Abnormal transaction identification method and system based on space-time relevance

Abstract

The invention provides an abnormal transaction identification method and system based on space-time relevance, and relates to the technical field of data processing, and the method comprises the steps: collecting multivariate time sequence transaction data, and carrying out the standardization processing of the data multivariate time sequence transaction; dividing the standardized data into a plurality of target time sequence transaction data according to a time window, and constructing a graph structure for input; based on graph structure input, utilizing a graph attention network to extract spatio-temporal features; performing feature reconstruction by using a Transform model based on the spatio-temporal features and the standardized data to obtain reconstruction data in one-to-one correspondence with the target transaction data; obtaining an abnormal score by calculating a reconstruction error between the target time sequence transaction data and the reconstruction data; judging whether the target data is abnormal or not according to comparison between the abnormal score and a dynamic threshold value; and sending the identified abnormal transaction data to a manager for manual confirmation.

Description

Technical Field

[0001] The present invention belongs to the technical field of data processing, and more specifically, relates to a method and device for identifying abnormal transactions based on spatiotemporal correlation. Background Art

[0002] With the rapid development of financial markets and the continuous increase in transaction data, anomaly detection in trading systems has become a crucial tool for ensuring the healthy operation of financial markets. Abnormal transactions generally refer to trading behaviors that deviate from normal patterns, such as market manipulation, fraud, or other trading patterns that do not conform to expectations. To promptly detect these abnormal transactions, numerous methods and technologies have been proposed. Among them, abnormal transaction identification methods based on spatiotemporal correlation have become a research hotspot in recent years.

[0003] By comprehensively considering the spatial and temporal characteristics of transaction data, spatiotemporal correlation anomaly detection methods can better capture complex patterns in trading behavior. In time series data, temporal continuity and spatial correlation often lead to potential correlations between trading activities in different time periods. This spatiotemporal correlation provides richer clues for anomaly detection, especially in the case of multivariate time series data, effectively improving the accuracy of anomaly identification.

[0004] However, existing methods often assume that data conforms to a known distribution. This makes them difficult to effectively process transaction data that exhibits high levels of nonlinearity and complexity, resulting in low accuracy in identifying abnormal transactions. Furthermore, existing evaluation mechanisms often rely on fixed thresholds, which are prone to both false positives and false negatives.

[0005] For example, Chinese patent document CN119693111A discloses a method and device for detecting and assessing financial transaction anomalies and risks based on artificial intelligence. The method includes: collecting and preprocessing multi-source financial transaction-related data to obtain a multi-dimensional transaction data set; performing feature engineering and abnormal pattern recognition on the multi-dimensional transaction data set to obtain abnormal transaction identification results; constructing a financial field knowledge graph based on the abnormal transaction identification results and multi-dimensional transaction data to obtain a relationship network between transaction entities; performing multi-dimensional risk assessment on the relationship network between transaction entities to obtain risk scores and risk description data; based on the risk scores, performing time series analysis and trend extrapolation on the risk description data to obtain dynamic risk warning signals; performing scenario simulation and multi-factor analysis on the dynamic risk warning signals to obtain risk management strategy recommendations.

[0006] In view of this, the present invention designs a method and system for identifying abnormal transactions based on spatiotemporal correlation. Summary of the Invention

[0007] The present invention aims to overcome at least one of the aforementioned shortcomings of the existing technologies by providing a method for identifying abnormal transactions based on spatiotemporal correlation. This method addresses the problem that existing methods often assume that data conforms to a known distribution, making it difficult to effectively process transaction data exhibiting high levels of nonlinearity and complexity, resulting in low accuracy in identifying abnormal transactions. Furthermore, existing assessment mechanisms often rely on fixed thresholds, making them prone to false positives and false negatives.

[0008] The invention also discloses an abnormal transaction identification system based on time-space correlation.

