Abnormality detection method and device, electronic equipment, medium and program product

Abstract

The invention provides an anomaly detection method which can be applied to the technical field of artificial intelligence and the technical field of big data. The method comprises the steps of obtaining target transaction data; based on the target transaction data, using a feature extraction model to extract a transaction behavior feature vector; performing feature importance evaluation on the transaction behavior feature vector, constructing a feature selection optimization model based on an evaluation result, and solving the feature selection optimization model by using a target optimization algorithm to obtain a target feature subset; and inputting the target feature subset into a detection and recognition model for anomaly detection to obtain an anomaly recognition result.

Description

Technical Field

[0001] The present disclosure relates to the fields of artificial intelligence technology and big data technology, and more particularly to an anomaly detection method, apparatus, device, medium and program product. Background Art

[0002] With the rapid development of the financial market, the volume of transaction data has grown exponentially, and abnormal trading behaviors have become increasingly concealed and diversified, posing a severe risk identification challenge to financial institutions. Existing anomaly detection methods mostly rely on supervised learning and are difficult to identify new or unlabeled fraud behaviors.

[0003] As an unsupervised algorithm, Isolation Forest has high detection efficiency and the ability to adapt to big data, and is suitable for anomaly detection in the financial field. However, the Isolation Forest algorithm still faces problems such as strong parameter sensitivity and limited ability to model complex feature structures in practical applications, and it is difficult to fully cope with the high-dimensional and dynamic change characteristics of financial transaction data. Summary of the Invention

[0004] In view of the above problems, the present disclosure provides an anomaly detection method, apparatus, device, medium and program product.

[0005] According to a first aspect of the present disclosure, there is provided an anomaly detection method, the method comprising: obtaining target transaction data; extracting a transaction behavior feature vector by using a feature extraction model based on the target transaction data; evaluating the importance of features for the transaction behavior feature vector, constructing a feature selection optimization model based on the evaluation result, and solving the feature selection optimization model by using a target optimization algorithm to obtain a target feature subset; and inputting the target feature subset into a detection and recognition model for anomaly detection to obtain an anomaly recognition result.

[0006] According to an embodiment of the present disclosure, the feature extraction model includes a plurality of first sub-networks, and the outputs of the plurality of first sub-networks are fused to obtain the transaction behavior feature vector, wherein the plurality of first sub-networks are respectively used to extract feature vectors of different time scales; or the feature extraction model includes a plurality of second sub-networks, and the outputs of the plurality of second sub-networks are fused to obtain the transaction behavior feature vector, wherein the plurality of second sub-networks are respectively used to extract feature vectors of different modalities.

[0007] According to an embodiment of the present disclosure, the feature fusion of the outputs of multiple first sub-networks to obtain the transaction behavior feature vector specifically includes: obtaining multi-time-scale feature vectors output by multiple first sub-networks; calculating the representation differences between the multi-time-scale feature vectors, and constructing a consistency loss function based on the representation differences; and performing weighted fusion on the multi-time-scale feature vectors based on the consistency loss function to obtain the transaction behavior feature vector.

[0008] According to an embodiment of the present disclosure, the target transaction data includes data of different modalities. The feature fusion of the outputs of multiple second sub-networks to obtain the transaction behavior feature vector specifically includes: obtaining multi-modal feature vectors output by multiple second sub-networks, aligning the multi-modal feature vectors to obtain a set of modal alignment vectors; performing correlation modeling based on the set of modal alignment vectors to obtain attention weight information; and performing weighted fusion on the multi-modal feature vectors based on the attention weight information to obtain the transaction behavior feature vector.

[0009] According to an embodiment of the present disclosure, the method further includes: generating a modal granularity control signal based on the modal complexity of the target transaction data; and dynamically configuring a corresponding second sub-network based on the modal granularity control signal.

[0010] According to an embodiment of the present disclosure, the detection and recognition model is an isolation forest model. The inputting of the target feature subset into the detection and recognition model for anomaly detection to obtain an anomaly recognition result specifically includes: inputting the target feature subset into the detection and recognition model, and calculating the path lengths of the target feature subset in each isolation tree; calculating the anomaly score of the target feature subset according to the path lengths; and outputting an anomaly recognition result based on the anomaly score and a preset anomaly determination threshold.

[0011] According to an embodiment of the present disclosure, the feature selection optimization model is a quadratic unconstrained binary optimization model. The use of a target optimization algorithm to solve the feature selection optimization model to obtain a target feature subset specifically includes: inputting the quadratic unconstrained binary optimization model into a quantum optimization algorithm solver to obtain a solution result; and extracting the corresponding feature selection variable states from the solution result to obtain the target feature subset.

[0012] According to an embodiment of the present disclosure, the method further includes: in response to obtaining an anomaly recognition result, obtaining corresponding transaction association information; and performing multi-factor verification based on the transaction association information to obtain an anomaly verification result.

[0013] The second aspect of the present disclosure provides an anomaly detection device, which includes: a data acquisition module for acquiring target transaction data; a feature extraction module for extracting a transaction behavior feature vector based on the target transaction data by using a feature extraction model; a feature screening module for evaluating the importance of features for the transaction behavior feature vector, constructing a feature selection optimization model based on the evaluation result, and solving the feature selection optimization model by using a target optimization algorithm to obtain a target feature subset; and an anomaly detection module for inputting the target feature subset into a detection and recognition model for anomaly detection to obtain an anomaly recognition result.

[0014] According to an embodiment of the present disclosure, the feature extraction module may also be used to obtain multi-time scale feature vectors output by multiple first sub-networks; calculate the representation differences between the multi-time scale feature vectors, construct a consistency loss function based on the representation differences; and perform weighted fusion on the multi-time scale feature vectors based on the consistency loss function to obtain the transaction behavior feature vector.

[0015] According to an embodiment of the present disclosure, the feature extraction module may also be used to obtain multi-modal feature vectors output by multiple second sub-networks, align the multi-modal feature vectors, and obtain a set of modal alignment vectors; perform correlation modeling based on the set of modal alignment vectors to obtain attention weight information; and perform weighted fusion on the multi-modal feature vectors based on the attention weight information to obtain the transaction behavior feature vector.

[0016] According to an embodiment of the present disclosure, the feature extraction module may also be used to generate a modal granularity control signal based on the modal complexity of the target transaction data; and dynamically configure a corresponding second sub-network based on the modal granularity control signal.

[0017] According to an embodiment of the present disclosure, the feature screening module may also be used to input the quadratic unconstrained binary optimization model into a quantum optimization algorithm solver to obtain a solution result; and extract corresponding feature selection variable states from the solution result to obtain the target feature subset.

