Abnormal behavior detection method, system and device of financial transaction system and storage medium

Abstract

The invention discloses an abnormal behavior detection method, system and device of a financial transaction system and a storage medium, and is applied to the field of financial transaction system analysis, and the method comprises the steps: respectively obtaining transaction data, system operation data and user operation data of the financial transaction system, and carrying out the data preprocessing; identifying an abnormal behavior in the transaction data by using a transaction data abnormal behavior identification model based on an isolated forest algorithm; predicting system response time by using a system response time prediction model based on a neural network algorithm, comparing the system response time with actual system corresponding time, and identifying abnormal behaviors of system operation data; and identifying abnormal behaviors in the user operation data by using the user operation data abnormal behavior identification model based on the decision tree algorithm. According to the method, rapid change and complex diversity of the financial market are effectively realized, a proper anomaly detection method is selected according to different data characteristics, and the abnormal behavior detection precision of the financial transaction system is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of financial transaction system analysis, and particularly to an abnormal behavior detection method, system, device and storage medium for a financial transaction system. Background Art

[0002] In the wave of the digital transformation of the financial industry, financial transaction systems have become the core pillars for the stable operation of financial markets, undertaking massive transaction processing tasks. With the booming development and innovation of financial markets, the trading scale continues to expand, and trading forms become increasingly complex and diverse. Financial transaction systems are facing unprecedented challenges. Among them, abnormal trading behaviors emerge in an endless stream in financial transaction systems, covering multiple levels such as abnormal transaction data, abnormal system operation data, and abnormal user operations, seriously threatening the stability and security of financial markets.

[0003] The manifestation forms of abnormal transaction data are diverse and involve a large amount of data. For example, in the abnormal transaction data behavior related to trading time, investors' buying or selling of stocks usually concentrates in the opening and closing time periods. If there are large-scale buying or selling phenomena with abnormal trading volumes at other times, it may prove the existence of abnormal transaction data behavior. Another example is the abnormal transaction data behavior related to trading frequency. Some stocks have high-frequency large-scale buying or selling with abnormal trading volumes in a short period. Especially for the large-scale purchase of some unpopular stocks with poor performance and small market capitalization and the large-scale selling of some popular stocks, it may involve abnormal transaction data behavior caused by insider information leakage. There is also the abnormal transaction data behavior related to trading price. Some stocks show price fluctuations outside the normal range, which may involve abnormal transaction data behavior of certain hidden price manipulations.

[0004] The analysis of abnormal system operation data is also crucial. Its essence lies in the too long system response time. When the response time of a financial transaction system is too long, investors' trading orders may not be processed in time, resulting in trading delays. This not only causes investors to miss trading opportunities and brings economic losses to investors, but also has a certain impact on market confidence. Abnormal system operation data involves server load, network latency, trading request volume, etc. The current problem is that these system operation data cannot be accurately quantified as the system response time to further infer whether there is abnormal system operation data behavior.

[0005] The manifestation forms of abnormal user operations are still diverse. For example, in terms of abnormal user operations related to trading regions, if an investor buys or sells in an unusual trading region, there may be abnormal user operation behaviors. Another example is abnormal user operations related to trading amounts. If a user's trading amount reached within a short period has seriously exceeded the maximum range that could be achieved in previous transactions, there may be abnormal user operation behaviors caused by unclear funds or other illegal transactions. There is also abnormal user operations related to trading varieties. If a user often focuses on investing in certain trading varieties and suddenly involves large-scale investments in other unrelated varieties, especially the large-scale purchase of some unpopular stocks, it may involve abnormal user operation behaviors triggered by insider information leakage. Moreover, regarding the frequent switching of trading varieties, it may be to profit from short-term market fluctuations or to create market illusions to mislead other investors.

[0006] All in all, in the face of the rapid changes and complex diversity of the financial market, traditional rule-based anomaly detection methods have become inadequate. With the innovation and development of the financial market, new financial products and trading models are emerging continuously, and the characteristics and patterns of abnormal trading behaviors are also evolving continuously. The limitations of traditional methods are becoming increasingly prominent. Because they cannot effectively handle complex and changing abnormal trading situations, false negatives and false positives are likely to occur, resulting in the failure to detect and prevent potential risks in a timely manner.

[0007] Therefore, how to provide an abnormal behavior detection method, system, device and storage medium for a financial trading system that can effectively face the rapid changes and complex diversity of the financial market, select appropriate anomaly detection methods according to different data characteristics, and effectively improve the detection accuracy of abnormal behaviors is an urgent problem for those skilled in the art. Summary of the Invention

[0008] In view of this, the present invention proposes an abnormal behavior detection method, system, device and storage medium for a financial trading system.