[0009] The detailed technical solutions of the present invention are as follows: A method for identifying abnormal transactions based on spatiotemporal correlation, the method comprising: S1. Collect multivariate time series transaction data; S2. Perform data standardization on the multivariate time series transaction data to convert data of different features to the same scale, eliminating the influence of different dimensions, units, and numerical ranges. After standardization, the data will have the same mean and standard deviation, making the values of different features more comparable, thereby improving the training effect of the model; S3. Divide the standardized multivariate time series transaction data into multiple target multivariate time series transaction data according to time windows; S4. Constructing a graph structure input based on each of the target multivariate time series transaction data; S5. Using the graph structure input as the input of the graph attention network, and outputting the spatiotemporal features of the graph structure input; S6. Based on the spatiotemporal features and each of the target multivariate time series transaction data, use a Transformer model to perform feature reconstruction to obtain reconstructed multivariate time series transaction data that has a one-to-one correspondence with each of the target multivariate time series transaction data; S7. Calculate the reconstruction error between each target multivariate time series transaction data and the corresponding reconstructed multivariate time series transaction data as the anomaly score of each target multivariate time series transaction data; S8. Determine whether the anomaly score of each target multivariate time series transaction data is less than a dynamic anomaly score threshold; if so, identify the target multivariate time series transaction data as normal transaction data; otherwise, identify the target multivariate time series transaction data as abnormal transaction data; S9. Send the abnormal transaction data to a management staff for manual confirmation, and generate a report on the abnormal transaction data.

[0010] According to a preferred embodiment of the present invention, the multivariate time series transaction data specifically includes: Transaction price, highest transaction price, lowest transaction price, transaction volume, number of transactions and price fluctuation range.

[0011] According to a preferred embodiment of the present invention, S3 specifically includes: S301: Setting the time step of the time window; S302: Based on the time step, the multivariate time series transaction data after data standardization is divided into T target multivariate time series transaction data in a sliding window manner: (1) in, Represents a collection of multivariate time series transaction data, Represents the t-th time window data, , P represents the total number of time windows.

[0012] Preferably, according to the present invention, S4 specifically includes: S401: Divide a single time series in each target multivariate time series transaction data into multiple time period series; S402: Treat each time period sequence as a graph node and construct a set of graph nodes, where each graph node represents a transaction feature: (2) Among them, E represents the data matrix of graph structure input, represents the domain of real numbers, K represents the total number of time periods, N represents the number of features of the multivariate time series, and l represents the time step; S403: Connecting transaction features with spatial correlation within the same time window to construct edges containing spatial correlation; S404: Connecting transaction features with time correlation in different time windows to construct edges containing time correlation; S405: Combine each of the graph nodes with the corresponding edges to form the graph structure input.

[0013] Preferably, according to the present invention, S5 specifically includes: S501: Calculate the attention score between each pair of nodes in the graph structure input: (3) in, represents the attention score between the i-th node and the j-th node, LeakyReLU represents the activation function, represents the feature vector of the i-th node, represents the original feature vector of the jth node, W represents the weight matrix, represents the learning attention coefficient, T represents the transposition operation, Indicates column-by-column splicing. Represents the set of neighbor nodes of the i-th node; S502: Normalize the attention scores between each pair of nodes to obtain normalized attention scores: (4) in, represents the normalized attention score between the i-th node and the j-th node, exp represents the exponential function, k represents the set of all neighbor nodes of the i-th node, Represents the attention score between the i-th node and the d-th node; S503: Based on the normalized attention score, weighted aggregation is performed on the corresponding neighbor node features to obtain multiple aggregated features: (5) in, represents the aggregated features of the i-th node, represents the activation function, W represents the weight matrix, represents the updated feature vector of the jth node; S504: Combining the aggregated features as spatiotemporal feature output of the graph structure input.

[0014] Preferably, according to the present invention, S6 specifically includes: S601: performing dimensionality transformation on the spatiotemporal features of the graph structure input, adjusting the dimensions of the spatiotemporal features, and adjusting the originally complex and multi-dimensional spatiotemporal features to a unified dimension that meets the Transformer input requirements while retaining the rich characteristics of the graph structure input; S602: Merging the spatiotemporal features after dimension transformation with each of the target multivariate time series transaction data to obtain merged data; S603: Output the merged data to the Transformer model to calculate the query vector, key vector, and value vector: (6) (7) (8) Among them, Q represents the query vector in the Transformer model, F represents the merged data, represents the weight matrix of the query vector, represents the bias term of the query vector, K represents the key vector in the Transformer model, represents the weight matrix of the key vector, represents the bias term of the key vector, and V represents the value vector in the Transformer model; S604: Calculate the target attention score using the relationship between the query vector and the key vector: (9) in, represents the target attention score, represents the softmax operation, T represents the transpose operation, and d represents the dimension of the query vector and the key vector; S605: Perform weighted aggregation on the value vector according to the target attention score to obtain a node weighted feature: (10) Among them, s represents the node weighted feature, and LayerNorm represents layer normalization; S606: Extracting high-dimensional features of the node weighted features using the feedforward layer of the Transformer model: (11) Among them, S represents the high-dimensional features calculated by the feedforward layer, ReLU represents the activation function, represents the weight matrix of the first layer, represents the bias term of the first layer, represents the weight matrix of the second layer, represents the bias term of the second layer; S607: Reconstruct the high-dimensional features into reconstructed multivariate time series transaction data in a one-to-one correspondence with each target multivariate time series transaction data through the decoder of the Transformer model: (12) in, represents the reconstructed multivariate time series transaction data, represents the weight matrix of the third layer, Represents the bias term of the third layer.