[0018] According to an embodiment of the present disclosure, the anomaly detection module may also be used to input the target feature subset into the detection and recognition model, calculate the path lengths of the target feature subset in each isolation tree; calculate the anomaly score of the target feature subset according to the path lengths; and output an anomaly recognition result based on the anomaly score and a preset anomaly determination threshold.

[0019] A third aspect of the present disclosure provides an electronic device, including: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0020] A fourth aspect of the present disclosure further provides a computer-readable storage medium, on which a computer program or instruction is stored, and when the computer program or instruction is executed by a processor, the steps of the above method are implemented.

[0021] A fifth aspect of the present disclosure further provides a computer program product, including a computer program or instruction, and when the computer program or instruction is executed by a processor, the steps of the above method are implemented.

[0022] According to the embodiments of the present disclosure, by introducing a feature extraction, feature importance evaluation, and optimization and screening process based on the original transaction data, the computational complexity and resource consumption of the detection model are significantly reduced, and the response speed and processing throughput of the overall system are improved; at the same time, the feature selection problem is modeled as an optimization problem, and the optimization objective function can be flexibly adjusted according to different business requirements or strategic goals. The present disclosure improves the accuracy and robustness of anomaly detection by selectively retaining high-value features, effectively reduces the false alarm and missed alarm rates, thereby reducing the interference with normal transactions at the user experience level and improving the intelligence level and customer satisfaction of the risk control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Through the following description of the embodiments of the present disclosure with reference to the drawings, the above content and other objects, features, and advantages of the present disclosure will become clearer. In the drawings:

[0024] Figure 1 Schematically shows an application scenario diagram of an anomaly detection method, device, equipment, medium, and program product according to an embodiment of the present disclosure;

[0025] Figure 2 Schematically shows a flowchart of an anomaly detection method according to an embodiment of the present disclosure;

[0026] Figure 3 Schematically shows a flowchart of a method for feature fusion of the outputs of multiple first sub-networks according to an embodiment of the present disclosure;

[0027] Figure 4 Schematically shows a flowchart of a method for feature fusion of the outputs of multiple first sub-networks according to an embodiment of the present disclosure;

[0028] Figure 5 Schematically shows a structural block diagram of an anomaly detection device; and

[0029] Figure 6 A block diagram of an electronic device suitable for implementing an anomaly detection method according to an embodiment of the present disclosure is schematically shown. Detailed implementation manners

[0030] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the following detailed description, for the sake of explanation, many specific details are set forth in order to provide a comprehensive understanding of the embodiments of the present disclosure. However, obviously, one or more embodiments can also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present disclosure.

[0031] The terms used herein are merely for describing specific embodiments and are not intended to limit the present disclosure. The terms "including", "comprising", etc. used herein indicate the presence of the described features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0032] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0033] In the case of using expressions such as "at least one of A, B, and C, etc.", generally, it should be interpreted according to the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include, but not be limited to, a system having only A, only B, only C, having A and B, having A and C, having B and C, and / or having A, B, and C, etc.).

[0034] First, the technical terms described herein are explained and illustrated as follows.

[0035] Isolation Forest is an unsupervised learning algorithm for anomaly detection. It determines whether a sample is an outlier by constructing multiple "Isolation Trees". Its core idea is that outliers usually have distinctive features and are more likely to be isolated in the feature space. The algorithm constructs a tree structure by randomly selecting features and random splitting values, and records the average path length required to isolate the sample. The shorter the path, the more likely it is an outlier. Isolation Forest has the advantages of linear time complexity, low memory consumption, and no need for label training, and is especially suitable for large-scale high-dimensional data scenarios.

[0036] The Quadratic Unconstrained Binary Optimization (QUBO) model is widely used to model combinatorial optimization problems, such as feature selection, path planning, scheduling, etc. In feature selection, each binary variable represents whether a certain feature is selected. The objective function comprehensively considers factors such as feature importance and redundancy, and it is a general problem modeling form supported by quantum optimization algorithms.

[0037] Quantum optimization algorithms are a class of computational methods that utilize quantum mechanical principles (such as quantum superposition and tunneling effects) to solve complex optimization problems. Common quantum optimization algorithms include: Quantum Annealing: It searches for the minimum energy solution through the evolution process of quantum states and is suitable for solving problems such as QUBO; Quantum Approximate Optimization Algorithm (QAOA): Based on the gate-based quantum computing framework, it optimizes the quantum circuit through adjustable parameters to achieve an approximate optimal solution. Compared with traditional optimization methods, quantum optimization can achieve a higher-dimensional parallel search ability for specific problems and is suitable for handling feature selection tasks with high complexity and combinatorial explosion.

[0038] With the rapid development of fintech and the wide popularization of services such as online payment, intelligent wealth management, and cross-border settlement, the amount of data generated by financial trading systems has increased exponentially. Financial institutions are facing the huge challenge of accurately identifying abnormal trading behaviors and timely detecting potential fraud risks in the vast amount of data. Especially in the context of frequent real-time transactions, mobile payments, and multi-channel account operations, traditional risk control mechanisms based on manual rules or static thresholds can no longer meet the dual requirements of flexibility, response speed, and identification accuracy.

[0039] Most existing financial anomaly detection methods are based on supervised learning models and rely on a large number of labeled historical fraud samples for training. However, financial fraud techniques are updated rapidly, and new types of attacks often do not have clear labels, resulting in these models being prone to overfitting to historical patterns and lacking the generalization ability to identify unknown types of fraud. In addition, the training cost of supervised models is high, and their performance drops significantly when the data is imbalanced (fraud samples are much fewer than normal samples).

[0040] As an unsupervised anomaly detection algorithm, the Isolation Forest algorithm has received extensive attention in the field of financial risk control in recent years due to its linear time complexity and good adaptability to large-scale data processing. It scores a small number of samples that are easily isolated (i.e., potential anomalies) by constructing multiple isolated trees that randomly divide the feature space. However, in actual financial transaction data, due to high data dimensions, strong temporal characteristics, and complex modalities, the Isolation Forest algorithm has problems such as strong dependence on input feature selection, high parameter sensitivity, and insufficient modeling of complex relationships between features, which are prone to false alarms or missed alarms.

