A transaction anti-fraud method based on big data

Abstract

The present invention relates to a transaction anti-fraud method based on big data, and relates to the field of security technology. The present application uses transaction big data to create a directed transaction graph that describes transaction behaviors between accounts. The nodes in the directed transaction graph represent the accounts involved in various transactions, the direction of the directed edges represents the flow direction of the transaction amount, and the weight corresponding to the directed edges represents the transaction amount between the account nodes. Within a set time slice, a transaction network is constructed between any two accounts to be analyzed, formed by transactions through intermediate accounts. For any transaction network, the transaction network features of each transaction network in different time slices are arranged in sequence to form a time-series transaction network feature. A fraud recognition model is constructed and trained using the labeled transaction big data, aiming to automatically identify the difference between normal transactions and suspected fraudulent transactions through the fraud recognition model to identify suspicious transaction behaviors in transactions. The fraud recognition model includes: a graph neural network, a recurrent neural network, and a classification head.

Description

Technical Field

[0001] The present invention relates to the technical field of transaction anti-fraud, and in particular to a transaction anti-fraud method based on big data. Background Art

[0002] With the continuous development of the trade market and advances in information technology, especially in scenarios such as cross-border payments, financial derivatives trading, and investment transactions, transactions are becoming large and frequent, involving complex and dynamic capital flows and inter-account relationships. While these transactions hold significant economic value, they also carry potential criminal risks, particularly from illegal activities such as fraud. Therefore, identifying suspicious behavior in transactions and enhancing trade security has become a major challenge. Traditional anti-fraud measures typically rely on fixed rules and manual review. While these methods can detect anomalous behavior to a certain extent, they face significant limitations when identifying highly complex and diverse fraudulent activities. Deep learning technology has become a hot topic in the field of trade fraud due to its ability to process complex and unstructured data. Deep learning models can learn the underlying distribution and characteristics of transactions from large amounts of historical transaction data, capturing subtle differences in transaction behavior and identifying suspicious patterns. However, the application of deep learning models to detect suspicious behavior in transactions still faces several challenges. The transaction patterns of suspicious behavior are often dynamic, making identification less effective in dynamic transaction patterns.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the Invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the present invention provides a transaction anti-fraud method based on big data.

[0005] The present invention provides a transaction anti-fraud method based on big data, comprising:

[0006] Obtain transaction big data and use it to create a directed transaction graph that describes transaction behavior between accounts ,in, It is a node set in a directed transaction graph, where the nodes in the node set represent the accounts involved in various transactions; It is a set of directed edges with timestamps configured between account nodes in a directed transaction graph. The direction of the directed edge represents the direction of transaction amount flow, and the weight corresponding to the directed edge represents the transaction amount between account nodes.

[0007] Within a set time slice, a transaction network is constructed between any two accounts to be analyzed, formed by transactions conducted through intermediate accounts;

[0008] For any trading network, the trading network features of each trading network in different time slices are arranged in order to form a time-series trading network feature; the trading network feature includes: directed edge features and account node features;

[0009] A fraud recognition model is constructed and trained using the transaction network features of labeled transaction big data. The purpose is to automatically identify the differences between normal transactions and suspected fraudulent transactions through the fraud recognition model, so as to identify suspicious transaction behaviors in transactions and provide corresponding anti-fraud reminders based on the suspicious transaction behaviors. The fraud recognition model includes: a graph neural network, a recurrent neural network and a classification head.

[0010] Furthermore, the transaction network is composed of transaction streams of set length;

[0011] Set the corresponding nodes of any two accounts to be analyzed in the directed transaction graph to be source account nodes and the target account node ; Set the length of the time slice to T; then, based on the directed transaction graph, within each time slice T, from the source account node To the target account node Any transaction flow with an intermediate account length of I+1 is represented as:

[0012] ,

[0013] in, Indicates the source account node and the target account node The kth transaction flow between The I intermediate account nodes participating in the k-th transaction flow all belong to the node set , Both are node collections The account node index of any account node in; is a directed edge in the transaction flow, The timestamps of directed edges are all in the same time slice, and in the transaction flow, the order of directed edges is arranged according to the timestamp order, that is, the order of transaction intermediaries has nothing to do with the element index order of the node set; the transaction flow The length of is I+1;

[0014] For source account nodes To the target account node , count all transaction flows with a length less than Imax+1 between the two, and form a transaction network .