[0015] According to a preferred embodiment of the present invention, the abnormality score is calculated as follows: (13) in, represents the anomaly score of the t-th time window, It represents the value of the nth feature in the target multivariate time series transaction data at the kth time step, N represents the total number of features, and L represents the total number of time steps. Represents the value of the nth feature in the reconstructed data at the kth time step.

[0016] According to a preferred embodiment of the present invention, the dynamic anomaly score threshold is calculated as follows: (14) (15) (16) in, represents the dynamic anomaly score threshold of the t-th time window, represents the mean of the anomaly score in the t-th time window, represents the standard deviation of the anomaly score in the t-th time window, represents the sensitivity coefficient, represents the anomaly score of the i-th historical time window, and P represents the total number of time windows.

[0017] In another aspect of the present invention, a system for identifying abnormal transactions based on spatiotemporal correlation is provided, comprising: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the abnormal transaction identification method based on spatiotemporal correlation as described above is implemented.

[0018] Compared with the prior art, the present invention has the following beneficial effects: The multivariate time-series transaction data of the present invention is processed by standardization and time window division, eliminating scale differences and effectively capturing time-series correlations. The input construction based on the graph structure and the graph attention network successfully learn the spatiotemporal dependencies in the data, avoiding assumptions about data distribution and being able to better handle complex and nonlinear transaction data. The Transformer model automatically extracts complex spatiotemporal features and performs feature reconstruction through the self-attention mechanism, further improving recognition accuracy. At the same time, the introduction of a dynamic anomaly score threshold can automatically adjust the threshold according to changes in the data environment, thereby effectively reducing false positives and false negatives and improving the adaptability of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a flow chart of a method for identifying abnormal transactions based on spatiotemporal correlation according to the present invention.

[0020] Figure 2 A schematic diagram of the structure of an abnormal transaction identification system based on spatiotemporal correlation provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The present disclosure will be further described below with reference to the accompanying drawings and embodiments.

[0022] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present disclosure belongs.

[0023] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0024] In the absence of conflict, the embodiments of the present disclosure and the features thereof may be combined with each other.

[0025] Example 1 Ginseng Figure 1 The present invention provides a method for identifying abnormal transactions based on spatiotemporal correlation. This method can be implemented by a device for identifying abnormal transactions based on spatiotemporal correlation, which can be a terminal or a server. The process flow of the method for identifying abnormal transactions based on spatiotemporal correlation can include the following steps: S1: Collect multivariate time series transaction data.

[0026] Multivariate time-series trading data refers to a collection of data that records the changes in multiple different types of trading features over time. This data is commonly used in financial markets to help analyze market dynamics, identify trends, predict price fluctuations, and detect abnormal trading behavior. Its characteristic is that it contains a sequence of multiple different indicators (features) that change over time.

[0027] In one possible implementation, the multivariate time series transaction data specifically includes: Transaction price, highest transaction price, lowest transaction price, transaction volume, number of transactions and price fluctuation range.

[0028] In this embodiment of the present invention, by collecting multiple different types of transaction features, such as transaction price, highest transaction price, lowest transaction price, trading volume, number of transactions, and price fluctuation range, dynamic market changes can be comprehensively reflected from multiple dimensions. This multi-dimensional data helps provide more detailed market analysis and avoids the limitations that may be caused by a single feature. Furthermore, transaction data in financial markets often exhibits complex nonlinear relationships. By simultaneously considering the interactions between multiple features, these complex dynamic behaviors can be better modeled, improving the model's adaptability and accuracy to market fluctuations.

[0029] S2: Perform data standardization on multivariate time series transaction data.

