A fraud monitoring method and a monitoring system

Abstract

The application belongs to the technical field of anti-fraud monitoring, and provides an anti-fraud monitoring method and a monitoring system. The method comprises the following steps: receiving a first fraud investigation data set from multiple source channels, and using the first fraud investigation data set to build an initial detection model based on a random forest algorithm; receiving a second fraud investigation data set from multiple source channels, and driving the initial detection model to perform incremental learning based on the second fraud investigation data set to obtain a target detection model; and using the target detection model to perform anti-fraud monitoring on user behaviors and data traffic in a network environment. The application builds an initial detection model based on a random forest algorithm through multi-source data acquisition and a particle swarm optimization algorithm, and simultaneously uses a trend analysis mechanism based on a generative adversarial network to drive incremental learning, so as to balance the use of new and old data, thereby effectively enhancing the accuracy and timeliness of anti-fraud monitoring.

Description

Technical Field

[0001] The present invention relates to the technical field of anti-fraud monitoring, and in particular to an anti-fraud monitoring method and a monitoring system. Background Art

[0002] In the current online environment, anti-fraud detection faces significant challenges. Existing anti-fraud methods primarily include rule-based detection and detection using traditional machine learning algorithms. Rule-based detection methods typically rely on pre-defined rules to identify fraudulent activity. However, this approach has significant limitations. First, fraud methods are constantly evolving and innovating, and new forms of fraud can easily circumvent fixed rules, significantly compromising the accuracy and timeliness of detection. Second, due to the diverse nature of fraud types across regions, detection methods based on unified rules struggle to adapt to the actual conditions of different regions and are unable to accurately identify fraudulent activity in specific areas.

[0003] Traditional machine learning algorithms are also used in anti-fraud detection, but most are based on offline training models. These models are trained using historical data. While they can identify known fraud patterns to a certain extent, they often lag in responding to emerging fraud forms. Furthermore, offline training models struggle to adapt to the characteristics of fraud in different regions and may not accurately identify fraudulent activity in a specific detection area.

[0004] Furthermore, existing anti-fraud detection systems also have shortcomings in model updates. Once a model is trained and put into use, it typically requires manual intervention to update, making automatic iteration and upgrade impossible. This not only increases labor costs but also makes it difficult for the model to maintain efficient detection capabilities in the face of a rapidly changing fraud environment.

[0005] To sum up, existing anti-fraud monitoring technology has many shortcomings in terms of accuracy, adaptability, and automatic iteration and upgrade capabilities. It cannot effectively respond to increasingly complex and diverse fraud threats and needs to be improved. Summary of the Invention

[0006] In this regard, the present invention provides an anti-fraud monitoring method, system, electronic device, computer storage medium and computer program product to solve the problems of insufficient accuracy and timeliness of existing anti-fraud monitoring methods.

[0007] In a first aspect, the present invention provides an anti-fraud monitoring method, comprising the following steps:

[0008] Receiving a first fraud detection dataset from multiple sources, and constructing an initial detection model based on a random forest algorithm using the first fraud detection dataset; wherein hyperparameters of the random forest algorithm are dynamically adjusted based on a particle swarm optimization algorithm;

[0009] receiving a second fraud detection dataset from multiple sources, and driving the initial detection model to perform incremental learning based on the second fraud detection dataset to obtain a target detection model; wherein the incremental learning is implemented based on a trend analysis mechanism of a generative adversarial network;

[0010] Use target detection models to conduct anti-fraud monitoring of user behavior and data traffic in network environments.

[0011] In a second aspect of the present invention, an anti-fraud monitoring system is provided, the system comprising an offline training module, a near-line training module, and an online detection module;

[0012] The offline training module is configured to receive a first fraud detection dataset from multiple sources and use the first fraud detection dataset to construct an initial detection model based on a random forest algorithm; wherein hyperparameters of the random forest algorithm are dynamically adjusted based on a particle swarm optimization algorithm;

[0013] The near-line training module is configured to receive a second fraud detection dataset from multiple sources and drive the initial detection model to perform incremental learning based on the second fraud detection dataset to obtain a target detection model; wherein the incremental learning is implemented based on a trend analysis mechanism of a generative adversarial network;

[0014] The online detection module is used to use a target detection model to perform anti-fraud monitoring on user behavior and data traffic in a network environment.

