POS machine transaction risk identification method based on data analysis and deep learning technology

Abstract

The invention relates to the technical field of financial transaction security, and discloses a POS machine transaction risk identification method based on data analysis and a deep learning technology. According to the method, a transaction data stream is collected in real time, after multi-dimensional feature extraction and dynamic time sequence segmentation, the transaction data stream is input into a first deep learning model for preliminary risk scoring, high-risk time windows are screened, transaction data fine-grained features of the high-risk time windows are enhanced, then the transaction data stream is input into a second deep learning model for secondary risk judgment, and transaction risk tags are generated. Based on this, a real-time risk handling instruction is triggered. Wherein the multi-dimensional feature extraction comprehensively depicts transaction data, the deep learning model effectively mines risk features, and the dynamic time sequence segmentation adapts to different transaction frequencies. According to the method, the POS machine transaction risk can be accurately identified, disposal measures are taken in time, financial transaction safety is guaranteed, and the effect of improving risk identification accuracy, timeliness and comprehensiveness is remarkable.

Description

Technical Field

[0001] The present invention relates to the field of financial transaction security technology, and specifically to a POS machine transaction risk identification method based on data analysis and deep learning technology. Background Art

[0002] In today's digital payment era, POS machines, as important transaction terminals, are widely used in various business scenarios, greatly facilitating transaction activities between consumers and merchants.

[0003] Existing methods for identifying POS transaction risks have numerous limitations. Rule-based identification methods primarily rely on pre-set rules to determine transaction risk, such as whether the transaction amount exceeds a certain threshold or whether the transaction occurs during unusual hours. However, this approach relies too heavily on experience and fixed rules, making it incapable of adapting to complex and ever-changing risk scenarios. As fraud methods continue to evolve, new risk patterns are difficult to capture with timely rules, resulting in a high incidence of missed and misjudgment cases.

[0004] Statistical analysis methods identify risks by analyzing the statistical characteristics of historical transaction data. However, they often only identify risk patterns similar to those in historical data and lack the ability to effectively identify new risks. In the face of ever-changing market environments and fraudulent methods, statistical models have poor adaptability and are unable to promptly and accurately identify emerging risks.

[0005] While some risk identification systems have begun to incorporate deep learning models with the development of deep learning technology, practical applications still face challenges. Existing deep learning models, when processing POS transaction data, lack sufficient insight into data features, failing to fully capture the complex relationships and potential risks inherent in the data. Furthermore, during model training, uneven data quality and limited data volumes hinder the model's generalization capabilities, making it difficult to accurately identify risks across diverse transaction scenarios. Summary of the Invention

[0006] The purpose of the present invention is to provide a POS transaction risk identification method based on data analysis and deep learning technology to solve the problems raised in the above background technology.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a method for identifying POS machine transaction risks based on data analysis and deep learning technology, the method comprising: Real-time collection of POS transaction data streams, including transaction amount, transaction time, merchant type, and user behavior data; Performing multi-dimensional feature extraction on the transaction data stream to obtain an initial feature set; Dynamically segmenting the initial feature set based on a preset sliding time window to generate multiple time window feature sequences; Input the time window feature sequence into a pre-trained first deep learning model for preliminary risk scoring, and output the risk probability value corresponding to each time window; Screening out high-risk time windows based on the risk probability value, and performing fine-grained feature enhancement on the transaction data within the high-risk time windows; The enhanced fine-grained features are input into the pre-trained second deep learning model for secondary risk assessment to generate transaction risk labels. A real-time risk handling instruction is triggered based on the transaction risk tag.

[0008] Preferably, the step of performing fine-grained feature enhancement on the transaction data within the high-risk time window includes: extracting transaction geographic location distribution, device fingerprint information, and user historical transaction patterns within the high-risk time window; Spatially matching the geographical distribution of transactions with a preset high-risk area map to generate a geographical risk coefficient; Calculate similarity between the device fingerprint information and the historical abnormal device database to generate a device abnormality index; The user's historical transaction pattern, geographical risk coefficient and device anomaly index are integrated to construct an enhanced feature vector.

[0009] Preferably, the first deep learning model is a temporal convolutional network based on a multi-head attention mechanism, and its construction steps include: Input the time window feature sequence into the parallel temporal convolution layer and multi-head self-attention layer respectively; The output of the temporal convolution layer is weighted by local features, and the output of the multi-head self-attention layer is modeled by global correlation; The local features and global correlation features are fused through the feature splicing layer to generate a preliminary risk probability value.

