine learning model.

[0063] Deploy the user's corresponding machine learning model based on the candidate machine learning model after training.

[0064] Optionally, since the embodiment of the present invention is to identify data matrices, a machine learning model whose input form is a data matrix can be used as a candidate machine learning model (such as a convolutional neural network), and multiple machine learning models can be the same or different.

[0065] In an embodiment of the present invention, deploying a machine learning model corresponding to a user based on a trained candidate machine learning model includes:

[0066] Based on the candidate machine learning models after training, the candidate machine learning model with the highest recognition accuracy is determined as the machine learning model corresponding to the user and deployed.

[0067] There may be certain deviations in the training process of the machine learning model. Therefore, the candidate machine learning model with the highest recognition accuracy can be selected as the machine learning model corresponding to the user, which can resist training deviations to a certain extent.

[0068] Alternatively, based on the trained candidate machine learning models, a first association relationship between the candidate machine learning models is determined, and the candidate machine learning models are deployed according to the first association relationship to obtain a machine learning model corresponding to the user. The first association relationship is: based on the trained candidate machine learning models, a weight is determined for each candidate machine learning model, and the output of the candidate machine learning model is weighted by the weight to obtain a predicted probability.

[0069] Optionally, since the recognition accuracy of different candidate machine learning models after training is not much different, the weight of each candidate machine learning model in the embodiment of the present invention is set to the same value. For example, the weight of the four candidate machine learning models can be set to 0.25.

[0070] Alternatively, based on the candidate machine learning models after training, a second association relationship between the candidate machine learning models is determined, and the candidate machine learning models are deployed according to the second association relationship to obtain the machine learning model corresponding to the user. The second association relationship is: constructing a secondary classification model, using the output of the candidate machine learning model as the output of the secondary classification model, so that the secondary classification model outputs a predicted probability. For example, historical data can be used as the input of the candidate machine learning model, the outputs of multiple candidate machine learning models can be used to form the input of the secondary classification model, and the labels corresponding to the historical data can be used as the expected output, so that the training of the two-level classification model can be realized, so that the secondary classification model outputs a predicted probability.

[0071] Even if the training process finds the optimal parameters, the machine learning model may still have misidentification during the recognition process. Although the probability is extremely small, it is possible. Therefore, the embodiment of the present invention deploys the machine learning model through the second and third methods to effectively resist recognition errors.

[0072] In an embodiment of the present invention, each candidate machine learning model is trained according to the historical data set to obtain a trained candidate machine learning model, including:

[0073] Based on the historical data set, the candidate machine learning model is trained by adopting a multi-process parallel execution method to obtain a trained candidate machine learning model.

[0074] like Figure 2 As shown, the candidate machine learning model is trained, including:

[0075] S201. Initialize the model parameters of the candidate machine learning model multiple times between the upper limit and the lower limit of the parameter to obtain multiple model parameter individuals.

[0076] It is worth noting that the model parameters in the embodiment of the present invention refer to one or more parameters of the candidate machine learning model, that is, only one parameter can be optimized (such as weight), or multiple parameters can be optimized simultaneously (such as weight and threshold).

[0077] Initializing the model parameters of the candidate machine learning model between the upper parameter limit and the lower parameter limit multiple times may include: initializing the model parameters of the candidate machine learning model between the upper parameter limit and the lower parameter limit to obtain a model parameter individual, and then repeatedly obtaining multiple model parameter individuals.

[0078] S202. Obtain the loss function value corresponding to each model parameter individual according to the historical data set, and determine the optimal parameter individual and the worst parameter individual according to the loss function value corresponding to each model parameter individual.

[0079] Optionally, an embodiment of the present invention uses root mean square error loss, mean square error loss, and cross entropy loss to obtain the loss function value corresponding to each individual model parameter.

[0080] S203 : Based on the worst parameter individual, perform a local fine search on the model parameter individual to obtain a model parameter individual after the local fine search.

[0081] S204 , for the model parameter individuals after the local fine search, based on the optimal parameter individuals, perform a solution space diffusion search on the model parameter individuals to obtain the model parameter individuals after the diffusion search.

[0082] S205 . For the individual model parameters after the diffusion search, perform a global search in the solution space on the individual model parameters to obtain the individual model parameters after the global search.

[0083] S206. Determine whether the current number of training times has reached the maximum number of training times. If so, use the model parameter individual after the global search as the final model parameter corresponding to the candidate machine learning model to obtain the candidate machine learning model after training. Otherwise, return to the step of obtaining the loss function value.

[0084] In an embodiment of the present invention, based on the worst parameter individual, a local fine search is performed on the model parameter individual to obtain the model parameter individual after the local fine search, including:

[0085] For any model parameter individual, the goal is to make the model parameter individual away from the worst parameter individual, and the first update amount is determined according to the worst parameter individual.

[0086] According to the first update amount, a local fine search is performed on the individual model parameters to obtain the individual model parameters after the local fine search.