[0041] Based on this, embodiments of the present disclosure provide an anomaly detection method, and the method includes: obtaining target transaction data; extracting a transaction behavior feature vector by using a feature extraction model based on the target transaction data; evaluating the feature importance of the transaction behavior feature vector, constructing a feature selection optimization model based on the evaluation result, and solving the feature selection optimization model by using a target optimization algorithm to obtain a target feature subset; and inputting the target feature subset into a detection and recognition model for anomaly detection to obtain an anomaly recognition result. The anomaly detection method provided by the present disclosure significantly reduces the computational complexity and resource consumption of the detection model and improves the response speed and processing throughput of the overall system by introducing a feature extraction, feature importance evaluation, and optimization and screening process on the basis of the original transaction data; at the same time, modeling the feature selection problem as an optimization problem enables flexible adjustment of the optimization objective function according to different business requirements or strategic goals. The present disclosure improves the accuracy and robustness of anomaly detection, effectively reduces the false alarm rate and missed alarm rate by selectively retaining high-value features, thereby reducing the interference with normal transactions at the user experience level and improving the intelligence level and customer satisfaction of the risk control system.

[0042] It should be noted that the anomaly detection method, device, equipment, medium, and program product determined by the present disclosure can be used in the fields of artificial intelligence technology, big data technology, and fintech technology, and can also be used in a variety of fields other than the fields of artificial intelligence technology, big data technology, and fintech technology. The application fields of the anomaly detection method, device, equipment, medium, and program product provided by the embodiments of the present disclosure are not limited.

[0043] In the technical solution of the present disclosure, the user information involved (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) are all information and data that have been authorized by the user or fully authorized by all parties, and the processing of relevant data, such as collection, storage, use, processing, transmission, provision, disclosure, and application, all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good customs, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0044] In the scenario of making automated decisions using personal information, the methods, devices, and systems provided by the embodiments of the present disclosure all provide corresponding operation entrances for users to choose to agree or reject the results of automated decisions; if the user chooses to reject, the expert decision-making process will be entered. The term "automated decision" here refers to an activity of automatically analyzing and evaluating an individual's behavior habits, hobbies, or economic, health, credit status, etc. through a computer program and making a decision. The term "expert decision" here refers to an activity of making a decision by a person who specializes in a certain field, has specialized experience, knowledge, and skills, and has reached a certain professional level.

[0045] Figure 1 FIG. schematically shows an application scenario diagram of an anomaly detection method, device, equipment, medium, and program product according to an embodiment of the present disclosure.

[0046] As Figure 1 shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0047] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for examples).

[0048] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices with a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop portable computers, and desktop computers, etc.

[0049] The server 105 may be a server that provides various services, such as a background management server that supports the websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (only for examples). The background management server may analyze and process data such as user requests received, and feedback the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0050] It should be noted that the anomaly detection method provided by the embodiments of the present disclosure can generally be executed by the server 105. Correspondingly, the anomaly detection device provided by the embodiments of the present disclosure can generally be set in the server 105. The anomaly detection method provided by the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105. Correspondingly, the anomaly detection device provided by the embodiments of the present disclosure can also be set in a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105.

[0051] It should be understood that Figure 1 the number of terminal devices, networks, and servers in

[0052] is merely illustrative. According to the implementation requirements, there can be any number of terminal devices, networks, and servers. Figure 1 The following will be based on Figures 2 to 4 the scenarios described below, and through

[0053] Figure 2 FIG. schematically shows a flowchart of the anomaly detection method according to an embodiment of the present disclosure.

[0054] As Figure 2 shown, the anomaly detection method of this embodiment includes operations S210 to S240, and this anomaly detection method can be executed by the server 105.

[0055] In operation S210, target transaction data is obtained.

[0056] In the embodiments of the present disclosure, the target transaction data can be sourced from various business systems of financial institutions. For example, core transaction systems, payment gateways, user terminal interaction logs, risk control systems, or third-party behavior data platforms, etc. The target transaction data can be accessed in real-time stream or batch processing form, and the specific content can include structured or semi-structured fields in multiple dimensions such as user identification, transaction time, transaction amount, transaction type, receiving and paying accounts, transaction channels, geographical location information, IP address, device fingerprint, network type, etc.

[0057] Furthermore, the target transaction data can also be composite input information from different dimensions and different data types. For example, it can include the data modalities of the user device, such as device model, operating system version, device unique identifier (such as IMEI, MAC address), etc., which are used to reflect the terminal environment characteristics behind the transaction behavior. For example, it can include network behavior data related to the user interaction process, such as IP address, network type (Wi-Fi / 4G), DNS resolution record, HTTP request header, latency fluctuation situation, etc., which are used to assist in judging whether the transaction initiation location is trustworthy or whether there are abnormal traffic characteristics. For example, biometric data or behavioral biometric data can also be introduced, such as pressing rhythm, sliding trajectory, face recognition result, keyboard input pattern, etc., especially in mobile payment or advanced risk control applications, which are used to enhance the analysis of identity confirmation and behavior continuity.

[0058] In the embodiments of the present disclosure, in order to obtain transaction feature inputs with clear semantics and standardized formats, data preprocessing can be performed on the target transaction data. The data preprocessing process can include data cleaning, data transformation, and data normalization, corresponding to different levels of data quality control objectives respectively.

[0059] In the data cleaning stage, the integrity, accuracy, and consistency of the target transaction data can be comprehensively checked. Specifically, invalid transaction records can be eliminated, such as transactions with abnormal status, zero amount, and logical field conflicts; duplicate transaction entries in the data can be removed to avoid model bias caused by information redundancy; and for the case of missing fields, an intelligent filling mechanism can be adopted for processing. The filling methods can include mean imputation, median imputation, estimation based on similar users, or predicting the possible values of the missing fields through a lightweight model, ensuring that each transaction sample has structural integrity, so as to meet the input requirements of the feature extraction model.

[0060] The data transformation operation mainly processes the categorical variables in the transaction data. In actual financial transaction data, common categorical fields include transaction type (such as transfer, consumption, cash withdrawal), account type (such as personal account, enterprise account), customer level, payment method, etc. To make these non-numerical fields acceptable to the neural network model, the system can convert them into standardized numerical features through methods such as one-hot encoding, label encoding, frequency encoding, or embedding vector mapping. This processing process not only enhances the structural expression ability of the data but also improves the model's discrimination ability for the relationships between categories.

[0061] The normalization stage aims to unify the scales and distributions of various numerical features, eliminating the impact of dimensional differences on model training. Considering that financial data often has magnitude differences in dimensions such as amount, frequency, and time, linear normalization (such as min-max scaling), Z-score standardization, logarithmic transformation, or quantile mapping can be used to scale-standardize continuous variables, making them fall into the input intervals expected by the model (such as [0,1] or a distribution with a mean of 0 and a standard deviation of 1), thereby improving the training convergence speed, gradient stability, and recognition accuracy of the model.