[0015] In a third aspect of the present invention, an electronic device is provided, comprising: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the computer program implements any of the methods described above when executed by the processor.

[0016] According to a fourth aspect of the present invention, a computer storage medium is provided, wherein the computer storage medium stores a computer program executable by a processor to implement any of the methods described above.

[0017] According to a fifth aspect of the present invention, a computer program product is provided, which comprises a computer program executable by a processor to implement any of the methods described above.

[0018] This paper constructs an initial detection model based on the random forest algorithm through multi-source data collection and particle swarm optimization algorithm, and uses a trend analysis mechanism based on a generative adversarial network to drive incremental learning to balance the use of new and old data, thereby effectively enhancing the accuracy and timeliness of anti-fraud monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 This is a flow chart of an anti-fraud monitoring method disclosed in an embodiment of the present invention;

[0021] Figure 2 is a schematic diagram of the implementation process of the anti-fraud monitoring method disclosed in an embodiment of the present invention;

[0022] Figure 3 It is a structural diagram of an anti-fraud monitoring system disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The following specific embodiments illustrate the implementation of this application. Those familiar with the art can easily understand the other advantages and functions of this application from the content disclosed in this specification. Obviously, the described embodiments are part of the embodiments of this application, but not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0024] In addition, the technical features involved in the different embodiments of the present application described below can be combined with each other as long as they do not conflict with each other.

[0025] like Figure 1 、 Figure 2 As shown, an embodiment of the present invention discloses an anti-fraud monitoring method, including the following method steps:

[0026] S10, receiving a first fraud detection dataset from multiple sources, and using the first fraud detection dataset to construct an initial detection model based on a random forest algorithm; wherein the hyperparameters of the random forest algorithm are dynamically adjusted based on a particle swarm optimization algorithm.

[0027] The first fraud investigation dataset was obtained from reliable sources such as public security agencies, cybersecurity departments, and telecom operators. This dataset includes user behavior data, communication records, and transaction information from historical fraud cases. This data was preprocessed, including cleaning invalid data, standardizing the format (e.g., storing it as a CSV file), labeling fraud types (e.g., fake purchases, phishing scams), and using deep packet inspection (DPI) to extract temporal features of user app usage (e.g., the order in which apps were opened, duration of use, and key operation records). An offline training set was constructed based on the first fraud investigation dataset.

[0028] The random forest algorithm was used to construct the initial model, and offline training of the initial model was performed using the aforementioned offline training set. However, the performance of the random forest algorithm is affected by multiple hyperparameters, such as the number of decision trees, maximum depth, and minimum number of sample splits. Manually adjusting these hyperparameters often requires considerable time and experience, and finding the optimal solution is difficult. The particle swarm optimization algorithm, an optimization algorithm based on swarm intelligence, can quickly find optimal or near-optimal solutions in the search space. Therefore, this step combines the particle swarm optimization algorithm (PSO) with the random forest algorithm to automatically adjust the random forest's hyperparameters, improving the model's accuracy, stability, and generalization ability while reducing the workload of manual hyperparameter adjustment.

[0029] For example: the number of decision trees: PSO searches for the optimal value (e.g., initially set at 200, which can be adjusted to 250 after optimization to balance accuracy and efficiency); the maximum depth: limiting tree growth to prevent overfitting, with PSO automatically determining the optimal depth (e.g., optimizing from 15 to 18); and the minimum number of sample splits: controlling the minimum sample size for splitting a decision tree, with PSO dynamically optimizing based on the data distribution (e.g., adjusting from 5 to 3). This dynamic adjustment process evaluates model accuracy through cross-validation, and the optimal hyperparameter combination is determined using the global optimal solution of the particle swarm.

[0030] The preprocessed dataset is divided into a training set and a validation set. The random forest model is trained using the optimal hyperparameter combination obtained above. The model parameters are adjusted using the validation set to ensure that its recognition accuracy for historical fraud patterns reaches a preset threshold (e.g., above 95%), thereby obtaining an initial detection model.