[0015] Furthermore, for any source account node and target account node, the transaction network construction process includes:

[0016] S201, obtain any time slice Inward transaction graph ; Define the maximum transaction flow length Imax+1 and the remaining recursion depth initialized corresponding to the maximum transaction flow length;

[0017] S202, traverse from time slice Inward transaction graph The source account node to be analyzed obtained from ;

[0018] S203, for any transaction flow starting from the traversed source account node, check whether the remaining recursion depth of the transaction flow is zero;

[0019] If yes, execute S204; otherwise execute S205;

[0020] S204: Return the current account node. The returned current node is the end point account node of the transaction flow, and the account node search of the transaction flow ends. If the transaction flow contains multiple end point account nodes, the transaction flow is divided into transaction flows corresponding to the number of end point account nodes.

[0021] S205: For any transaction flow starting from the traversed source account node, check whether the number of current account nodes in the transaction flow is zero. If yes, execute S206; otherwise, execute S207.

[0022] S206, transaction flow ends;

[0023] S207: Add the found current account node to the transaction flow. If the transaction flow contains multiple current account nodes, the transaction flow forms transaction flows corresponding to the number of current account nodes. The remaining recursive depth of each new transaction flow is reduced by one.

[0024] For each new transaction flow, traverse all the next neighbor nodes of the current account node as the new current account node;

[0025] S208: Return all formed transaction flows to obtain a transaction network between any source account node and target account node.

[0026] Furthermore, the directed edge features include:

[0027] The combination of the directed edge weight arrays in each transaction flow in the transaction network;

[0028] The sum of all directed edge weights of each transaction flow in the transaction network is the following:

[0029] ;

[0030] in, Represents the operation of extracting directed edge weights; represents the sum of all directed edge weights of the k-th transaction flow;

[0031] The minimum weight combination of directed edges; the minimum weight of each directed edge of the transaction flow is as follows:

[0032] ;

[0033] Among them, min() represents the minimum value function, Indicates the minimum edge weight of the directed edge of the k-th transaction flow;

[0034] The account node features are derived from the account node information, which includes: the coded account entity, the mean, variance, and change rate of the account's historical transactions.

[0035] Furthermore, the graph neural network includes a graph embedding layer, which slices the time Internal trading network The directed edge features and account node features of are mapped into corresponding feature embeddings, expressed as:

[0036] ;

[0037] Among them, the graph embedding layer adopts MLP, Time slices The account node characteristics and directed edge characteristics of the internal transaction network, These are the feature embeddings of account node features and directed edge features respectively;

[0038] The first aggregation function learned by the graph neural network learns the relationship between adjacent nodes and edges in each transaction network based on the adjacency relationship between nodes and directed edges in the transaction network, and obtains potential account node representations and potential directed edge representations:

[0039] ;

[0040] in, is the first aggregation function with learnable parameters, It is the learnable parameter of the first aggregation function constructed by the graph neural network, the trading network Based on time slice The inward transaction graph is obtained;

[0041] The second aggregation function learned by the graph neural network represents the potential account nodes in multiple transaction networks in time series. and potential directed edges Aggregate to each account node and get the aggregate potential account node representation:

[0042] ;

[0043] in, Represents the potential account nodes in the aggregated b+1 trading networks and potential directed edges Aggregate potential account node representation; is the potential account node representation and potential directed edge representation from the continuous b+1 transaction networks; is the second aggregation function with learnable parameters, It is a learnable parameter for the graph neural network to construct the second aggregation function;

[0044] Use the first aggregation function to update the potential directed edge representation of each transaction network based on the aggregated potential account node representation , the updated potential directed edge representations of b+1 trading networks are aggregated using attention aggregation to obtain the aggregated potential directed edge representation.

[0045] Furthermore, the graph neural network represents the aggregated potential account nodes of the time series and aggregated potential directed edges The data is passed to a recurrent neural network for time series modeling, where the recurrent neural network adopts any one of GRU, LSTM, and RNN.

[0046] Furthermore, the classification head learns a classification function , aggregate potential account nodes to represent and aggregated potential directed edges The hidden features of are mapped to the predicted transaction category labels:

[0047] ,

[0048] Where H is the aggregated potential account node representation output by the recurrent neural network and aggregated potential directed edges The hidden features of θ are the learnable parameters of the classification head.

[0049] Furthermore, the loss function used to train the fraud detection model is cross entropy loss, which is defined as:

[0050] ;

[0051] Where N is the number of fraud types, C is the number of labels, represents the true and predicted results corresponding to the c-th label in the n-th fraud type; during training, the Adam optimizer is used with early stopping strategy to prevent overfitting of the fraud recognition model, and the best model is selected based on the highest validation F1 score.

