Abnormal transaction prevention and control method and device, computer equipment and readable storage medium

Abstract

The invention discloses an abnormal transaction prevention and control method and device, computer equipment and a readable storage medium, relates to the field of artificial intelligence and financial science and technology, and can realize real-time monitoring and prevention and control of abnormal transaction behaviors. The method comprises the steps of obtaining a plurality of historical transaction behaviors of a target user, constructing a historical transaction behavior model, and adjusting an abnormal threshold value based on spatial-temporal feature distribution of the historical transaction behavior model; obtaining a to-be-detected transaction behavior, determining a current transaction scene, and adjusting an abnormal threshold according to the transaction scene; based on a preset abnormal transaction detection model, comparing the transaction characteristics of the to-be-detected transaction behavior with a historical transaction behavior model, generating an abnormal score, and comparing the abnormal score with the adjusted abnormal threshold value to determine a detection result; and if the detection result indicates that the to-be-detected transaction behavior is an abnormal transaction, determining a risk level of the to-be-detected transaction behavior, and executing a prevention and control strategy corresponding to the risk level.

Description

Technical Field

[0001] The present application relates to the fields of artificial intelligence and financial technology, and in particular to a method, apparatus, computer equipment and readable storage medium for preventing and controlling abnormal transactions. Background Art

[0002] With the large-scale application and diversified development of electronic payments, the risk of account theft has become increasingly hidden. Attackers often use a progressive attack strategy of "small-amount probing followed by large-amount transfers," utilizing techniques such as virtual proxies and IP redirection to evade detection, creating blind spots in traditional risk control systems.

[0003] In related technologies, mainstream risk prevention and control systems primarily rely on static rule engines (such as single amount thresholds and fixed time period restrictions) and basic statistical analysis models. The updates to their detection rule bases lag behind the iteration rate of fraudulent methods, and threshold settings based on group behavior statistics are difficult to adapt to individual user transaction patterns. Therefore, there is an urgent need for an abnormal transaction prevention and control method that can identify abnormal transaction behavior in real time and implement corresponding prevention and control measures. Summary of the Invention

[0004] In view of this, the present application provides a method, apparatus, computer equipment and readable storage medium for abnormal transaction prevention and control. The main purpose is to solve the problem that mainstream risk prevention and control systems mainly rely on static rule engines (such as single amount thresholds, fixed time period restrictions) and basic statistical analysis models, making it difficult to accurately identify abnormal transaction behaviors.

[0005] According to the first aspect of the present application, a method for preventing and controlling abnormal transactions is provided, the method comprising:

[0006] Obtaining multiple historical transaction behaviors of the target user, identifying the multiple historical transaction behaviors using a clustering algorithm and a time series analysis algorithm, constructing a historical transaction behavior model, and adjusting anomaly thresholds based on the spatiotemporal feature distribution of the historical transaction behavior model, wherein the historical transaction behavior model indicates the spatiotemporal feature distribution of historical transactions corresponding to each historical transaction pattern;

[0007] In response to a transaction request initiated by the target user, obtaining a transaction behavior to be detected, determining a current transaction scenario, and adjusting the abnormality threshold according to the transaction scenario;

[0008] Based on a preset abnormal transaction detection model, the transaction characteristics of the transaction behavior to be detected are compared with the historical transaction behavior model to generate an abnormality score, and the abnormality score is compared with the adjusted abnormality threshold to determine a detection result. The transaction behavior to be detected is associated with the detection result and stored as historical transaction behavior in a preset storage space;

[0009] If the detection result indicates that the transaction behavior to be detected is an abnormal transaction, the risk level of the transaction behavior to be detected is determined, and a prevention and control strategy corresponding to the risk level is executed.

[0010] According to a second aspect of the present application, there is provided an abnormal transaction prevention and control device, the device comprising:

[0011] A construction module is configured to obtain multiple historical transaction behaviors of a target user, identify the multiple historical transaction behaviors using a clustering algorithm and a time series analysis algorithm, construct a historical transaction behavior model, and adjust an anomaly threshold based on the spatiotemporal feature distribution of the historical transaction behavior model, wherein the historical transaction behavior model indicates the spatiotemporal feature distribution of historical transactions corresponding to each historical transaction pattern;

[0012] an acquisition module, configured to respond to a transaction request initiated by the target user, acquire the transaction behavior to be detected, determine the current transaction scenario, and adjust the abnormality threshold according to the transaction scenario;

[0013] a determination module configured to compare, based on a preset abnormal transaction detection model, the transaction characteristics of the transaction behavior to be detected with the historical transaction behavior model and generate an anomaly score, and to compare the anomaly score with an adjusted anomaly threshold to determine a detection result, associate the transaction behavior to be detected with the detection result, and store the result as historical transaction behavior in a preset storage space;

[0014] The prevention and control module is used to determine the risk level of the transaction behavior to be detected and execute the prevention and control strategy corresponding to the risk level if the detection result indicates that the transaction behavior to be detected is an abnormal transaction.

