E-card transaction risk evaluation method based on multi-source data fusion

Abstract

The invention discloses an E-card transaction risk evaluation method based on multi-source data fusion, and the method comprises the steps: data obtaining and preprocessing: collecting the multi-source data, including user transaction behavior data, equipment environment data, geographic position data, historical credit data and third-party credit data, of an E-card transaction in real time, and carrying out the denoising, normalization and feature extraction of the data; according to the method, multi-source heterogeneous data such as equipment environment and real-time geographic position are fused, and a dynamic weight adjustment mechanism is introduced, so that the limitation of traditional single data source evaluation is broken through; meanwhile, a time attenuation factor log (1 + delta t) is matched, so that high-frequency abnormal transactions are effectively identified; a dynamic weight mechanism improves the adaptability of the model to a novel fraud mode.

Description

Technical Field

[0001] The present invention relates to the technical field of risk transactions, and in particular to an E-card transaction risk assessment method based on multi-source data fusion. Background Art

[0002] In the field of electronic payments and financial transactions, transaction risk assessment technology is a core component in ensuring transaction security. With the increasing popularity of mobile payments, traditional risk assessment methods have gradually exposed the following limitations.

[0003] Early risk models primarily relied on user transaction behavior data (e.g., amount, frequency) or credit scores, ignoring the value of heterogeneous data from multiple sources, such as device environment and geographic location. For example, traditional methods are unable to effectively identify abnormally high-frequency transactions by the same device in different geographic locations, resulting in insufficient detection capabilities for new fraud methods such as virtual location forgery. Most systems employ static, rule-based scoring models that rely on manually preset thresholds (e.g., daily transaction limits), making it difficult to dynamically respond to new fraud patterns (e.g., short-term, high-frequency, small-value transactions). Statistics show that such models have a false alarm rate as high as 15%, and require frequent manual adjustments to the rule base. Traditional methods require centralized data transmission to the cloud for processing, which results in communication delays (averaging over 200ms), making it difficult to meet the real-time requirements of high-concurrency scenarios. Furthermore, centralized data storage can pose privacy risks. While deep learning-based black box models can improve detection rates, they lack a visual explanation of the causes of risk, impacting the decision-making efficiency of risk control personnel.

[0004] In recent years, the industry has partially solved the above problems through the following technical optimizations. Despite the improvements, the existing technologies still have the following defects:

[0005] (1) Unstructured features such as device fingerprints and social data are difficult to quantify uniformly with structured transaction data, resulting in an explosion in the dimension of feature vectors and an increase in computational complexity by more than 30%.

[0006] (2) The weight update cycle of most systems is long and cannot capture sudden risk events at the second level (such as distributed denial of service attacks).

[0007] (3) The local model lacks incremental learning capabilities and needs to rely on daily synchronous update strategies, making it difficult to cope with scenarios with high-frequency strategy changes.

[0008] Therefore, it is urgent to design an E-card transaction risk assessment method based on multi-source data fusion to solve the above problems. Summary of the Invention

[0009] The purpose of the present invention is to provide an E-card transaction risk assessment method based on multi-source data fusion. This technology proposes a multi-source data spatiotemporal fusion framework to solve existing problems through the following breakthroughs: fusing device environment data (such as network protocol features) with transaction time series (Δ_t) through a spatiotemporal attention mechanism to reduce feature dimension redundancy; embedding a lightweight federated learning module in the edge node to support minute-level model parameter synchronization and improve the efficiency of cross-platform risk pattern recognition; combining the SHAP (Shapley Additive Explanations) algorithm to quantify the contribution of each feature to the risk score, and generating a visual report to assist decision-making to solve the above-mentioned shortcomings in the existing technology.