[0052] Furthermore, contrastive learning constraints are set after the graph neural network and the recurrent neural network respectively; contrastive learning is used to strengthen the difference between the aggregated potential account node representation and the aggregated potential directed edge representation corresponding to the positive and negative transaction behavior data obtained by the graph neural network, and contrastive learning is used to strengthen the similarity between the aggregated potential account node representation and the aggregated potential directed edge representation corresponding to the positive or negative pairs of transaction behavior data obtained by the graph neural network; contrastive learning is used to strengthen the difference between the hidden features of the aggregated potential account node representation and the aggregated potential directed edge representation corresponding to the positive and negative transaction behavior data obtained by the recurrent neural network, and contrastive learning is used to strengthen the similarity between the hidden features of the aggregated potential account node representation and the aggregated potential directed edge representation corresponding to the positive or negative pairs of transaction behavior data obtained by the recurrent neural network.

[0053] Furthermore, the L2 norm sum of all trainable parameters is introduced into the loss function to achieve L2 regularization of the trainable parameters.

[0054] The above technical solution provided by the embodiment of the present invention has the following advantages compared with the prior art:

[0055] This application organizes transaction data into a transaction network that is convenient for graph neural network analysis. Leveraging the dynamic modeling capabilities of graph neural networks, this application establishes spatial dynamic associations for complex transactions. This allows for the spatial dimension to capture transaction features that differentiate between normal and suspected fraudulent transactions, supporting better identification of these differences. This application also combines graph neural networks with recurrent neural networks, utilizing them to model temporal dynamic associations. This allows for the temporal dimension to capture transaction features that differentiate between normal and suspected fraudulent transactions, supporting better identification of these differences.

[0056] The fraud detection model in this application performed best under normal transaction patterns, achieving an F1 score of 0.92. This demonstrates that the fraud detection model maintained high accuracy and precision when identifying normal transaction behavior. This reflects the relatively stable and consistent characteristics of normal transactions, enabling the fraud detection model to easily distinguish transactions consistent with normal transactions. In contrast, the fraud detection model's F1 score dropped to 0.85 when identifying fraud. Fraud often involves complex fund flows and covert transfers between accounts, which are more difficult to identify than normal transactions. The fraud detection model encounters more irregular behavior, which reduces its ability to detect fraudulent activity. Although lower than normal transactions, it still demonstrates strong recognition capabilities. Fraudulent activity often involves fake accounts, fictitious transaction paths, and complex transaction patterns. Despite its high concealment, the fraud detection model is able to identify fraudulent activity by learning transaction characteristics and abnormal patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0058] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0059] Figure 1 A flowchart of a transaction anti-fraud method based on big data provided in an embodiment of the present invention.

[0060] Figure 2 A schematic diagram of a trading network provided in accordance with an embodiment of the present invention.

[0061] Figure 3 A flowchart for constructing a transaction network between any source account node and target account node provided in the disclosed embodiment of the present invention.

[0062] Figure 4 A schematic diagram of a fraud identification model provided in an embodiment of the present invention.

[0063] Figure 5 A schematic diagram of a big data-based transaction anti-fraud device provided in an embodiment disclosed by the present invention. DETAILED DESCRIPTION

[0064] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0065] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0066] Example 1

[0067] See Figure 1 As shown, an embodiment of the present invention provides a transaction anti-fraud method based on big data, comprising:

[0068] S100, obtain transaction big data, and use the transaction big data to create a directed transaction graph that describes the transaction behavior between accounts ,in, It is a node set in a directed transaction graph, where the nodes in the node set represent the accounts involved in various transactions; It is a set of directed edges with timestamps between account nodes in a directed transaction graph. The direction of the directed edge represents the direction of transaction amount flow, and the weight corresponding to the directed edge represents the transaction amount between account nodes.

[0069] Transaction big data is labeled based on whether transactions exhibit anomalies. An example of transaction big data comes from public datasets, such as the PaySim dataset. The PaySim dataset is a large-scale simulated dataset based on real-world transaction behavior. It contains transaction big data from payment systems and is suitable for detecting potentially suspicious behavior in large-value payment flows. The PaySim dataset simulates various payment scenarios from multiple users, including regular transactions, fraudulent transactions, and illegal fund transfers. Each data record includes features such as account ID, transaction amount, transaction type, and timestamp. The PaySim dataset contains over one million transaction records. Each transaction behavior is labeled as "normal" or "fraudulent" based on its characteristics. Fraudulent behavior often manifests as abnormal fund flows, frequent large-value transactions, and other patterns. Each transaction in the dataset contains rich feature information, such as payment amount, account type, transaction time, and payment method. This information provides valuable data for building generative model-based suspicious behavior detection.