[0015] According to a third aspect of the present application, a computer device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0016] According to a fourth aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0017] By leveraging the above-mentioned technical solution, the present application provides a method, apparatus, computer device, and readable storage medium for preventing and controlling abnormal transactions. The present application first obtains multiple historical transaction behaviors of a target user, identifies these historical transaction behaviors using a clustering algorithm and a time series analysis algorithm, and constructs a historical transaction behavior model. The anomaly threshold is then adjusted based on the spatiotemporal feature distribution of the historical transaction behavior model, where the historical transaction behavior model indicates the spatiotemporal feature distribution of historical transactions corresponding to each historical transaction pattern. Next, in response to a transaction request initiated by the target user, the transaction behavior to be detected is obtained, the current transaction scenario is determined, and the anomaly threshold is adjusted based on the transaction scenario. Furthermore, based on a preset abnormal transaction detection model, the transaction features of the transaction to be detected are compared with the historical transaction behavior model to generate an anomaly score. The anomaly score is then compared with the adjusted anomaly threshold to determine a detection result. Finally, if the detection result indicates that the transaction to be detected is abnormal, the risk level of the transaction to be detected is determined, and a prevention and control strategy corresponding to the risk level is implemented. By integrating a clustering algorithm with time series analysis to construct a user transaction behavior model, adaptive modeling of the spatiotemporal feature distribution of historical transactions is achieved, accurately characterizing the multi-dimensional user behavior patterns. In addition, the dynamic abnormality threshold adjustment mechanism combined with real-time transaction scenario perception improves the detection sensitivity of high-risk scenarios and reduces the misjudgment rate of normal transactions.

[0018] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present application. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0020] Figure 1 A schematic diagram of a method for preventing and controlling abnormal transactions provided in an embodiment of the present application is shown;

[0021] Figure 2 A schematic diagram of another abnormal transaction prevention and control method provided in an embodiment of the present application is shown;

[0022] Figure 3 A schematic diagram of the structure of an abnormal transaction prevention and control system provided in an embodiment of the present application is shown;

[0023] Figure 4A schematic diagram of the device structure of a computer device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0024] The following describes in detail embodiments of the present application, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and are not to be construed as limiting the present application.

[0025] Those skilled in the art will understand that, unless otherwise stated, the singular forms "a," "an," "said," and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of this application refers to the presence of the stated features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0026] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in common dictionaries should be understood to have meanings consistent with their meanings in the context of the prior art and will not be interpreted in an idealized or overly formal sense unless specifically defined as herein.

[0027] Those skilled in the art will appreciate that the term "terminal" as used herein includes both devices that are wireless signal receivers, i.e., devices that only have wireless signal receivers without transmission capabilities, and devices that have receiving and transmitting hardware capable of performing two-way communication over a two-way communication link. Such devices may include: cellular or other communication devices with single-line displays, multi-line displays, or cellular or other communication devices without multi-line displays; PCS (Personal Communications Service) devices that may combine voice, data processing, fax, and / or data communication capabilities; PDAs (Personal Digital Assistants) that may include a radio frequency receiver, a pager, Internet / Intranet access, a web browser, a notepad, a calendar, and / or a GPS (Global Positioning System) receiver; and conventional laptop and / or palmtop computers or other devices that have and / or include a radio frequency receiver. As used herein, a "terminal" may be portable, transportable, installed in a vehicle (air, sea, and / or land), or adapted and / or configured to operate locally, and / or in a distributed manner, at any other location on Earth and / or in space. As used herein, a "terminal" may also be a communication terminal, an Internet access terminal, or a music / video playback terminal, such as a PDA, an MID (Mobile Internet Device), and / or a mobile phone with music / video playback capabilities, or a device such as a smart TV or a set-top box.

[0028] The abnormal transaction prevention and control method provided in the embodiments of this application can be applied to a transaction prevention and control system. The system can obtain real-time user transaction behavior and compare the characteristics of the real-time transaction behavior with the characteristics of the user's normal transaction behavior to determine whether the transaction is abnormal. If the transaction behavior is abnormal, the system determines the risk level of the transaction behavior and implements corresponding prevention and control measures based on the risk level.

[0029] Transaction behavior refers to the transaction operation records generated by users during the payment process, including transaction time, transaction funds, transaction location, transaction type, payee information, login device, etc., which are used to analyze users' payment habits and build personalized behavior patterns.

[0030] Abnormal transaction behavior is behavior that significantly deviates from a user's historical transaction patterns, such as large transfers at unusual times (such as early morning), transactions with unfamiliar recipients, and high-frequency operations in different locations. Abnormal transaction behavior will trigger a risk warning mechanism to prevent account theft.

[0031] This application embodiment provides a method for preventing and controlling abnormal transactions. Figure 1 As shown, the method includes:

[0032] S10. Obtain multiple historical transaction behaviors of the target user, use a clustering algorithm and a time series analysis algorithm to identify the multiple historical transaction behaviors, construct a historical transaction behavior model, and adjust the abnormality threshold based on the spatiotemporal feature distribution of the historical transaction behavior model. The historical transaction behavior model is used to indicate the spatiotemporal feature distribution of historical transactions corresponding to each historical transaction pattern.

[0033] In an embodiment of the present application, the transaction prevention and control system can obtain multiple historical transaction behaviors of the target user in a preset storage space. Taking into account that users' transaction habits will change in different time periods, for example, a few years ago, when users were in school, their transaction amounts were mostly small, and the transaction locations were concentrated near the school. A few years later, when users were working, their transaction amounts would increase compared to when they were in school, and the transaction locations might be scattered around the office area and the place of residence. Therefore, the system can set the transaction time limit to be obtained, and select transaction behavior data within a time period of one year, half a year, or three months to ensure the timeliness and accuracy of the model. Historical transaction behaviors include but are not limited to transaction time, transaction amount, transaction location, transaction frequency, transaction type, and payee information.