[0030] Data normalization (or standardization) is a crucial step in data preprocessing. It aims to convert data with different features to the same scale, eliminating the effects of varying dimensions, units, and numerical ranges. After standardization, the data will have the same mean and standard deviation, making the values of different features more comparable, thereby improving model training effectiveness.

[0031] Optionally, the data normalization process is specifically as follows: The data were transformed into a distribution with a mean of 0 and a standard deviation of 1 by Z-score normalization.

[0032] In this embodiment of the present invention, by converting the data into a distribution with a mean of 0 and a standard deviation of 1, the scale differences between different features are effectively eliminated. In actual trading data, there may be features such as price, trading volume, and price fluctuation range, and their numerical ranges and units may be completely different. After Z-score normalization, the numerical ranges of each feature are unified, allowing them to be compared on the same scale, avoiding the excessive influence of certain features on model training.

[0033] S3: Divide the standardized multivariate time series transaction data into multiple target multivariate time series transaction data according to time windows.

[0034] Time windowing is a common technique used in time series data analysis. It divides continuous time series data into fixed-length time periods, allowing analysis, processing, or modeling of the data within each time period. This approach is particularly well-suited for processing time series data, helping models capture the dynamic characteristics of data as it changes over time.

[0035] In a possible implementation, S3 specifically includes: S301: Setting the time step of the time window.

[0036] The time step is a key concept in time series data processing, typically referring to the time interval between data points in the data. When analyzing time series data, the time step determines the frequency and granularity of the data processed by the model at each time point.

[0037] S302: Based on the time step, the standardized multivariate time series transaction data is divided into multiple target multivariate time series transaction data in a sliding window manner: (1) in, Represents a collection of multivariate time series transaction data, Represents the t-th time window data, , P represents the total number of time windows.

[0038] In the embodiment of the present invention, a reasonable time step can help capture short-term price fluctuations and abnormal behavior. For time series data with strong periodicity, an appropriate time step helps to identify changes within the period without missing key information due to excessively sparse data. At the same time, the data collection interval may be irregular. Setting a time step can effectively divide the data at irregular time points into reasonable groups, avoiding analytical bias caused by irregular data points. For example, in the financial market, sudden events may occur in certain time periods. A reasonable time step can help the model better capture the impact of these events on the market.

[0039] S4: Build graph structure input based on each target multivariate time series transaction data.

[0040] In machine learning and deep learning, graph-structured input refers to representing data as a graph structure, using the nodes and edges within the graph to represent the data's features and their relationships. In time series data analysis, particularly multivariate time series transaction data, graph-structured input can effectively capture the complex spatiotemporal dependencies within the data. The nodes in the graph structure represent certain features of the data, while the edges represent the correlations between features.

[0041] In a possible implementation, S4 specifically includes: S401: Divide a single time series in each target multivariate time series transaction data into multiple time period series.

[0042] A time segment series is typically a subsequence created by dividing a continuous time series into multiple fixed-length time segments (or "segments"). Each time segment represents a portion of the data, which can be analyzed or modeled independently to capture local characteristics and temporal variations in the data.

[0043] S402: Treat each time period sequence as a graph node and construct a set of graph nodes, where each graph node represents a transaction feature: (2) Among them, E represents the data matrix of graph structure input, represents the real number domain, K represents the total number of time periods, N represents the number of features of the multivariate time series, and l represents the time step.

[0044] In the embodiment of the present invention, after the time series is divided into multiple time period sequences, each time period sequence is processed as a graph node, which can effectively capture local patterns and short-term fluctuations.

[0045] S403: Connecting transaction features with spatial correlation within the same time window to construct edges containing spatial correlation.

[0046] S404: Connect transaction features with time correlation in different time windows to construct edges containing time correlation.

[0047] S405: Combine each graph node with the corresponding edges to form a graph structure input.

[0048] Specifically, the time series in each target multivariate time series transaction data set is first divided into multiple time period sequences, with each time period sequence being treated as a node in the graph. Next, the dependencies between different nodes are represented by edges: related features within the same time window are connected by edges, indicating spatial correlation. Features with temporal correlations between different time windows are connected by edges, indicating temporal dependency. Ultimately, the collection of nodes and edges forms the graph structure input, providing spatiotemporal features for subsequent graph neural network learning and prediction.