[0087] Optionally, an embodiment of the present invention provides a method for local fine search, which may include:

[0088]

[0089] in, Indicates the d-th dimension parameter in the i-th model parameter individual during the t-th training process, i = 1, 2, ..., N, N represents the total number of model parameter individuals, d = 1, 2, ..., D, D represents the total dimension of the parameters in the model parameter individual, Represents the individual model parameters after local subtle search The dth parameter in the equation is K, which represents the step size control coefficient and belongs to [-1,1]. id Indicates that between (0,1) Generate a random number, represents the d-th dimension parameter in the worst parameter individual, F i Indicates the fitness of the i-th model parameter individual, F w represents the fitness of the individual with the worst parameters, ε represents the noise term, and is set to 0.0001. The fitness can be set to 1 / (loss function value + ε).

[0090] Through the above updates, the individual model parameters can be moved closer to the optimal position, thereby further optimizing the parameters and making the final abnormal transaction prediction more accurate.

[0091] In an embodiment of the present invention, for the model parameter individuals after the local fine search, based on the optimal parameter individuals, a solution space diffusion search is performed on the model parameter individuals to obtain the model parameter individuals after the diffusion search, including:

[0092] For the individual model parameters after the local fine search, the average position of all individual model parameters in the solution space is determined.

[0093] According to the average position of all model parameter individuals in the solution space and the optimal parameter individual, the model parameter individuals are diffused and searched, so that the model parameter individuals can conduct population cooperative search in the solution space and obtain the model parameter individuals after the diffusion search.

[0094] Optionally, an embodiment of the present invention provides a solution space diffusion search method, which may include:

[0095]

[0096] in, represents the d-th dimension parameter in the model parameter individual after the j-th local subtle search in the t-th training process, j = 1, 2, ..., N, R1 represents a random number between [0, 2π], R2 represents a random number between [0, π], represents the d-th dimension parameter in the optimal parameter individual, ξ1=-π+(1-τ)*2π, ξ1 represents the first update factor, π represents pi, τ represents the golden section number, and ξ2=-π+τ*2π, ξ2 represents the second update factor, Represents the d-th dimension parameter in the average position. Each dimension parameter in the average position is the mean of all model parameter individuals in that dimension.

[0097] Diffusion search is performed on individual model parameters, so that the individual model parameters conduct a population cooperative search in the solution space. Compared with the search of a single individual, it can more effectively search for a better position and expand the search range in the solution space, thereby improving the global search ability and convergence accuracy of the algorithm.

[0098] In an embodiment of the present invention, for the model parameter individuals after the diffusion search, a global search of the solution space is performed on the model parameter individuals to obtain the model parameter individuals after the global search, including:

[0099] For the model parameter individuals after the diffusion search, based on the spiral flight and greedy strategies, a global search of the solution space is performed on the model parameter individuals to obtain the model parameter individuals after the global search.

[0100] Optionally, an embodiment of the present invention provides a global search method for a solution space, which may include:

[0101] First, perform the search as:

[0102]

[0103] in, represents the d-th dimension parameter in the model parameter individual after the m-th diffusion search in the t-th training process, m=1,2,…,N, Indicates after the search X dlevy represents the Rhine flight step corresponding to the d-th dimension parameter, and λ represents the upper limit λ max With the lower limit λ min The random coefficient between [-1, 1], l represents a random number between [-1, 1], ξ represents a random number between [-1, 1], A t Represents the adaptive adjustment step size, μ represents the first random flight coefficient, v represents the second random flight coefficient, η represents a random number between (0,2], and μ and v obey the normal distribution, that is, v~N(0,1), σμ represents the intermediate parameter, and Γ represents the gamma function.

[0104] Then determine whether the loss function value after the global search of the solution space is reduced. If so, accept the search, otherwise reject the search.

[0105] The global search method for the solution space provided in this embodiment performs searches at a certain rotation angle, thereby avoiding the generation of duplicate individuals to the greatest extent possible, and can effectively improve the local development capability of the algorithm. At the same time, Rhine flight is added, which can occasionally cause long jumps during the random walk. During the search process, Rhine flight can expand the group search range and assist the algorithm to jump out of the local optimum when necessary. It can effectively assist the algorithm to jump out of the local optimum and realize global search, thereby improving the algorithm search performance.

[0106] In the embodiment of the present invention, after determining that the current transaction is an abnormal transaction behavior, the method further includes:

[0107] Archive abnormal transaction behavior data and generate abnormal transaction behavior reminder information to enable users to handle abnormal transactions in a timely manner.