[0010] Preferably, the second deep learning model is a hybrid model based on a gated recurrent unit and a graph neural network, and its construction steps include: Inputting the enhanced feature vector into a gated recurrent unit network for temporal dependency modeling; Extract user-merchant relationships from transaction data and construct a dynamic heterogeneous graph structure; Aggregating neighborhood information of nodes in the heterogeneous graph structure through a graph neural network to generate node embedding representation; The temporal dependency modeling result is integrated with the node embedding representation to output a secondary risk determination result.

[0011] Preferably, the step of extracting multi-dimensional features includes: Discretize the transaction amount into segments to generate amount distribution characteristics; Extract the hourly periodicity and date fluctuation patterns of transaction time and construct time series statistical features; Generate merchant association features based on the hierarchical classification code of merchant types; Exponential smoothing is performed on the operation interval and input frequency in user behavior data to generate a behavior stability index.

[0012] Preferably, the step of dynamic time series segmentation further includes: Adaptively adjust the length of the sliding time window based on the transaction frequency, where the window length is shortened to a first preset threshold in high-frequency transaction scenarios and extended to a second preset threshold in low-frequency transaction scenarios; The cosine weighting strategy is used to smooth the features of the transaction data in the overlapping window area.

[0013] Preferably, the step of spatial matching includes: Convert the transaction location into longitude and latitude coordinates and use the ray method to compare it with the polygonal areas in the high-risk area map; The dynamic geographic risk coefficient is calculated based on the number of times and duration that the transaction coordinates fall into the high-risk area.

[0014] Preferably, the similarity calculation between the device fingerprint information and the historical abnormal device database adopts an improved Jaccard algorithm, specifically including: Extract hardware identification, operating system version and network protocol features from device fingerprints; Hash encoding of hardware identifiers, semantic version comparison of operating system versions, and protocol field similarity calculation of network protocol features; The hash code difference, version comparison result and protocol field similarity are weightedly integrated to generate a device anomaly index.

[0015] Preferably, the step of constructing the dynamic heterogeneous graph structure includes: User nodes and merchant nodes are used as vertices, and transaction frequency and amount are used as edge weights; Dynamically update edge weights based on a transaction time decay function, where recent transactions are given higher weights; Add virtual edges to isolated nodes and connect them to historically high-risk nodes to avoid information islands.

[0016] Preferably, the triggering logic of the real-time risk handling instruction includes: If the secondary risk assessment result is high risk, the current transaction will be frozen and a verification request will be sent to the user terminal; If the user terminal does not respond within the preset time, a risk warning log will be automatically generated and the associated account will be marked; The risk warning log is synchronized to the distributed risk database, and a cross-platform risk joint defense mechanism is triggered.

[0017] Compared with the prior art, the present invention has the following beneficial effects: The POS transaction risk identification method proposed in the present invention based on data analysis and deep learning technology has significant beneficial effects in improving the accuracy, timeliness and comprehensiveness of transaction risk identification.

[0018] In terms of accuracy, the present invention comprehensively characterizes the characteristics of POS machine transaction data through multi-dimensional feature extraction. The segmented discretization of transaction amounts can carefully reflect the transaction distribution of different amount segments, enabling the risk identification model to better capture risk characteristics related to the amount. The hourly periodicity and date fluctuation pattern of transaction time are extracted to construct time series statistical features, and the merchant association features are generated based on the hierarchical classification code of merchant type. This enriches the data features from the time and merchant dimensions, helping the model to discover risk signals hidden in transaction time patterns and merchant associations. Exponential smoothing of the operation intervals and input frequencies in user behavior data is performed to generate a behavioral stability index, further providing a basis for risk judgment from the user operation level. These multi-dimensional features complement each other, providing a richer and more accurate data foundation for risk identification, greatly improving the accuracy of risk identification compared to traditional methods.

[0019] In constructing the deep learning model, the first deep learning model utilizes a temporal convolutional network based on a multi-head attention mechanism. This network utilizes parallel temporal convolutional layers and multi-head self-attention layers to perform local feature extraction and global correlation modeling, respectively. The temporal convolutional layers effectively mine local patterns in time series, capturing short-term trading changes, while the multi-head self-attention layers capture the dependencies between features at different locations from a global perspective. This allows the model to comprehensively consider local and global information and provide a more accurate preliminary score for trading risk. The second deep learning model is based on a hybrid model of gated recurrent units and graph neural networks. The gated recurrent unit network performs temporal dependency modeling on the enhanced feature vectors, capturing the temporal trends and dependencies of features. The graph neural network constructs a dynamic heterogeneous graph structure and aggregates node neighborhood information to generate node embedding representations. The two are fused to output secondary risk assessment results, further improving the accuracy of risk identification.

