A method and system for identifying abnormal transactions based on correlation analysis

Abstract

This invention provides a method and system for identifying abnormal transactions based on correlation analysis, relating to the field of data processing technology. The method includes: collecting historical normal behavior pattern data of users on various trading platforms and establishing a cross-platform normal behavior pattern library; extracting transaction activity features from current transaction data; performing cross-platform correlation analysis on the transaction activity features in the current transaction data and the transaction activity features in the cross-platform normal behavior pattern library to calculate the abnormal transaction index of the current transaction; determining whether the abnormal transaction index is less than a preset value; if so, initially marking it as a normal transaction; otherwise, manually reviewing the current transaction; converting the transaction activity features corresponding to the initially marked normal transactions into a comprehensive feature vector, inputting it into a convolutional neural network, and outputting the transaction identification result; manually reviewing the abnormal transactions; and storing the transaction behavior data of normal transactions in the cross-platform normal behavior pattern library.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and more specifically, to a method and system for identifying abnormal transactions based on correlation analysis. Background Technology

[0002] In the financial markets and e-commerce sectors, anomaly transaction identification based on correlation analysis has become a crucial research topic. Anomalies typically refer to behaviors that deviate from normal transaction patterns, such as market manipulation, fraudulent transactions, or other violations. These anomalies can not only lead to severe financial losses but also pose a significant threat to market fairness and transparency. With the widespread adoption of electronic payments and online transactions, the volume and complexity of transaction data have increased dramatically, making manual monitoring and traditional detection methods increasingly inadequate. Therefore, developing effective anomaly transaction detection methods has become a pressing issue for financial institutions, regulators, and merchants.

[0003] Currently, methods for detecting abnormal transactions mainly include rule-based methods, statistical methods, and intelligent detection methods based on machine learning and deep learning. Rule-based methods identify abnormal transactions by setting predefined rules (such as excessively large transaction amounts or abnormal transaction frequency). Statistical analysis techniques are used to build models based on historical data to identify transactions that significantly deviate from normal behavior. Commonly used intelligent detection methods include decision trees, random forests, support vector machines (SVMs), and neural networks. These methods can automatically learn patterns from large amounts of complex data and have high predictive accuracy.

[0004] However, existing methods rely too heavily on manually set rules, which are typically static and unable to cope with complex and ever-changing trading patterns, leading to high false positive rates. Furthermore, the lack of data support from multiple trading platforms means that these rules change over time and with market conditions, causing trained models to degrade in performance when faced with new data, resulting in reduced accuracy.

[0005] For example, Chinese patent document CN119741101A discloses a method and system for identifying financial data anomalies based on big data analysis. The method includes: collecting high-frequency trading data from multiple markets and performing synchronous preprocessing; constructing a dynamic correlation network based on the preprocessed data to correlate the linkage characteristics between multiple markets; identifying normal trading patterns and abnormal trading patterns based on the correlation between multiple markets; selecting abnormal trading points and classifying the abnormal trading points; constructing an anomaly propagation network based on the classification results of abnormal trading points, quantifying the propagation path and global influence of abnormal trading points, and analyzing the time dynamic characteristics of propagation.

[0006] Chinese patent document CN118537141A discloses an insurance fraud identification and response system based on correlation network analysis technology. The method includes: a data collection subsystem responsible for collecting users' insurance transaction data and dividing it into transaction data blocks; a data processing subsystem performing preprocessing to obtain preprocessed data blocks; a correlation network generation subsystem using correlation network analysis technology to process the preprocessed data blocks, forming a correlation data topology; a detection model construction subsystem responsible for constructing a convolutional neural network and training it with a sample set to obtain a fraud detection model; a computation subsystem acquiring the features of the correlation data topology and generating a node feature dataset based on these features; and inputting the node feature dataset into the fraud detection model for computation to obtain the detection result.

[0007] To address the aforementioned problems, this invention presents a method and system for identifying abnormal transactions based on correlation analysis. Summary of the Invention

[0008] This invention aims to overcome at least one of the shortcomings of the prior art and provide an abnormal transaction identification method based on correlation analysis. This addresses the problem that existing methods rely too heavily on manually set rules, which are typically static and unable to cope with complex and ever-changing transaction patterns, leading to high false positive rates. Furthermore, the lack of support from multiple trading platform data means that the trained model changes with time and market conditions, causing performance degradation when faced with new data and resulting in reduced identification accuracy.

[0009] The present invention also discloses a system loaded with an abnormal transaction identification method based on correlation analysis.

[0010] The detailed technical solution of this invention is as follows:

[0011] An abnormal transaction identification method based on correlation analysis, the method comprising:

[0012] S1: Collect historical normal behavior patterns of users on various trading platforms;

[0013] S2: Analyze the historical normal behavior pattern data and establish a cross-platform normal behavior pattern library;

[0014] S3: Obtain current transaction data, which is provided by various trading platforms;

[0015] S4: Extract transaction activity features from the current transaction data;

[0016] S5: By comparing the transaction activity characteristics in the current transaction data with the transaction activity characteristics in the cross-platform normal behavior pattern library, cross-platform correlation analysis is performed to calculate the abnormal transaction index of the current transaction;

[0017] S6: Determine whether the abnormal transaction index is less than the preset abnormal transaction index; if so, initially mark the current transaction as a normal transaction and proceed to the next step; otherwise, mark the current transaction as an abnormal transaction and conduct manual review of the current transaction.

