A transaction security authentication method based on multi-source information fusion

Abstract

The present invention relates to the field of data processing technology, and more specifically, to a transaction security authentication method based on multi-source information fusion, the method comprising: collecting training fraud samples of the current month and normal transaction samples of the current month, obtaining the evolution degree of each training fraud sample of the current month and the growth degree of each training fraud sample of the current month based on the difference in feature vectors between the training fraud sample of the current month and each historical fraud sample in each historical time period before the training fraud sample of the current month; obtaining the sample weight of each training fraud sample of the current month based on the growth degree and the evolution degree, assigning corresponding sample weights to the training fraud samples of the current month, and inputting the training fraud samples and the normal transaction samples of the current month into a LightGBM model for training to obtain a trained LightGBM model, and identifying fraudulent behavior in the latest transaction records based on the trained LightGBM model. The present invention improves the accuracy of fraudulent behavior identification.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and more particularly to a transaction security authentication method based on multi-source information fusion. Background Art

[0002] Transaction security authentication is a core mechanism for safeguarding the security of funds and information during online and offline transactions. Through identity verification, data encryption, and risk monitoring, it verifies the authenticity of both parties and the compliance of transaction behavior, preventing malicious intrusion, data leakage, and illegal transactions. Identifying fraudulent behavior is a key part of transaction security authentication. Failure to identify fraudulent behavior in a timely manner can lead to personal financial losses, damage to corporate reputation, and even trigger systemic financial risks.

[0003] The fusion of multi-source information plays the role of an "intelligent filter" in this process. By integrating multi-dimensional data such as user transaction data, geographic location information, and behavioral patterns, a dynamic risk assessment model is constructed. Through rapid cross-validation, it can accurately determine whether there is a fraud risk, significantly improving the accuracy and timeliness of risk identification, and becoming a solid line of defense against fraud.

[0004] Since the LightGBM model only relies on each training fraud sample to identify fraud, and the traditional LightGBM model assigns the same weight to each training fraud sample, the manifestation of fraud in the transaction security authentication scenario is not static, but is in continuous evolution. Therefore, the traditional LightGBM model does not take into account the emergence of new fraud behaviors and the growth trend of fraud behaviors, making it difficult for the model to accurately identify when faced with different growth trend changes and new fraud behaviors. Summary of the Invention

[0005] In order to solve the problem that the traditional LightGBM model does not take into account the emergence of new fraud behaviors and the growth trend of fraud behaviors, making it difficult for the model to accurately identify different growth trend changes and new fraud behaviors, the present invention proposes a transaction security authentication method based on multi-source information fusion, which includes the following steps:

[0006] Collect feature vectors of fraudulent samples and normal transaction samples for the current month; obtain historical fraud samples for each historical time period before each fraudulent sample for the current month;

[0007] According to the difference between the feature vectors of each training fraud sample of the month and each historical fraud sample in each previous historical time period, the evolution degree of each training fraud sample of the month is obtained.

[0008] Based on the Manhattan distance between each training fraud sample of the month and each historical fraud sample in each previous historical time period, obtain the nearest fraud samples in each historical time period before each training fraud sample of the month; based on the growth of the total number of nearest fraud samples in all historical time periods before each training fraud sample of the month, obtain the growth rate of each training fraud sample of the month;

[0009] Get the sample weight of each training fraud sample in the current month , Represents the sample weight of the i-th training fraud sample in the month; Represents the evolution degree of the i-th training fraud sample in the month; Represents the growth rate of the i-th training fraud sample in the month; Represents the preset coefficient;

[0010] The LightGBM model is trained based on the sample weight of each training fraud sample of the month, the training fraud samples of the month, and the normal transaction samples of the month to obtain a trained LightGBM model; based on the trained LightGBM model, fraudulent behavior in the latest transaction records is identified.