[0070] S200: Construct a transaction network between any two accounts to be analyzed, formed by transactions conducted through intermediate accounts within a set time slice. This process extracts a simplified transaction network with a shorter time span from a complex directed transaction graph with a longer time span. This time-series transaction network is then used to describe the transaction behavior between the analysis accounts and analyze trading patterns.

[0071] In fraudulent transactions, intermediary accounts are often used to complicate fund transfers and evade detection. Therefore, to detect fraudulent transactions between any two accounts, this application constructs a transaction network formed by transactions between any two accounts to be analyzed through intermediary accounts within a set time slice. The transaction network is explained as follows:

[0072] Set the corresponding nodes of any two accounts to be analyzed in the directed transaction graph to be source account nodes and the target account node ; Set the length of the time slice to T.

[0073] Then, based on the directed transaction graph, in each time slice T, from the source account node To the target account node Any transaction flow with an intermediate account length of I+1 is represented as:

[0074] ,

[0075] in, Indicates the source account node and the target account node The kth transaction flow between The I intermediate account nodes participating in the k-th transaction flow all belong to the node set , Both are node collections The account node index of any account node in the transaction flow. There is no identical account node in the same transaction flow. There may be common account nodes in different transaction flows. is a directed edge in the transaction flow, The timestamps of directed edges are all in the same time slice, and in the transaction flow, the order of directed edges is arranged according to the timestamp order, that is, the order of transaction intermediaries has nothing to do with the element index order of the node set; the transaction flow The length of is I+1.

[0076] like Figure 2 In the given example, the source account node and the target account node There are 12 intermediate accounts, forming five transaction flows, namely:

[0077] ;

[0078] ;

[0079] ;

[0080] ;

[0081] ;

[0082] For source account nodes To the target account node , count all transaction flows with a length less than Imax+1 between the two, and form a transaction network ;for Figure 2 In the given example, if the value of Imax+1 is greater than or equal to 5, then all five transaction flows form a transaction network If Imax+1 is 4, the last two transaction flows form a transaction network .

[0083] For any source account node and target account node, this application uses the following method to build a trading network, such as Figure 3 Shown, including:

[0084] S201, obtain any time slice Inward transaction graph ; Define the maximum transaction flow length Imax+1 and the remaining recursion depth initialized corresponding to the maximum transaction flow length; Represents the xth time slice of length T.

[0085] S202, traverse from time slice Inward transaction graph The source account node to be analyzed obtained from ;

[0086] S203: For any transaction flow starting from the traversed source account node, check whether the remaining recursion depth of the transaction flow is zero. If the remaining recursion depth is zero, it indicates that the transaction flow length difference of 1 has reached the maximum transaction flow length Imax+1. If so, execute S204; otherwise, execute S205.

[0087] S204, returning the current account node. The returned current node is the end account node of the transaction flow, and the account node search of the transaction flow ends. If the transaction flow contains multiple end account nodes, the transaction flow forms a transaction flow corresponding to the number of end account nodes.

[0088] S205: For any transaction flow starting from the traversed source account node, check whether the current number of account nodes in the transaction flow is zero. If so, execute S206; otherwise, execute S207. When the current number of account nodes is 0, it indicates that the transaction flow has terminated.

[0089] S206, the transaction flow ends.

[0090] S207: Add the found current account node to the transaction flow. If the transaction flow contains multiple current account nodes, the transaction flow is divided into transaction flows corresponding to the number of current account nodes, with the current account node as the temporary end point. The remaining recursive depth of each new transaction flow is reduced by one. For each new transaction flow, all next neighbor nodes of the current account node are traversed to form the new current account node.

[0091] S208 returns all the generated transaction flows and obtains the transaction network between any source account node and target account node. S208 returns the transaction flows outputted by S206 and S204.

[0092] Any trading network obtained by the above process Time slice A subgraph of the inward transaction graph.

[0093] S300: For any trading network, arrange the trading network features of each trading network in different time slices in order to form a time-series trading network feature. For any trading network, its trading network feature includes: directed edge features and account node features.

[0094] Among them, directed edge features include:

[0095] The combination of the directed edge weight arrays in each transaction flow in the transaction network;

[0096] The sum of all directed edge weights of each transaction flow in the transaction network is the combination of the following:

[0097] ;

[0098] in, Represents the operation of extracting directed edge weights; Represents the sum of all directed edge weights of the k-th transaction flow.