[0031] S20, receiving a second fraud detection dataset from multiple sources, and driving the initial detection model to perform incremental learning based on the second fraud detection dataset to obtain a target detection model; wherein the incremental learning is implemented based on a trend analysis mechanism of a generative adversarial network.

[0032] Continuously receive new fraud data from multiple sources, namely the second fraud detection data set, including new fraud cases monitored in real time, fraud incidents reported by users, etc., to ensure the timeliness and authenticity of the data.

[0033] Preprocess new data, including feature extraction (such as APP usage timing, transaction amount fluctuations, abnormal communication patterns, etc.), standardization and fraud type labeling, to form incremental training samples that can be used for model updates.

[0034] Based on the initial detection model, incremental learning is performed using newly added data. The core goal is to quickly adapt to new fraud patterns while retaining historical knowledge. Specific implementations include:

[0035] Time decay weight: Different weights are assigned to new and old data. New data (such as the past 7 days) has a higher weight (such as 0.7), and historical data has a lower weight (such as 0.3). The weight is dynamically adjusted through the exponential decay function ( ), to prevent the model from forgetting historical patterns due to over-reliance on new data;

[0036] Fraud pattern clustering: Using algorithms such as K-means to cluster the features of new and old data, we can identify different types of fraud patterns (such as "impersonating public security, procuratorial, and legal entities" and "virtual currency fraud"), maintain high stability for high-frequency patterns, and increase update sensitivity for emerging patterns.

[0037] Feature importance protection: Based on the feature importance score (such as the Gini coefficient) of random forest, a protection mechanism is set for key features (such as transaction amount and app usage order) to prevent the weight of key features from dropping sharply due to data fluctuations during incremental learning.

[0038] Furthermore, during incremental learning, it's necessary to balance the value of new and old data, ensuring that the model remains sensitive to new fraud patterns while not losing its memory of historical fraud patterns due to an excessive pursuit of new data. To address this, the present invention has designed a trend analysis mechanism based on a generative adversarial network. This mechanism can pre-analyze new fraud patterns in the second fraud detection dataset and, based on their development trends, decide whether to include them in the incremental learning dataset, thereby avoiding oversensitivity to new data. The specific process will be discussed later.

[0039] S30, uses target detection models to perform anti-fraud monitoring on user behavior and data traffic in the network environment.

[0040] After the above step S20, the initial detection model further completes near-line training, thereby obtaining a target detection model that can be used for online anti-fraud monitoring.

[0041] Through network probes, DPI equipment and other technical means, user behavior and data traffic in the network environment are monitored in real time, including: the websites visited by users, the types of apps used and the time sequence (such as the abnormal sequence of "stranger social app → investment app → transfer app"); transaction data (amount, frequency, characteristics of the recipient); communication patterns (keywords in SMS / voice, call frequency, cross-border communication, etc.).

[0042] Fraud-related feature vectors are extracted from the collected data and used as input to the target detection model. The target detection model then calculates the probability of a user being scammed (in the range [0, 1]). When the probability exceeds a preset threshold (e.g., 0.8), an early warning mechanism is triggered. Warning methods include sending SMS / app pop-up alerts to users, notifying security departments, freezing abnormal transactions, and recording detailed information about the warning event (e.g., feature vector, warning time, and predicted fraud type).

[0043] In addition, the fraud case data confirmed during monitoring (such as records of users actually being defrauded) can be fed back to the S20's second fraud detection dataset as new training samples to drive the continuous iteration of the target detection model, forming a "detection-feedback-update" closed-loop mechanism to ensure that the model's response ability to new types of fraud continues to improve.

[0044] This paper constructs an initial detection model based on the random forest algorithm through multi-source data collection and particle swarm optimization algorithm, and uses a trend analysis mechanism based on a generative adversarial network to drive incremental learning to balance the use of new and old data, thereby effectively enhancing the accuracy and timeliness of anti-fraud monitoring.

[0045] As an example, the hyperparameters of the random forest algorithm are dynamically adjusted based on the particle swarm optimization algorithm, including:

[0046] The hyperparameter space of random forest is defined as a multidimensional vector space. An initial population of multiple particles is randomly generated. Each particle position corresponds to a set of hyperparameter combinations, and the particle velocity is initialized.