[0034] Further, if Figure 2 As shown, steps S11 to S13 below use clustering and time series analysis algorithms to identify multiple historical transaction behaviors and construct a historical transaction behavior model. This historical transaction behavior model can reflect the transaction characteristics of users in different time periods, including the behavioral characteristics of normal and abnormal transactions. By comparing real-time transactions with the model characteristics, the system can accurately identify anomalies, provide timely warnings, and effectively prevent risks. Simultaneously, thresholds are dynamically adjusted to adapt to changes in user behavior, improving prevention and control accuracy and ensuring transaction security.

[0035] S11. Cluster multiple historical transaction behaviors based on the K-Means clustering algorithm.

[0036] In this step, the system first classifies multiple historical transaction behaviors based on the K-Means clustering algorithm to obtain clustering results. Each clustering result indicates a transaction pattern, which includes but is not limited to daily consumption, large-value transfers, and high-frequency small-value payments. Specifically, the system first extracts features from historical transaction behaviors. During actual operation, before feature extraction, the system can use a predefined rule engine or supervised learning classification model to preliminarily classify transaction behaviors into two categories: normal transaction behaviors and abnormal transaction behaviors. Feature extraction is then performed on normal and abnormal transaction behaviors respectively, and the extracted transaction features are clustered to generate multiple classification clusters. The center point features of each classification cluster are extracted to obtain clustering results. The clustering results include clustering results for normal transaction behaviors and clustering results for abnormal transaction behaviors. The criteria for determining normal transaction behavior include but are not limited to transaction time that matches the user's historical active period, transaction amount that falls within the user's regular consumption range, payee being a bound or high-frequency transaction partner, and geographic location that is consistent with the user's frequently used area. Abnormal transaction behavior refers to abnormal transaction behavior indicated by the detection results, including but not limited to transaction time deviating from the user's typical behavior (such as sudden operations in the early morning hours), transaction amount significantly exceeding the historical average, the recipient being an unrelated unfamiliar account, and geographical location jumping across regions.

[0037] It is understandable that in actual operation, the feature data can be preprocessed by Z-score standardization or minimum-maximum normalization method to eliminate the impact of dimensional differences on clustering results.

[0038] For example, the system can set an initial number of clusters, K, and then calculate the similarity between feature vectors based on Euclidean distance, iteratively optimizing the location of cluster centers. After the algorithm converges, it outputs multiple classification clusters, each representing a specific transaction pattern (e.g., "daily consumption," "large transfers," "high-frequency small payments"). The feature vector of the center point of each classification cluster is further extracted as a typical representation of that transaction pattern.

[0039] It is understandable that the system can periodically re-execute the clustering process based on the user's newly added transaction data and adaptively update the transaction pattern library to reflect the temporal evolution characteristics of user behavior.

[0040] Through phased pre-classification and refined clustering, this method significantly improves the sensitivity of identifying hidden abnormal trading patterns. A dynamic update mechanism also ensures the model's adaptability to changes in user behavior. The generated cluster center features can be directly used as a benchmark reference for risk warning systems, optimizing the accuracy of risk assessment and response efficiency.

[0041] S12. Model multiple historical trading behaviors based on time series analysis algorithms.

[0042] In this step, the system uses multidimensional time series modeling techniques to refine the spatiotemporal characteristics of transaction behavior within each cluster generated by K-Means clustering, thereby constructing a historical behavioral benchmark for the target user under a specific trading pattern. Specifically, for each cluster's transaction behavior, an autoregressive integrated moving average (ARIMA) model can be used to output periodic prediction intervals for intra-cluster transactions (such as confidence intervals for daily transaction frequency and fluctuation ranges for weekly transaction amounts). Alternatively, a long-short-term memory (LSTM) neural network can be used to capture key timing nodes and output dynamic behavioral trajectories for intra-cluster transactions.

[0043] For example, the system can also perform a weighted fusion of the periodic prediction results of the ARIMA model and the dynamic trajectory prediction results of the LSTM network to generate a joint spatiotemporal feature matrix as a model of historical trading behavior. This fusion result not only improves prediction accuracy but also enhances the model's sensitivity to sudden anomalies, ensuring that the risk warning system can promptly identify potential risks in complex trading scenarios and provide users with more accurate security protection.

[0044] S13. Adjust the anomaly threshold based on the spatiotemporal characteristic distribution of the historical trading behavior model.

[0045] In this step, the historical transaction behavior model includes a normal transaction behavior model and an abnormal transaction behavior model. The system can determine whether a user has abnormal transaction behavior by judging whether the abnormal transaction behavior model exists. Furthermore, if the target user is determined to have abnormal transaction behavior, a threshold boost coefficient is calculated based on the transaction feature distribution of the abnormal transaction behavior. The abnormal threshold is adjusted by multiplying the threshold boost coefficient with the abnormal threshold to obtain an optimized abnormal threshold. Specifically, the system can determine the abnormal transaction characteristics of the abnormal transaction behavior, determine the threshold boost coefficient and weight associated with the abnormal transaction characteristics, perform a weighted sum of the threshold boost coefficients associated with all abnormal transaction characteristics to obtain a final threshold boost coefficient, and calculate the product of the threshold boost coefficient and the abnormal threshold to obtain the optimized abnormal threshold. For example, the abnormal transaction features corresponding to abnormal transaction behavior are abnormal amount, abnormal geographic location, and abnormal time. The threshold boost coefficient corresponding to the amount is 0.3 with a weight of 0.3, the threshold boost coefficient corresponding to the geographic location is 0.2 with a weight of 0.1, and the threshold boost coefficient corresponding to time is 0.3 with a weight of 0.2. The weighted summation results in a final threshold boost coefficient of 0.17, an initial abnormal threshold of 0.7, and an optimized abnormal threshold of 0.819.