[0011] The innovation of the present invention lies in obtaining the evolution degree of each training fraud sample of the month based on the difference in the characteristic vectors of each training fraud sample of the month and the historical fraud samples in the previous historical time period, reflecting whether each training fraud sample of the month is a new type of fraud behavior, then obtaining the neighboring fraud samples in each historical time period before each training fraud sample of the month, and obtaining the growth degree of each training fraud sample of the month based on the growth of the total number of the neighboring fraud samples, reflecting the frequency of occurrence of each training fraud sample of the month, and finally obtaining the sample weight of each training fraud sample of the month based on the growth degree and evolution degree, so that when the LightGBM model is subsequently trained based on each training fraud sample of the month, the accuracy of the model training can be improved by focusing on new fraud behaviors with a growth trend, and further, the accuracy of identifying fraudulent behaviors in the latest transaction records using the trained LightGBM model is improved.

[0012] Preferably, the step of collecting feature vectors of fraudulent samples and normal transaction samples for training in the current month includes:

[0013] Obtaining feature vectors of all transaction records in the current month in the transaction system, wherein the feature vectors of the transaction records include a plurality of feature components;

[0014] Obtain the transaction labels of each transaction record that month after manual review and confirmation; preset the number of samples H, select H transaction records with the transaction label of fraud from all transaction records that month as the training fraud samples for that month, and select H transaction records with the transaction label of normal from all transaction records that month as the normal transaction samples for that month.

[0015] Preferably, obtaining historical fraud samples in each historical time period before each training fraud sample in the current month includes:

[0016] The preset historical time period unit is one month; according to the collection method of the training fraud samples of the current month, the training fraud samples in each historical time period before the transaction time of the i-th training fraud sample of the current month are obtained, and recorded as the historical fraud samples in each historical time period before the i-th training fraud sample of the current month.

[0017] Preferably, obtaining the evolution degree of each training fraud sample in the current month includes:

[0018] ;

[0019] Where, Represents the evolution degree of the i-th training fraud sample in the month; Represents the transaction time interval between the i-th training fraud sample in the current month and the last historical fraud sample in the m-th historical time period before it; as well as Represents the value of the jth feature component of the i-th fraud training sample in the current month and the value of the jth feature component of the k-th historical fraud sample in the m-th historical time period before it; as well as Represents the number of historical time periods before the i-th training fraud sample in the current month and the number of historical fraud samples in each historical time period; Represents the variance of the jth feature component of all training fraud samples in that month; represents the number of characteristic components of the i-th training fraud sample in the current month; || is the absolute value symbol; exp() is an exponential function with a natural constant as the base.

[0020] The greater the evolution degree of the training fraud sample, the more likely it is that the training fraud sample belongs to a new type of fraud.

[0021] Preferably, obtaining neighboring fraud samples in each historical time period before each training fraud sample of the current month includes:

[0022] A distance threshold R is preset, and the Manhattan distance between the feature vector of the i-th training fraud sample of the current month and the feature vector of each historical fraud sample in each historical time period before the i-th training fraud sample of the current month is obtained. The historical fraud samples in each historical time period corresponding to the Manhattan distance less than or equal to R are recorded as the neighboring fraud samples in each historical time period before the i-th training fraud sample of the current month.

[0023] This facilitates the subsequent acquisition of the growth rate of each training fraud sample in the current month based on the growth of the number of neighboring fraud samples in all historical time periods.

[0024] Preferably, obtaining the growth rate of each training fraud sample in the current month includes:

[0025]

[0026] Where, Represents the growth rate of the i-th training fraud sample in the month; Represents the total number of neighboring fraud samples of the i-th fraud training sample in the month; Represents the total number of neighbor fraud samples in the neighbor history period before the i-th training fraud sample in the current month; Represents the total number of neighboring fraud samples in the m+1th historical time period before the i-th training fraud sample in the current month; Represents the total number of neighboring fraud samples in the mth historical time period before the i-th training fraud sample in the current month; Represents the number of historical time periods before the i-th training fraud sample in the current month; Represents a piecewise linear function; norm() represents a normalization function.

[0027] The greater the growth of training fraud samples, the higher the frequency of training fraud samples.