[0018] S7: Transform the transaction activity features corresponding to the transaction data initially marked as normal transactions into a comprehensive feature vector;

[0019] S8: Input the comprehensive feature vector into the convolutional neural network and output the transaction recognition result; use the cross-entropy loss function as the loss function of the convolutional neural network; optimize the convolutional neural network through the improved Adam optimizer until the function value of the cross-entropy loss function is less than the preset function value;

[0020] S9: If the transaction identification result is an abnormal transaction, the current transaction shall be manually reviewed; if the transaction identification result is a normal transaction, the behavioral data of the current transaction shall be stored in the cross-platform normal behavior pattern library.

[0021] According to a preferred embodiment of the present invention, S1 specifically comprises:

[0022] The historical normal behavior pattern data is collected from the transaction records of various trading platforms. The historical normal behavior pattern data refers to the data on normal user behavior collected and analyzed over a long period of time in a specific system.

[0023] According to a preferred embodiment of the present invention, S2 specifically includes:

[0024] S201: Perform data cleaning on the historical normal behavior pattern data to remove irrelevant and inaccurate parts of the data;

[0025] S202: Select representative features from the cleaned historical normal behavior pattern data to distinguish between normal and abnormal transactions as transaction activity features;

[0026] S203: Based on the characteristics of transaction activities in historical normal behavior pattern data, data mining algorithms are used to extract multiple typical transaction patterns;

[0027] S204: Combine the various typical transaction patterns to establish the cross-platform normal behavior pattern library.

[0028] According to a preferred embodiment of the present invention, the representative features used to distinguish between normal transactions and abnormal transactions in S202 include: static features and dynamic features;

[0029] The static features include user ID, device information, transaction account information, and payment method;

[0030] The dynamic features include transaction amount, transaction time, transaction frequency, and number of times the payment password has been entered.

[0031] According to a preferred embodiment of the present invention, S5 specifically includes:

[0032] S501: Using Hamming distance, calculate the similarity between static features in the current transaction activity and static features in the cross-platform normal behavior pattern library;

[0033] The Hamming distance is calculated as follows:

[0034] (1)

[0035] in, The Hamming distance represents the difference between two static features x and y. This represents the i-th element in the binary sequence x. Let represent the i-th element in the binary sequence y. This indicates an indicator function, which compares two sequences to see if the characters or bits at corresponding positions are the same. If they are different, it increments by 1; if they are the same, it increments by 0. g represents the length of the string.

[0036] S502: Use cosine similarity to calculate the similarity between dynamic features in the current transaction activity and dynamic features in the cross-platform normal behavior pattern library;

[0037] The formula for calculating cosine similarity is:

[0038] (2)

[0039] (3)

[0040] in, Let A represent the dynamic characteristics of the current trading activity and B represent the dynamic characteristics of the historical normal behavior pattern. Indicates the modulus. This represents the i-th dynamic feature in the current transaction activity. Let i represent the i-th dynamic feature in the historical normal behavior pattern, and n represent the total number of features;

[0041] S503: Calculate the matching score for the current transaction activity by combining the similarity of various static and dynamic features.

[0042] (4)

[0043] in, This represents the matching score of the j-th transaction activity. This represents the characteristics of the j-th transaction activity. This represents the characteristics of the corresponding activity in the normal behavior pattern library. The weight of the i-th feature is represented by n, and n represents the total number of features.

[0044] S504: Calculate the weighted average of the matching scores for each current transaction activity to obtain the abnormal transaction index for the current transaction:

[0045] (5)

[0046] Where S represents the abnormal transaction index of the current transaction, This represents the matching score of the j-th transaction activity. This represents the importance weight of the j-th transaction activity. Labels indicating normal behavioral patterns. This indicates a normal behavioral pattern. This indicates an abnormal behavior pattern, and m represents the total number of transactions.

[0047] According to a preferred embodiment of the present invention, S7 specifically includes:

[0048] S701: Using One-Hot encoding, the static features in the transaction activity features corresponding to the transaction data initially marked as normal transactions are transformed into the first feature vector;

[0049] S702: Using standardization and normalization, the dynamic features in the transaction activity features corresponding to the transaction data initially marked as normal transactions are transformed into a second feature vector;

[0050] S703: Perform feature concatenation on the first feature vector and the second feature vector to obtain the comprehensive feature vector.

[0051] According to a preferred embodiment of the present invention, the convolutional neural network specifically includes:

[0052] The comprehensive feature vector is transformed into a target feature map;

[0053] A 1x1 convolution kernel is used to perform a convolution operation on the target feature map to generate a first feature map;

[0054] The target feature map is convolved using depthwise convolution to generate a second feature map.

[0055] The first feature map and the second feature map are concatenated and spliced ​​along the channel dimension;

[0056] Perform pooling operation on the concatenated feature map;

[0057] The feature map after pooling is activated using the ReLU activation function;

[0058] Using the activated feature map as input, the rows and columns of the feature map are processed separately through the fully connected layers of the deep convolutional neural network using the DFC attention mechanism.

[0059] An attention map is generated by weighted summation of each location in the processed feature map with its corresponding horizontal and vertical neighborhoods.

[0060] Based on the attention map, the transaction recognition result is output through the Softmax function.

[0061] According to a preferred embodiment of the present invention, the transaction identification result specifically includes: abnormal transactions and normal transactions.

[0062] According to a preferred embodiment of the present invention, the improved Adam optimizer specifically includes:

[0063] First, initialize the parameters, including the initial weights. Learning rate First-order moment decay rate Second-order moment decay rate ,constant .