[0046] S20. In response to a transaction request initiated by a target user, obtain the transaction behavior to be detected, determine the current transaction scenario, and adjust the abnormality threshold according to the transaction scenario.

[0047] In this step, the system identifies whether the transaction scenario under investigation falls within a pre-defined special scenario. Special scenarios are used to indicate scenarios exhibiting unusual characteristics or collective behavior patterns. Based on the detected scenario type, the system automatically selects the appropriate risk assessment strategy. For example, during shopping festivals, due to a surge in transaction volume, the system may lower the threshold for certain unusual transaction characteristics to prevent misjudgments and ensure smooth transactions. In everyday transactions, more stringent detection measures are implemented to prevent fraudulent activity. Through this flexible adjustment mechanism, the system balances user experience and transaction security, enhancing overall risk management capabilities.

[0048] Furthermore, if the current transaction scenario falls into a pre-set special scenario category, the threshold adjustment coefficient corresponding to the special scenario is determined. The threshold adjustment coefficient is then multiplied by the optimized anomaly threshold to adjust the anomaly threshold, resulting in the adjusted anomaly threshold. For example, assuming the threshold adjustment coefficient during a shopping festival is -0.6 and the optimized anomaly threshold is 0.819, the adjusted anomaly threshold will become 0.7371. Thus, during the shopping festival, the system will adopt a more relaxed standard for determining abnormal transaction behavior to accommodate normal transaction needs in a high-volume environment. Conversely, in daily transactions, if no special scenario triggers, the optimized anomaly threshold is directly used for risk assessment.

[0049] S30. Based on a preset abnormal transaction detection model, the transaction characteristics of the transaction behavior to be detected are compared with the historical transaction behavior model, and an anomaly score is generated. The anomaly score is also compared with the adjusted anomaly threshold to determine the detection result.

[0050] In an embodiment of the present application, the system detects the transaction features of the transaction behavior to be detected based on the pre-trained abnormal transaction detection model by executing the following steps S31 to S35 and generates an anomaly score. Whether the transaction behavior is abnormal is confirmed based on the anomaly score. Specifically, if the generated anomaly score exceeds or equals the adjusted anomaly threshold, the transaction behavior is judged to be abnormal, and the system will initiate corresponding risk response measures, such as freezing the account, sending early warning notifications to users and security teams, etc. On the contrary, if the anomaly score is lower than the threshold, it is regarded as a normal transaction, and the system allows the transaction to continue. In this way, the system can not only detect and handle abnormal transaction behaviors in a timely manner, but also protect the legitimate rights and interests of users and maintain the stable operation of the financial market.

[0051] S31. Extract multi-dimensional transaction features from the transaction behavior to be detected. The multi-dimensional transaction features include but are not limited to transaction time, transaction amount, transaction location, transaction frequency, transaction type, and payee information.

[0052] S32. Input the multi-dimensional transaction features into the trained abnormal transaction detection model, compare the transaction features of the transaction behavior to be detected with the historical transaction behavior model, and generate an abnormality score.

[0053] The abnormal transaction detection model is at least one of the Isolation Forest model, XGBoost model, and Random Forest model. The transaction time is accurately timestamped to the millisecond level, converted to the user's local time zone, and marked with weekday / holiday identifiers. The deviation from the historical active time period is calculated (Z-Score normalization). Dynamic discretization is performed based on the percentile distribution (P95) of the user's historical transaction amount to generate low / medium / high / ultra-high risk intervals. GPS coordinates are converted to Geohash-8-bit codes, and the Havshin distance to the permanent residence (based on DBSCAN clustering) is calculated to match the high-risk regional database. The transaction frequency in the past 1 hour, 24 hours, and 7 days is counted, and the moving average ratio with the historical data of the same period is calculated. A user-payee transaction map is constructed, and the payee's trust score is calculated (based on historical transaction frequency, amount stability, and associated merchant types).

[0054] S321. Input the multi-dimensional transaction features into the trained Isolation Forest model, compare the transaction features of the transaction behavior to be detected with the historical transaction behavior model, and generate an anomaly score.

[0055] In this step, if the abnormal transaction detection model is an Isolation Forest model, the multidimensional transaction feature vector is input into the trained abnormal transaction detection model. Within each isolated tree, the path length from the root node to the isolated leaf node of the transaction is calculated. All isolated trees are traversed, the average path length is calculated, and the average path length is mapped to the interval [0, 1] to obtain an anomaly score. For example, if a user's historical transactions are primarily concentrated during the daytime on weekdays (8:00 AM to 8:00 PM), and a transaction occurs at 3:00 AM, with an amount far exceeding the user's historical transaction average, the Isolation Forest model will calculate an anomaly score for this transaction and mark it as "abnormal transaction." The reasons for this may be "abnormal transaction time" and "abnormal transaction amount."

[0056] S322. Input the multi-dimensional transaction features into the trained XGBoost model, compare the transaction features of the transaction behavior to be detected with the historical transaction behavior model, and generate an anomaly score.

[0057] In this step, the XGBoost model builds a multi-layer decision tree structure and uses the nonlinear mapping relationship of the gradient boosted decision tree to output the probability value of the transaction being predicted as an anomaly. The probability value is then compressed to the range [0, 1] using the Sigmoid function to obtain the anomaly score. Suppose that in a user's historical transaction data, abnormal transactions often occur late at night and involve large amounts. The XGBoost model learns these characteristics and makes predictions for new transactions. If a transaction occurs in the early morning and the amount far exceeds the user's historical average, the model predicts it as an abnormal transaction and identifies the reason.