[0062] In operation S220, based on the target transaction data, a transaction behavior feature vector is extracted using a feature extraction model.

[0063] In the embodiments of the present disclosure, the feature extraction model can be a traditional feature engineering method, such as the construction of aggregation metrics based on rule definitions, such as the transaction frequency in the past N days, average transaction amount, proportion of night transactions, standard deviation of consecutive transaction intervals, etc.; it can also be a feature representation automatically extracted by machine learning or deep learning methods.

[0064] Preferably, for transaction sequence data with time continuity and context dependence, a long short-term memory network (LSTM) or a gated recurrent unit network (GRU) can be used to model the transaction time series. LSTM or GRU can use the timestamp, amount, transaction channel, etc. of each transaction as sequence elements, and unfold through time steps to learn the evolution trend of transaction behavior. For example, by analyzing the continuous transaction sequence of a certain user in the past 24 hours, subtle patterns such as a sudden increase in transaction amount and abnormal density of transaction frequency within a short period can be captured, providing key support for subsequent anomaly recognition.

[0065] In another embodiment, in order to capture short-term and long-term behavior patterns simultaneously, the feature extraction model can be constructed as a multi-scale neural network structure, that is, multiple sub-networks are constructed in parallel to model the transaction data of different time windows respectively. For example, one sub-network processes the transactions within the past 5 minutes, another sub-network processes the behavior within the past 1 hour, and another sub-network is responsible for analyzing the overall transactions in the past 7 days. The outputs of each sub-network can be fused through concatenation, weighting, or attention mechanisms to form a complete multi-scale transaction feature vector.

[0066] In addition, in scenarios where the sources of transaction data are relatively rich, the feature extraction model may also include a multi-modal processing structure. Taking a certain financial payment platform as an example, in addition to the transaction behavior itself, the device usage behavior of users (such as device fingerprints, operating systems), network access behavior (such as IP change frequency, login location jump situation), and even biometric data of users (such as fingerprints, face verification records) can be collected. In this implementation, dedicated sub-networks can be designed for different modal data respectively. For example, a convolutional neural network (CNN) is used to process image-like information, and a Transformer structure is used to process heterogeneous log sequences. Then, through alignment and fusion in a unified representation space, a comprehensive transaction behavior feature vector is formed.

[0067] It should be noted that during the feature extraction process, the feature extraction model can be pre-trained in combination with historical label data to improve the expression ability of features; or a self-supervised learning strategy, such as contrast learning or masked prediction, can be adopted to enhance the model's understanding of unlabeled transaction behavior patterns. Taking self-supervised contrast learning as an example, the system can construct transaction pairs of the same user in different time segments as positive samples, and transaction pairs between different users as negative samples to guide the model to learn the consistency and distinctiveness of user features.

[0068] In the embodiments of the present disclosure, the transaction behavior feature vector can be a set of real number vectors with a fixed dimension. Each dimension represents a semantic feature learned through training to support subsequent tasks such as feature selection optimization, anomaly detection modeling, and security risk assessment. Its dimension can be flexibly set according to system design, such as 128 dimensions, 256 dimensions, 512 dimensions, etc.

[0069] In operation S230, the importance of the transaction behavior feature vector is evaluated, a feature selection optimization model is constructed based on the evaluation result, and the target optimization algorithm is used to solve the feature selection optimization model to obtain the target feature subset.

[0070] In the feature importance evaluation stage, the system can use a variety of interpretability techniques to score features. For example, the SHAP value (SHapley Additive exPlanations) based on model output perturbation is used to measure the marginal impact of each feature on the anomaly score. For the case where labels cannot be obtained in the unsupervised situation, metrics such as feature variance, cluster center distance, or information entropy can also be used to measure the discrimination ability of features in the latent class structure. For example, for a vector composed of a set of transaction amount, transaction frequency, and device ID features, the system can evaluate the stability and influence degree of the path length distribution after being divided by the isolation forest, and then determine its importance in the formation process of the anomaly score.

[0071] In some embodiments, the importance assessment can also combine historical verified abnormal transaction data and construct a high-risk feature contribution map through retrospective analysis. For example, if multiple abnormal transaction behaviors are found to be related to the feature combination of high-frequency trading / remote login / late-night time period within a certain period, higher importance weights can be set according to the activity level and co-occurrence rate of these features in the historical samples.

[0072] Furthermore, the method of constructing a feature selection optimization model and solving it using an optimization algorithm has more refined risk characterization ability and recognition accuracy in the scenario of financial anomaly detection, and also has better business adaptability and interpretability compared with other methods, and is applicable to the financial security scenario.

[0073] According to the embodiments of the present disclosure, the objective function of the feature selection optimization model can comprehensively consider multiple factors, such as the evaluation score of features, the redundancy between features, the model interpretability constraint, or the number of selected features, etc. Specifically, the feature selection task can be modeled as a combinatorial optimization problem, and its form is not limited. For example, linear programming, integer programming, graph optimization methods can be used, or it can also be modeled using graph neural structures, heuristic search, or probability modeling.

[0074] For example, in an environment with sufficient computing resources, a simulated annealing algorithm or a genetic algorithm can be used for heuristic search, which is suitable for the processing requirements of medium-scale feature sets. Preferably, in scenarios with higher requirements for computing efficiency or result globality, a quantum optimization solver can also be called. For example, a quantum annealing platform is used to solve the constructed quadratic unconstrained binary optimization (QUBO) problem, and a low-energy solution can be quickly obtained by means of quantum superposition parallel state search, thereby greatly improving the solving efficiency and the quality of the feature subset.

[0075] Furthermore, in order to improve the robustness of the selected feature subset, a perturbation mechanism can be introduced: perform multiple rounds of sample perturbations (such as subsampling, adding noise, etc.) on the transaction behavior feature vector, perform feature selection under each round of perturbation, and count the selection frequency or stability score of each feature in all results, and use this as the basis for additional model constraints or result re-screening. This method can effectively suppress the selection bias caused by sample distribution fluctuations, feature redundancy, or individual abnormal data, and improve the anti-interference ability and consistency of the overall model.

[0076] In operation S240, the target feature subset is input into the detection and recognition model for anomaly detection to obtain an anomaly recognition result.

[0077] In some embodiments, the detection and recognition model can be an unsupervised detection model based on a graph structure. For example, in a transaction network, different users or accounts can form directed graph nodes, and different transaction relationships form edge weights. The system can construct a transaction graph, extract graph structure features based on a graph neural network, and then fuse them with the target feature subset for detecting structurally abnormal transactions and the like.