[0009] To achieve the above object, the present invention adopts the following technical solutions:

[0010] An abnormal behavior detection method for a financial trading system includes:

[0011] Step 1: Obtain the trading data, system operation data and user operation data of the financial trading system respectively, and perform data preprocessing;

[0012] Step 2: Identify abnormal behaviors in transaction data using the abnormal behavior recognition model for transaction data based on the Isolation Forest algorithm; predict the system response time using the system response time prediction model based on the neural network algorithm, and compare it with the actual system response time to identify abnormal behaviors in system operation data; identify abnormal behaviors in user operation data using the abnormal behavior recognition model for user operation data based on the decision tree algorithm.

[0013] Optionally, data preprocessing includes: data cleaning, denoising, and normalization operations.

[0014] Optionally, the training process of the abnormal behavior recognition model for transaction data based on the Isolation Forest algorithm is specifically as follows:

[0015] Use the transaction time, transaction frequency, and transaction price in the transaction data as feature inputs to train the abnormal behavior recognition model for transaction data based on the Isolation Forest algorithm, and optimize and update the abnormal behavior recognition model for transaction data according to the recognition results of abnormal behaviors in transaction data.

[0016] Optionally, the training process of the system response time prediction model based on the neural network algorithm is specifically as follows:

[0017] Use the server load, network latency, and transaction request volume in the system operation data as inputs to train the system response time prediction model based on the neural network algorithm, and optimize and update the system response time prediction model according to the recognition results of abnormal behaviors in system operation data.

[0018] Optionally, the abnormal behavior recognition model for user operation data based on the decision tree algorithm is specifically as follows:

[0019] Use the transaction region, transaction amount, and transaction mode in the user operation data as inputs to train the abnormal behavior recognition model for user operation data based on the decision tree algorithm, and optimize and update the abnormal behavior recognition model for user operation data according to the recognition results of abnormal behaviors in user operation data.

[0020] Optionally, it further includes: verifying the performance of the abnormal behavior recognition model for transaction data based on the Isolation Forest algorithm, the system response time prediction model based on the neural network algorithm, and the abnormal behavior recognition model for user operation data based on the decision tree algorithm by calculating the accuracy rate, recall rate, and F1 value respectively.

[0021] The present invention also provides an abnormal behavior detection system for a financial trading system using an abnormal behavior detection method for a financial trading system, including:

[0022] Data acquisition and preprocessing module: used to acquire transaction data, system operation data, and user operation data of the financial trading system respectively, and perform data preprocessing;

[0023] Abnormal behavior recognition module: used to identify abnormal behaviors in transaction data by using an abnormal behavior recognition model for transaction data based on the Isolation Forest algorithm; predict the system response time by using a system response time prediction model based on the neural network algorithm, and compare it with the actual system response time to identify abnormal behaviors in system operation data; identify abnormal behaviors in user operation data by using an abnormal behavior recognition model for user operation data based on the decision tree algorithm.

[0024] The present invention also provides an electronic device, including:

[0025] A memory for storing computer programs;

[0026] A processor for implementing the steps of an abnormal behavior detection method for a financial trading system when executing the computer program.

[0027] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of an abnormal behavior detection method for a financial trading system are implemented.

[0028] As can be seen from the above technical solutions, compared with the prior art, the present invention proposes an abnormal behavior detection method, system, device, and storage medium for a financial trading system. By using machine learning technologies with good adaptability and self-learning ability, which can continuously adjust and optimize model parameters with the change of the market environment and the emergence of new data, and according to the different characteristics of the data, the Isolation Forest algorithm is selected for detecting abnormal behaviors in transaction data, and the decision tree algorithm is selected for detecting abnormal behaviors in user operation data. At the same time, for system operation data that cannot be directly quantified as the system response time, a prediction algorithm based on the neural network is selected, and the final prediction result is compared with the actual system response time to accurately judge the abnormal behaviors in system operation data. Based on this, the present invention can effectively face the rapid changes and complex diversity of the financial market, and select appropriate abnormal detection methods according to different data characteristics, effectively improving the accuracy of abnormal behavior detection in the financial trading system. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained according to the provided drawings without creative efforts.

[0030] Figure 1 This is a schematic flow diagram of the method of the present invention. Specific embodiments

[0031] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0032] Embodiment 1:

[0033] Embodiment 1 of the present invention discloses an abnormal behavior detection method for a financial trading system, including:

[0034] Step 1: Obtain transaction data, system operation data, and user operation data of the financial trading system respectively, and perform data preprocessing.