[0028] Preferably, obtaining the total number of neighboring fraud samples of the i-th fraud training sample in the current month includes:

[0029] A distance threshold R is preset, and the Manhattan distance between the feature vector of the i-th training fraud sample of the month and the feature vector of each other training fraud sample of the month is obtained. The training fraud sample of the month corresponding to the Manhattan distance less than or equal to R is recorded as the neighboring fraud sample of the i-th fraud training sample of the month.

[0030] Preferably, obtaining the nearest historical time period before the i-th training fraud sample in the current month includes:

[0031] Obtain the transaction time interval between the i-th training fraud sample of the month and the last historical fraud sample in each historical time period before the i-th training fraud sample of the month as the time interval between the i-th training fraud sample of the month and each of its historical time periods; record the historical time period corresponding to the minimum value of the time interval as the nearest historical time period before the i-th training fraud sample of the month.

[0032] Preferably, obtaining the trained LightGBM model includes:

[0033] The fraud samples and normal transaction samples trained in the current month are input into the LightGBM model for training to obtain a trained LightGBM model. The number of iterations of the LightGBM model is set to 500, the maximum tree depth is 5, and the binary cross entropy loss function is selected as the loss function of the LightGBM model. For the fraud samples trained in the current month, corresponding sample weights are assigned; and the sample weights of the normal transaction samples of the current month are all set to 1.

[0034] The accuracy of model training is improved by setting higher sample weights for new and increasingly frequent training fraud samples.

[0035] Preferably, identifying fraudulent behavior in the latest transaction records based on the trained LightGBM model includes:

[0036] Obtain the feature vector of the latest transaction record and input it into the trained LightGBM model to obtain the fraud confidence of the latest transaction record; set the fraud confidence threshold T. When the fraud confidence of the latest transaction record is greater than or equal to T, mark the latest transaction record as fraudulent behavior and freeze the account in real time to prevent the account from continuing to conduct fraudulent transactions.

[0037] The present invention has the following beneficial effects: The purpose of the present invention is to obtain the evolution degree of each training fraud sample of the month based on the difference in the characteristic vectors of each training fraud sample of the month and the historical fraud samples in the previous historical time period, reflecting whether each training fraud sample of the month is a new type of fraud behavior, and then obtain the neighboring fraud samples in each historical time period before each training fraud sample of the month, and obtain the growth degree of each training fraud sample of the month based on the growth of the total number of the neighboring fraud samples, reflecting the frequency of occurrence of each training fraud sample of the month, and finally obtain the sample weight of each training fraud sample of the month based on the growth degree and evolution degree, so that when the LightGBM model is subsequently trained based on each training fraud sample of the month, the accuracy of the model training can be improved by focusing on new fraud behaviors with a growth trend, and further, the accuracy of identifying fraud behaviors in the latest transaction records using the trained LightGBM model is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood by reading the following detailed description with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present invention are shown in an illustrative and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0039] Figure 1 This is a flowchart of the steps of a transaction security authentication method based on multi-source information fusion in an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0041] See also Figure 1 , which shows a flowchart of a transaction security authentication method based on multi-source information fusion provided by an embodiment of the present invention, the method includes the following steps:

[0042] S001. Collect the training fraud samples of the current month, the normal transaction samples of the current month, and the historical fraud samples of each historical time period before each training fraud sample of the current month.

[0043] In an embodiment of the present invention, all transaction records of the current month are obtained from the transaction system. For any transaction record of the current month, the transaction amount, the number of transactions of the user in the past seven days, the time interval between the user's last transaction and the user's last transaction (numerical features requiring normalization / standardization), the user's payment method (categorical features requiring label coding), the user's maximum transaction amount, the transaction timestamp, the location of the transaction IP, whether the transaction IP is a known risk (Boolean feature, represented by 0 / 1), and the transaction label confirmed by manual review (fraud / normal, represented by 1 / 0) are used as the feature vector of the transaction record. The feature vector of the transaction record includes several feature components. The feature vectors of all transaction records of the current month are obtained.