[0064] Calculate the first and second moments:

[0065] (6)

[0066] (7)

[0067] in, Let i represent the first moment of the i-th parameter in the t-th iteration. This represents the first-order moment decay rate. This represents the first moment of the i-th parameter in the (t-1)-th iteration. This represents the gradient of the i-th parameter. Let represent the second moment of the i-th parameter in t iterations. This represents the second-order moment decay rate. Let represent the second moment of the i-th parameter in the (t-1)th iteration. This represents the square of the gradient;

[0068] Corrections are made for the first and second moments:

[0069] (8)

[0070] (9)

[0071] in, It is the first moment after bias correction for the i-th parameter. It is the first-order moment decay rate. It is the second moment after bias correction for the i-th parameter. It is the second-order moment decay rate;

[0072] An adaptive learning function is introduced, which updates the parameters using the bias-corrected moments and the adaptive learning function:

[0073] (10)

[0074] (11)

[0075] in, It is the update value of the i-th parameter in the (t+1)-th iteration. It is the updated value of the i-th parameter in the t-th iteration. This is the current learning rate. It is a constant. It is an adaptive learning function. λ is the scaling factor, λ is the sensitivity factor, and t is the current step number;

[0076] Continue performing the above steps until the preset number of training rounds is reached or the loss converges. The parameters will be updated in each iteration, and the learning rate will be adjusted according to the training progress.

[0077] In another aspect of the present invention, an abnormal transaction identification system based on correlation analysis is also provided, comprising:

[0078] processor;

[0079] The memory stores computer-readable instructions, which, when executed by the processor, implement the aforementioned abnormal transaction identification method based on correlation analysis.

[0080] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0081] (1) This invention solves the problem of relying on manually set static rules by establishing a cross-platform normal behavior pattern library and using convolutional neural networks for transaction recognition. The cross-platform normal behavior pattern library can provide sufficient training datasets, enabling the system to automatically learn and adapt to complex and ever-changing transaction patterns, thus reducing the false positive rate. At the same time, by continuously updating the cross-platform normal behavior pattern library, the system can be continuously adjusted and optimized according to new data, thereby coping with the challenges brought about by changes in time and market environment, ensuring that the model maintains accuracy and robustness when facing new data, thereby significantly improving the accuracy of recognition.

[0082] (2) This invention, through comprehensive scoring, can more comprehensively determine whether a transaction is abnormal. At the same time, this method enhances the flexibility of abnormal transaction detection, reduces false positives and false negatives, provides real-time response to abnormal behavior, adapts to changes in user behavior, and improves platform security and user trust.

[0083] (3) This invention combines static and dynamic features through feature splicing. The model can not only identify the relationships between static features, but also understand the interaction between these static and dynamic features. This multi-dimensional information fusion makes the model more effective in processing complex data. At the same time, combining static and dynamic features can improve the detection of abnormal transactions. By considering both types of features simultaneously, the model can more accurately identify transaction behaviors that differ significantly from historical normal transaction patterns, thereby effectively identifying abnormal transactions.

[0084] (4) The improved Adam optimizer of this invention estimates the dynamic learning rate of each parameter through the first and second moments, and can automatically adjust the learning rate according to the gradient information of each parameter. This allows each parameter to be updated more appropriately during training, reduces the need for manual adjustment of the learning rate, and accelerates the convergence speed of the network. Bias correction of the first and second moments avoids the problem of the learning rate being too large or too small in the initial stage, and enhances the convergence of the model. This helps the optimizer escape local optima and find the global optimum in a wider solution space. Attached Figure Description

[0085] Figure 1 This is a flowchart illustrating an abnormal transaction identification method based on correlation analysis provided in an embodiment of the present invention.

[0086] Figure 2 This is a schematic diagram of the structure of an abnormal transaction identification system based on correlation analysis provided in an embodiment of the present invention. Detailed Implementation

[0087] The present disclosure will be further described below with reference to the accompanying drawings and embodiments.

[0088] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of this disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains.

[0089] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they specify the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0090] Without conflict, the embodiments in the present disclosure and the features in the embodiments can be combined with each other.

[0091] Embodiment 1

[0092] Refer Figure 1 , this embodiment provides an abnormal transaction recognition method based on association analysis. This method can be implemented by an abnormal transaction recognition device based on association analysis. The abnormal transaction recognition device based on association analysis can be a terminal or a server. The processing flow of the abnormal transaction recognition method based on association analysis can include the following steps:

[0093] S1: Collect historical normal behavior pattern data of users on various trading platforms.

[0094] Among them, the historical normal behavior pattern data refers to the data of normal user behavior collected and analyzed for a long time in a specific system. These data serve as the basis for establishing a model, judging, and predicting whether the user behavior is normal.

[0095] In a possible implementation manner, S1 is specifically:

[0096] Collect historical normal behavior pattern data from the transaction records of each trading platform.

[0097] It should be noted that in the scenario of an e-commerce trader platform, the historical normal behavior pattern data usually consists of a large amount of cleaned and processed transaction data, which describes the common behavior characteristics of platform users in the normal trading process.

[0098] In the present invention, the historical normal behavior pattern data provides a stable benchmark. By analyzing and learning these normal trading patterns, the system can establish an accurate normal behavior template. All subsequent transactions will be compared with this benchmark, making it easier to identify abnormal behaviors.

[0099] S2: Analyze the historical normal behavior pattern data and establish a cross-platform normal behavior pattern library.

[0100] In a possible implementation manner, S2 specifically includes:

[0101] S201: Clean the historical normal behavior pattern data.

[0102] Data cleaning is a key step in data preprocessing. It aims to identify and remove irrelevant and inaccurate parts of the data, such as noise, errors, missing values, and duplicate records, in order to ensure data quality and improve the accuracy and reliability of subsequent analysis and modeling.

[0103] Optionally, data cleaning specifically includes removing duplicate data, filling in missing values, and handling outliers.