[0010] In order to achieve the above object, the present invention provides the following technical solutions:

[0011] The E-card transaction risk assessment method based on multi-source data fusion includes the following steps:

[0012] S1 Data Acquisition and Preprocessing: Real-time collection of multi-source data on E-card transactions, including user transaction behavior data, device environment data, geographic location data, historical credit data, and third-party credit data, and denoising, normalization, and feature extraction of the data;

[0013] S2 multi-source data fusion modeling: Multi-source data is mapped into a unified risk feature vector through a weighted fusion algorithm to build a dynamic risk scoring model. The formula is:

[0014]

[0015] Among them, S is the comprehensive risk score, wi is the dynamic weight of the i-th type of data, f i (x i ) is the characteristic function of the i-th type of data, Δt is the transaction time interval, and β is the time decay coefficient;

[0016] S3 dynamic weight adjustment: Based on real-time transaction data and historical abnormal patterns, the weight wi is updated using a sliding window mechanism to ensure the model's sensitivity to sudden risks;

[0017] S4 risk level output: Risk levels are divided into low, medium, and high according to the score S, and corresponding risk control strategies are triggered.

[0018] Preferably, the data preprocessing includes:

[0019] Divide the time window (5 minutes, 1 hour, 24 hours) to analyze the transaction frequency;

[0020] Gaussian kernel density estimation is used to detect abnormal areas in geographic location data.

[0021] Preferably, the characteristic function fi (x i ) is calculated as follows:

[0022] Adopting the Hidden Markov Model (HMM) to identify abnormal state transitions for user behavior data;

[0023] Extracting hardware fingerprints and network protocol features from device environment data.

[0024] 5. Preferably, the update rule of the dynamic weight wi is:

[0025] wi (t+1) = wi (t) + α·(Ractual - Rpredicted)

[0026] where α is the learning rate, Ractual is the actual risk label, and Rpredicted is the model prediction value.

[0027] Preferably, it also includes real-time triggering of secondary verification for high-risk transactions, including biometric recognition, face, voiceprint, and SMS verification codes.

[0028] Preferably, the threshold for risk level division is:

[0029] [[ID=..]]Low risk S ≤ 30: Normal release;

[0030] Medium risk 30 < S ≤ 70: Delayed settlement and notification to the user;

[0031] High risk S > 70: Freeze the account and initiate manual review.

[0032] Preferably, the third-party credit data includes:

[0033] Bank credit score, social network connection degree score, and blacklist library matching result.

[0034] Preferably, it also includes: Aggregating anonymized data across platforms based on federated learning technology to optimize the model generalization ability.

[0035] Preferably, the method is deployed on an edge computing node to achieve local real-time risk assessment and reduce cloud communication latency.

[0036] Preferably, it also includes: Generating a visual risk report to display the heatmap distribution and feature contribution analysis of high-risk transactions. [[ID=..]]

[0037] In the above technical solution, the present invention provides an E-card transaction risk assessment method based on multi-source data fusion. The present invention breaks through the limitations of traditional single data source evaluation by fusing multi-source heterogeneous data, such as device environment and real-time geographic location, and introducing a dynamic weight adjustment mechanism; at the same time, it cooperates with the time decay factor log(1+Δt) to effectively identify high-frequency abnormal transactions; the dynamic weight mechanism improves the model's adaptability to new fraud patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0039] Figure 1 This is a structural diagram of an embodiment of the E-card transaction risk assessment method based on multi-source data fusion provided by the present invention. DETAILED DESCRIPTION

[0040] In order to enable those skilled in the art to better understand the technical solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings.

[0041] like Figure 1 As shown, the E-card transaction risk assessment method based on multi-source data fusion provided by the embodiment of the present invention includes the following steps:

[0042] S1 Data Acquisition and Preprocessing: Real-time collection of multi-source data on E-card transactions, including user transaction behavior data, device environment data, geographic location data, historical credit data, and third-party credit data, and denoising, normalization, and feature extraction of the data;

[0043] S2 multi-source data fusion modeling: Multi-source data is mapped into a unified risk feature vector through a weighted fusion algorithm to build a dynamic risk scoring model. The formula is:

[0044]

[0045] Among them, S is the comprehensive risk score, wi is the dynamic weight of the i-th type of data, f i (x i ) is the characteristic function of the i-th type of data, Δt is the transaction time interval, and β is the time decay coefficient;

[0046] S3 dynamic weight adjustment: Based on real-time transaction data and historical abnormal patterns, the weight wi is updated using a sliding window mechanism to ensure the model's sensitivity to sudden risks;

[0047] S4 risk level output: Risk levels are divided into low, medium, and high according to the score S, and corresponding risk control strategies are triggered.