[0049] In embodiments of the present invention, time and space are often two inseparable and important features of multivariate time-series transaction data. By simultaneously incorporating temporally and spatially correlated edges into a graph structure, the model can simultaneously consider the interaction between these two dimensions during learning, thereby enhancing a comprehensive understanding of changes in transaction data. Furthermore, the graph structure can effectively identify anomalous behavior in the data that does not conform to conventional patterns. By modeling the spatiotemporal correlations between transaction features, anomalous transaction patterns often manifest as unusual nodes or edge connections in the graph. Graph neural networks can identify these anomalous patterns through the unusual graph structure, thereby improving the precision and accuracy of anomaly detection.

[0050] S5: Take the graph structure input as the input of the graph attention network and output the spatiotemporal features of the graph structure input.

[0051] The Graph Attention Network (GAT) is a deep learning model based on a graph neural network (GNN) specifically designed for processing graph data structures. The core idea of GAT is to dynamically assign different weights to each node's neighbors through an attention mechanism. This enables the model to automatically learn and adjust the influence of different neighboring nodes.

[0052] In a possible implementation, S5 specifically includes: S501: Calculate the attention score between each pair of nodes in the graph structure input: (3) in, represents the attention score between the i-th node and the j-th node, LeakyReLU represents the activation function, represents the feature vector of the i-th node, represents the original feature vector of the jth node, W represents the weight matrix, represents the learning attention coefficient, T represents the transposition operation, Indicates column-by-column splicing. Represents the set of neighbor nodes of the i-th node.

[0053] S502: Normalize the attention scores between each pair of nodes to obtain normalized attention scores: (4) in, represents the normalized attention score between the i-th node and the j-th node, exp represents the exponential function, k represents the set of all neighbor nodes of the i-th node, represents the attention score between the i-th node and the d-th node.

[0054] In embodiments of the present invention, the graph attention network effectively handles nonlinear relationships between nodes in a graph by calculating attention scores and normalizing them. The relationships between nodes are often complex, especially in spatiotemporal data, where relationships between nodes are often not simple linear dependencies. The attention mechanism allows the model to flexibly capture these nonlinear dependencies, improving its adaptability to complex data patterns.

[0055] S503: Based on the normalized attention score, perform weighted aggregation on the corresponding neighbor node features to obtain multiple aggregated features: (5) in, represents the aggregated features of the i-th node, represents the activation function, W represents the weight matrix, represents the updated feature vector of the j-th node.

[0056] S504: Combining the various aggregated features as spatiotemporal feature output of the graph structure input.

[0057] In an embodiment of the present invention, a graph attention network uses an attention mechanism to dynamically assign different weights to each node's neighbors. This means that for each node, the model can determine which neighbors have the greatest influence on the current node based on the characteristics of its neighboring nodes, thereby adaptively adjusting the influence of these neighbors. This mechanism can automatically learn and capture complex local relationships within the graph without requiring any fixed weighting rules, thereby improving the model's expressiveness. Furthermore, by feeding the graph structure into the graph attention network, the model can simultaneously learn feature dependencies in both temporal and spatial dimensions. For example, temporally adjacent time windows may be correlated, and spatially distinct trading features (such as price and volume) may also have dependencies. Through weighted aggregation within the graph attention network, these temporal and spatial features can be effectively combined, enabling more accurate modeling of time series data.

[0058] S6: Based on the spatiotemporal features and each target multivariate time series transaction data, the Transformer model is used to reconstruct the features to obtain reconstructed multivariate time series transaction data that has a one-to-one correspondence with each target multivariate time series transaction data.

[0059] The core idea of the Transformer model is to capture the relationship between each position in the input sequence through the self-attention mechanism, rather than relying on the traditional sequential recursive approach. This enables the Transformer to process sequential data in parallel, improve computational efficiency, and better capture long-range dependencies.

[0060] In a possible implementation, S6 specifically includes: S601: Perform dimensionality transformation on the spatiotemporal features of the graph structure input, and adjust the dimensions of the spatiotemporal features to be suitable for input into the Transformer model.

[0061] S602: Merge the spatiotemporal features after dimension transformation with each target multivariate time series transaction data to obtain merged data.

[0062] In this embodiment of the present invention, spatiotemporal features are combined with the target multivariate time-series transaction data, enabling the Transformer to process these different types of data simultaneously. This fusion approach allows the model to consider both spatiotemporal features and the patterns of the original transaction data during learning, further improving the accuracy of feature reconstruction and helping the model learn more comprehensive information from multiple dimensions.