[0078] In some embodiments, for some scenarios with high requirements for business compliance and result interpretability, the detection and recognition model can adopt an ensemble method based on a tree model, such as a random forest or a gradient boosting tree. This type of method supports providing a contribution score of each feature in the model determination process while outputting an abnormal recognition result, providing a decision-making explanation basis for the risk control department.

[0079] Preferably, the detection and recognition model can be an isolation forest model, which has good unsupervised learning ability and sensitivity to high-dimensional sparse outliers, and is particularly suitable for the actual needs of massive samples, missing labels, and variable patterns in the financial transaction scenario.

[0080] Specifically, in the isolation forest model, there are several isolation trees constructed during the training phase. Each isolation tree is constructed by randomly partitioning the feature space. Its structure is not based on sample labels, but by continuously selecting feature dimensions and random thresholds for recursive splitting until the samples are completely isolated.

[0081] In the prediction phase, the system sequentially inputs the target feature subset into each isolation tree and records the path length required to reach the leaf node in the tree. The shorter the path length, the easier it is for the sample to be partitioned and isolated, and the higher the probability that it may be abnormal. The system calculates the anomaly score of the sample by statistically averaging the path lengths in multiple isolation trees and combining the theoretical reference path length standard. For example, the anomaly score can take values between 0 and 1, and the value closer to 1 indicates that it is more likely to be an abnormal transaction.

[0082] After obtaining the anomaly score, it can be compared with a preset decision threshold. This threshold can be set according to the statistical distribution experience of historical data or obtained through model tuning on the training set. If the anomaly score of the target feature subset exceeds the threshold, the system outputs that the transaction is an abnormal behavior; otherwise, the transaction behavior is considered normal.

[0083] It should be noted that the specific threshold can be dynamically adjusted according to the specific business scenario. For example, for high-risk accounts or sensitive business types, the system can adopt a lower threshold to improve detection sensitivity; while in scenarios with higher requirements for user experience, the threshold can be appropriately increased to reduce the false alarm rate.

[0084] In addition, to enhance the interpretability and operability of the model, the path information of each transaction can also be packaged and output together with the abnormal score results for subsequent risk control intervention measures, manual review assistance, or system feedback mechanisms.

[0085] Through the above methods, the detection and recognition model based on Isolation Forest in this disclosure can effectively identify abnormal patterns in transaction behaviors without supervision, is suitable for the early detection of new and variant fraud behaviors, and maintains a high detection accuracy and system generalization ability without relying on labels.

[0086] In the embodiments of this disclosure, in order to improve the credibility of the abnormal recognition results and further reduce the false alarm rate, after the detection and recognition model outputs abnormal results, a post-processing mechanism is further included to further verify the abnormal results and perform feedback transmission based on the verification results to assist in the dynamic adjustment of risk strategies.

[0087] Specifically, after the system obtains the preliminary abnormal recognition results, if it detects that a certain transaction is determined to be a high-risk behavior, it can initiate the process of extracting context data related to this transaction. The system can automatically retrieve transaction correlation information related to this transaction, such as: the current login device of the account, the fingerprint of the historical commonly used device, the login IP address and geographical location, the user behavior trajectory, the characteristics of the transaction time period, the information of the payee, etc. These information can constitute a relatively complete transaction background, which helps to comprehensively judge whether this behavior conforms to the user's regular transaction pattern.

[0088] In this embodiment, multi-factor verification can be performed based on the above transaction correlation information. For example, multi-factor verification can adopt a rule library method (such as whether it hits a high-risk IP, whether there are multiple login failures in a short time, etc.), a model-assisted method (such as judging the consistency of behavior clustering), or a user interaction method (such as sending a mobile phone verification code or requesting biometric secondary verification). The verification path can be flexibly selected according to different transaction risk levels, customer types, and business scenarios.

[0089] After completing the multi-factor verification, the verification results can be sorted and standardized, and pushed to the risk management system of the financial institution through the feedback sub-module. For example, if a combination of device jump and night transaction is confirmed to be abnormal in multiple users, the system can automatically add this feature combination to the high-risk pattern library; if a certain rule is frequently misreported for a long time, the system can dynamically increase the threshold of the corresponding detection model to avoid frequent triggering of low-risk alarms.

[0090] Through the above methods, this disclosure not only provides high-precision abnormal detection in the recognition stage, but also introduces a verification and feedback mechanism in the post-processing stage to ensure that the recognition results have more practical business value, and at the same time realizes the closed-loop optimization of risk strategies, greatly improving the response ability and stability of the financial risk control system.

[0091] The following will take the feature extraction model for extracting feature vectors of different time scales / different modal features as an example to specifically introduce the preferred embodiments of the present disclosure.

[0092] In some embodiments, the feature extraction model includes a plurality of first sub-networks, and the outputs of the plurality of first sub-networks are subjected to feature fusion to obtain the transaction behavior feature vector, wherein the plurality of first sub-networks are respectively used to extract feature vectors of different time scales.

[0093] In some embodiments, the feature extraction model includes a plurality of second sub-networks, and the outputs of the plurality of second sub-networks are subjected to feature fusion to obtain the transaction behavior feature vector, wherein the plurality of second sub-networks are respectively used to extract feature vectors of different modalities.

[0094] Figure 3 A flowchart of a method for fusing the outputs of a plurality of first sub-networks according to an embodiment of the present disclosure is schematically shown.

[0095] As Figure 3 shown, the method for fusing the outputs of the plurality of first sub-networks in this embodiment may include operation S310 to operation S330.

[0096] In operation S310, multi-time scale feature vectors output by the plurality of first sub-networks are obtained.

[0097] Specifically, the target transaction data can be processed by using a plurality of first sub-networks respectively. Each first sub-network can correspond to a time window, such as short-term (e.g., last 5 minutes), medium-term (e.g., last 1 hour), and long-term (e.g., last 7 days). Each sub-network can adopt a time series modeling structure, such as LSTM or GRU, to adapt to the behavior laws under different time scales.

[0098] According to an embodiment of the present disclosure, each sub-network outputs a feature representation vector, which characterizes the time series feature of the transaction behavior during this time period. For example, the short-term sub-network is more sensitive to sudden capital fluctuations or intensive trading patterns, the medium-term network can learn the change of the user's trading rhythm, and the long-term network tends to capture the user's behavior inertia and periodic trend.

[0099] In operation S320, the representation differences between the multi-time scale feature vectors are calculated, and a consistency loss function is constructed based on the representation differences.

[0100] Exemplarily, based on metrics such as cosine distance, Euclidean distance, or KL divergence, the degree of difference between features of different scales can be calculated, which represents the difference. The represented difference reflects the semantic inconsistency degree of the same transaction under different time windows. Subsequently, a consistency loss function can be constructed based on the represented difference to serve as a regularization term in the neural network training process, which is used to constrain the feature representations of different scales to tend to be consistent, or at least to be coordinated in specific dimensions.