[0048] Preferably, the data preprocessing includes:

[0049] Divide the time window (5 minutes, 1 hour, 24 hours) to analyze the transaction frequency;

[0050] Gaussian kernel density estimation is used to detect abnormal areas in geographic location data.

[0051] Specifically in this embodiment, user transaction behavior data includes transaction amount, frequency, time interval, and transaction channel (online / offline); high-frequency transactions (≥3 times within 5 minutes) are marked as frequency anomalies.

[0052] Preferably, the characteristic function f i (x i ) calculation includes:

[0053] Use Hidden Markov Model (HMM) to identify abnormal state transitions in user behavior data;

[0054] Extract hardware fingerprints and network protocol features from device environment data.

[0055] Specifically in this embodiment, the device environment data includes:

[0056] Device fingerprint (model, operating system version, IP address) and network protocol characteristics (proxy / VPN flags); generate a unique device ID through a cryptographic hash algorithm and match it with historical records;

[0057] Preferably, the update rule of the dynamic weight wi is:

[0058] wi (t+1) =wi (t) +α·(Ractual-Rpredicted)

[0059] Among them, α is the learning rate, Ractual is the actual risk label, and Rpredicted is the model prediction value.

[0060] Specifically, in this embodiment, the update rule of the dynamic weight wi is as follows: the proportion of high-risk transactions in the statistical window is calculated every 5 minutes. If the proportion of device abnormalities is ≥ 20%, the device data weight is increased to 0.4;

[0061] Preferably, it also includes real-time triggering of secondary verification for high-risk transactions, including biometric recognition, face, voiceprint and SMS verification code.

[0062] Preferably, the threshold for the risk level division is:

[0063] Low risk S≤30: normal release;

[0064] Medium risk 30 < S ≤ 70: Delay settlement and notify the user;

[0065] High risk S > 70: Freeze the account and initiate manual review.

[0066] Specifically in this embodiment, the risk grading thresholds are as follows:

[0067] Low risk (S ≤ 30): Release normally and record the log;

[0068] Medium risk (30 < S ≤ 70): Delay settlement for 5 minutes and send a SMS verification code;

[0069] High risk (S > 70): Freeze the account, initiate face recognition and voiceprint comparison

[0070] Preferably, the third-party credit data includes: bank credit score, social network connection degree score, and blacklist database matching result.

[0071] Specifically in this embodiment, the third-party credit data includes querying the credit status through an API interface, with a response time ≤ 100ms;

[0072] Preferably, it further includes: aggregating anonymized data across platforms based on federated learning technology to optimize the model generalization ability; also includes aggregating cross-platform anonymized data based on federated learning and using differential privacy technology to optimize the model generalization ability; update the global model parameters once a month.

[0073] Preferably, the method is deployed on an edge computing node to achieve local real-time risk assessment and reduce cloud communication latency.

[0074] Preferably, it further includes: generating a visual risk report to display the heatmap distribution and feature contribution analysis of high-risk transactions; also includes generating a visual risk report: displaying the geographical heatmap, device fingerprint distribution, and feature contribution ranking of high-risk transactions.

[0075] Embodiment 1

[0076] Implementation method of data acquisition and preprocessing

[0077] Multi-source data collection:

[0078] Transaction behavior data: Real-time collect transaction amount, frequency, time interval (such as more than 3 consecutive transactions within 5 minutes), transaction channel (online / offline), etc., and achieve millisecond-level data access through a streaming data processing platform (such as Apache Flink).

[0079] Device environment data: Extract device fingerprints (device model, operating system version, IP address) and network protocol characteristics (proxy detection, VPN usage mark), and use a cryptographic hash algorithm to generate a unique device identifier.

[0080] Geographic location data: Real-time coordinates are obtained through GPS and base station positioning, combined with Gaussian kernel density estimation (KDE) to identify abnormal areas (such as the same device trading at locations more than 100 km apart within a short period of time).