[0058] S323. Input the multi-dimensional transaction features into the trained Random Forest model, compare the transaction features of the transaction behavior to be detected with the historical transaction behavior model, and generate an anomaly score.

[0059] In this step, the multidimensional transaction features are fed into the trained Random Forest model. The model traverses all decision trees, determines their classification results, and calculates the percentage of trees classified as anomalous. This percentage is then mapped to the interval [0, 1] to obtain an anomaly score. Assume that in a user's historical transaction data, anomalous transactions often occur in locations the user has never visited. The Random Forest model learns these features and makes predictions for new transactions. If a transaction occurs in a location the user has never visited, the model predicts it as an anomalous transaction and labels the reason.

[0060] S33. Compare the mapped anomaly score with the adjusted anomaly threshold to generate a detection result. In this step, if the comparison result indicates that the mapped anomaly score is greater than or equal to the anomaly threshold, a detection result is generated indicating that the transaction under test is an abnormal transaction. If the comparison result indicates that the anomaly score is less than the anomaly threshold, a detection result is generated indicating that the transaction under test is a normal transaction. The transaction under test is associated with the detection result and stored as historical transaction behavior in a preset storage space.

[0061] S40. If the detection result indicates that the transaction behavior to be detected is an abnormal transaction, the risk level of the transaction behavior to be detected is determined, and a prevention and control strategy corresponding to the risk level is executed.

[0062] In this step, if the detection result indicates that the transaction is abnormal, the transaction is determined to be abnormal and a risk score for the transaction is determined. If the risk score is below the first scoring threshold, the transaction is assigned a first risk level and the first control strategy corresponding to the first risk level is implemented, which is logging. If the risk score is greater than or equal to the first scoring threshold and less than the second scoring threshold, the transaction is assigned a second risk level and the second control strategy corresponding to the second risk level is implemented, which is transaction notification confirmation. If the risk score is greater than or equal to the second scoring threshold, the transaction is assigned a third risk level and the third control strategy corresponding to the third risk level is implemented, which is multi-factor authentication. Multi-factor authentication can include SMS authentication and biometric authentication. It should be noted that multi-factor authentication can select an authentication combination based on device trustworthiness. For example, a trusted device can use SMS plus facial recognition, while an untrusted device can use voiceprint plus dynamic password. A cross-institutional fund lockup period is initiated for high-risk transactions. The balance of suspicious receiving accounts is frozen through smart contracts. After the freeze is lifted, security reinforcement recommendations are provided, such as device binding management and transaction limit setting guidance.

[0063] It should be noted that if the user passes the relevant prevention and control measures, the transaction will be approved and marked, and the detection result of the transaction will be modified. If the user fails, the account will be immediately frozen to prevent further risks.

[0064] The method provided in the embodiment of the present application first obtains multiple historical transaction behaviors of the target user, uses a clustering algorithm and a time series analysis algorithm to identify the multiple historical transaction behaviors, and constructs a historical transaction behavior model. Then, based on the spatiotemporal feature distribution of the historical transaction behavior model, the abnormality threshold is adjusted, wherein the historical transaction behavior model is used to indicate the spatiotemporal feature distribution of historical transactions corresponding to each historical transaction pattern. Next, in response to the transaction request initiated by the target user, the transaction behavior to be detected is obtained, and the current transaction scenario is determined, and the abnormality threshold is adjusted according to the transaction scenario. Furthermore, based on the preset abnormal transaction detection model, the transaction characteristics of the transaction behavior to be detected are compared with the historical transaction behavior model, and an abnormality score is generated, and the abnormality score is compared with the adjusted abnormality threshold to determine the detection result. Finally, if the detection result indicates that the transaction behavior to be detected is an abnormal transaction, the risk level of the transaction behavior to be detected is determined, and the prevention and control strategy corresponding to the risk level is executed. By integrating the clustering algorithm and time series analysis to construct a user transaction behavior model, adaptive modeling of the spatiotemporal feature distribution of historical transactions is achieved, and the multi-dimensional behavior pattern of users is accurately portrayed. In addition, the dynamic abnormality threshold adjustment mechanism combined with real-time transaction scenario perception improves the detection sensitivity of high-risk scenarios and reduces the misjudgment rate of normal transactions.

[0065] Further, as Figure 1 The specific implementation of the method, the embodiment of the present application provides an abnormal transaction prevention and control device, such as Figure 3 As shown, the device includes: a construction module 301, an acquisition module 302, a determination module 303, and a prevention and control module 304.

[0066] The construction module 301 is used to obtain multiple historical transaction behaviors of the target user, identify the multiple historical transaction behaviors using a clustering algorithm and a time series analysis algorithm, construct a historical transaction behavior model, and adjust the abnormality threshold based on the spatiotemporal feature distribution of the historical transaction behavior model. The historical transaction behavior model is used to indicate the spatiotemporal feature distribution of historical transactions corresponding to each historical transaction pattern.