[0044] The preset number of samples H=500. In other embodiments, the value of H is preset according to the specific implementation situation. H transaction records with transaction labels of fraud are selected from all transaction records of the month as training fraud samples of the month. H transaction records with transaction labels of normal are selected from all transaction records of the month as normal transaction samples of the month. The training fraud samples of the month and the normal transaction samples of the month are used as training samples of the month.

[0045] The preset historical time period unit is one month, and the preset number of historical time periods is M=6. According to the method for obtaining the training fraud samples of the current month, the training fraud samples in each historical time period before the transaction time of the i-th training fraud sample of the current month are obtained, and recorded as the historical fraud samples in each historical time period before the i-th training fraud sample of the current month.

[0046] S002. Obtain the evolution degree of each training fraud sample of the current month based on the difference in feature vectors between the training fraud sample of the current month and each historical fraud sample in each historical time period before the training fraud sample of the current month.

[0047] It should be noted that since the LightGBM model only relies on each training fraud sample to identify fraud, and the traditional LightGBM model will give each training fraud sample the same weight, the manifestation of fraud in the transaction security authentication scenario is not static, but is in continuous evolution. Therefore, the traditional LightGBM model does not take into account the emergence of new fraud behaviors and the growth trend of fraud behaviors, making it difficult for the model to accurately identify when faced with different growth trend changes and new fraud behaviors. Therefore, each training fraud sample of the month is analyzed to obtain the sample weight of each training fraud sample, thereby improving the LightGBM model's ability to identify evolving fraud behaviors.

[0048] It should be further explained that if the difference between the feature vectors of any fraud training sample of the month and the historical fraud samples in the historical time periods before the training fraud sample of the month is large, it means that the evolution degree of the fraud training sample is higher, and the possibility that the fraud training sample is a new type of fraud behavior sample is higher. Therefore, the evolution degree of the fraud training sample of the month is first obtained by combining the difference between the feature vectors of any fraud training sample of the month and the historical fraud samples in the historical time periods before the training fraud sample of the month.

[0049] In this embodiment of the present invention, the evolution degree of each training fraud sample in the current month is obtained:

[0050] ;

[0051] Where, Represents the evolution degree of the i-th training fraud sample in the month; Represents the transaction time interval between the last historical fraud sample in the mth historical time period before the i-th training fraud sample of the month and the i-th training fraud sample; Represents the value of the jth feature component of the i-th fraud training sample in the current month; Represents the value of the jth feature component of the kth historical fraud sample in the mth historical time period before the i-th training fraud sample in the current month; Represents the number of historical time periods before the i-th training fraud sample in the current month; Represents the number of historical fraud samples in each historical time period before the i-th training fraud sample of the month; Represents the variance of the jth feature component of all training fraud samples in that month; represents the number of characteristic components of the i-th training fraud sample in the current month; the number of characteristics in the i-th training fraud sample is the same as the number of characteristic components of the k-th fraud sample in the m-th historical time period before the i-th training fraud sample; || represents the absolute value symbol; exp() represents an exponential function with a natural constant as the base;

[0052] Represents the difference between the i-th fraud training sample of the month and the k-th historical fraud sample in the m-th historical time period before the i-th training fraud sample of the month. The higher the value, the higher the evolution degree of the i-th fraud training sample of the month, indicating that the i-th fraud sample of the month is more likely to be a new type of fraud behavior;

[0053] The larger the value of , the shorter the transaction time interval between the last historical fraud sample in the mth historical time period before the i-th training fraud sample of the month and the i-th training fraud sample of the month. In this case, the greater the influence weight of the difference between the i-th fraud training sample of the month and the k-th historical fraud sample in the m-th historical time period before the i-th training fraud sample of the month.

[0054] S003. Obtain the nearest neighbor fraud samples in each historical time period before each training fraud sample of the month, and obtain the growth rate of each training fraud sample of the month based on the growth trend of the number of nearest neighbor fraud samples in the historical time period before each training fraud sample of the month; obtain the sample weight of each training fraud sample of the month based on the growth rate of each training fraud sample of the month and the evolution rate of each training fraud sample of the month.