[0081] Credit data: Connect to bank credit scoring systems (such as FICO scores) and third-party blacklist libraries (such as Sesame Credit), and query user credit status in real time through API interfaces.

[0082] Data preprocessing:

[0083] Denoising and standardization: Missing values are interpolated using mean values, outliers (such as single transaction amounts exceeding five times the user's historical mean) are truncated, and the dimensions are unified through Z-score standardization.

[0084] Time window division: Count transaction frequencies at 5-minute, 1-hour, and 24-hour granularities, and construct sliding window statistical features (such as the standard deviation of the total transaction amount within 1 hour);

[0085] Specifically, a user's E-card account made three consecutive online transactions between 10:00 and 10:05 (for amounts of 200, 500, and 1,000 yuan, respectively). The device fingerprint indicated frequent IP address switching, and the GPS location jumped from Beijing to Shanghai. This triggered an anomaly flag and initiated a multi-source fusion risk assessment.

[0086] Example 2

[0087] Characteristic function design:

[0088] User behavior features (fi(xi)): Based on the Hidden Markov Model (HMM), the probability of abnormal state transition is identified, such as the probability of a sudden change from a "low-frequency, small-amount" state to a "high-frequency, large-amount" state;

[0089] Device characteristics (f2(x2)): Calculate the matching degree between the device fingerprint and the historical records (e.g., 80% match is normal, less than 50% is high risk);

[0090] Geographic features (f 3(x 3)): The probability density difference between the current location and the user's usual location (such as home / office) is calculated through KDE. If the difference exceeds a threshold (such as 3σ), it is marked as an anomaly.

[0091] Dynamic weight adjustment algorithm:

[0092] Initial weight assignment: The weight of credit data w1 = 0.4, the weight of behavior data w2 = 0.3, the weight of device data w3 = 0.2, and the weight of geographical data w4 = 0.1 (determined based on the statistics of historical fraud cases).

[0093] Sliding window update: Every 5 minutes, calculate the proportion of high-risk transactions within the statistical window. If the proportion of abnormal device features exceeds 20%, then increase w3 to 0.4 and decrease other weights.

[0094] Time decay factor optimization:

[0095] Set the time decay coefficient β = 0.05, perform logarithmic transformation on the continuous trading interval Δt (unit: seconds) to suppress the interference of high-frequency transactions (for example, when Δt < 60s, log(1 + Δt) grows slowly).

[0096] The comprehensive score calculation for a certain transaction is as follows:

[0097] Input: w1 = 0.4, w2 = 0.3, w3 = 0.2, w4 = 0.1, f1 = 0.8, f2 = 0.5, f3 = 0.9, f4 = 0.2, Δt = 30s.

[0098] Calculation:

[0099] S = 0.4×0.8 + 0.3×0.5 + 0.2×0.9 + 0.1×0.2 + 0.05×log(31) ≈ 0.32 + 0.15 + 0.18 + 0.02 + 0.17 = 0.84.

[0100] Result: The score S = 84, triggering the high-risk level (threshold 70), and the system freezes the account and initiates manual review.

[0101] Example 3

[0102] Implementation of risk control strategy

[0103] Hierarchical response mechanism:

[0104] Low risk (S ≤ 30): Release normally and record the transaction log.

[0105] Medium risk (30 < S ≤ 70): Delay settlement for 5 minutes and synchronously send a SMS verification code for secondary verification.

[0106] High risk (S > 70): Immediately freeze the account, push a risk report to the risk control platform, and initiate face recognition and voiceprint comparison (false rejection rate < 0.5%).

[0107] Federated learning optimization, cross-institutional aggregation of anonymized data (such as device fingerprint patterns, fraud transaction labels), using differential privacy technology to protect user information, and updating the global model parameters once a month;

[0108] Specifically, a merchant's E-card terminal detected multiple transactions with the same device fingerprint (all using a simulator environment). The system obtained similar risk patterns from other platforms through federated learning, dynamically adjusted the model weights, and increased the scores of such transactions by 20%, blocking the fraud chain in advance.