[0067] The acquisition module 302 is configured to respond to a transaction request initiated by the target user, acquire the transaction behavior to be detected, determine the current transaction scenario, and adjust the abnormality threshold according to the transaction scenario;

[0068] The determination module 303 is configured to compare the transaction characteristics of the transaction behavior to be detected with the historical transaction behavior model based on a preset abnormal transaction detection model, generate an abnormality score, compare the abnormality score with the adjusted abnormality threshold, determine a detection result, associate the transaction behavior to be detected with the detection result, and store the result as a historical transaction behavior in a preset storage space;

[0069] The prevention and control module 304 is configured to determine a risk level of the transaction behavior to be detected and execute a prevention and control strategy corresponding to the risk level if the detection result indicates that the transaction behavior to be detected is an abnormal transaction.

[0070] In a specific application scenario, the construction module 301 is used to obtain multiple historical transaction behaviors corresponding to the target user, and the historical transaction behaviors include but are not limited to transaction time, transaction amount, transaction location, transaction frequency, transaction type and payee information; based on the K-Means clustering algorithm, multiple historical transaction behaviors are extracted, and the extracted transaction features are clustered to generate multiple classification clusters, and the center point features of each classification cluster are extracted to obtain clustering results, wherein each classification cluster indicates a transaction pattern, and the transaction pattern includes but is not limited to daily consumption, large-value transfers and high-frequency small-value payments; the transaction features corresponding to each classification cluster are analyzed using time series, and each historical transaction behavior is modeled to determine the historical transaction spatiotemporal features of the target user under the transaction pattern corresponding to each classification cluster, and obtain the historical transaction behavior model.

[0071] In a specific application scenario, the construction module 301 is used to determine whether the target user has abnormal transaction behavior based on a historical transaction behavior model; if it is determined that the target user has abnormal transaction behavior, the threshold boost coefficient is calculated based on the transaction feature distribution of the abnormal transaction behavior, and the product between the threshold boost coefficient and the abnormal threshold is used to adjust the abnormal threshold to obtain an optimized abnormal threshold.

[0072] In a specific application scenario, the acquisition module 302 is used to identify whether the transaction scenario belongs to a preset special scenario, and the special scenario is used to indicate a scenario with abnormal characteristics or collective behavior patterns; if the current transaction scenario belongs to the preset special scenario category, the threshold adjustment coefficient corresponding to the special scenario is determined, and the product of the threshold adjustment coefficient and the optimized abnormal threshold is used to adjust the abnormal threshold to obtain the adjusted abnormal threshold.

[0073] In a specific application scenario, the determination module 303 is used to extract multidimensional transaction features from the transaction behavior to be detected, wherein the multidimensional transaction features include but are not limited to transaction time, transaction amount, transaction location, transaction frequency, transaction type, and payee information; input the multidimensional transaction features into the trained abnormal transaction detection model, compare the transaction features of the transaction behavior to be detected with the historical transaction behavior model, and generate an anomaly score, wherein the abnormal transaction detection model is at least one of an isolation forest model, a gradient boosting decision tree XGBoost model, and a random forest model; compare the mapped anomaly score with the adjusted anomaly threshold; if the comparison result indicates that the mapped anomaly score is greater than or equal to the anomaly threshold, then generate a detection result indicating that the transaction behavior to be detected is an abnormal transaction.

[0074] In a specific application scenario, when the abnormal transaction detection model is an Isolation Forest model, the determination module 303 is configured to input the multidimensional transaction features into the trained abnormal transaction detection model, traverse all isolated trees, and calculate the path depth of the transaction from the root node to the isolated leaf node in each tree. The anomaly score is calculated based on the average path length of all trees, and the anomaly score is mapped to the interval [0, 1]. When the abnormal transaction detection model is an XGBoost model, the multidimensional transaction features are input into the trained abnormal transaction detection model, and through the nonlinear mapping relationship of the gradient boosting decision tree, the probability value of the transaction being predicted as an abnormal category is output. The probability value is compressed to the interval [0, 1] using a Sigmoid function to obtain the anomaly score. When the abnormal transaction detection model is a Random Forest model, the multidimensional transaction features are input into the trained abnormal transaction detection model, and all decision trees are traversed to calculate the percentage of trees determined to be abnormal. The percentage is mapped to the interval [0, 1] to obtain the anomaly score.

[0075] In a specific application scenario, the prevention and control module 304 is used to determine that the transaction is an abnormal transaction if the detection result indicates that the transaction behavior to be detected is an abnormal transaction, and determine the risk score of the transaction behavior; if the risk score is lower than the first scoring threshold, the risk level of the transaction behavior is determined to be the first risk level, and the first prevention and control strategy corresponding to the first risk level is executed, and the first prevention and control strategy is log recording; if the risk score is higher than or equal to the first scoring threshold and lower than the second scoring threshold, the risk level of the transaction behavior is determined to be the second risk level, and the second prevention and control strategy corresponding to the second risk level is executed, and the second prevention and control strategy is transaction notification confirmation; if the risk score is higher than or equal to the second scoring threshold, the risk level of the transaction behavior is determined to be the third risk level, and the third prevention and control strategy corresponding to the third risk level is executed, and the third prevention and control strategy is multi-factor authentication, and the multi-factor authentication includes SMS authentication and biometric authentication.