[0101] For example, the consistency loss function can use the L2 norm to measure the distance between short-, medium-, and long-term feature vectors, and apply gradient guidance in backpropagation, so that each first sub-network can avoid generating contradictory or uncorrelated representation results while maintaining the scale perception ability.

[0102] In operation S330, based on the consistency loss function, the multi-time-scale feature vectors are weighted and fused to obtain the transaction behavior feature vector. Specifically, the fusion method can be attention mechanism weighted, non-linear fusion controlled by a gating mechanism, or directly using a trainable fully connected fusion layer. The fusion process not only considers the original information amount of each scale feature, but also comprehensively considers its coordination score with other scales, making the fusion result more globally consistent and discriminative.

[0103] According to an embodiment of the present disclosure, the fusion feature based on the time scale, as the input of the subsequent anomaly detection module, will have stronger time sensitivity and semantic stability, and is particularly suitable for detecting complex behavior patterns such as short-term frequent transactions and long-term latent anomalies.

[0104] Figure 4 The flowchart of the method for feature fusion of the outputs of multiple first sub-networks according to an embodiment of the present disclosure is schematically shown.

[0105] As Figure 4 shown, the method for feature fusion of the outputs of multiple first sub-networks in this embodiment may include operation S410 to operation S430.

[0106] In operation S410, multi-modal feature vectors output by multiple second sub-networks are obtained, and the multi-modal feature vectors are aligned to obtain a set of modality alignment vectors.

[0107] Due to the differences in dimension, scale, and semantics among different modal features, directly concatenating or weighting them is likely to introduce information bias or semantic misalignment. Therefore, in operation S410, the system performs alignment processing on all modal feature vectors. Specifically, a modal embedding strategy can be adopted to map the original features of different modalities to a unified representation space. In this space, each feature vector can have a consistent dimensional structure, and the statistical distribution differences between the original features are eliminated through projection, normalization, or linear transformation, thus forming a unified set of modal alignment vectors.

[0108] For example, layer normalization or batch normalization operations can be connected after each embedding vector to alleviate the problem of inconsistent statistical distributions between different modalities. At the same time, activation functions can also be used to enhance the non-linear expression ability of the embedding layer, ensuring that the mapping results can fully reflect the semantic information of the original modal features.

[0109] In operation S420, correlation modeling is performed based on the set of modal alignment vectors to obtain attention weight information. The attention weight information is used to reflect the interaction intensity between modalities, enabling the system to adaptively identify which modal information is more discriminative in the current transaction behavior, thereby providing a dynamic weight basis for subsequent feature fusion.

[0110] Exemplarily, a cross-attention mechanism can be used to perform the correlation modeling task. In this mechanism, each modal feature is sequentially correlated with the remaining modalities. For example, when processing a certain modal feature, it can be used as the "query party", and other modalities can be used as the "reference party" to calculate the similarity between the two. This similarity can be indirectly reflected by the projection method in the vector space or represented by the learnable weight parameters in the neural network to represent the structural connection between modalities. The calculated similarity information can be further normalized to form an attention distribution weight, which indicates which other modalities should be focused on and the degree of focus when integrating information for the current modality. Each modality can finally obtain a representation vector that integrates the semantic features of other modalities based on this mechanism, thus having a more comprehensive context understanding ability.

[0111] It should be noted that the attention weight information is not predefined but is automatically learned by the system during the model training process. The system will continuously optimize the attention allocation strategy through repeated training with a large amount of transaction data, making it highly adaptable in different transaction scenarios. For example, when detecting abnormal transactions of overseas accounts, the model may pay more attention to the modalities related to the device usage environment and network characteristics; while when identifying account sharing behavior, the user behavior modality and geographical information modality may obtain higher weights.

[0112] Preferably, in order to improve the stability and generalization ability of relevance modeling, a mechanism can also be set up to prevent the attention from being overly concentrated on a single modality. For example, a balance regularization term can be introduced, or residual connections can be used to maintain a certain proportion of the original modality features. This mechanism ensures that even if some modalities dominate the judgment in a specific scenario, other modalities can still provide auxiliary support for the recognition result, avoiding information bias.

[0113] In operation S430, the multi-modal feature vectors are weighted and fused based on the attention weight information to obtain the transaction behavior feature vectors. Similarly, the fusion can be achieved by weighted summation, linear combination, or multi-head attention aggregation, etc.

[0114] In the embodiments of the present disclosure, in order to more flexibly adapt to the complexity differences of different modality data in the transaction scenario, the embodiments of the present disclosure also provide a granularity control mechanism driven by modality complexity to dynamically configure the structure of the second sub-network, thereby improving the efficiency and accuracy of feature extraction.

[0115] Specifically, after receiving the target transaction data, the system can first perform complexity analysis on each data modality therein. The so-called modality complexity can be understood as the comprehensive manifestation of indicators such as the information density, change frequency, and feature distribution diversity of a certain modality data in the current transaction sample or scenario. For example, device fingerprint information may be relatively stable and have low complexity in some transactions; while network behavior logs may have a large number of non-linear jumps in high-frequency operation scenarios, and their complexity is significantly increased.

[0116] In order to quantify this complexity index, the system can evaluate the statistical distribution, entropy change, data sparsity, or change rate of each modality feature within the historical window, obtain the corresponding modality complexity score, and generate a modality granularity control signal, which can be used to indicate what kind of granularity or accuracy should be used for each modality in the modeling process.

[0117] In actual deployment, the modality granularity control signal can be discrete granularity levels (such as "low", "medium", "high"), or a continuous numerical range, representing dynamic adjustment factors of structural parameters such as network depth, number of channels, or receptive field size. The modality granularity control signal can be used to dynamically configure the corresponding second sub-network structure. Exemplarily, when a certain modality is determined to be "high complexity", its corresponding second sub-network may enable more layers, larger convolutional kernels, longer time windows, or introduce residual structures to enhance its modeling ability; while for modalities with lower complexity, the system can be configured as a shallow network or enable a lightweight architecture to save computing resources.

[0118] According to an embodiment of the present disclosure, based on the structure adaptive mechanism of the granularity control signal, the system can optimize the overall resource allocation efficiency while ensuring the quality of feature extraction, avoid over-modeling of low-complexity modalities, and reduce the false detection risk caused by insufficient modeling of high-complexity modalities.

[0119] The following will be based on the feature selection method of the QUBO model, and specifically illustrate the preferred embodiments of the present disclosure through a quantum optimization algorithm solver.