[0099] The minimum weight combination of each directed edge of each transaction flow in the transaction network. The minimum weight of each directed edge of each transaction flow is as follows:

[0100] .

[0101] Among them, min() represents the minimum value function, Indicates the minimum edge weight of the directed edge of the k-th transaction flow.

[0102] Account node features come from account node information, which includes: the coded account entity, the mean, variance, and rate of change of the account's historical transactions.

[0103] This application proposes a fraud detection model based on a graph neural network. This model is trained using existing transaction data. The goal is to automatically distinguish between legitimate transactions and those suspected of fraudulent activity, thereby identifying suspicious transactions. The fraud detection model comprises a graph neural network, a recurrent neural network, and a classification head.

[0104] The graph neural network includes a graph embedding layer, which slices the time Internal trading network The directed edge features and account node features of are mapped into corresponding feature embeddings, expressed as:

[0105] ;

[0106] In the specific implementation process, the graph embedding layer adopts MLP. Time slices Account node characteristics and directed edge characteristics of the intranet transaction network. They are the feature embeddings of account node features and directed edge features respectively.

[0107] The first aggregation function of the graph neural network learns the relationship between adjacent nodes and edges in each transaction network based on the adjacency relationship between nodes and directed edges in the transaction network, and obtains potential account node representations and potential directed edge representations:

[0108] Transaction information is embedded in the feature embedding of directed edge features, account node information is embedded in the feature embedding of account node features, and at any time slice In the transaction network within a time slice, an account node may have multiple edges. The graph neural network learns a first aggregation function to aggregate account nodes and directed edge information based on the adjacency relationship contained in the transaction network within any time slice to calculate the potential account node representation. and potential directed edges :

[0109] ;

[0110] in, is the first learnable aggregation function for the parameters of graph neural networks, It is a learnable parameter for the first aggregation function of the graph neural network. Based on time slice An example of a first aggregation function is to use MLP.

[0111] In multiple groups of transaction networks corresponding to multiple time slices, if the common account nodes of any two transaction networks have different directed edges, it is necessary to aggregate the different directed edge information into the account node and use message passing to update the potential directed edge representation of the directed edge.

[0112] The graph neural network learns a second aggregation function, which represents the potential account nodes in multiple transaction networks in time series. and potential directed edges Aggregate to each account node:

[0113] ;

[0114] in, Represents the potential account nodes in the aggregated b+1 trading networks and potential directed edges Aggregate potential account node representation; is the potential account node representation and potential directed edge representation from the continuous b+1 transaction networks; is the second aggregation function with learnable parameters, is a learnable parameter used by the graph neural network to construct the second aggregation function. The second aggregation function focuses on a larger time range than the first aggregation function. In one example, the second aggregation function uses an attention mechanism to implement aggregation.

[0115] Represent the potential directed edges of each trading network , using the first aggregation function to update according to the aggregated potential account node representation: The “_” corresponds to the potential account node representation that should have been output by the first aggregation function, which can be discarded. The updated potential directed edge representations of the b+1 trading networks are aggregated using attention aggregation to obtain the aggregated potential directed edge representation .

[0116] Aggregate potential account node representation and aggregated potential directed edges Aggregate the transaction account nodes and directed edge information within the time span of (b+1) times the time slice length T. Aggregate potential account node representation and aggregated potential directed edges It is also time-series.

[0117] Graph neural network represents the aggregated potential account nodes of time series and aggregated potential directed edges The data is passed to a recurrent neural network for time series modeling, where the recurrent neural network adopts any one of GRU, LSTM, and RNN.

[0118] Taking GRU as an example, GRU aggregates potential account nodes to represent and aggregated potential directed edges The hidden features are provided to the classification head, which learns a classification function , aggregate potential account nodes to represent and aggregated potential directed edges The hidden features of are mapped to the predicted transaction category labels:

[0119] ,

[0120] in, Aggregated potential account node representation output by the recurrent neural network and aggregated potential directed edges The hidden features of , θ is the learnable parameter of the classification head. The classification head of the example adopts a fully connected network.

[0121] The fraud recognition model is trained using the transaction network features of the labeled transaction big data. The purpose is to automatically identify the difference between normal transactions and suspected fraudulent transactions through the fraud recognition model, so as to identify suspicious transaction behaviors in transactions and provide corresponding anti-fraud reminders based on the suspicious transaction behaviors. The loss function used in training the fraud recognition model is the cross entropy loss, which is defined as:

[0122] ;

[0123] Where N is the number of fraud types, C is the number of labels, Represents the actual and predicted results corresponding to the cth label in the nth fraud type, the predicted result belong During training, the Adam optimizer was used with an early stopping strategy to prevent the fraud detection model from overfitting, and the best model was selected based on the highest validation F1 score.