[0035] Data preprocessing includes data cleaning, denoising, and normalization operations. Cleaning data can remove duplicate, incorrect, and missing data records; denoising can reduce noise interference in the data and improve the stability of the data; normalization can unify data with different features to the same scale, facilitating model training and comparison.

[0036] Step 2: Use a transaction data abnormal behavior recognition model based on the isolation forest algorithm to identify abnormal behaviors in the transaction data; use a system response time prediction model based on the neural network algorithm to predict the system response time, and compare it with the actual system response time to identify abnormal behaviors in the system operation data; use a user operation data abnormal behavior recognition model based on the decision tree algorithm to identify abnormal behaviors in the user operation data.

[0037] Machine learning technology, as an important branch in the field of artificial intelligence, with its powerful data analysis and pattern recognition capabilities, has brought new solutions for the detection of abnormal behaviors in financial trading systems. Machine learning algorithms can automatically learn the patterns and features of normal trading behaviors from a large amount of financial trading data, and build an abnormal detection model based on this. By analyzing and comparing real-time trading data, the model can quickly and accurately identify abnormal trading behaviors, effectively improving the accuracy and efficiency of detection. Machine learning models also have good adaptability and self-learning capabilities, and can continuously adjust and optimize model parameters with the changes in the market environment and the emergence of new data, enhancing the detection ability for new types of abnormal trading behaviors.

[0038] In the present invention, by utilizing two currently mainstream anomaly detection algorithms, including the Isolation Forest algorithm and the Decision Tree algorithm, the abnormal behavior detection of the financial trading system is carried out. According to the characteristics of the data, the Isolation Forest algorithm is selected for the abnormal behavior detection of trading data, and the Decision Tree algorithm is selected for the abnormal behavior detection of user operation data. At the same time, for the system operation data that cannot be directly quantified as the system response time, a prediction algorithm based on neural network is selected, and the final prediction result is compared with the actual system response time to accurately judge the abnormal behavior of the system operation data. Based on this, the present invention effectively faces the rapid changes and complex diversity of the financial market, and selects appropriate anomaly detection methods according to different data characteristics, effectively improving the accuracy of abnormal behavior detection of the financial trading system.

[0039] The training process of the abnormal behavior recognition model of trading data based on the Isolation Forest algorithm is specifically as follows:

[0040] Taking the trading time, trading frequency and trading price in the trading data as feature inputs, training the abnormal behavior recognition model of trading data based on the Isolation Forest algorithm, and optimizing and updating the abnormal behavior recognition model of trading data according to the recognition results of the abnormal behavior of trading data.

[0041] The Isolation Forest algorithm is an anomaly detection algorithm based on ensemble learning. It isolates outliers by constructing multiple isolation trees. In the process of constructing an isolation tree, a feature and a split value are randomly selected, and the data set is recursively divided into sub-data sets until the sub-data set has only one data point or reaches the maximum depth of the tree. In financial trading, abnormal trading data usually appears as outliers in the data set, and the Isolation Forest algorithm can effectively identify these outliers. For a large amount of data, the Isolation Forest is efficient. Because it is a sub-sampling method, each time a part of the data is randomly selected from the data set to construct an isolation tree. For example, assuming the data set has 1 million data, it can draw a small number of samples (such as 256) each time to construct a tree, so that multiple isolation trees can be constructed in a relatively short time. Moreover, the time complexity of the Isolation Forest algorithm is relatively low. When dealing with large-scale data, the computing cost will not increase sharply with the increase of the data volume. The Isolation Forest mainly focuses on the isolation degree of data points and has no strict requirements on the data distribution, and can adapt to various complex data distribution situations. This enables it to effectively detect outliers when facing massive data without making too many assumptions and preprocessing on the data distribution. Therefore, based on the characteristics of the large volume of trading data in the present invention, the Isolation Forest algorithm is selected for the abnormal behavior detection of trading data to further improve the detection efficiency, accuracy and reduce the computing cost.

[0042] The training process of the system response time prediction model based on the neural network algorithm is specifically as follows:

[0043] Taking the server load, network latency, and transaction request volume in the system operation data as inputs, training a system response time prediction model based on a neural network algorithm, and optimizing and updating the system response time prediction model according to the recognition results of abnormal behaviors in the system operation data.

[0044] As the current mainstream prediction algorithm, the neural network algorithm is selected in this invention as the quantification tool for predicting the system response time based on the system operation data due to its powerful non-linear fitting ability and adaptive learning ability. Further, this invention compares the prediction result of the system response time with the actual system response time, thereby realizing the detection of abnormal behaviors in the system operation data.