[0120] In an embodiment of the present disclosure, in order to identify the most valuable feature subset for anomaly detection in the transaction behavior feature vector, the feature selection task can be modeled as a quadratic unconstrained binary optimization problem. This modeling method can represent the interaction effects between multiple features without introducing explicit constraint conditions, and can be efficiently solved by using advanced quantum or quantum-like optimization techniques to improve the global optimality and structural controllability of feature selection.

[0121] Specifically, after the system completes the evaluation of feature importance, each feature and its weight relationship are mapped to a set of binary selection variables, and each variable represents whether the feature is included in the final feature subset. At the same time, the redundancy between features can also be considered. By introducing quadratic terms, combinations of multiple highly redundant features selected simultaneously are penalized, thereby constructing a complete QUBO objective function. This function form supports the joint optimization of the target subset in two directions: "maximizing importance" and "minimizing redundancy".

[0122] In an embodiment of the present disclosure, the constructed QUBO model can be input into a quantum optimization algorithm solver for processing. For example, the solver can be a quantum annealing solver; for example, the quantum approximate optimization algorithm (QAOA) can also be used to solve it in a simulated quantum environment; the QUBO problem can also be approximately solved by using simulated annealing, variational quantum circuits, etc. to adapt to different computing power resources and deployment scenarios.

[0123] According to an embodiment of the present disclosure, the quantum optimization algorithm can utilize quantum superposition states and tunneling effects to parallelly explore possible feature selection combinations in a complex search space, so as to more efficiently approximate the global optimal solution in cases where traditional computing methods are difficult to converge quickly.

[0124] After the solution is obtained, the optimal value state of each binary variable can be extracted from the optimization result, that is, the feature selection variable state indicating whether each feature is selected. If a variable takes the value of "1" in the final solution, it means that the corresponding feature is included in the target feature subset; if the value is "0", the feature is discarded. Thus, the system obtains a set of structure-optimized feature subsets generated by the support of the quantum optimization algorithm as the input of the subsequent anomaly detection model.

[0125] According to an embodiment of the present disclosure, the present disclosure effectively integrates the structural expression ability of QUBO optimization modeling and the global solution efficiency of quantum optimization, solves the problems faced by traditional feature selection methods such as strong redundant interference, low search efficiency, and unstable structure, and improves the performance ceiling and engineering adaptability of the entire anomaly detection system.

[0126] Figure 5 A structural block diagram of an anomaly detection device according to an embodiment of the present disclosure is schematically shown.

[0127] As Figure 5 shown, the anomaly detection device 500 of this embodiment includes a data acquisition module 510, a feature extraction module 520, a feature screening module 530, and an anomaly detection module 540.

[0128] The data acquisition module 510 can be used to acquire target transaction data. In one embodiment, the data acquisition module 510 can be used to perform the operation S210 described above, which will not be elaborated here.

[0129] The feature extraction module 520 can be used to extract a transaction behavior feature vector based on the target transaction data by using a feature extraction model. In one embodiment, the feature extraction module 520 can be used to perform the operation S220 described above, which will not be elaborated here.

[0130] The feature screening module 530 can be used to evaluate the feature importance of the transaction behavior feature vector, construct a feature selection optimization model based on the evaluation result, and use a target optimization algorithm to solve the feature selection optimization model to obtain a target feature subset. In one embodiment, the feature screening module 530 can be used to perform the operation S230 described above, which will not be elaborated here.

[0131] The anomaly detection module 540 can be used to input the target feature subset into a detection and recognition model for anomaly detection to obtain an anomaly recognition result. In one embodiment, the anomaly detection module 540 can be used to perform the operation S240 described above, which will not be elaborated here.

[0132] According to an embodiment of the present disclosure, the feature extraction module 520 can also be used to obtain multi-time scale feature vectors output by multiple first sub-networks; calculate the representation differences between the multi-time scale feature vectors, construct a consistency loss function based on the representation differences; and perform weighted fusion on the multi-time scale feature vectors based on the consistency loss function to obtain the transaction behavior feature vector.

[0133] According to an embodiment of the present disclosure, the feature extraction module 520 may further be configured to obtain multi-modal feature vectors output by a plurality of the second sub-networks, align the multi-modal feature vectors to obtain a set of modality alignment vectors; perform correlation modeling based on the set of modality alignment vectors to obtain attention weight information; and perform weighted fusion on the multi-modal feature vectors based on the attention weight information to obtain the transaction behavior feature vector.

[0134] According to an embodiment of the present disclosure, the feature extraction module 520 may further be configured to generate a modality granularity control signal based on the modality complexity of the target transaction data; and dynamically configure a corresponding second sub-network based on the modality granularity control signal.

[0135] According to an embodiment of the present disclosure, the feature screening module 530 may further be configured to input the quadratic unconstrained binary optimization model into a quantum optimization algorithm solver to obtain a solution result; and extract corresponding feature selection variable states from the solution result to obtain the target feature subset.

[0136] According to an embodiment of the present disclosure, the anomaly detection module 540 may further be configured to input the target feature subset into the detection and recognition model, calculate the path lengths of the target feature subset in each isolation tree; calculate the anomaly score of the target feature subset according to the path lengths; and output an anomaly recognition result based on the anomaly score and a preset anomaly determination threshold.

[0137] According to an embodiment of the present disclosure, any plurality of the data acquisition module 510, the feature extraction module 520, the feature screening module 530, and the anomaly detection module 540 may be combined and implemented in one module, or any one of them may be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules may be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the data acquisition module 510, the feature extraction module 520, the feature screening module 530, and the anomaly detection module 540 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on substrate, a system on package, an application specific integrated circuit (ASIC), or any other reasonable way of integrating or packaging circuits, etc., implemented by hardware or firmware, or implemented in any one of the three implementation manners of software, hardware, and firmware, or in any appropriate combination of several of them. Alternatively, at least one of the data acquisition module 510, the feature extraction module 520, the feature screening module 530, and the anomaly detection module 540 may be at least partially implemented as a computer program module, and when the computer program module is run, it may execute the corresponding functions.

[0138] Figure 6 A block diagram of an electronic device suitable for implementing an anomaly detection method according to an embodiment of the present disclosure is schematically shown.