[0124] In the specific implementation process, in order to enhance the effect of the fraud recognition model, contrastive learning constraints are set after the graph neural network and the recurrent neural network respectively; contrastive learning is used to strengthen the aggregated potential account node representation corresponding to the positive and negative transaction behavior data obtained by the graph neural network. and aggregated potential directed edges The difference between the two is obtained by contrastive learning, and the aggregated potential account node representation corresponding to the positive or negative transaction behavior data obtained by the enhanced graph neural network is obtained. and aggregated potential directed edges The aggregated potential account node representation corresponding to the positive and negative transaction behavior data obtained by using contrastive learning to enhance the recurrent neural network and aggregated potential directed edges The difference between the hidden features of the positive or negative transaction behavior data is obtained by using contrastive learning to strengthen the aggregated potential account node representation corresponding to the recurrent neural network. and aggregated potential directed edges The similarity of hidden features.

[0125] The L2 norm sum of squares of all trainable parameters is introduced into the loss function to achieve L2 regularization of the trainable parameters and improve the model quality.

[0126] The fraud detection model performed best under normal transaction patterns, achieving an F1 score of 0.92. This demonstrates that the fraud detection model maintained high accuracy and precision when identifying normal transaction behavior. This reflects the relatively stable and consistent characteristics of normal transactions, enabling the fraud detection model to easily distinguish transactions consistent with normal ones. In contrast, the fraud detection model's F1 score dropped to 0.85 when identifying fraud. Fraud often involves complex fund flows and covert transfers between accounts, which are more difficult to detect than normal transactions. The fraud detection model encounters more irregular behavior, which reduces its ability to detect fraudulent activity. Although lower than normal transactions, it still demonstrates strong identification capabilities. Fraudulent activity often involves fictitious accounts, fictitious transaction paths, and complex transaction patterns. Despite its high concealment, the fraud detection model is able to identify these fraudulent activities by learning transaction characteristics and abnormal patterns.

[0127] Example 2

[0128] See Figure 5As shown, the present invention provides a transaction anti-fraud device based on big data, comprising: at least one processing unit, the processing unit being connected to a storage unit via a bus unit, the storage unit storing a computer program, and the computer program, when executed by the processing unit, implementing the multi-level power optimization allocation and equipment selection method for the energy and power system, comprising:

[0129] Obtain transaction big data and use it to create a directed transaction graph that describes transaction behavior between accounts ,in, It is a node set in a directed transaction graph, where the nodes in the node set represent the accounts involved in various transactions; It is a set of directed edges with timestamps configured between account nodes in a directed transaction graph. The direction of the directed edge represents the direction of transaction amount flow, and the weight corresponding to the directed edge represents the transaction amount between account nodes.

[0130] Within a set time slice, a transaction network is constructed between any two accounts to be analyzed, formed by transactions conducted through intermediate accounts;

[0131] For any trading network, the trading network features of each trading network in different time slices are arranged in order to form a time-series trading network feature; the trading network feature includes: directed edge features and account node features;

[0132] Construct and use labeled transaction big data to train a fraud recognition model, aiming to automatically identify the differences between normal transactions and suspected fraudulent transactions through the fraud recognition model, so as to identify suspicious transaction behaviors in transactions. The fraud recognition model includes: graph neural network, recurrent neural network and classification head.

[0133] Of course, the computer program stored in the storage unit of the big data-based transaction anti-fraud device provided in an embodiment of the present invention is not limited to the operations of the method described above, and can also execute related operations in the big data-based transaction anti-fraud method provided in any embodiment of the present invention.

[0134] Example 3

[0135] An embodiment of the present invention provides a computer-readable storage medium storing computer instructions. When the computer instructions are executed by a processor, the method for anti-fraud transactions based on big data is implemented, including:

[0136] Obtain transaction big data and use it to create a directed transaction graph that describes transaction behavior between accounts ,in, It is a node set in a directed transaction graph, where the nodes in the node set represent the accounts involved in various transactions; It is a set of directed edges with timestamps configured between account nodes in a directed transaction graph. The direction of the directed edge represents the direction of transaction amount flow, and the weight corresponding to the directed edge represents the transaction amount between account nodes.