[0045] The abnormal behavior recognition model for user operation data based on the decision tree algorithm is specifically as follows:

[0046] Taking the transaction region, transaction amount, and transaction mode in the user operation data as inputs, training an abnormal behavior recognition model for user operation data based on the decision tree algorithm, and optimizing and updating the abnormal behavior recognition model for user operation data according to the recognition results of abnormal behaviors in the user operation data.

[0047] A decision tree is a classification algorithm based on a tree structure. It constructs decision rules by recursively partitioning data features. The construction process of a decision tree is based on metrics such as information gain, information gain ratio, or Gini coefficient. For each feature, it evaluates and selects the optimal feature to partition the data set, and then recursively constructs sub-trees. In user operation data, abnormal transaction patterns usually have some unique features, and the decision tree algorithm can effectively capture these features, thereby realizing the recognition of abnormal transaction patterns. However, when the data volume is large, some problems may occur in the decision tree. For example, the computational complexity of constructing a decision tree is relatively high. Especially when dealing with large-scale data, calculating metrics such as information gain requires traversing and calculating the entire data set, which consumes a large amount of time and memory. Moreover, decision trees are prone to overfitting. When the data volume is very large, it may over-learn the details and noises in the data, resulting in a decline in the generalization ability on new data. Therefore, based on some unique features of user operation data and the limited volume of user operation data, this invention selects the decision tree algorithm for detecting abnormal behaviors in user operation data, effectively improving the detection accuracy.

[0048] It also includes: verifying the performance of the abnormal behavior recognition model for transaction data based on the isolation forest algorithm, the system response time prediction model based on the neural network algorithm, and the abnormal behavior recognition model for user operation data based on the decision tree algorithm by calculating the accuracy rate, recall rate, and F1 value respectively.

[0049] Through further experimental verification, it is obtained that the accuracy rate of the abnormal behavior recognition model for transaction data based on the Isolation Forest algorithm is 0.739, the recall rate is 0.85, and the F1 value is 0.791. From the results, this model has a certain degree of accuracy and reliability in identifying abnormal transaction data. It can accurately identify most of the abnormal transactions, with a recall rate of 0.85, indicating that the model can effectively capture abnormal transaction behaviors. The accuracy rate is 0.739, although not very high, but it is still within an acceptable range. The main reason for misjudgment may be that some normal transaction behaviors are at the edge of the normal range and are relatively similar to the characteristics of abnormal transaction behaviors, resulting in misjudgment by the model. In addition, data noise and incompleteness may also have a certain impact on the performance of the model.

[0050] Through further experimental verification, it is obtained that the accuracy rate of the abnormal behavior detection of system operation data by the system response time prediction model based on the neural network algorithm is 0.727, the recall rate is 0.8, and the F1 value is 0.761. From the results, this model has a certain degree of accuracy and reliability in identifying abnormal system operation data. It can accurately identify most of the abnormal situations, with a recall rate of 0.8, indicating that the model can effectively capture abnormal changes in system operation data. The accuracy rate is 0.727, although not very high, but it is still within an acceptable range.

[0051] Through further experimental verification, it is obtained that the accuracy rate of the abnormal behavior recognition model for user operation data based on the decision tree algorithm is 0.842, the recall rate is 0.8, and the F1 value is 0.821. From the results, this model has relatively high accuracy and reliability in identifying abnormal user operations. It can accurately identify most of the abnormal transactions, with a recall rate of 0.8, indicating that the model can effectively capture abnormal transaction behaviors. The accuracy rate of 0.842 indicates that the model has a strong ability to distinguish between normal and abnormal transactions.

[0052] Embodiment 2:

[0053] Embodiment 2 of the present invention discloses an abnormal behavior detection system for a financial trading system using an abnormal behavior detection method for a financial trading system, including:

[0054] A data acquisition and preprocessing module: used to respectively acquire transaction data, system operation data, and user operation data of the financial trading system, and perform data preprocessing.

[0055] Abnormal behavior recognition module: used to recognize abnormal behaviors in transaction data by using an abnormal behavior recognition model for transaction data based on the Isolation Forest algorithm; predict the system response time by using a system response time prediction model based on the neural network algorithm, and compare it with the actual system response time to identify abnormal behaviors in system operation data; recognize abnormal behaviors in user operation data by using an abnormal behavior recognition model for user operation data based on the decision tree algorithm.

[0056] Embodiment 3:

[0057] Embodiment 3 of the present invention discloses an electronic device, including:

[0058] A memory for storing computer programs;

[0059] A processor for implementing the steps of an abnormal behavior detection method for a financial trading system when executing the computer program.