[0047] The cross-validation accuracy is used as the fitness function to evaluate the performance of the random forest model corresponding to each set of hyperparameter combinations. The individual optimal position and global optimal position of the particles are updated iteratively until the convergence conditions are met.

[0048] Map the optimized particle positions to actual hyperparameter values.

[0049] First, the hyperparameters of the random forest (number of decision trees, maximum depth, minimum number of sample splits, minimum number of sample leaves, maximum number of features, etc.) are defined as a multidimensional vector space, where each dimension corresponds to a parameter value range.

[0050] Then, by randomly generating an initial population of multiple particles, each particle's position corresponds to a set of hyperparameter combinations, and assigning random initialization velocities to the particles, the particles are given the ability to search in the hyperparameter space. For example, the number of decision trees is mapped to the interval [100, 500], and the maximum depth is mapped to the interval [5, 30]. This numerical mapping from continuous space enables optimal search of discrete parameters.

[0051] Next, the performance of the random forest model for each hyperparameter combination is quantitatively evaluated, using cross-validation accuracy as the fitness function. During the iteration process, particles continuously search for optimal solutions in the hyperparameter space by updating their individual optimal positions (their own historically optimal parameter combination) and the global optimal position (the optimal parameter combination among all particles). Dynamic adjustments to inertia weights, individual learning factors, and social learning factors balance the particles' global search and local development capabilities until convergence conditions (such as an upper limit on the number of iterations or a threshold for accuracy improvement) are met.

[0052] Finally, the optimized particle positions are mapped to actual hyperparameter values ​​through a linear transformation. For example, the number of decision trees is calculated from the particle position value ([0,1]) as "100 + particle value × 400," and the maximum depth is calculated as "5 + particle value × 25." These mapped hyperparameters are used to construct the initial random forest detection model. Compared to traditional manual parameter tuning or grid search, this significantly improves model accuracy while effectively reducing computational effort, enhancing the model's generalization and stability to historical fraud patterns.

[0053] As an example, the method of driving the initial detection model to perform incremental learning based on the second fraud detection dataset to obtain a target detection model includes:

[0054] Classifying the second fraud detection dataset to obtain sub-datasets corresponding to new fraud patterns;

[0055] The generator generates simulated fraud data based on the sub-dataset, and the discriminator distinguishes between real fraud data and simulated fraud data. The maturity index corresponding to the new fraud model is obtained by calculating the discriminator's error rate for the simulated fraud data corresponding to the sub-dataset.

[0056] Each sub-dataset whose maturity index is higher than the index threshold is fused with the historical data set to obtain an incremental learning data set, and the incremental learning data set is used to drive the initial detection model to perform incremental learning to obtain a target detection model.

[0057] As an example, the incremental learning is implemented based on an online gradient descent method.

[0058] As an example, the sub-datasets whose maturity indicators are higher than the indicator threshold are fused with the historical data set to obtain the incremental learning data set, including:

[0059] Assign decay weights to historical data sets according to timestamps, and assign weights to corresponding sub-data sets based on misjudgment rates; the above weights are used at least for adjusting the gradient update amount during parameter updates and adjusting the loss function of incremental learning.

[0060] New types of fraud typically go through three stages of development: The embryonic stage: The methods haven't yet been finalized (e.g., there have only been 10 cases of "AI face-swapping + e-commerce fraud"). Including them in training at this stage can easily lead to model overfitting. The development stage: The number of cases increases rapidly (100-1000 cases), the methods tend to be fixed, and pattern characteristics begin to form. The mature stage: The fraudulent methods are replicated on a large scale (e.g., there have been 1000 similar cases), and the model needs to be updated quickly. However, traditional incremental learning treats all new data equally, which can easily include "pseudo-new frauds" that have not yet reached scale (such as occasional abnormal behavior) in training, leading to model misjudgment. For example, a user who accidentally uses an overseas app to transfer money may be mistakenly identified as a fraud. Directly updating the model will introduce noise.