[0020] In terms of timeliness, the initial feature set is dynamically segmented based on a preset sliding time window, and the window length is adaptively adjusted according to transaction frequency. In high-frequency trading scenarios, the window length is shortened to the first preset threshold, enabling faster capture of transaction changes and timely identification of potential risks. In low-frequency trading scenarios, the window length is extended to the second preset threshold, ensuring sufficient transaction information for risk analysis even in low-frequency trading. Furthermore, a cosine weighting strategy is used to smooth the features of transaction data within the overlapping window area, making the feature transition between adjacent windows more natural and avoiding data mutations. This helps the model identify risks promptly and accurately, and enables the implementation of risk mitigation measures.

[0021] In terms of comprehensiveness, the present invention performs fine-grained feature enhancement on transaction data within the high-risk time window. It not only extracts the geographical distribution of transactions, device fingerprint information and historical transaction patterns of users, but also generates a geographical risk coefficient by spatially matching the transaction geographical location with a preset high-risk area map, and generates a device anomaly index based on the similarity calculation of the device fingerprint information and the historical abnormal device library. This information is integrated to construct an enhanced feature vector, providing more comprehensive information for risk determination. Moreover, the real-time risk disposal instruction triggering logic of the present invention is perfect. If the secondary risk determination result is high risk, the current transaction is frozen and a verification request is sent to the user terminal. If the user terminal does not respond, a risk warning log is automatically generated and the associated account is marked. The risk warning log is synchronized to the distributed risk database, and a cross-platform risk joint defense mechanism is triggered. From transaction freezing, user verification, risk recording to cross-platform joint defense, transaction security is fully guaranteed and risk losses are effectively reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a working principle diagram of the POS transaction risk identification method of the present invention; Figure 2 Flowchart built for temporal convolutional networks; Figure 3 Flowchart for mixed model determination; Figure 4 Flowchart generated for the device anomaly index. DETAILED DESCRIPTION

[0023] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0024] See also Figures 1-4The present invention provides a POS transaction risk identification method based on data analysis and deep learning technology, which aims to effectively identify risks in POS transactions and ensure transaction security. The method includes: Through an interface with the POS system, the system captures real-time data streams generated during transactions. This data includes transaction amount, transaction time, merchant type, and user behavior data. The transaction amount records the specific value of each transaction, while the transaction time is accurate to the second, accurately recording the moment the transaction occurred. Merchant type is used to distinguish between merchants of different industries or business natures. User behavior data covers information such as the interval between user operations and input frequency during POS operation.

[0025] For the collected transaction data stream, feature extraction is performed from multiple dimensions. The transaction amount is discretized in segments. For example, the transaction amount is divided into common consumption ranges to generate amount distribution features, which reflect the transaction distribution of different amount ranges. The hourly periodicity and date fluctuation patterns of transaction time are extracted, and the transaction patterns at different times of the day and different days of the week are analyzed to construct time series statistical features. Based on the hierarchical classification coding of merchant types, various merchants are coded according to industry standards or common market classification systems to generate merchant association features to represent the associations between different merchants. The operation intervals and input frequencies in user behavior data are exponentially smoothed to remove noise in the data and generate behavior stability indicators to measure the stability of user operations.

[0026] A sliding time window is set. The length of this window is not fixed but adaptively adjusted based on the trading frequency. In high-frequency trading scenarios, the window length is shortened to the first preset threshold to capture trading changes more promptly. In low-frequency trading scenarios, the window length is appropriately extended to the second preset threshold to obtain more comprehensive trading information. During the window sliding process, the transaction data within the overlapping window area is smoothed using a cosine weighting strategy. This makes the feature transition between adjacent windows more natural and avoids data mutations caused by window switching. In this way, the initial feature set is segmented into multiple time window feature sequences, each of which contains transaction feature information for a period of time.