[0108] It will be understood by those skilled in the art that the embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present invention may be implemented in various computer languages, for example, the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0109] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0110] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0111] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0112] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0113] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A method for identifying abnormal transaction behavior, characterized in that: include: Obtaining a historical data set uploaded by a user; wherein the historical data set includes historical transaction data and abnormal behavior labels of the transaction data over historical time; After the user uploads the historical data set, the machine learning model is called from the database and deployed according to the historical data set to obtain the machine learning model corresponding to the user; After deploying the machine learning model corresponding to the user, obtain the current transaction data uploaded by the user and use the current transaction data as the data corresponding to the machine learning model corresponding to the user to obtain the predicted probability of anomalies in the current transaction; When the predicted probability of anomaly in the current transaction is greater than the user-preset probability threshold, the current transaction is determined to be an abnormal transaction behavior, realizing abnormal transaction behavior identification based on user data; The machine learning model is called from the database and deployed according to the historical data set to obtain the machine learning model corresponding to the user, including: Call multiple machine learning models from the database to obtain candidate machine learning models; Training each candidate machine learning model according to the historical data set to obtain a trained candidate machine learning model; Deploy the user's corresponding machine learning model based on the trained candidate machine learning model; Training each candidate machine learning model according to the historical data set to obtain a trained candidate machine learning model includes: According to the historical data set, the candidate machine learning model is trained by executing multiple processes in parallel to obtain a trained candidate machine learning model; Training candidate machine learning models, including: Initializing the model parameters of the candidate machine learning model multiple times between the upper limit and the lower limit of the parameter to obtain multiple model parameter individuals; Obtaining the loss function value corresponding to each model parameter individual according to the historical data set, and determining the optimal parameter individual and the worst parameter individual according to the loss function value corresponding to each model parameter individual; Based on the worst parameter individual, a local fine search is performed on the model parameter individual to obtain a model parameter individual after the local fine search; For the model parameter individuals after the local fine search, based on the optimal parameter individuals, the model parameter individuals are subjected to a solution space diffusion search to obtain the model parameter individuals after the diffusion search; For the model parameter individuals after the diffusion search, a global search of the solution space is performed on the model parameter individuals to obtain the model parameter individuals after the global search; Determine whether the current number of training times has reached the maximum number of training times. If so, use the model parameter individual after the global search as the final model parameter corresponding to the candidate machine learning model to obtain the candidate machine learning model after training. Otherwise, return to the step of obtaining the loss function value.

2. The abnormal transaction behavior identification method according to claim 1, characterized in that: Before calling the machine learning model from the database, it also includes: Perform data cleaning on historical transaction data and abnormal behavior labels of the transaction data in historical time to remove missing values.

3. The abnormal transaction behavior identification method according to claim 1, characterized in that: Deploy the user's corresponding machine learning model based on the trained candidate machine learning model, including: Based on the trained candidate machine learning models, the candidate machine learning model with the highest recognition accuracy is determined as the machine learning model corresponding to the user and deployed; Alternatively, based on the trained candidate machine learning models, a first association relationship between the candidate machine learning models is determined, and the candidate machine learning models are deployed according to the first association relationship to obtain a machine learning model corresponding to the user; wherein the first association relationship is: based on the trained candidate machine learning models, a weight of each candidate machine learning model is determined, and the output of the candidate machine learning model is weighted by the weight to obtain a prediction probability; Alternatively, based on the candidate machine learning models after training, a second association relationship between the candidate machine learning models is determined, and the candidate machine learning models are deployed according to the second association relationship to obtain the machine learning model corresponding to the user; wherein the second association relationship is: constructing a secondary classification model, using the output of the candidate machine learning model as the output of the secondary classification model, so that the secondary classification model outputs the prediction probability.

4. The abnormal transaction behavior identification method according to claim 1, characterized in that: Based on the worst parameter individual, a local fine search is performed on the model parameter individual to obtain the model parameter individual after the local fine search, including: For any model parameter individual, the goal is to make the model parameter individual away from the worst parameter individual, and determine the first update amount based on the worst parameter individual; According to the first update amount, a local fine search is performed on the individual model parameters to obtain the individual model parameters after the local fine search.

5. The abnormal transaction behavior identification method according to claim 4, characterized in that: For the model parameter individuals after the local fine search, based on the optimal parameter individuals, the model parameter individuals are subjected to a solution space diffusion search to obtain the model parameter individuals after the diffusion search, including: For the individual model parameters after local fine search, determine the average position of all individual model parameters in the solution space; According to the average position of all model parameter individuals in the solution space and the optimal parameter individual, the model parameter individuals are diffused and searched, so that the model parameter individuals can conduct population cooperative search in the solution space and obtain the model parameter individuals after the diffusion search.

6. The abnormal transaction behavior identification method according to claim 5, characterized in that: For the model parameter individuals after the diffusion search, a global search of the solution space is performed on the model parameter individuals to obtain the model parameter individuals after the global search, including: For the model parameter individuals after the diffusion search, based on the spiral flight and greedy strategies, a global search of the solution space is performed on the model parameter individuals to obtain the model parameter individuals after the global search.

7. The abnormal transaction behavior identification method according to claim 1, characterized in that: After determining that the current transaction is abnormal, the following also applies: Archive abnormal transaction behavior data and generate abnormal transaction behavior reminder information to enable users to handle abnormal transactions in a timely manner.

Images