[0063] S603: Output the merged data to the Transformer model to calculate the query vector, key vector, and value vector: (6) (7) (8) Among them, Q represents the query vector in the Transformer model, F represents the merged data, represents the weight matrix of the query vector, represents the bias term of the query vector, K represents the key vector in the Transformer model, represents the weight matrix of the key vector, represents the bias term of the key vector, and V represents the value vector in the Transformer model.

[0064] S604: Calculate the target attention score using the relationship between the query vector and the key vector: (9) in, represents the target attention score, represents the softmax operation, T represents the transpose operation, and d represents the dimension of the query vector and the key vector.

[0065] S605: Perform weighted aggregation on the value vector according to the target attention score to obtain the node weighted feature: (10) Among them, s represents the node weighted feature and LayerNorm represents layer normalization.

[0066] In this embodiment of the present invention, the attention calculation and weighted aggregation process allows the model to dynamically learn the relationships between neighboring nodes based on the characteristics of the data itself. This mechanism avoids fixed weight assignments and enables the model to flexibly adjust the degree of attention it pays to neighboring nodes based on the specific context of each node.

[0067] S606: Use the feedforward layer of the Transformer model to extract high-dimensional features of node weighted features: (11) Among them, S represents the high-dimensional features calculated by the feedforward layer, ReLU represents the activation function, represents the weight matrix of the first layer, represents the bias term of the first layer, represents the weight matrix of the second layer, Represents the bias term of the second layer.

[0068] S607: Through the decoder of the Transformer model, the high-dimensional features are reconstructed into reconstructed multivariate time series transaction data that has a one-to-one correspondence with each target multivariate time series transaction data: (12) in, represents the reconstructed multivariate time series transaction data, represents the weight matrix of the third layer, Represents the bias term of the third layer.

[0069] In this embodiment of the present invention, the Transformer can output a reconstruction result consistent with the original data through the decoder based on previous spatiotemporal features and transaction data. Thanks to the introduction of the attention mechanism, the model can fully utilize historical information during reconstruction, thereby reducing information loss caused by improper data processing or feature selection.

[0070] S7: Calculate the reconstruction error between each target multivariate time series transaction data and the corresponding reconstructed multivariate time series transaction data as the anomaly score of each target multivariate time series transaction data.

[0071] Reconstruction error is a metric that measures the difference between original data and data reconstructed using a model (such as an autoencoder, variational autoencoder, or Transformer). It is a commonly used metric in anomaly detection and feature learning, particularly in unsupervised learning. Reconstruction error can be used to identify abnormal data that differs from normal patterns.

[0072] In one possible implementation, the anomaly score is calculated as follows: (13) in, represents the anomaly score of the t-th time window, It represents the value of the nth feature in the target multivariate time series transaction data at the kth time step, N represents the total number of features, and L represents the total number of time steps. Represents the value of the nth feature in the reconstructed data at the kth time step.

[0073] In this embodiment of the present invention, using reconstruction error as an anomaly score provides a quantitative indicator of the degree of anomaly in each time window, thereby helping the model identify potentially anomalous trading data. Furthermore, by calculating the error between the target multivariate time series trading data and its reconstructed data, the model can use the anomaly score to identify anomalous behavior in the data. For most time series data, anomalous behavior (such as market manipulation and price manipulation) typically manifests as large fluctuations that deviate from normal patterns. Using reconstruction error as an anomaly score effectively detects these anomalous behaviors, improving the accuracy of anomaly detection.

[0074] S8: Determine whether the anomaly score of each target multivariate time series transaction data is less than a dynamic anomaly score threshold. If so, identify the target multivariate time series transaction data as normal transaction data. Otherwise, identify the target multivariate time series transaction data as abnormal transaction data.

[0075] It should be noted that in order to better reflect the volatility and trend of the data, within each time window, the system calculates the anomaly score threshold for the current time window based on the scores of the past T windows (i.e., historical anomaly scores).

[0076] In one possible implementation, the dynamic anomaly score threshold is calculated as follows: (14) (15) (16) in, represents the dynamic anomaly score threshold of the t-th time window, represents the mean of the anomaly score in the t-th time window, represents the standard deviation of the anomaly score in the t-th time window, represents the sensitivity coefficient, represents the anomaly score of the i-th historical time window, and P represents the total number of time windows.