[0027] A temporal convolutional network based on a multi-head attention mechanism is used as the first deep learning model. First, the time window feature sequence is fed into a parallel temporal convolutional layer and a multi-head self-attention layer. The temporal convolutional layer extracts local features from the sequence, mining local patterns within the time series. The multi-head self-attention layer performs global correlation modeling on the sequence, capturing the dependencies between features at different positions. Next, the output of the temporal convolutional layer is weighted by local features to highlight important local features, and the output of the multi-head self-attention layer is subjected to global correlation modeling to strengthen long-range dependencies between features. Finally, the feature concatenation layer fuses local features with global correlation features to generate a preliminary risk probability value, which reflects the initial risk level of the transaction within each time window.

[0028] Set a risk probability threshold, filter out time windows with risk probability values higher than the threshold, and identify them as high-risk time windows. Further fine-grained feature enhancement is performed on the transaction data within these high-risk time windows. Specifically, the transaction geographic location distribution, device fingerprint information, and user historical transaction patterns within the high-risk time window are extracted. The transaction geographic location is converted into longitude and latitude coordinates, and the ray method is used to judge it against the polygonal area in the preset high-risk area map. The dynamic geographic risk coefficient is calculated based on the number and duration of the transaction coordinates falling into the high-risk area; based on the device fingerprint information, the hardware identification, operating system version, and network protocol features are extracted, the hardware identification is hashed, the operating system version is compared with the semantic version, and the network protocol features are calculated for protocol field similarity. These results are weighted and fused to generate a device anomaly index; finally, the user's historical transaction pattern, geographic risk coefficient, and device anomaly index are fused to construct an enhanced feature vector to provide richer information for subsequent risk judgment.

[0029] A hybrid model based on gated recurrent units and graph neural networks is used as the second deep learning model. First, the enhanced feature vector is input into a gated recurrent unit network for temporal dependency modeling, capturing the temporal trends and dependencies of features. Next, the user-merchant relationships in the transaction data are extracted. With user and merchant nodes as vertices and transaction frequency and amount as edge weights, edge weights are dynamically updated based on a transaction time decay function, assigning higher weights to recent transactions. Virtual edges are added to isolated nodes connecting them to historically high-risk nodes to construct a dynamic heterogeneous graph structure. Next, a graph neural network is used to aggregate neighborhood information of nodes in the heterogeneous graph structure to generate node embedding representations. Finally, the temporal dependency modeling results are combined with the node embedding representations to output a secondary risk assessment result, generating a transaction risk label that clearly identifies whether the transaction is high-risk, medium-risk, or low-risk.

[0030] Execute corresponding real-time risk management instructions based on the generated transaction risk tag. If the secondary risk assessment result is high risk, the current transaction is frozen and a verification request is sent to the user terminal, requiring the user to verify the authenticity of the transaction. If the user terminal does not respond within the preset time, a risk warning log is automatically generated and the associated account is marked, recording the risk event and related account information. At the same time, the risk warning log is synchronized to the distributed risk database to facilitate subsequent risk analysis and statistics, and trigger the cross-platform risk prevention mechanism, notifying relevant platforms to strengthen monitoring of the account or similar transactions to prevent further spread of risks.

[0031] The present invention will be further described below in conjunction with Examples 1 to 6: Example 1: In this embodiment, the specific process of fine-grained feature enhancement and spatial matching of transaction data within a high-risk time window is described in detail.

[0032] Once the high-risk time window has been identified, an in-depth analysis of the transaction data within that window is conducted. First, the geographic distribution of transactions is extracted, and the geographic location at the time of the transaction is converted into longitude and latitude coordinates. These longitude and latitude coordinates are accurate to six decimal places to ensure location accuracy. The pre-set high-risk area map is a dataset containing multiple polygonal regions, each representing a known high-risk area. The ray method is used to determine whether the transaction coordinates fall within these polygonal regions. The ray method works by drawing a ray in any direction from the transaction coordinates and counting the number of intersections between the ray and the polygon boundary. If the number of intersections is odd, the transaction coordinates are inside the polygon; if it is even, they are outside.

[0033] The dynamic geographic risk coefficient is calculated based on the number and duration of transaction coordinates falling into the high-risk area. Assume that within the high-risk time window, the number of times the transaction coordinates fall into the high-risk area is The duration of each fall is , set a time decay factor ( ), then the dynamic geographical risk coefficient The calculation formula is: The meaning of this formula is that the more times you fall into high-risk areas and the longer each time lasts, the higher the geographical risk coefficient; at the same time, as time goes by, the impact of falling into high-risk areas earlier will gradually decay.