[0139] As Figure 6 shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage section 606 into a random access memory (RAM) 603. The processor 601 may include, for example, a general microprocessor (e.g., CPU), an instruction set processor, and / or a related chipset, and / or a dedicated microprocessor (e.g., an application specific integrated circuit (ASIC)), etc. The processor 601 may also include on-board memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0140] In the RAM 603, various programs and data required for the operation of the electronic device 600 are stored. The processor 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. The processor 601 performs various operations of the method flow according to an embodiment of the present disclosure by executing the programs in the ROM 602 and / or the RAM 603. It should be noted that the programs may also be stored in one or more memories other than the ROM 602 and the RAM 603. The processor 601 may also perform various operations of the method flow according to an embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0141] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, and the input / output (I / O) interface 605 is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc. and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed so that a computer program read from it can be installed into the storage section 608 as needed.

[0142] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist separately without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the methods according to the embodiments of the present disclosure are implemented.

[0143] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In the present disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program, and this program can be used by or in combination with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the above-described ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603.

[0144] Embodiments of the present disclosure also include a computer program product, which includes a computer program, and the computer program contains program codes for executing the methods shown in the flowcharts. When the computer program product runs in a computer system, the program codes are used to enable the computer system to implement the anomaly detection method provided by the embodiments of the present disclosure. [[ID= 7]]

[0145] When the computer program is executed by the processor 601, the above functions defined in the system / apparatus of the embodiments of the present disclosure are executed. According to an embodiment of the present disclosure, the above-described systems, apparatuses, modules, units, etc. may be implemented by computer program modules.

[0146] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices and magnetic storage devices. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and be downloaded and installed through the communication part 609, and / or be installed from the removable medium 611. The program codes included in the computer program may be transmitted by any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0147] In such an embodiment, the computer program can be downloaded and installed from a network through the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above-described functions defined in the system of the embodiments of the present disclosure are performed. According to an embodiment of the present disclosure, the above-described systems, devices, apparatuses, modules, units, etc. can be implemented by computer program modules.

[0148] According to an embodiment of the present disclosure, program code for executing the computer program provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level procedures and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages include, but are not limited to, such as Java, C++, Python, the "C" language, or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, by connecting through an Internet service provider via the Internet).

[0149] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the above-mentioned module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than marked in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram or flowchart, and combinations of blocks in the block diagram or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0150] Those skilled in the art can understand that the features described in the various embodiments of the present disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure can be combined and / or combined in various ways. All such combinations and / or combinations fall within the scope of the present disclosure.

[0151] The embodiments of the present disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments have been described separately above, this does not mean that the measures in each embodiment cannot be used advantageously in combination. Without departing from the scope of the present disclosure, those skilled in the art can make various substitutions and modifications, and all such substitutions and modifications should fall within the scope of the present disclosure.

Claims

1. An anomaly detection method, characterized in that, The method includes: Obtaining target transaction data; Based on the target transaction data, extracting a transaction behavior feature vector by using a feature extraction model; Evaluating the importance of features for the transaction behavior feature vector, constructing a feature selection optimization model based on the evaluation result, and using a target optimization algorithm to solve the feature selection optimization model to obtain a target feature subset; and Inputting the target feature subset into a detection and recognition model for anomaly detection to obtain an anomaly recognition result.

2. The method according to claim 1, wherein The feature extraction model includes multiple first sub-networks, and the outputs of the multiple first sub-networks are fused to obtain the transaction behavior feature vector, where the multiple first sub-networks are respectively used to extract feature vectors of different time scales; or The feature extraction model includes multiple second sub-networks, and the outputs of the multiple second sub-networks are fused to obtain the transaction behavior feature vector, where the multiple second sub-networks are respectively used to extract feature vectors of different modalities.

3. The method according to claim 2, wherein The fusing the outputs of the multiple first sub-networks to obtain the transaction behavior feature vector specifically includes: Obtaining multi-time scale feature vectors output by the multiple first sub-networks; Calculating the representation difference between the multi-time scale feature vectors, and constructing a consistency loss function based on the representation difference; and Based on the consistency loss function, performing weighted fusion on the multi-time scale feature vectors to obtain the transaction behavior feature vector.

4. The method according to claim 1, characterized in that, The target transaction data includes data of different modalities, and the fusing the outputs of the multiple second sub-networks to obtain the transaction behavior feature vector specifically includes: Obtaining multi-modal feature vectors output by the multiple second sub-networks, aligning the multi-modal feature vectors, and obtaining a set of modality alignment vectors; Performing correlation modeling based on the set of modality alignment vectors to obtain attention weight information; and Based on the attention weight information, performing weighted fusion on the multi-modal feature vectors to obtain the transaction behavior feature vector.

5. The method according to claim 2, characterized in that The method further includes: Generating a modality granularity control signal based on the modality complexity of the target transaction data; and Dynamically configuring a corresponding second sub-network based on the modality granularity control signal.

6. The method according to any one of claims 1 to 5, characterized in that The detection and recognition model is an isolation forest model, and the inputting the target feature subset into the detection and recognition model for anomaly detection and outputting an anomaly recognition result specifically includes: Inputting the target feature subset into the detection and recognition model, and calculating the path length of the target feature subset in each isolation tree; Calculating the anomaly score of the target feature subset according to the path length; and Based on the anomaly score and a preset anomaly determination threshold, outputting an anomaly recognition result.

7. The method according to any one of claims 1 to 5, characterized in that, The feature selection optimization model is a quadratic unconstrained binary optimization model, and the using a target optimization algorithm to solve the feature selection optimization model to obtain a target feature subset specifically includes: Inputting the quadratic unconstrained binary optimization model into a quantum optimization algorithm solver to obtain a solution result; and Extract the corresponding feature selection variable status from the solution result to obtain the target feature subset.

8. The method according to any one of claims 1 to 5, characterized in that The method further includes: In response to obtaining an anomaly recognition result, obtaining corresponding transaction association information; and Performing multi-factor verification based on the transaction association information to obtain an anomaly verification result.

9. An anomaly detection device, characterized in that, The apparatus includes: A data acquisition module, configured to: acquire target transaction data; A feature extraction module, configured to: based on the target transaction data, extract a transaction behavior feature vector by using a feature extraction model; A feature screening module, configured to: evaluate the importance of features for the transaction behavior feature vector, construct a feature selection optimization model based on the evaluation result, solve the feature selection optimization model by using a target optimization algorithm, and obtain a target feature subset; and An anomaly detection module, configured to: input the target feature subset into a detection and recognition model for anomaly detection to obtain an anomaly recognition result.

10. An electronic device, including: One or more processors; A memory, configured to store one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, The computer program or instruction, when executed by a processor, implements the steps of the method according to any one of claims 1 to 8.

12. A computer program product comprising a computer program or instructions, characterized in that, The computer program or instruction, when executed by a processor, implements the steps of the method according to any one of claims 1 to 8.

Images