[0061] To address this issue, the present invention designs a trend analysis mechanism based on a generative adversarial network to decide whether to include data corresponding to new fraud patterns in the incremental learning dataset, thereby avoiding the problem of model overfitting caused by improper use of data from emerging fraud patterns. Specifically:

[0062] In the second fraud detection dataset, we clustered feature vectors (such as app usage time series, transaction patterns, and communication keywords) using the K-means or DBSCAN algorithm, dividing the data into sub-datasets representing different fraud patterns. For example, samples with "high frequency use of virtual currency trading apps and overseas IP transfers" were classified as the "new cryptocurrency fraud" sub-dataset.

[0063] For each sub-dataset, the degree of feature difference (e.g., cosine similarity) with historical fraud patterns is calculated. Any feature difference exceeding a threshold (e.g., 0.6) is identified as a new fraud pattern. For example, if the feature vector of a sub-dataset has a similarity of only 0.3 with a historical "pig-killing scam" pattern, it is considered a new pattern.

[0064] A generative adversarial network (GAN) consists of two neural networks: a generator and a discriminator. The generator aims to learn the distribution of real data by generating simulated data through random noise input. The discriminator is responsible for distinguishing whether the input data is real data or simulated data generated by the generator. During adversarial training, the generator strives to produce more realistic data to deceive the discriminator, while the discriminator continuously improves its discrimination ability. The two networks compete with each other, causing the data generated by the generator to increasingly resemble the distribution of real data.

[0065] When assessing the maturity of a new fraud model, the generator generates simulated fraud data based on the sub-dataset corresponding to the new fraud model, and the discriminator distinguishes between real fraud data and simulated fraud data. The maturity index is calculated by calculating the discriminator's error rate for new fraud samples. The maturity index can be the error rate, which is calculated as the ratio of simulated fraud data that the discriminator mistakenly identifies as real fraud data to the total number of data in the sub-dataset corresponding to the new fraud model.

[0066] If the false positive rate exceeds a threshold (e.g., 0.6), the new fraud model is considered mature (both objectively and predictively). This is because a high false positive rate indicates a high degree of similarity between the simulated fraud data generated by the generator and the real fraud data, reflecting that the new fraud model may have achieved a certain degree of universality and stability, that is, it is maturing. At this point, the sub-dataset corresponding to the new fraud model can be included in the incremental learning dataset. For example, if the anti-fraud monitoring system of the present invention is primarily used in Region A, and the new fraud model originates from Region B, when the new fraud model from Region B has reached maturity, it can be applied to Region A, where the new fraud model has not yet matured, thereby timely and proactively improving the monitoring capabilities of relevant personnel in Region A for this new fraud model.

[0067] Then, each sub-dataset whose maturity index is higher than the index threshold is fused with the historical dataset to obtain the incremental learning dataset.

[0068] For historical data sets, decay weights are assigned according to timestamps. The formula is: ,in, For the current moment, is the time when historical data is obtained, 、 are adjustable parameters, such as =0.3, The older the historical data is from the current time, the lower its weight is. For newly acquired data, i.e., sub-datasets whose maturity index is higher than the index threshold, its weight is set to be positively correlated with the misjudgment rate: ,in, is the misjudgment rate, are adjustable parameters, such as .

[0069] The weights are then used to associate and label the newly acquired sub-dataset and historical dataset. The labeled data is then fused to form an incremental learning dataset. This fused incremental learning dataset is then fed into the initial detection model, and the model parameters are updated using an incremental learning algorithm (such as online gradient descent).

[0070] Take the online gradient descent method as an example to explain the role of the above weights in the incremental learning process:

[0071] When the parameters are updated, the gradient update of the historical data sample is multiplied by , which is equivalent to the “protection coefficient” of historical knowledge. For example, the gradient update amount of a historical fraud feature (such as “unknown number requesting transfer”) is , multiplied by After that, the actual update amount is , to prevent the model from drastically changing its judgment of the feature due to the impact of new data.

[0072] The gradient update for new data samples is multiplied by , the more mature the new data ( For example, the larger the value of a new fraud feature (such as "AI-generated video call") , and its gradient update amount is , pushing the model to learn this feature first.