[0034] Extract device fingerprint information, including hardware identification, operating system version, and network protocol characteristics. The hardware identification is a unique identifier for the device, used to distinguish different POS devices. Hash the hardware identification and convert it into a fixed-length digital code to facilitate subsequent calculation of the degree of difference. The operating system version records the version number of the operating system used by the POS machine. Using the semantic version comparison method, the major version number, minor version number, and revision number of the version number are compared to determine the degree of difference between the versions. The network protocol characteristics cover the protocol information used by the device during network communication. Similarity calculations are performed on the protocol fields to analyze the consistency of the protocol configuration.

[0035] These calculation results are weighted and integrated to generate the device anomaly index. Assume that the hardware identification hash code difference is , the operating system version comparison result is , the network protocol field similarity is , assign them weights respectively 、 、 ( ), then the device abnormality index The calculation formula is: This formula takes into account differences in hardware, operating systems, and network protocols, and more comprehensively reflects the degree of device abnormality.

[0036] Extract the user's historical transaction pattern, such as the time pattern of the user's previous transactions, the transaction amount range, the type of merchants commonly used, etc. The geographical risk coefficient generated by the geographical distribution of transactions and the device anomaly index generated by the device fingerprint information are integrated with the user's historical transaction pattern to construct an enhanced feature vector. Assume that the user's historical transaction pattern is encoded to obtain a vector , enhanced feature vector It can be expressed as: ,In this way, richer and more targeted feature information is provided for subsequent risk ,determination.

[0037] Example 2: The input to the first deep learning model is multiple time window feature sequences, which contain multi-dimensional feature information of POS machine transactions in different time periods. First, the time window feature sequences are input into the parallel temporal convolution layer and multi-head self-attention layer.

[0038] The temporal convolution layer consists of multiple convolution kernels, whose size is set based on the temporal granularity of the transaction data. For example, if transaction data is recorded in seconds, the convolution kernel size can be set to 3-5 seconds to capture local transaction patterns within a short period of time. The temporal convolution layer extracts features from the input sequence through convolution operations, generating local feature representations.

[0039] The multi-head self-attention layer is used to capture the global correlation between features at different positions in the sequence. The multi-head self-attention mechanism uses multiple attention heads to calculate in parallel and focus on the information in the sequence from different perspectives. Assume that the input sequence is The dimension is , the multi-head self-attention layer projects the input to different subspaces, each with a dimension of For each attention head, the query vector is calculated , key vector Sum vector , the calculation formulas are: , , ,in 、 、 Is a learnable weight matrix. By calculating the attention score , and perform Softmax normalization on it to obtain the attention weight matrix, and finally obtain the output of the multi-head self-attention layer through weighted summation.

[0040] Output of the temporal convolutional layer Perform local feature weighting by setting a learnable weight vector , calculate the weighted local features , highlighting the local features that are important for risk judgment. Output of the multi-head self-attention layer Perform global correlation modeling to further strengthen the long-distance dependencies between features.

[0041] The weighted local features are concatenated through the feature concatenation layer Globally associated features Fusion is performed to generate a preliminary risk probability value. Assume that the feature concatenation layer concatenates the two features by dimension to obtain the fused feature , and then pass through a fully connected layer and Softmax function to obtain the preliminary risk probability value , the calculation formula is: ,in In this way, the first deep learning model can integrate local and global information to perform a preliminary risk score on transactions within the time window and output the corresponding risk probability value.

[0042] Example 3: The input of the second deep learning model is the enhanced feature vector after fine-grained feature enhancement. First, the enhanced feature vector is input to the gated recurrent unit network (GRU) for temporal dependency modeling. GRU is a special recurrent neural network that can effectively handle long-term dependency problems in time series data. It contains two gates: reset gate and update gate . Assume that the input at the current moment is , the hidden state at the previous moment is , reset gate The calculation formula is: , update gate The calculation formula is: ,in is the Sigmoid function, 、 Is a learnable weight matrix. By resetting the gate and updating the gate, the candidate hidden state is calculated : , and finally get the hidden state at the current moment : , here's ” indicates element-wise multiplication. By passing through the layers of the GRU network, the changing trend and dependency of the enhanced feature vector over time are captured.

[0043] Extract the user-merchant relationship in the transaction data and construct a dynamic heterogeneous graph structure. Take the user node and merchant node as vertices, and the transaction frequency and amount as edge weights. Assume that within a period of time, the user With merchants The transaction frequency between The total transaction amount is , then the edge weight It can be expressed as: ,in 、 is the weight coefficient ( ), which is used to adjust the impact of transaction frequency and transaction amount on edge weight.