[0055] It should be noted that the evolution of each training fraud sample in the current month only represents the difference between the fraud samples in the current month and the historical fraud samples in the previous historical time periods. It cannot effectively identify the increasing frequency trend of fraudulent behaviors represented by the fraud samples.

[0056] The present invention first obtains the neighboring fraud samples in each historical time period before each training fraud sample of the month based on the distance between the feature vector of any training fraud sample of the month and the feature vector of each historical fraud sample in each historical time period before the training fraud sample. Therefore, the number of neighboring fraud samples in each historical time period before the training fraud sample of the month increases in chronological order and the greater the word growth rate, the more likely it is that the frequency of occurrence of the fraudulent behavior represented by the training fraud sample of the month will increase, and the higher the growth degree of the training fraud sample.

[0057] In this embodiment of the present invention, a distance threshold R is preset, and the Manhattan distance between the feature vector of the i-th training fraud sample of the current month and the feature vector of each historical fraud sample in each historical time period before the i-th training fraud sample of the current month is obtained. The historical fraud sample in each historical time period corresponding to the Manhattan distance being less than or equal to R is recorded as the nearest neighbor fraud sample in each historical time period before the i-th training fraud sample of the current month;

[0058] Obtain the Manhattan distance between the feature vector of the i-th fraudulent training sample of the month and the feature vector of each other fraudulent training sample of the month. Record the fraudulent training sample of the month for which the Manhattan distance is less than or equal to R as the nearest neighbor fraudulent sample of the i-th fraudulent training sample of the month.

[0059] Obtain the transaction time interval between the i-th training fraud sample of the month and the last historical fraud sample in each historical time period before the i-th training fraud sample of the month as the time interval between the i-th training fraud sample of the month and each of its historical time periods; record the historical time period corresponding to the minimum value of the time interval as the nearest historical time period before the i-th training fraud sample of the month;

[0060] Get the growth rate of each training fraud sample in the current month:

[0061]

[0062] Where, Represents the growth rate of the i-th training fraud sample in the month; Represents the total number of neighboring fraud samples of the i-th fraud training sample in the month; Represents the total number of neighbor fraud samples in the neighbor history period before the i-th training fraud sample in the current month; Represents the total number of neighboring fraud samples in the m+1th historical time period before the i-th training fraud sample in the current month; Represents the total number of neighboring fraud samples in the mth historical time period before the i-th training fraud sample in the current month; Represents the number of historical time periods before the i-th training fraud sample in the current month; Represents a piecewise linear function, used to retain positive values, when When the value of is less than or equal to 0, The value of is 0, when When the value of is greater than 0, The value of The difference; norm() represents the normalization function;

[0063] Represents the growth of the total number of neighboring fraud samples of the i-th fraud training sample in the current month compared to the total number of neighboring fraud samples in its most recent historical time period;

[0064] Represents the sum of the growth of the neighboring fraud samples in each historical time period before the i-th training fraud sample in the current month compared with the neighboring fraud samples in the previous historical time period; The larger the value of , the more the total number of neighboring fraud samples in the historical period before the i-th training fraud sample of the month continues to grow, which means that the possibility of the fraudulent behavior represented by the i-th training fraud sample of the month increasing in frequency is higher, and therefore the growth rate of the i-th training fraud sample of the month is higher.

[0065] It should be noted that the higher the evolution degree and the higher the growth degree of any training fraud sample in the month, the more it indicates that the training fraud sample is a new type of fraud sample with a growth trend, and a larger sample weight needs to be set to facilitate key identification.

[0066] In this embodiment of the present invention, the sample weight of each training fraud sample in the current month is obtained:

[0067] ;

[0068] Where, Represents the sample weight of the i-th training fraud sample in the month; Represents the evolution degree of the i-th training fraud sample in the month; Represents the growth rate of the i-th training fraud sample in the month; Represents a preset coefficient. In the embodiment of the present invention, the preset coefficient ,right The value multiplied by , making The value of is between 0 and 2. The training fraud samples with higher evolution degree and higher relative growth degree are new fraud samples with a growth trend. Therefore, the sample weight of the training fraud samples is higher and needs to be identified with emphasis.