[0073] The loss function of incremental learning is expressed as: .in, is the prediction loss of historical data, is the prediction loss for new data.

[0074] Model parameters When taking the derivative: For example, if , , the contribution of the loss gradient of the new data to the parameter update is about 2.3 times that of the historical data, making the model more focused on feature learning of new frauds.

[0075] It is understandable that after completing incremental learning, the verification mechanism can also be used to verify the model performance by comparing the F1 scores of the model on the validation set before and after the update. If the improvement is ≥2%, the update is retained; otherwise, it is rolled back and the GAN parameters are readjusted.

[0076] like Figure 3 As shown, an embodiment of the present invention further provides an anti-fraud monitoring system 10, the system 10 includes an offline training module 101, a near-line training module 102, and an online detection module 103:

[0077] The offline training module 101 is configured to receive a first fraud detection dataset from multiple sources and use the first fraud detection dataset to construct an initial detection model based on a random forest algorithm; wherein hyperparameters of the random forest algorithm are dynamically adjusted based on a particle swarm optimization algorithm;

[0078] The near-line training module 102 is configured to receive a second fraud detection dataset from multiple sources and drive the initial detection model to perform incremental learning based on the second fraud detection dataset to obtain a target detection model; wherein the incremental learning is implemented based on a trend analysis mechanism of a generative adversarial network;

[0079] The online detection module 103 is used to perform anti-fraud monitoring on user behavior and data traffic in a network environment using a target detection model.

[0080] As an example, the offline training module 101 specifically:

[0081] The hyperparameter space of random forest is defined as a multidimensional vector space. An initial population of multiple particles is randomly generated. Each particle position corresponds to a set of hyperparameter combinations, and the particle velocity is initialized.

[0082] The cross-validation accuracy is used as the fitness function to evaluate the performance of the random forest model corresponding to each set of hyperparameter combinations. The individual optimal position and global optimal position of the particles are updated iteratively until the convergence conditions are met.

[0083] Map the optimized particle positions to actual hyperparameter values.

[0084] As an example, the near-line training module 102 specifically:

[0085] Classifying the second fraud detection dataset to obtain sub-datasets corresponding to new fraud patterns;

[0086] The generator generates simulated fraud data based on the sub-dataset, and the discriminator distinguishes between real fraud data and simulated fraud data. The maturity index corresponding to the new fraud model is obtained by calculating the discriminator's error rate for the simulated fraud data corresponding to the sub-dataset.

[0087] Each sub-dataset whose maturity index is higher than the index threshold is fused with the historical data set to obtain an incremental learning data set, and the incremental learning data set is used to drive the initial detection model to perform incremental learning to obtain a target detection model.

[0088] As an example, the incremental learning is implemented based on an online gradient descent method.

[0089] As an example, the near-line training module 102 specifically:

[0090] Assign decay weights to historical data sets according to timestamps, and assign weights to corresponding sub-data sets based on misjudgment rates; the above weights are used at least for adjusting the gradient update amount during parameter updates and adjusting the loss function of incremental learning.

[0091] An embodiment of the present invention further provides an electronic device comprising: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the computer program implements any of the aforementioned methods when executed by the processor.

[0092] An embodiment of the present invention further provides a computer storage medium storing a computer program that can be executed by a processor to implement any of the methods described above.

[0093] An embodiment of the present invention further provides a computer program product, which includes a computer program that can be executed by a processor to implement any of the methods described above.

[0094] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the composition and steps of each example according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0095] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and such modifications or substitutions are intended to be within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. An anti-fraud monitoring method, characterized by: The method comprises the following steps: Receiving a first fraud detection dataset from multiple sources, and constructing an initial detection model based on a random forest algorithm using the first fraud detection dataset; wherein hyperparameters of the random forest algorithm are dynamically adjusted based on a particle swarm optimization algorithm; receiving a second fraud detection dataset from multiple sources, and driving the initial detection model to perform incremental learning based on the second fraud detection dataset to obtain a target detection model; wherein the incremental learning is implemented based on a trend analysis mechanism of a generative adversarial network; Use target detection models to conduct anti-fraud monitoring of user behavior and data traffic in network environments; The initial detection model is driven to perform incremental learning based on the second fraud detection dataset to obtain a target detection model, including: Classifying the second fraud detection dataset to obtain sub-datasets corresponding to new fraud patterns; The generator generates simulated fraud data based on the sub-dataset, and the discriminator distinguishes between real fraud data and simulated fraud data. The maturity index corresponding to the new fraud model is obtained by calculating the discriminator's error rate for the simulated fraud data corresponding to the sub-dataset. Each sub-dataset whose maturity index is higher than the index threshold is fused with the historical data set to obtain an incremental learning data set, and the incremental learning data set is used to drive the initial detection model to perform incremental learning to obtain a target detection model.