[0044] The edge weights are dynamically updated based on the transaction time decay function, with recent transactions being given higher weights. Suppose the transaction time is , the current time is , the time decay function can be set as: ,in Is the decay coefficient, which controls the speed at which the edge weight decays over time. The updated edge weight .

[0045] For isolated nodes, i.e. user or merchant nodes that have no connection to other nodes, add virtual edges to connect to historical high-risk nodes. This is done to avoid information silos and enable these isolated nodes to participate in risk analysis. Assume that the historical high-risk node is , the isolated node is , the virtual edge weight can be set to a fixed value , indicating the potential association between the isolated node and the high-risk nodes.

[0046] The graph neural network aggregates the neighborhood information of nodes in the heterogeneous graph structure and generates node embedding representation. The graph neural network uses graph convolution operation, assuming that the node The set of neighboring nodes is ,node The eigenvector of , the calculation formula of the graph convolution operation is: ,in 、 Node and nodes The degree, is a learnable weight matrix. Through multi-layer graph convolution operations, neighborhood information is continuously aggregated to generate more representative node embedding representations.

[0047] Finally, the temporal dependency modeling results (i.e., the output of the GRU network) are combined with the node embedding representation to produce a secondary risk assessment result. The output of the last layer of the GRU network is concatenated with the node embedding representation generated by the graph neural network. This is then passed through a fully connected layer and a softmax function to produce the secondary risk assessment result, generating a transaction risk label and clarifying the transaction's risk level.

[0048] Example 4: This embodiment describes in detail the specific operation process of multi-dimensional feature extraction.

[0049] For the transaction amount, segmented discretization is performed. According to the common consumption amount range in the market and the needs of risk analysis, the transaction amount is divided into multiple intervals. For example, 、 、 、 、 Count the number of times the transaction amount falls into each interval in each time window to generate the amount distribution characteristics. Suppose that in a time window, the transaction amount falls into The number of intervals is ,fall into The number of intervals is , and so on, the amount distribution feature can be expressed as a vector .

[0050] Extract the hourly periodicity and date fluctuation pattern of transaction time and construct time series statistical features. Divide the 24 hours of a day into different time periods, for example, every 3 hours is a time period, a total of 8 time periods. Count the number of transactions in each time period to obtain hourly periodic features. Assume that in the The number of transactions in a time period is , then the hourly periodic eigenvector At the same time, we analyze the trading patterns of different days in a week, count the number of transactions per day from Monday to Sunday, and generate the characteristic vector of the date fluctuation pattern. ,in Indicates the The number of transactions per day. The hourly periodic feature vector and the date fluctuation pattern feature vector are combined to obtain the time series statistical features. .

[0051] Based on the hierarchical classification code of merchant types, merchant association features are generated. Merchants are divided into multiple levels according to industry standards or market-wide merchant classification systems. For example, the first level can be divided into major categories such as retail, catering, and entertainment, and the second level can be divided into subcategories such as food retail and clothing retail under the major retail category. Each merchant type is coded, assuming there are Different merchant types are represented by a unique hot encoding method. dimensional vector, where only the corresponding type position is 1 and the other positions are 0. Different merchant types, the vector obtained by adding the encoding vectors of these merchant types is the merchant association feature. The encoding vectors of merchant types are , then the merchant association feature .

[0052] For the operation interval and input frequency in the user behavior data, exponential smoothing is performed to generate a behavior stability index. Assume that the operation interval sequence is , the input frequency sequence is , the exponential smoothing coefficient is ( ). First, exponential smoothing is performed on the operation interval, and the initial smoothing value , subsequent smoothing value , The input frequency is processed similarly, and the initial smoothing value , subsequent smoothing value , Finally, the smoothed values of the processed operation intervals and input frequency are comprehensively calculated. This multi-dimensional feature extraction method characterizes POS transaction data from different perspectives, providing a rich data foundation for subsequent risk analysis.

[0053] Example 5: In this embodiment, the process of adaptively adjusting the sliding time window length according to the transaction frequency in dynamic time series segmentation and using the cosine weighting strategy to perform feature smoothing on the transaction data in the window overlapping area is described in detail.