[0137] Within a set time slice, a transaction network is constructed between any two accounts to be analyzed, formed by transactions conducted through intermediate accounts;

[0138] For any trading network, the trading network features of each trading network in different time slices are arranged in order to form a time-series trading network feature; the trading network feature includes: directed edge features and account node features;

[0139] Construct and use labeled transaction big data to train a fraud recognition model, aiming to automatically identify the differences between normal transactions and suspected fraudulent transactions through the fraud recognition model, so as to identify suspicious transaction behaviors in transactions. The fraud recognition model includes: graph neural network, recurrent neural network and classification head.

[0140] Of course, the computer-readable storage medium provided by an embodiment of the present invention stores a computer program that is not limited to the operations of the method described above, and can also execute related operations in a big data-based transaction anti-fraud method provided by any embodiment of the present invention.

[0141] In the embodiments provided by the present invention, it should be understood that the disclosed structures and methods can be implemented in other ways. For example, the structural embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, structure or unit, which can be electrical, mechanical or other forms.

[0142] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0143] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0144] The foregoing description is intended only to provide specific embodiments of the present invention, which will enable those skilled in the art to understand and implement the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown herein, but is intended to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A transaction anti-fraud method based on big data, characterized in that: include: Obtain transaction big data and use it to create a directed transaction graph that describes transaction behavior between accounts ,in, It is a node set in a directed transaction graph, where the nodes in the node set represent the accounts involved in various transactions; It is a set of directed edges with timestamps configured between account nodes in a directed transaction graph. The direction of the directed edge represents the direction of transaction amount flow, and the weight corresponding to the directed edge represents the transaction amount between account nodes. Within a set time slice, a transaction network is constructed between any two accounts to be analyzed, formed by transactions through intermediate accounts; the transaction network consists of transaction flows of a set length; the corresponding nodes of any two accounts to be analyzed in the directed transaction graph are set as source account nodes and the target account node ; Set the length of the time slice to T; then, based on the directed transaction graph, within each time slice T, from the source account node To the target account node Any transaction flow with an intermediate account length of I+1 is represented as: ， in, Indicates the source account node and the target account node The kth transaction flow between The I intermediate account nodes participating in the k-th transaction flow all belong to the node set , Both are node collections The account node index of any account node in; is a directed edge in the transaction flow, The timestamps of directed edges are all in the same time slice, and in the transaction flow, the order of directed edges is arranged according to the timestamp order, that is, the order of transaction intermediaries has nothing to do with the element index order of the node set; the transaction flow The length of is I+1; For source account nodes To the target account node , count all transaction flows with a length less than Imax+1 between the two, and form a transaction network ; For any trading network, the trading network features of each trading network in different time slices are arranged in sequence to form a time-series trading network feature. The trading network feature includes directed edge features and account node features. The directed edge feature includes: a combination of the directed edge weight arrays in each transaction flow in the trading network, a combination of the sum of all directed edge weights in each transaction flow in the trading network, and a combination of the minimum directed edge weights. The account node feature is derived from the account node information, which includes: the encoded account entity, the mean, variance, and rate of change of the account's historical flow. Construct and utilize the transaction network features of labeled transaction big data to train a fraud recognition model, aiming to automatically identify the difference between normal transactions and suspected fraudulent transactions through the fraud recognition model, so as to identify suspicious transaction behaviors in transactions and provide corresponding anti-fraud reminders based on the suspicious transaction behaviors. The fraud recognition model includes: a graph neural network, a recurrent neural network and a classification head.

2. The transaction anti-fraud method based on big data according to claim 1 is characterized in that: For any source account node and target account node, the transaction network construction process includes: S201, obtain any time slice Directed transaction graph within ; Define the maximum transaction flow length Imax+1 and the remaining recursion depth initialized corresponding to the maximum transaction flow length; S202, traverse from time slice Directed transaction graph within The source account node to be analyzed obtained from ; S203, for any transaction flow starting from the traversed source account node, check whether the remaining recursion depth of the transaction flow is zero; If yes, execute S204; otherwise execute S205; S204: Return the current account node. The returned current node is the end point account node of the transaction flow, and the account node search of the transaction flow ends. If the transaction flow contains multiple end point account nodes, the transaction flow is divided into transaction flows corresponding to the number of end point account nodes. S205: For any transaction flow starting from the traversed source account node, check whether the number of current account nodes in the transaction flow is zero. If yes, execute S206; otherwise, execute S207. S206, transaction flow ends; S207: Add the found current account node to the transaction flow. If the transaction flow contains multiple current account nodes, the transaction flow forms transaction flows corresponding to the number of current account nodes. The remaining recursive depth of each new transaction flow is reduced by one. For each new transaction flow, traverse all the next neighbor nodes of the current account node as the new current account node; S208: Return all formed transaction flows to obtain a transaction network between any source account node and target account node.