[0104] S202: Select representative features from the cleaned historical normal behavior pattern data to distinguish between normal and abnormal transactions as transaction activity features.

[0105] In one possible implementation, the representative features used in S202 to distinguish between normal and abnormal transactions include: static features and dynamic features.

[0106] Static features include user ID, device information, transaction account information, and payment method.

[0107] Dynamic features include transaction amount, transaction time, transaction frequency, and number of times payment password was entered.

[0108] S203: Based on the characteristics of transaction activities in historical normal behavior pattern data, data mining algorithms are used to extract multiple typical transaction patterns.

[0109] Data mining algorithms are techniques and methods used to discover potential patterns, rules, and knowledge from large amounts of data. By analyzing and processing massive amounts of data, they extract information useful for decision-making and have wide applications in various fields.

[0110] Optionally, the data mining algorithm specifically includes:

[0111] Features that appear more frequently than a specified threshold in transaction data are grouped into frequent itemsets.

[0112] The Apriori algorithm is used to generate frequent itemsets starting from a single feature, and these frequent itemsets are gradually merged until no more frequent itemsets can be generated.

[0113] By traversing all transaction records, the support of each frequent itemset is calculated, and frequent itemsets that meet the support threshold are selected.

[0114] Relationships between frequent itemsets are represented by generating association rules.

[0115] The reliability of association rules is measured by calculating their confidence level.

[0116] Calculate the lifting degree of association rules to measure the strength of the association between features.

[0117] High-quality association rules are selected based on confidence and lift.

[0118] Optionally, the confidence level is greater than 0.7 and the lift is greater than 1.2.

[0119] For example, if the transaction amount is greater than 500 yuan and the transaction time is between 6 pm and 9 pm, the probability of the payment method being a credit card is 90%; if the user's device type is a mobile phone and the transaction amount is between 100 and 500 yuan, the user is more likely to buy electronic products. These association rules help to obtain typical transaction patterns.

[0120] Analyzing the generated high-quality association rules reveals several typical transaction patterns. For example, high-value transactions often occur at night, and the payment method is credit card. When users transact using their mobile phones, they typically purchase certain categories of goods, such as electronic products.

[0121] S204: Establish a cross-platform normal behavior pattern library by combining various typical transaction models.

[0122] Specifically, all extracted typical transaction patterns and associated rules are integrated into a unified cross-platform normal behavior pattern library.

[0123] In this invention, a cross-platform normal behavior pattern library is constructed by extracting typical transaction patterns from historical normal transaction data, providing a clear behavioral benchmark for future transactions. The system can use this benchmark to determine whether the current transaction conforms to a normal pattern, thereby effectively distinguishing between normal transactions and potentially abnormal transactions. Simultaneously, by constructing a detailed cross-platform normal behavior pattern library, the system can identify what constitutes "normal" behavior based on rich historical data, thus more accurately distinguishing between normal and abnormal behavior and reducing the probability of false positives and false negatives.

[0124] Furthermore, a cross-platform normal behavior pattern library can help e-commerce platforms proactively detect and curb abnormal transactions, reduce economic losses caused by transaction fraud, and enhance platform security and user trust.

[0125] S3: Get the current transaction data.

[0126] Specifically, transaction data is typically provided by transaction platforms, payment gateways, or third-party payment systems. Examples include e-commerce platforms, financial service platforms, and bank payment gateways. These platforms provide API interfaces through which transaction data can be obtained in real time.

[0127] S4: Extract transaction activity features from the current transaction data.

[0128] It should be noted that the transaction activity characteristics in the current transaction data are the representative characteristics mentioned above used to distinguish between normal and abnormal transactions.

[0129] In this invention, by extracting features related to transaction activities, the system can clearly identify whether the current transaction is abnormal, thereby further improving the effectiveness of detection.

[0130] S5: By comparing the transaction activity characteristics in the current transaction data with the transaction activity characteristics in the cross-platform normal behavior pattern library, cross-platform correlation analysis is performed to calculate the abnormal transaction index of the current transaction.

[0131] In one possible implementation, S5 specifically includes:

[0132] S501: Using Hamming distance, calculate the similarity between static features in the current transaction activity and static features in the cross-platform normal behavior pattern library.

[0133] Hamming distance is a metric used to measure the difference between two strings or binary numbers of the same length. It represents the number of characters or bits that are different at the same position in two strings or binary sequences.

[0134] Alternatively, the Hamming distance can be calculated as follows:

[0135]

[0136] in, Hamming distance represents the difference between two strings or binary sequences x and y. This represents the i-th element in the binary sequence x. Let represent the i-th element in the binary sequence y. This indicates an indicator function, which compares two sequences to see if the characters or bits at corresponding positions are the same. If they are different, it increments by 1; if they are the same, it increments by 0. g represents the length of the string.

[0137] For example, x and y represent the binary representations of two specific static features (e.g., IP address, device information, etc.). Let's assume the static feature is an IP address. x might represent the binary encoding of the IP address of the current transaction, while y might represent the binary encoding of IP addresses from historical normal transaction patterns. The two binary sequences are compared using Hamming distance to see if the characters at each position are the same.

[0138] For example, if the IP address of the current transaction differs significantly from the IP addresses in historical normal transaction patterns, Hamming distance can be used to measure the similarity between the two sets of data.

[0139] S502: Use cosine similarity to calculate the similarity between dynamic features in the current transaction activity and dynamic features in the cross-platform normal behavior pattern library.

[0140] Optionally, the formula for calculating cosine similarity is:

[0141]

[0142]

[0143] in, Let A represent the dynamic characteristics of the current trading activity and B represent the dynamic characteristics of the historical normal behavior pattern. Indicates the modulus. This represents the i-th dynamic feature in the current transaction activity. Let represent the i-th dynamic feature in the historical normal behavior pattern, and n represent the total number of features.