[0060] Embodiment 4:

[0061] Embodiment 4 of the present invention discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of an abnormal behavior detection method for a financial trading system are implemented.

[0062] Embodiments of the present invention disclose an abnormal behavior detection method, system, device, and storage medium for a financial trading system. By using machine learning techniques with good adaptability and self-learning ability, which can continuously adjust and optimize model parameters with the change of the market environment and the emergence of new data, and according to the different characteristics of the data, the Isolation Forest algorithm is selected for abnormal behavior detection of transaction data, and the decision tree algorithm is selected for abnormal behavior detection of user operation data. At the same time, for system operation data that cannot be directly quantified as the system response time, a prediction algorithm based on the neural network is selected, and the final prediction result is compared with the actual system response time, so as to accurately judge the abnormal behavior of the system operation data. Based on this, the present invention can effectively face the rapid changes and complex diversity of the financial market, and select appropriate abnormal detection methods according to different data characteristics, effectively improving the accuracy of abnormal behavior detection of the financial trading system.

[0063] In this specification, each embodiment is described in a progressive manner. The key point of each embodiment is to illustrate the differences from other embodiments. The same or similar parts among the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method part.

[0064] The foregoing description of the disclosed embodiments enables those skilled in the art to practice or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting abnormal behavior of a financial transaction system, characterized in that: include: Step 1: Obtain the transaction data, system operation data and user operation data of the financial transaction system respectively, and perform data preprocessing; Step 2: using a transaction data abnormal behavior recognition model based on an isolation forest algorithm to identify abnormal behaviors in the transaction data; A system response time prediction model based on a neural network algorithm is used to predict the system response time, and compared with the actual system response time to identify abnormal behavior of the system operation data; a user operation data abnormal behavior identification model based on a decision tree algorithm is used to identify abnormal behavior in the user operation data.

2. The abnormal behavior detection method of a financial transaction system according to claim 1, characterized in that: The data preprocessing includes: data cleaning, denoising and normalization operations.

3. The abnormal behavior detection method of a financial transaction system according to claim 1, characterized in that: The training process of the transaction data abnormal behavior recognition model based on the isolation forest algorithm is specifically as follows: The transaction time, transaction frequency and transaction amount in the transaction data are used as feature inputs to train a transaction data abnormal behavior recognition model based on the isolation forest algorithm, and the transaction data abnormal behavior recognition model is optimized and updated according to the recognition results of the transaction data abnormal behavior.

4. The abnormal behavior detection method of a financial transaction system according to claim 1, characterized in that: The training process of the system response time prediction model based on the neural network algorithm is specifically as follows: The server load, network delay and transaction request volume in the system operation data are used as input to train a system response time prediction model based on a neural network algorithm, and the system response time prediction model is optimized and updated according to the identification results of abnormal behavior of the system operation data.

5. The abnormal behavior detection method of a financial transaction system according to claim 1, characterized in that: The user operation data abnormal behavior recognition model based on the decision tree algorithm is specifically: Taking the transaction region, transaction amount and transaction mode in the user operation data as input, a user operation data abnormal behavior recognition model based on a decision tree algorithm is trained, and according to the recognition result of the user operation data abnormal behavior, the user operation data abnormal behavior recognition model is optimized and updated.

6. The abnormal behavior detection method of a financial transaction system according to claim 1, characterized in that: Also includes: The performance of the transaction data abnormal behavior recognition model based on the isolation forest algorithm, the system response time prediction model based on the neural network algorithm, and the user operation data abnormal behavior recognition model based on the decision tree algorithm are verified respectively by calculating the accuracy, recall rate and F1 value.

7. An abnormal behavior detection system for a financial transaction system using the abnormal behavior detection method for a financial transaction system according to any one of claims 1 to 6, characterized in that: include: Data acquisition and preprocessing module: used to acquire transaction data, system operation data and user operation data of the financial transaction system, and perform data preprocessing; Abnormal behavior identification module: used to identify abnormal behavior in the transaction data using an abnormal behavior identification model for transaction data based on an isolation forest algorithm; A system response time prediction model based on a neural network algorithm is used to predict the system response time, and compared with the actual system response time to identify abnormal behavior of the system operation data; a user operation data abnormal behavior identification model based on a decision tree algorithm is used to identify abnormal behavior in the user operation data.

8. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of a method for detecting abnormal behavior in a financial transaction system as described in any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the abnormal behavior detection method for a financial transaction system according to any one of claims 1 to 6 are implemented.

Images