[0069] S004. Assign corresponding sample weights to the fraud samples trained in the current month, and input them and the normal transaction samples of the current month into the LightGBM model for training to obtain a trained LightGBM model. Based on the trained LightGBM model, identify fraudulent behavior in recent transaction records.

[0070] In an embodiment of the present invention, the fraud samples trained in the current month and the normal transaction samples of the current month are input into the LightGBM model for training to obtain a trained LightGBM model; wherein, the number of iterations of the LightGBM model is set to 500, the maximum tree depth is 5, and the binary cross entropy loss function is selected as the loss function of the LightGBM model; for the fraud samples trained in the current month, corresponding sample weights are assigned; and the sample weights of the normal transaction samples of the current month are all set to 1; the specific training process is a well-known content of the LightGBM model, and this embodiment will not repeat the specific training process.

[0071] Obtain the feature vector of the latest transaction record and input the obtained feature vector into the trained LightGBM model to obtain the fraud confidence of the latest transaction record;

[0072] The fraud confidence threshold T is set to 0.7. In other embodiments, the implementer may preset the value of the fraud confidence threshold according to the specific implementation method. When the fraud confidence of the latest transaction record is greater than or equal to the fraud confidence threshold, the latest transaction record will be marked as fraudulent behavior, and the account will be frozen in real time to prevent the account from continuing to conduct fraudulent transactions.

[0073] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A transaction security authentication method based on multi-source information fusion, characterized in that: include: Collect feature vectors of fraudulent samples and normal transaction samples for training in that month; Obtain historical fraud samples for each historical time period before each training fraud sample of the current month; According to the difference between the feature vectors of each training fraud sample of the month and each historical fraud sample in each previous historical time period, the evolution degree of each training fraud sample of the month is obtained. Based on the Manhattan distance between each training fraud sample of the month and each historical fraud sample in each previous historical time period, obtain the nearest fraud samples in each historical time period before each training fraud sample of the month; based on the growth of the total number of nearest fraud samples in all historical time periods before each training fraud sample of the month, obtain the growth rate of each training fraud sample of the month; Get the sample weight of each training fraud sample in the current month , Represents the sample weight of the i-th training fraud sample in the month; Represents the evolution degree of the i-th training fraud sample in the month; Represents the growth rate of the i-th training fraud sample in the month; Represents the preset coefficient; The LightGBM model is trained based on the sample weight of each training fraud sample of the month, the training fraud samples of the month, and the normal transaction samples of the month to obtain a trained LightGBM model; based on the trained LightGBM model, fraudulent behavior in the latest transaction records is identified.

2. A transaction security authentication method based on multi-source information fusion according to claim 1, characterized in that: The feature vectors of the fraudulent samples and normal transaction samples collected for training in the current month include: Obtaining feature vectors of all transaction records in the current month in the transaction system, wherein the feature vectors of the transaction records include a plurality of feature components; Obtain the transaction labels of each transaction record that month after manual review and confirmation; preset the number of samples H, select H transaction records with the transaction label of fraud from all transaction records that month as the training fraud samples for that month, and select H transaction records with the transaction label of normal from all transaction records that month as the normal transaction samples for that month.

3. A transaction security authentication method based on multi-source information fusion according to claim 2, characterized in that: The acquisition of historical fraud samples for each historical time period before each training fraud sample of the current month includes: The preset historical time period unit is one month. According to the collection method of the training fraud samples of the month, the training fraud samples in each historical time period before the transaction time of the i-th training fraud sample of the month are obtained, and recorded as the historical fraud samples in each historical time period before the i-th training fraud sample of the month.