[0076] The device provided in the embodiment of the present application first obtains multiple historical transaction behaviors of the target user, uses a clustering algorithm and a time series analysis algorithm to identify the multiple historical transaction behaviors, and constructs a historical transaction behavior model. Then, based on the spatiotemporal feature distribution of the historical transaction behavior model, the abnormality threshold is adjusted, wherein the historical transaction behavior model is used to indicate the spatiotemporal feature distribution of historical transactions corresponding to each historical transaction pattern. Next, in response to the transaction request initiated by the target user, the transaction behavior to be detected is obtained, and the current transaction scenario is determined, and the abnormality threshold is adjusted according to the transaction scenario. Furthermore, based on the preset abnormal transaction detection model, the transaction characteristics of the transaction behavior to be detected are compared with the historical transaction behavior model, and an abnormality score is generated, and the abnormality score is compared with the adjusted abnormality threshold to determine the detection result. Finally, if the detection result indicates that the transaction behavior to be detected is an abnormal transaction, the risk level of the transaction behavior to be detected is determined, and the prevention and control strategy corresponding to the risk level is executed. By integrating the clustering algorithm and time series analysis to construct a user transaction behavior model, adaptive modeling of the spatiotemporal feature distribution of historical transactions is achieved, and the multi-dimensional behavior pattern of users is accurately portrayed. In addition, the dynamic abnormality threshold adjustment mechanism combined with real-time transaction scenario perception improves the detection sensitivity of high-risk scenarios and reduces the misjudgment rate of normal transactions.

[0077] It should be noted that for other corresponding descriptions of the functional units involved in the copper smelting slag slow cooling field scheduling device provided in the embodiment of the present application, please refer to Figure 1 and Figure 2 The corresponding description in will not be repeated here.

[0078] To solve the above technical problems, the embodiment of the present invention also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0079] like Figure 4 As shown, a schematic diagram of the internal structure of a computer device. The computer device includes a processor, a non-volatile storage medium, a memory and a network interface connected via a system bus. Among them, the non-volatile storage medium of the computer device stores an operating system, a database and computer-readable instructions, and the database may store a control information sequence. When the computer-readable instructions are executed by the processor, the processor can implement a data relationship reconstruction method. The processor of the computer device is used to provide computing and control capabilities to support the operation of the entire computer device. The memory of the computer device may store computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor can execute a data relationship reconstruction method. The network interface of the computer device is used to connect and communicate with the terminal. Those skilled in the art will understand that Figure 4The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0080] In this embodiment, the processor is used to execute Figure 3 The memory stores the program code and various data required to execute the specific functions of the construction module 301, acquisition module 302, determination module 303, and prevention and control module 304. The network interface is used to transmit data between user terminals or servers. The memory in this embodiment stores the program code and data required to execute all submodules in the data relationship reconstruction device. The server can call the server's program code and data to execute the functions of all submodules.

[0081] The present invention also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the data relationship reconstruction method in any of the above embodiments.

[0082] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When executed, the program can include the processes in the above-described method embodiments. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0083] The present invention also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the data relationship reconstruction method in any of the above embodiments.

[0084] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When executed, the program can include the processes in the above-described method embodiments. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0085] Those skilled in the art will appreciate that the steps, measures, and schemes in the various operations, methods, and processes discussed in this application may be interchanged, modified, combined, or deleted. Furthermore, other steps, measures, and schemes in the various operations, methods, and processes discussed in this application may also be interchanged, modified, rearranged, decomposed, combined, or deleted. Furthermore, steps, measures, and schemes in the prior art that are similar to those disclosed in this application may also be interchanged, modified, rearranged, decomposed, combined, or deleted.

[0086] The above description is only part of the implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for preventing and controlling abnormal transactions, characterized in that: include: Obtaining multiple historical transaction behaviors of the target user, identifying the multiple historical transaction behaviors using a clustering algorithm and a time series analysis algorithm, constructing a historical transaction behavior model, and adjusting anomaly thresholds based on the spatiotemporal feature distribution of the historical transaction behavior model, wherein the historical transaction behavior model indicates the spatiotemporal feature distribution of historical transactions corresponding to each historical transaction pattern; In response to a transaction request initiated by the target user, obtaining a transaction behavior to be detected, determining a current transaction scenario, and adjusting the abnormality threshold according to the transaction scenario; Based on a preset abnormal transaction detection model, the transaction characteristics of the transaction behavior to be detected are compared with the historical transaction behavior model to generate an abnormality score, and the abnormality score is compared with the adjusted abnormality threshold to determine a detection result. The transaction behavior to be detected is associated with the detection result and stored as historical transaction behavior in a preset storage space; If the detection result indicates that the transaction behavior to be detected is an abnormal transaction, the risk level of the transaction behavior to be detected is determined, and a prevention and control strategy corresponding to the risk level is executed.

2. The method according to claim 1, characterized in that The acquiring of the historical transaction behaviors of the target user, clustering the historical transaction behaviors using a clustering algorithm, determining the historical transaction patterns of the target user, and modeling the target user's transaction behaviors using time series analysis to obtain a historical transaction behavior model includes: Obtain multiple historical transaction behaviors corresponding to the target user, including but not limited to transaction time, transaction amount, transaction location, transaction frequency, transaction type, and payee information; Using the K-Means clustering algorithm, we extract features from multiple historical transaction behaviors and cluster the extracted transaction features to generate multiple clusters. We then extract the center point features of each cluster to obtain clustering results. Each cluster indicates a transaction pattern, which includes but is not limited to daily consumption, large-value transfers, and high-frequency small-value payments. Use time series analysis to analyze the transaction features corresponding to each classification cluster, model each historical transaction behavior, determine the historical transaction spatiotemporal features of the target user under the transaction mode corresponding to each classification cluster, and obtain the historical transaction behavior model.