[0144] It should be noted that the closer the value is to 1, the more similar the two vectors are. This is suitable for measuring feature similarity with multiple dimensions.

[0145] In this invention, Hamming distance is used to measure the similarity between static features, such as IP addresses and device information, and is particularly suitable for binary or discrete data. It effectively identifies and measures whether significant differences exist in these features. Cosine similarity is used to measure the similarity between dynamic features, such as transaction amount, transaction time, and transaction frequency, and is particularly suitable for continuous data. It measures the directional similarity between these features, thus helping to determine whether the current transaction is consistent with historical patterns. By using these two methods, accurate similarity measurements can be performed for different types of features, thereby improving the ability to distinguish between normal and abnormal transactions.

[0146] S503: Calculate the matching score for the current transaction activity by combining the similarity of various static and dynamic features.

[0147]

[0148] in, This represents the matching score of the j-th transaction activity. This represents the characteristics of the j-th transaction activity. This represents the characteristics of the corresponding activity in the normal behavior pattern library. The weight represents the weight of the i-th feature, and n represents the total number of features.

[0149] S504: Calculate the weighted average of the matching scores for each current transaction activity to obtain the abnormal transaction index for the current transaction.

[0150]

[0151] Where S represents the abnormal transaction index of the current transaction, This represents the matching score of the j-th transaction activity. This represents the importance weight of the j-th transaction activity. Labels indicating normal behavioral patterns. This indicates a normal behavioral pattern. This indicates an abnormal behavior pattern, and m represents the total number of transactions.

[0152] It's important to note that the weight of each activity is manually assigned based on the expert's understanding of the transaction process. For example, the expert might consider the payment process and identity verification to be the most important activities, thus assigning them higher weights, while other activities such as browsing products and adding items to the cart are less important and can be assigned lower weights. For instance, the payment process might have a higher weight than browsing products.

[0153] In this invention, combining static and dynamic features improves the accuracy of the judgment because abnormal transactions may stand out in some features but be relatively similar to normal transactions in others. By using a comprehensive score, a more complete judgment can be made as to whether a transaction is abnormal. At the same time, this approach enhances the flexibility of abnormal transaction detection, reduces false positives and false negatives, enables real-time response to abnormal behavior, adapts to changes in user behavior, and improves platform security and user trust.

[0154] S6: Determine if the abnormal transaction index is less than the preset abnormal transaction index. If yes, initially mark the current transaction as a normal transaction and proceed to the next step. Otherwise, mark the current transaction as an abnormal transaction and conduct a manual review.

[0155] It should be noted that those skilled in the art can set the size of the preset abnormal transaction index according to actual needs, and this invention does not limit this.

[0156] The abnormal trading index is a numerical indicator used to measure whether a particular trade is abnormal. It provides a quantitative result by comparing the current trade with historical normal behavior patterns.

[0157] It should be noted that a higher value indicates that the transaction is more likely to be abnormal. Conversely, a lower value indicates that the transaction conforms to normal behavior patterns.

[0158] In this invention, by setting reasonable thresholds, the system can automatically identify obviously abnormal transactions, preventing normal transactions from being incorrectly marked as abnormal, thereby reducing unnecessary manual intervention. Simultaneously, when the abnormal transaction index exceeds the threshold, the system can automatically mark the transaction as abnormal and notify the administrator for manual review. This combination of automation and manual review improves review efficiency, especially on platforms with high transaction volumes, significantly reducing the workload of manual review.

[0159] Furthermore, by monitoring abnormal transaction indices, the platform can promptly detect and issue warnings when transactions occur. This early warning system helps the platform take measures in the early stages, thereby reducing losses.

[0160] S7: Transform the transaction activity features corresponding to the transaction data initially marked as normal transactions into a comprehensive feature vector.

[0161] In one possible implementation, S7 specifically includes:

[0162] S701: Using One-Hot encoding, the static features in the transaction activity features corresponding to the transaction data initially marked as normal transactions are transformed into the first feature vector.

[0163] Specifically, first determine the static features that need to be One-Hot encoded. Static features are those that do not change over time. For example, user ID, device information, transaction account information, and payment method. Define a category for each static feature: User ID: User1, User2, and User3; Device information: Phone, Laptop, and Tablet; Transaction account information: Standard and Premium; Payment method: Credit-Card and PayPal. Create a binary feature for each category: User ID: [User1->[1,0,0], User2->[0,1,0], User3->[0,0,1]]; Device information: [Phone->[1,0,0], Laptop->[0,1,0], Tablet->[0,0,1]]; Transaction account information: [Standard->[1,0], Premium->[0,1]]; Payment method: [Credit-Card->[1,0], PayPal->[0,1]]. For a given normal transaction record, select the category of its static features. Finally, map the current transaction category to the corresponding One-Hot encoded value and concatenate these values ​​to form a long binary feature vector. For example, User ID User2: [0,1,0], Device information Laptop: [0,1,0], Transaction account information Premium: [0,1], and Payment method Credit-Card: [1,0]. The concatenated first feature vector is obtained.

[0164] S702: Using standardization and normalization, the dynamic features in the transaction activity features corresponding to the transaction data initially marked as normal transactions are transformed into a second feature vector.

[0165] Specifically, the process involves identifying dynamic features; converting the data into a distribution with a mean of 0 and a standard deviation of 1; scaling the data to a fixed range, typically [0,1]; and concatenating the converted features to obtain a second feature vector.

[0166] S703: Perform feature concatenation on the first feature vector and the second feature vector to obtain a comprehensive feature vector.