3. The transaction anti-fraud method based on big data according to claim 1 is characterized in that: The sum of all directed edge weights of each transaction flow is as follows: ； in, Represents the operation of extracting directed edge weights; represents the sum of all directed edge weights of the k-th transaction flow; The minimum edge weight of each directed edge of a transaction flow is as follows: ； Among them, min() represents the minimum value function, Indicates the minimum edge weight of the directed edge of the k-th transaction flow.

4. The transaction anti-fraud method based on big data according to claim 1 is characterized in that: The graph neural network includes a graph embedding layer, which slices the time Internal trading network The directed edge features and account node features of are mapped into corresponding feature embeddings, expressed as: ； Among them, the graph embedding layer adopts MLP, Time slices The account node characteristics and directed edge characteristics of the internal transaction network, These are the feature embeddings of account node features and directed edge features respectively; The first aggregation function learned by the graph neural network learns the relationship between adjacent nodes and edges in each transaction network based on the adjacency relationship between nodes and directed edges in the transaction network, and obtains potential account node representations and potential directed edge representations: ； in, is the first aggregation function with learnable parameters, It is the learnable parameter of the first aggregation function constructed by the graph neural network; Based on time slice The directed transaction graph within is obtained; The second aggregation function learned by the graph neural network represents the potential account nodes in multiple transaction networks in time series. and potential directed edges Aggregate to each account node and get the aggregate potential account node representation: ； in, Represents the potential account nodes in the aggregated b+1 trading networks and potential directed edges Aggregate potential account node representation; is the potential account node representation and potential directed edge representation from the continuous b+1 transaction networks; is the second aggregation function with learnable parameters, It is a learnable parameter for the graph neural network to construct the second aggregation function; Use the first aggregation function to update the potential directed edge representation of each transaction network based on the aggregated potential account node representation , the updated potential directed edge representations of b+1 trading networks are aggregated using attention aggregation to obtain the aggregated potential directed edge representation.

5. The transaction anti-fraud method based on big data according to claim 1 is characterized in that: Graph neural network represents the aggregated potential account nodes of time series and aggregated potential directed edges The data is passed to a recurrent neural network for time series modeling, where the recurrent neural network adopts any one of GRU, LSTM, and RNN.

6. The transaction anti-fraud method based on big data according to claim 1 is characterized in that: The classification head learns a classification function , aggregate potential account nodes to represent and aggregated potential directed edges The hidden features of are mapped to the predicted transaction category labels: ， Where H is the aggregated potential account node representation output by the recurrent neural network and aggregated potential directed edges The hidden features of θ are the learnable parameters of the classification head.

7. The transaction anti-fraud method based on big data according to claim 1, characterized in that: The loss function used in training the fraud detection model is cross entropy loss, which is defined as: ； Where N is the number of fraud types, C is the number of labels, represents the true and predicted results corresponding to the c-th label in the n-th fraud type; during training, the Adam optimizer is used with early stopping strategy to prevent overfitting of the fraud recognition model, and the best model is selected based on the highest validation F1 score.

8. The transaction anti-fraud method based on big data according to claim 7 is characterized in that: Contrastive learning constraints are set after the graph neural network and the recurrent neural network respectively; contrastive learning is used to strengthen the difference between the aggregated potential account node representation and the aggregated potential directed edge representation corresponding to the positive and negative transaction behavior data obtained by the graph neural network, and contrastive learning is used to strengthen the similarity between the aggregated potential account node representation and the aggregated potential directed edge representation corresponding to the positive or negative pairs of transaction behavior data obtained by the graph neural network; contrastive learning is used to strengthen the difference between the hidden features of the aggregated potential account node representation and the aggregated potential directed edge representation corresponding to the positive and negative transaction behavior data obtained by the recurrent neural network, and contrastive learning is used to strengthen the similarity between the hidden features of the aggregated potential account node representation and the aggregated potential directed edge representation corresponding to the positive or negative pairs of transaction behavior data obtained by the recurrent neural network.

9. The transaction anti-fraud method based on big data according to claim 7, characterized in that: The L2 norm sum of squares of all trainable parameters is introduced into the loss function to achieve L2 regularization of the trainable parameters.

Images