[0054] When performing dynamic time series segmentation, the first thing to do is to monitor the transaction frequency in real time. The transaction frequency is calculated as the number of transactions per unit time, such as the number of transactions per minute. Two preset thresholds are set. The first preset threshold is and a second preset threshold , When the transaction frequency is monitored Greater than When it is determined to be a high-frequency trading scenario, the length of the sliding time window is Shorten to the first preset threshold, assuming the first preset threshold is 1 minute, that is This is because in high-frequency trading scenarios, transactions change rapidly, and shorter window lengths can capture the changing trends of transaction data more timely and quickly discover potential risks. On the contrary, when the transaction frequency is Less than When it is determined to be a low-frequency trading scenario, the length of the sliding time window is Extend to the second preset threshold, assuming the second preset threshold is 5 minutes, that is In low-frequency trading scenarios, a longer window can collect more comprehensive trading information and avoid missing important data due to a short window.

[0055] In the process of sliding the time window, there will be a window overlap area. In order to make the feature transition between adjacent windows smoother and avoid data mutation caused by window switching, the transaction data in the window overlap area is smoothed using the cosine weighting strategy. Assume that the current window is , the next window is , their overlapping area is For each eigenvalue in the overlapping region , in the window The weight in , in the window The weight in According to the cosine weighting strategy, , ,in is the eigenvalue Distance Window The distance from the starting position, is the eigenvalue Distance Window The distance from the starting position, is the length of the overlapping area. After weighted processing, the eigenvalues in the overlapping area The comprehensive value of In this way, each feature is weighted and smoothed in the overlapping area, making the time window feature sequence generated based on different windows more coherent and stable, which helps the subsequent deep learning model to perform risk scoring and judgment more accurately.

[0056] Example 6: The improved Jaccard algorithm is used to calculate the similarity between the device fingerprint information and the historical abnormal device database. First, the hardware identification, operating system version and network protocol features in the device fingerprint are extracted. The hardware identification is a unique identifier of the device, such as the device serial number, MAC address, etc. The hardware identification is hashed and converted into a fixed-length digital code to facilitate the calculation of the difference. Assume that the hardware identification is , after the hash function After processing, the hash code is obtained .

[0057] The operating system version records the version number of the operating system used by the device, using the semantic version comparison method. The semantic version number is usually composed of a major version number, a minor version number, and a revision number, such as "1.2.3". Comparing the major version number, minor version number, and revision number of two version numbers, if the major version number is different, the difference is large; if the major version number is the same but the minor version number is different, the difference is second; if the major version number and minor version number are the same but the revision number is different, the difference is small. Suppose the two operating system version numbers to be compared are and , operating system version comparison results The calculation method is as follows: If ,but ;like and ,but ;like , and ,but ;like ,but .

[0058] The network protocol features cover the protocol information used by the device during network communication and perform similarity calculation on the protocol fields. Analyze the key fields in the protocol, such as IP address, port number, protocol type, etc., and calculate the similarity between them. Suppose two network protocol feature sets are and , network protocol field similarity The calculation can use the traditional Jaccard similarity formula: ,in Represents the number of elements in the intersection of two sets. Represents the number of elements in the union of two sets.

[0059] The device anomaly index is generated by weighted fusion of hardware identification hash code differences, operating system version comparison results, and network protocol field similarity. This index quantifies the degree of similarity between a device and historically abnormal devices, providing a basis for risk assessment.

[0060] In terms of the triggering logic of the real-time risk disposal instruction, when the transaction risk label generated by the second deep learning model shows high risk, the current transaction is immediately frozen to prevent the risk from further expanding. At the same time, a verification request is sent to the user terminal, requiring the user to perform identity verification to confirm the authenticity of the transaction. Set a preset time If the user terminal does not respond to the verification request within the preset time, a risk warning log is automatically generated. The risk warning log records detailed transaction information, including transaction time, transaction amount, merchant type, device information, etc., and also marks the associated account for subsequent key monitoring.

[0061] Risk alert logs are synchronized to a distributed risk database, which can store large amounts of risk event data for easy risk analysis and statistics. Furthermore, a cross-platform risk prevention mechanism is triggered, notifying other platforms associated with the transaction, such as payment platforms and financial institutions, to strengthen monitoring of the account or similar transactions. This enables risk information sharing and collaborative prevention across multiple platforms, effectively reducing the likelihood and scope of risk.

[0062] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0063] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A POS transaction risk identification method based on data analysis and deep learning technology, characterized in that: The method comprises: Real-time collection of POS transaction data streams, including transaction amount, transaction time, merchant type, and user behavior data; Performing multi-dimensional feature extraction on the transaction data stream to obtain an initial feature set; Dynamically segmenting the initial feature set based on a preset sliding time window to generate multiple time window feature sequences; Input the time window feature sequence into a pre-trained first deep learning model for preliminary risk scoring, and output the risk probability value corresponding to each time window; Screening out high-risk time windows based on the risk probability value, and performing fine-grained feature enhancement on the transaction data within the high-risk time windows; The enhanced fine-grained features are input into the pre-trained second deep learning model for secondary risk assessment to generate transaction risk labels. A real-time risk handling instruction is triggered based on the transaction risk tag.