[0167] Optionally, the first feature vector and the second feature vector are connected by dimension to form a unified comprehensive feature vector.

[0168] In this invention, by combining static and dynamic features through feature concatenation, the model can not only identify relationships between static features, such as behavioral differences between different users, but also understand the interaction relationships between these static and dynamic features, such as the relationship between user ID and transaction amount. This multi-dimensional information fusion makes the model more effective in processing complex data. Simultaneously, combining static and dynamic features can improve the effectiveness of abnormal transaction detection. For example, static features help confirm the basic background of a transaction, such as user identity and device type, while dynamic features can reveal the actual behavior of the transaction, such as amount, time, and frequency. By considering both types of features simultaneously, the model can more accurately identify transaction behaviors that differ significantly from historical normal transaction patterns, thereby effectively identifying abnormal transactions.

[0169] S8: Input the comprehensive feature vector into the convolutional neural network and output the transaction recognition result.

[0170] In one possible implementation, the processing steps of a convolutional neural network specifically include:

[0171] The comprehensive feature vector is transformed into the target feature map.

[0172] A 1x1 convolution kernel is used to perform a convolution operation on the target feature map to generate the first feature map.

[0173] The target feature map is convolved using depthwise convolution to generate a second feature map.

[0174] The first feature map and the second feature map are concatenated and stitched together along the channel dimension:

[0175]

[0176] Where Y represents the concatenated feature map, and Concat represents the concatenation operation. Represents the first feature map. Represents the depthwise convolution kernel. This represents the second feature map obtained from the depthwise convolution operation.

[0177] In this invention, concatenating the first and second feature maps along the channel dimension combines two different convolutional features, increasing the model's expressive power. The concatenated feature map contains more information, helping the model better learn and understand the relationships between different features.

[0178] Perform pooling operation on the concatenated feature maps:

[0179]

[0180] in, This represents the output value at position (i,j) after the pooling operation. This represents the element in the m-th row and n-th column of the pooling window, and max represents maximizing.

[0181] The ReLU activation function is used to activate the feature map after pooling.

[0182] Using the activated feature map as input, the rows and columns of the feature map are processed separately through the fully connected layers of a deep convolutional neural network using the DFC attention mechanism:

[0183]

[0184]

[0185] in, This represents the feature values ​​after row-wise weighting, where h represents the number of rows in the image, w represents the number of columns in the image, H represents the total number of rows, and W represents the total number of columns. This represents the row-weighted coefficient. This indicates element-wise multiplication. This represents the feature value of an image at a certain location. This represents the eigenvalues ​​after column-weighted calculation. This represents the coefficient for column weighting. This represents the weighted feature at a certain location in the image after row-direction weighting.

[0186] Among them, the DFC attention mechanism is a technique in deep learning used to enhance the model's attention to important features. Its goal is to help the model automatically identify and focus on the most relevant parts of the input data, thereby improving the model's performance and efficiency.

[0187] In this invention, the DFC attention mechanism dynamically focuses on important regions in an image through weighted processing in both row and column directions, assigning higher weights to features useful for classification. This mechanism enables the model to automatically focus on key features, thereby improving the accuracy of transaction recognition.

[0188] An attention map is generated by weighted summation of each location in the processed feature map with its corresponding horizontal and vertical neighborhoods.

[0189] Based on the attention map, the transaction recognition result is output through the Softmax function:

[0190]

[0191] Where P represents probability, and y represents the predicted category. Let z represent the probability of predicting a transaction as the c-th category given an input feature vector, where c represents the category label (c=1 for normal transactions, c=2 for abnormal transactions), and z represents the input feature vector. This indicates the probability that the prediction is a normal transaction. This represents the probability of predicting an abnormal transaction, where e represents the exponential function. This represents the original predicted score for category c. This represents the value obtained by applying an exponential function to these original fractions.

[0192] In this invention, by using a Convolutional Neural Network (CNN) and incorporating an attention mechanism, the model can automatically extract important features and improve the accuracy of abnormal transaction identification. This process not only enhances the focus on key features but also improves classification accuracy and robustness through precise feature concatenation, convolution, and weighted summation, ultimately enhancing the efficiency and reliability of the transaction identification system.

[0193] In one possible implementation, the transaction identification results specifically include: abnormal transactions and normal transactions.

[0194] In one possible implementation, the cross-entropy loss function is used as the loss function for the convolutional neural network.

[0195] Optionally, the cross-entropy loss function is as follows:

[0196]

[0197] in, Let C represent the cross-entropy loss function, and C represent the total number of categories. Let represent the i-th value of the true label, and log represent the logarithmic function. This represents the predicted probability value output by the model.

[0198] The convolutional neural network is optimized using an improved Adam optimizer until the cross-entropy loss function value is less than a preset value.

[0199] It should be noted that those skilled in the art can set the size of the preset function value according to actual needs, and this invention does not limit this.

[0200] Optionally, the improved Adam optimizer specifically includes:

[0201] First, we need to initialize some parameters, including the initial weights. Learning rate First-order moment decay rate Second-order moment decay rate ,constant .

[0202] The algorithm calculates the first and second moments, relying on the first (mean) and second (variance) moments of the gradient to adjust the learning rate for each parameter.

[0203]

[0204]

[0205] in, Let i represent the first moment of the i-th parameter in the t-th iteration. This represents the first-order moment decay rate. This represents the first moment of the i-th parameter in the (t-1)-th iteration. This represents the gradient of the i-th parameter. Let represent the second moment of the i-th parameter in t iterations. This represents the second-order moment decay rate. Let represent the second moment of the i-th parameter in the (t-1)th iteration. This represents the square of the gradient.