2. The anti-fraud monitoring method according to claim 1, characterized in that: Dynamically adjust the hyperparameters of the random forest algorithm based on the particle swarm optimization algorithm, including: The hyperparameter space of random forest is defined as a multidimensional vector space. An initial population of multiple particles is randomly generated. Each particle position corresponds to a set of hyperparameter combinations, and the particle velocity is initialized. The cross-validation accuracy is used as the fitness function to evaluate the performance of the random forest model corresponding to each set of hyperparameter combinations. The individual optimal position and global optimal position of the particles are updated iteratively until the convergence conditions are met. Map the optimized particle positions to actual hyperparameter values.

3. The anti-fraud monitoring method according to claim 1, characterized in that: The incremental learning is implemented based on the online gradient descent method.

4. The anti-fraud monitoring method according to claim 3, characterized in that: The sub-datasets whose maturity indicators are higher than the indicator threshold are fused with the historical data set to obtain an incremental learning data set, including: Assign decay weights to historical data sets according to timestamps, and assign weights to corresponding sub-data sets based on misjudgment rates; the above weights are used at least for adjusting the gradient update amount during parameter updates and adjusting the loss function of incremental learning.

5. An anti-fraud monitoring system, characterized in that: The system includes an offline training module, a near-line training module, and an online detection module; The offline training module is configured to receive a first fraud detection dataset from multiple sources and use the first fraud detection dataset to construct an initial detection model based on a random forest algorithm; wherein hyperparameters of the random forest algorithm are dynamically adjusted based on a particle swarm optimization algorithm; The near-line training module is configured to receive a second fraud detection dataset from multiple sources and drive the initial detection model to perform incremental learning based on the second fraud detection dataset to obtain a target detection model; wherein the incremental learning is implemented based on a trend analysis mechanism of a generative adversarial network; The online detection module is used to perform anti-fraud monitoring on user behavior and data traffic in the network environment using a target detection model; The near-line training module specifically: Classifying the second fraud detection dataset to obtain sub-datasets corresponding to new fraud patterns; The generator generates simulated fraud data based on the sub-dataset, and the discriminator distinguishes between real fraud data and simulated fraud data. The maturity index corresponding to the new fraud model is obtained by calculating the discriminator's error rate for the simulated fraud data corresponding to the sub-dataset. Each sub-dataset whose maturity index is higher than the index threshold is fused with the historical data set to obtain an incremental learning data set, and the incremental learning data set is used to drive the initial detection model to perform incremental learning to obtain a target detection model.

6. The anti-fraud monitoring system according to claim 5, characterized in that: The offline training module specifically: The hyperparameter space of random forest is defined as a multidimensional vector space. An initial population of multiple particles is randomly generated. Each particle position corresponds to a set of hyperparameter combinations, and the particle velocity is initialized. The cross-validation accuracy is used as the fitness function to evaluate the performance of the random forest model corresponding to each set of hyperparameter combinations. The individual optimal position and global optimal position of the particles are updated iteratively until the convergence conditions are met. Map the optimized particle positions to actual hyperparameter values.

7. An electronic device, characterized in that: The electronic device includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the computer program implements the method according to any one of claims 1 to 4 when executed by the processor.

8. A computer storage medium, characterized in that: The computer storage medium stores a computer program that can be executed by a processor to implement the method according to any one of claims 1 to 4.

9. A computer program product, characterized in that: The computer program product comprises a computer program that can be executed by a processor to implement the method according to any one of claims 1 to 4.

Images