2. The POS machine transaction risk identification method according to claim 1, characterized in that: The step of performing fine-grained feature enhancement on the transaction data within the high-risk time window includes: extracting transaction geographic location distribution, device fingerprint information, and user historical transaction patterns within the high-risk time window; Spatially matching the geographical distribution of transactions with a preset high-risk area map to generate a geographical risk coefficient; Calculate similarity between the device fingerprint information and the historical abnormal device database to generate a device abnormality index; The user's historical transaction pattern, geographical risk coefficient and device anomaly index are integrated to construct an enhanced feature vector.

3. The POS machine transaction risk identification method according to claim 1, characterized in that: The first deep learning model is a temporal convolutional network based on a multi-head attention mechanism, and its construction steps include: Input the time window feature sequence into the parallel temporal convolution layer and multi-head self-attention layer respectively; The output of the temporal convolution layer is weighted by local features, and the output of the multi-head self-attention layer is modeled by global correlation; The local features and global correlation features are fused through the feature splicing layer to generate a preliminary risk probability value.

4. The POS machine transaction risk identification method according to claim 3, characterized in that: The second deep learning model is a hybrid model based on a gated recurrent unit and a graph neural network, and its construction steps include: Inputting the enhanced feature vector into a gated recurrent unit network for temporal dependency modeling; Extract user-merchant relationships from transaction data and construct a dynamic heterogeneous graph structure; Aggregating neighborhood information of nodes in the heterogeneous graph structure through a graph neural network to generate node embedding representation; The temporal dependency modeling result is integrated with the node embedding representation to output a secondary risk determination result.

5. The POS machine transaction risk identification method according to claim 1, characterized in that: The step of extracting multi-dimensional features includes: Discretize the transaction amount into segments to generate amount distribution characteristics; Extract the hourly periodicity and date fluctuation patterns of transaction time and construct time series statistical features; Generate merchant association features based on the hierarchical classification code of merchant types; Exponential smoothing is performed on the operation interval and input frequency in user behavior data to generate a behavior stability index.

6. The POS machine transaction risk identification method according to claim 5, characterized in that: The step of dynamic time segmentation also includes: Adaptively adjust the length of the sliding time window based on the transaction frequency, where the window length is shortened to a first preset threshold in high-frequency transaction scenarios and extended to a second preset threshold in low-frequency transaction scenarios; The cosine weighting strategy is used to smooth the features of the transaction data in the overlapping window area.

7. The POS machine transaction risk identification method according to claim 2, characterized in that: The step of spatial matching includes: Convert the transaction location into longitude and latitude coordinates and use the ray method to compare it with the polygonal areas in the high-risk area map; The dynamic geographic risk coefficient is calculated based on the number of times and duration that the transaction coordinates fall into the high-risk area.

8. The POS machine transaction risk identification method according to claim 1, wherein: The similarity calculation between the device fingerprint information and the historical abnormal device database adopts the improved Jaccard algorithm, which specifically includes: Extract hardware identification, operating system version and network protocol features from device fingerprints; Hash encoding of hardware identifiers, semantic version comparison of operating system versions, and protocol field similarity calculation of network protocol features; The hash code difference, version comparison result and protocol field similarity are weightedly integrated to generate a device anomaly index.

9. The POS machine transaction risk identification method according to claim 4, characterized in that: The steps of constructing the dynamic heterogeneous graph structure include: User nodes and merchant nodes are used as vertices, and transaction frequency and amount are used as edge weights; Dynamically update edge weights based on a transaction time decay function, where recent transactions are given higher weights; Add virtual edges to isolated nodes and connect them to historically high-risk nodes to avoid information islands.

10. The POS machine transaction risk identification method according to claim 1, wherein: The triggering logic of the real-time risk disposal instruction includes: If the secondary risk assessment result is high risk, the current transaction will be frozen and a verification request will be sent to the user terminal; If the user terminal does not respond within the preset time, a risk warning log will be automatically generated and the associated account will be marked; The risk warning log is synchronized to the distributed risk database, and a cross-platform risk joint defense mechanism is triggered.

Images