[0206] In this invention, the Adam optimizer estimates the dynamic learning rate of each parameter using the first and second moments, and can automatically adjust the learning rate based on the gradient information of each parameter. This allows each parameter to be updated more appropriately during training, reduces the need for manual adjustment of the learning rate, and accelerates the convergence speed of the network.

[0207] Corrections are made for the first and second moments:

[0208]

[0209]

[0210] in, It is the first moment after bias correction for the i-th parameter. It is the first-order moment decay rate. It is the second moment after bias correction for the i-th parameter. It is the second-order moment decay rate.

[0211] In this invention, Adam avoids the problem of excessively large or small learning rates in the initial stage by biasing the first and second moments, thus enhancing the model's convergence. This helps the optimizer escape local optima and find the global optimum in a wider solution space.

[0212] An adaptive learning function is introduced, which uses the bias-corrected moments and the adaptive learning function to update the parameters:

[0213]

[0214]

[0215] in, It is the update value of the i-th parameter in the (t+1)-th iteration. It is the updated value of the i-th parameter in the t-th iteration. This is the current learning rate. It is a constant. It is an adaptive learning function. It is the scaling factor. t is the sensitivity coefficient, and t is the current step number.

[0216] In this invention, different parameters may exhibit different update rates during training. By introducing an adaptive learning function, the optimizer can dynamically adjust the learning rate of each parameter based on its gradient information and historical updates, ensuring rapid convergence. For parameters that learn slowly, the optimizer increases the learning rate, while for parameters that change significantly, the optimizer decreases the learning rate.

[0217] This process continues until the preset number of training rounds is reached or the loss converges. Each iteration updates the parameters and adjusts the learning rate according to the training progress.

[0218] S9: If the transaction identification result is an abnormal transaction, the current transaction will be manually reviewed. If the transaction identification result is a normal transaction, the behavioral data of the current transaction will be stored in the cross-platform normal behavior pattern library.

[0219] It should be noted that normal trading patterns may change over time. Therefore, the cross-platform normal behavior pattern library needs to be updated regularly. This involves continuously adjusting and improving the pattern library by introducing new historical data.

[0220] In this invention, as normal transaction data is continuously introduced, the cross-platform normal behavior pattern library will become increasingly comprehensive, encompassing more features of normal transaction behavior. This means that when identifying transactions, the model can refer to more diverse normal behavior patterns, thereby improving the accuracy of detecting abnormal transactions.

[0221] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following:

[0222] In this embodiment of the invention, by establishing a cross-platform normal behavior pattern library and using convolutional neural networks for transaction recognition, the problem of relying on manually set static rules can be solved. The cross-platform normal behavior pattern library can provide sufficient training datasets, enabling the system to automatically learn and adapt to complex and ever-changing transaction patterns, reducing the false positive rate. Simultaneously, by continuously updating the cross-platform normal behavior pattern library, the system can be constantly adjusted and optimized based on new data, thereby addressing the challenges brought about by changes in time and market environment, ensuring that the model maintains accuracy and robustness when facing new data, and thus significantly improving the accuracy of recognition.

[0223] Example 2

[0224] like Figure 2 As shown, this embodiment provides an abnormal transaction identification system 20 based on correlation analysis, applied to the above-mentioned abnormal transaction identification method based on correlation analysis, including:

[0225] Processor 201.

[0226] The memory 202 stores computer-readable instructions, which, when executed by the processor 201, implement the abnormal transaction identification method based on correlation analysis as described in the method embodiment.

[0227] The abnormal transaction identification system 20 based on correlation analysis provided by the present invention can execute the above-mentioned abnormal transaction identification method based on correlation analysis and achieve the same or similar technical effects. To avoid duplication, it will not be described again here.

[0228] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the technical solutions of the present invention, and are not intended to limit the specific implementation of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention should be included within the protection scope of the claims of the present invention.