4. A transaction security authentication method based on multi-source information fusion according to claim 1, characterized in that: Obtaining the evolution of each fraudulent training sample for the current month includes: ； Where, Represents the evolution degree of the i-th training fraud sample in the month; Represents the transaction time interval between the i-th training fraud sample in the current month and the last historical fraud sample in the m-th historical time period before it; as well as Represents the value of the jth feature component of the i-th training fraud sample in the current month and the value of the jth feature component of the k-th historical fraud sample in the m-th historical time period before it; as well as Represents the number of historical time periods before the i-th training fraud sample in the current month and the number of historical fraud samples in each historical time period; Represents the variance of the jth feature component of all training fraud samples in that month; represents the number of characteristic components of the i-th training fraud sample in the current month; || is the absolute value symbol; exp() is an exponential function with a natural constant as the base.

5. The transaction security authentication method based on multi-source information fusion according to claim 1 is characterized in that: The obtaining of neighboring fraud samples in each historical time period before each training fraud sample of the current month includes: A distance threshold R is preset, and the Manhattan distance between the feature vector of the i-th training fraud sample of the current month and the feature vector of each historical fraud sample in each historical time period before the i-th training fraud sample of the current month is obtained. The historical fraud samples in each historical time period corresponding to the Manhattan distance less than or equal to R are recorded as the neighboring fraud samples in each historical time period before the i-th training fraud sample of the current month.

6. A transaction security authentication method based on multi-source information fusion according to claim 1, characterized in that: Obtaining the growth rate of each training fraud sample in the current month includes: Where, Represents the growth rate of the i-th training fraud sample in the month; Represents the total number of neighboring fraud samples of the i-th training fraud sample in the current month; Represents the total number of neighbor fraud samples in the neighbor history period before the i-th training fraud sample in the current month; Represents the total number of neighboring fraud samples in the m+1th historical time period before the i-th training fraud sample in the current month; Represents the total number of neighboring fraud samples in the mth historical time period before the i-th training fraud sample in the current month; Represents the number of historical time periods before the i-th training fraud sample in the current month; Represents a piecewise linear function; norm() represents a normalization function.

7. A transaction security authentication method based on multi-source information fusion according to claim 6, characterized in that: The total number of neighboring fraud samples of the i-th training fraud sample in the month is obtained by: A distance threshold R is preset, and the Manhattan distance between the feature vector of the i-th training fraud sample of the month and the feature vector of each other training fraud sample of the month is obtained. The training fraud sample of the month corresponding to the Manhattan distance less than or equal to R is recorded as the neighboring fraud sample of the i-th training fraud sample of the month.

8. The transaction security authentication method based on multi-source information fusion according to claim 6 is characterized in that: The acquisition of the nearest historical time period before the i-th training fraud sample in the month includes: Obtain the transaction time interval between the i-th training fraud sample of the month and the last historical fraud sample in each historical time period before the i-th training fraud sample of the month as the time interval between the i-th training fraud sample of the month and each of its historical time periods; record the historical time period corresponding to the minimum value of the time interval as the nearest historical time period before the i-th training fraud sample of the month.

9. The transaction security authentication method based on multi-source information fusion according to claim 1, characterized in that: The obtained trained LightGBM model includes: The fraud samples and normal transaction samples trained in the current month are input into the LightGBM model for training to obtain a trained LightGBM model. The number of iterations of the LightGBM model is set to 500, the maximum tree depth is 5, and the binary cross entropy loss function is selected as the loss function of the LightGBM model. For the fraud samples trained in the current month, corresponding sample weights are assigned; and the sample weights of the normal transaction samples of the current month are all set to 1.

10. The transaction security authentication method based on multi-source information fusion according to claim 1, characterized in that: The trained LightGBM model is used to identify fraudulent behavior in the latest transaction records, including: Obtain the feature vector of the latest transaction record and input it into the trained LightGBM model to obtain the fraud confidence of the latest transaction record; set the fraud confidence threshold T. When the fraud confidence of the latest transaction record is greater than or equal to T, mark the latest transaction record as fraudulent behavior and freeze the account in real time to prevent the account from continuing to conduct fraudulent transactions.

Images