[0109] Example 4

[0110] Localized risk assessment:

[0111] A lightweight risk assessment model (TensorFlow Lite version) is deployed on the E-Card terminal, retaining only core features (such as transaction frequency and device fingerprints), with a response time of <50ms; the edge node synchronizes risk strategies with the cloud, and updates model parameters incrementally every day.

[0112] In an offline scenario (such as a subway gate), the edge node calculates transaction risks in real time. If it finds that the cumulative daily consumption of a card exceeds three times the historical average, it immediately limits the single transaction amount and asynchronously reports it to the cloud for analysis.

[0113] The above description is merely illustrative of certain exemplary embodiments of the present invention. It goes without saying that those skilled in the art will be able to modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the above drawings and description are illustrative in nature and should not be construed as limiting the scope of protection of the claims.

Claims

1. The E-card transaction risk assessment method based on multi-source data fusion is characterized by: It includes the following steps: S1 Data acquisition and preprocessing: Real-time collect multi-source data of E-card transactions, including user transaction behavior data, device environment data, geographical location data, historical credit data, and third-party credit investigation data, and perform denoising, normalization, and feature extraction on the data; S2 Multi-source data fusion modeling: Map multi-source data into a unified risk feature vector through a weighted fusion algorithm, and construct a dynamic risk scoring model, the formula of which is Among them, S is the comprehensive risk score, wi is the dynamic weight of the i-th type of data, f i (x i ) is the characteristic function of the i-th type of data, Δt is the transaction time interval, and β is the time decay coefficient; S3 Dynamic weight adjustment: Based on real-time transaction data and historical abnormal patterns, use a sliding window mechanism to update the weight wi to ensure the sensitivity of the model to sudden risks; S4 Risk level output: Divide the risk levels into low, medium, and high according to the score S, and trigger corresponding risk control strategies.

2. The E-card transaction risk assessment method based on multi-source data fusion according to claim 1 is characterized in that: The data preprocessing includes: Divide time windows, 5 minutes, 1 hour, 24 hours, and analyze the transaction frequency; Use Gaussian kernel density estimation for abnormal area detection of geographical location data.

3. The E-card transaction risk assessment method based on multi-source data fusion according to claim 1 is characterized in that: The characteristic function f i (x i ) calculation includes: Use the hidden Markov model HMM to identify abnormal state transitions for user behavior data. Extract hardware fingerprints and network protocol features for device environment data.

4. The E-card transaction risk assessment method based on multi-source data fusion according to claim 1 is characterized in that: The update rule of the dynamic weight wi is: wi (t+1) =wi (t) +α·(Ractual-Rpredicted) where α is the learning rate, R actual is the actual risk label, and R prediction is the model prediction value.

5. The E-card transaction risk assessment method based on multi-source data fusion according to claim 1 is characterized in that: It also includes real-time triggering of secondary verification for high-risk transactions, including biometric recognition, face, voiceprint, and SMS verification codes.

6. The E-card transaction risk assessment method based on multi-source data fusion according to claim 1 is characterized in that: The thresholds for the risk level division are: Low risk S ≤ 30: Normal release; Medium risk 30 < S ≤ 70: Delay settlement and notify the user; High risk S > 70: Freeze the account and initiate manual review.

7. The E-card transaction risk assessment method based on multi-source data fusion according to claim 1 is characterized in that: The third-party credit investigation data includes: Bank credit score, social network association score, and blacklist database matching results.

8. The E-card transaction risk assessment method based on multi-source data fusion according to claim 1 is characterized in that: It also includes: Based on federated learning technology, aggregate anonymized data across platforms to optimize the model generalization ability.

9. The E-card transaction risk assessment method based on multi-source data fusion according to claim 1 is characterized in that: The method is deployed on edge computing nodes to achieve local real-time risk assessment and reduce cloud communication latency.

10. The E-card transaction risk assessment method based on multi-source data fusion according to claim 1 is characterized in that: It also includes: Generate a visual risk report to display the heat map distribution and feature contribution analysis of high-risk transactions.

Images