Claims

1. A method for identifying abnormal transactions based on correlation analysis, characterized in that, The method includes: S1: Collect historical normal behavior patterns of users on various trading platforms; S2: Analyze the historical normal behavior pattern data to establish a cross-platform normal behavior pattern library, specifically including: S201: Perform data cleaning on the historical normal behavior pattern data to remove irrelevant and inaccurate parts of the data; S202: Select representative features from the cleaned historical normal behavior pattern data to distinguish between normal and abnormal transactions as transaction activity features; S203: Based on the characteristics of transaction activities in historical normal behavior pattern data, use data mining algorithms to extract typical transaction patterns; S204: Based on the various typical transaction patterns described above, establish the cross-platform normal behavior pattern library; S3: Obtain current transaction data, which is provided by various trading platforms; S4: Extract transaction activity features from the current transaction data; S5: By comparing the transaction activity characteristics in the current transaction data with the transaction activity characteristics in the cross-platform normal behavior pattern database, cross-platform correlation analysis is performed to calculate the abnormal transaction index of the current transaction, specifically including: S501: Using Hamming distance, calculate the similarity between static features in the current transaction activity and static features in the cross-platform normal behavior pattern library; The Hamming distance is calculated as follows: （1） in, The Hamming distance represents the difference between two static features x and y. This represents the i-th element in the binary sequence x. Let represent the i-th element in the binary sequence y. This indicates an indicator function, which compares two sequences to see if the characters or bits at corresponding positions are the same. If they are different, it increments by 1; if they are the same, it increments by 0. g represents the length of the string. S502: Use cosine similarity to calculate the similarity between dynamic features in the current transaction activity and dynamic features in the cross-platform normal behavior pattern library; The formula for calculating cosine similarity is: （2） （3） in, Let A represent the dynamic characteristics of the current trading activity and B represent the dynamic characteristics of the historical normal behavior pattern. Indicates the modulus. This represents the i-th dynamic feature in the current transaction activity. Let i represent the i-th dynamic feature in the historical normal behavior pattern, and n represent the total number of features; S503: Calculate the matching score for the current transaction activity by combining the similarity of various static and dynamic features. （4） in, This represents the matching score of the j-th transaction activity. Describe the characteristics of the j-th transaction activity. This represents the characteristics of the corresponding activity in the normal behavior pattern library. The weight of the i-th feature is represented by n, and n represents the total number of features. S504: Calculate the weighted average of the matching scores for each current transaction activity to obtain the abnormal transaction index for the current transaction: （5） Where S represents the abnormal transaction index of the current transaction, This represents the matching score of the j-th transaction activity. This represents the importance weight of the j-th transaction activity. Labels indicating normal behavioral patterns. This indicates a normal behavioral pattern. This indicates an abnormal behavior pattern, and m represents the total number of transaction activities. S6: Determine whether the abnormal transaction index is less than the preset abnormal transaction index; if so, initially mark the current transaction as a normal transaction and proceed to the next step; otherwise, mark the current transaction as an abnormal transaction and conduct manual review of the current transaction. S7: Transform the transaction activity features corresponding to the transaction data initially marked as normal transactions into a comprehensive feature vector; S8: Input the comprehensive feature vector into the convolutional neural network and output the transaction recognition result; use the cross-entropy loss function as the loss function of the convolutional neural network; optimize the convolutional neural network through the improved Adam optimizer until the function value of the cross-entropy loss function is less than the preset function value; S9: If the transaction identification result is an abnormal transaction, the current transaction shall be manually reviewed; if the transaction identification result is a normal transaction, the behavioral data of the current transaction shall be stored in the cross-platform normal behavior pattern library.

2. The abnormal transaction identification method based on correlation analysis according to claim 1, characterized in that, Specifically, S1 is: The historical normal behavior pattern data is collected from the transaction records of various trading platforms. The historical normal behavior pattern data refers to the data on normal user behavior collected and analyzed over a long period of time in a specific system.

3. The abnormal transaction identification method based on correlation analysis according to claim 1, characterized in that, The representative features used to distinguish between normal and abnormal transactions in S202 include: static features and dynamic features; The static features include user ID, device information, transaction account information, and payment method; The dynamic features include transaction amount, transaction time, transaction frequency, and number of times the payment password has been entered.

4. The abnormal transaction identification method based on correlation analysis according to claim 1, characterized in that, Specifically, S7 includes: S701: Using One-Hot encoding, the static features in the transaction activity features corresponding to the transaction data initially marked as normal transactions are transformed into the first feature vector; S702: Using standardization and normalization, the dynamic features in the transaction activity features corresponding to the transaction data initially marked as normal transactions are transformed into a second feature vector; S703: Perform feature concatenation on the first feature vector and the second feature vector to obtain the comprehensive feature vector.

5. The abnormal transaction identification method based on correlation analysis according to claim 1, characterized in that, The convolutional neural network specifically includes: The comprehensive feature vector is transformed into a target feature map; A 1x1 convolution kernel is used to perform a convolution operation on the target feature map to generate a first feature map; The target feature map is convolved using depthwise convolution to generate a second feature map. The first feature map and the second feature map are concatenated and spliced ​​along the channel dimension; Perform pooling operation on the concatenated feature map; The feature map after pooling is activated using the ReLU activation function; Using the activated feature map as input, the rows and columns of the feature map are processed separately through the fully connected layers of the deep convolutional neural network using the DFC attention mechanism. An attention map is generated by weighted summation of each location in the processed feature map with its corresponding horizontal and vertical neighborhoods. Based on the attention map, the transaction recognition result is output through the Softmax function.

6. The abnormal transaction identification method based on correlation analysis according to claim 1, characterized in that, The transaction identification results specifically include: abnormal transactions and normal transactions.

7. The abnormal transaction identification method based on correlation analysis according to claim 1, characterized in that, The improved Adam optimizer specifically includes: First, initialize the parameters, including the initial weights. Learning rate First-order moment decay rate Second-order moment decay rate ,constant ; Calculate the first and second moments: （6） （7） in, Let i represent the first moment of the i-th parameter in the t-th iteration. This represents the first-order moment decay rate. This represents the first moment of the i-th parameter in the (t-1)-th iteration. This represents the gradient of the i-th parameter. Let i represent the second moment of the i-th parameter in t iterations. This represents the second-order moment decay rate. Let represent the second moment of the i-th parameter in the (t-1)th iteration. Represents the square of the gradient; Corrections are made for the first and second moments: （8） （9） in, It is the first moment after bias correction for the i-th parameter. It is the first-order moment decay rate. It is the second moment after bias correction for the i-th parameter. It is the second-order moment decay rate; An adaptive learning function is introduced, which updates the parameters using the bias-corrected moments and the adaptive learning function: （10） （11） in, It is the update value of the i-th parameter in the (t+1)-th iteration. It is the updated value of the i-th parameter in the t-th iteration. This is the current learning rate. It is a constant. It is an adaptive learning function. λ is the scaling factor, λ is the sensitivity factor, and t is the current step number; Continue performing the above steps until the preset number of training rounds is reached or the loss converges. The parameters will be updated in each iteration, and the learning rate will be adjusted according to the training progress.

8. An abnormal transaction identification system based on correlation analysis, characterized in that, include: processor; A memory storing computer-readable instructions, which, when executed by the processor, implement the abnormal transaction identification method based on correlation analysis as described in any one of claims 1 to 7.

Images