3. The method according to claim 1, characterized in that The adjusting the abnormality threshold based on the historical transaction behavior model includes: Based on the historical transaction behavior model, determine whether the target user has abnormal transaction behavior; If it is determined that the target user has abnormal transaction behavior, a threshold boost coefficient is calculated based on the transaction feature distribution of the abnormal transaction behavior, and the abnormal threshold is adjusted by multiplying the threshold boost coefficient by the abnormal threshold to obtain an optimized abnormal threshold.

4. The method according to claim 3, characterized in that The step of obtaining the transaction behavior to be detected in response to the transaction request initiated by the target user, determining the current transaction scenario, and adjusting the abnormality threshold according to the transaction scenario includes: Identify whether the transaction scenario belongs to a preset special scenario, where the special scenario is used to indicate a scenario with abnormal characteristics or collective behavior patterns; If the current transaction scenario belongs to a preset special scenario category, the threshold adjustment coefficient corresponding to the special scenario is determined, and the abnormal threshold is adjusted by multiplying the threshold adjustment coefficient and the optimized abnormal threshold to obtain the adjusted abnormal threshold.

5. The method according to claim 1, wherein The process of comparing the transaction characteristics of the transaction behavior to be detected with the historical transaction behavior model based on the preset abnormal transaction detection model to generate an abnormality score, and comparing the abnormality score with the adjusted abnormality threshold to determine the detection result includes: Extracting multi-dimensional transaction features from the transaction behavior to be detected, wherein the multi-dimensional transaction features include but are not limited to transaction time, transaction amount, transaction location, transaction frequency, transaction type, and payee information; Inputting the multi-dimensional transaction features into a trained abnormal transaction detection model, comparing the transaction features of the transaction behavior to be detected with the historical transaction behavior model, and generating an anomaly score, wherein the abnormal transaction detection model is at least one of an Isolation Forest model, an XGBoost model, and a Random Forest model; Compare the mapped anomaly score with the adjusted anomaly threshold; If the comparison result indicates that the mapped anomaly score is greater than or equal to the anomaly threshold, a detection result indicating that the transaction behavior to be detected is an abnormal transaction is generated.

6. The method according to claim 5, characterized in that Inputting the multi-dimensional transaction features into the trained abnormal transaction detection model, comparing the transaction features of the transaction behavior to be detected with the historical transaction behavior model, and generating an anomaly score, includes: When the abnormal transaction detection model is an Isolation Forest model, the multi-dimensional transaction features are input into the trained abnormal transaction detection model, all isolation trees are traversed, and the path depth of the transaction from the root node to the isolated leaf node in each tree is counted. The anomaly score is calculated based on the average path length of all trees and mapped to the interval [0, 1]. When the abnormal transaction detection model is an XGBoost model, the multi-dimensional transaction features are input into the trained abnormal transaction detection model, and the nonlinear mapping relationship of the gradient boosting decision tree is used to output the probability value of the transaction being predicted as an abnormal category. The probability value is then compressed to the interval [0, 1] using a Sigmoid function to obtain the abnormality score; When the abnormal transaction detection model is a Random Forest model, the multi-dimensional transaction features are input into the trained abnormal transaction detection model, all decision trees are traversed, the proportion of trees judged to be abnormal is counted, and the proportion is mapped to the interval [0, 1] to obtain the abnormality score.

7. The method according to claim 1, characterized in that If the detection result indicates that the transaction behavior to be detected is an abnormal transaction, the risk level of the transaction behavior to be detected is determined, and a prevention and control strategy corresponding to the risk level is executed, including: If the detection result indicates that the transaction behavior to be detected is an abnormal transaction, then determining that the transaction is an abnormal transaction and determining a risk score for the transaction behavior; If the risk score is lower than a first scoring threshold, determining the risk level of the transaction behavior as a first risk level, and executing a first prevention and control strategy corresponding to the first risk level, wherein the first prevention and control strategy is log recording; If the risk score is higher than or equal to the first scoring threshold and lower than the second scoring threshold, the risk level of the transaction behavior is determined to be a second risk level, and a second prevention and control strategy corresponding to the second risk level is executed, where the second prevention and control strategy is transaction notification confirmation; If the risk score is higher than or equal to the second scoring threshold, the risk level of the transaction behavior is determined to be the third risk level, and a third prevention and control strategy corresponding to the third risk level is executed. The third prevention and control strategy is multi-factor authentication, and the multi-factor authentication includes SMS authentication and biometric authentication.

8. An abnormal transaction prevention and control device, characterized in that: include: A construction module is configured to obtain multiple historical transaction behaviors of a target user, identify the multiple historical transaction behaviors using a clustering algorithm and a time series analysis algorithm, construct a historical transaction behavior model, and adjust an anomaly threshold based on the spatiotemporal feature distribution of the historical transaction behavior model, wherein the historical transaction behavior model indicates the spatiotemporal feature distribution of historical transactions corresponding to each historical transaction pattern; an acquisition module, configured to respond to a transaction request initiated by the target user, acquire the transaction behavior to be detected, determine the current transaction scenario, and adjust the abnormality threshold according to the transaction scenario; a determination module configured to compare, based on a preset abnormal transaction detection model, the transaction characteristics of the transaction behavior to be detected with the historical transaction behavior model and generate an anomaly score, and to compare the anomaly score with an adjusted anomaly threshold to determine a detection result, associate the transaction behavior to be detected with the detection result, and store the result as historical transaction behavior in a preset storage space; The prevention and control module is used to determine the risk level of the transaction behavior to be detected and execute the prevention and control strategy corresponding to the risk level if the detection result indicates that the transaction behavior to be detected is an abnormal transaction.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images