[0077] In this embodiment of the present invention, the dynamic anomaly score threshold allows the model to adapt to data changes and adjust the threshold over time, enabling the model to flexibly respond to market volatility. Furthermore, the introduction of dynamic thresholds ensures that the model maintains efficient anomaly detection capabilities under varying market conditions, avoiding the potential for false positives or false negatives associated with static thresholds.

[0078] Furthermore, by dynamically calculating thresholds, the model can automatically adjust detection criteria, rather than relying on manually set static thresholds. This avoids the subjective errors that can occur when manually setting thresholds and allows for a more objective assessment of whether the current data is abnormal.

[0079] S9: Send abnormal transaction data to management personnel for manual confirmation.

[0080] While the automated detection system in this embodiment can effectively identify most abnormal transactions, due to market complexity and data diversity, the automated model may experience false positives (misidentifying normal transactions as abnormal) and false negatives (failing to identify truly abnormal transactions). By sending suspected abnormal transaction data to human management for manual confirmation, these risks can be effectively mitigated, ensuring that truly abnormal transactions are identified and that no potential issues are missed.

[0081] In a possible implementation manner, after S9, the method further includes: Generate reports on unusual transaction data.

[0082] In this embodiment of the present invention, generating an abnormal transaction report can provide management and audit teams with detailed analysis, helping them understand the specific circumstances of abnormal transactions. The report can include detailed information such as the transaction time, transaction amount, involved accounts, and the type of abnormal pattern, providing the necessary data support for subsequent investigation, analysis, and decision-making.

[0083] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least: In an embodiment of the present invention, multivariate time-series transaction data is standardized and time-windowed, removing scale differences and effectively capturing time-series correlations. The graph-structured input construction and graph attention network successfully learn the spatiotemporal dependencies in the data, avoiding assumptions about data distribution and enabling better processing of complex and nonlinear transaction data. The Transformer model automatically extracts complex spatiotemporal features and reconstructs them through a self-attention mechanism, further improving recognition accuracy. Furthermore, the introduction of a dynamic anomaly score threshold automatically adjusts the threshold based on changes in the data environment, effectively reducing false positives and false negatives and improving the model's adaptability.

[0084] Example 2 like Figure 2 This embodiment further provides an abnormal transaction identification system 20 based on spatiotemporal correlation, which is applied to the above-mentioned abnormal transaction identification method based on spatiotemporal correlation, and includes: Processor 201.

[0085] The memory 202 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 201 , the abnormal transaction identification method based on spatiotemporal correlation as in the method embodiment is implemented.

[0086] The abnormal transaction identification system 20 based on spatiotemporal correlation provided by the present invention can execute the above-mentioned abnormal transaction identification method based on spatiotemporal correlation and achieve the same or similar technical effects. To avoid repetition, the present invention will not elaborate on them.

[0087] Obviously, the above embodiments of the present invention are merely examples for the purpose of clearly illustrating the technical solutions of the present invention, and are not intended to limit the specific implementation methods of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention shall be included within the scope of protection of the claims of the present invention.

Claims

1. A method for identifying abnormal transactions based on spatiotemporal correlation, characterized in that: The method comprises: S1. Collect multivariate time series transaction data; S2. Perform data standardization on the multivariate time series transaction data to convert data with different characteristics into the same scale. After standardization, the data will have the same mean and standard deviation. S3. Divide the standardized multivariate time series transaction data into multiple target multivariate time series transaction data according to time windows; S4. Constructing a graph structure input based on each of the target multivariate time series transaction data; S5. Using the graph structure input as the input of the graph attention network, and outputting the spatiotemporal features of the graph structure input; S6. Based on the spatiotemporal features and each of the target multivariate time series transaction data, use a Transformer model to perform feature reconstruction to obtain reconstructed multivariate time series transaction data that has a one-to-one correspondence with each of the target multivariate time series transaction data; S7. Calculate the reconstruction error between each target multivariate time series transaction data and the corresponding reconstructed multivariate time series transaction data as the anomaly score of each target multivariate time series transaction data; S8. Determine whether the anomaly score of each target multivariate time series transaction data is less than a dynamic anomaly score threshold; if so, identify the target multivariate time series transaction data as normal transaction data; otherwise, identify the target multivariate time series transaction data as abnormal transaction data; S9. Send the abnormal transaction data to a management staff for manual confirmation, and generate a report on the abnormal transaction data.

2. The abnormal transaction identification method based on spatiotemporal correlation according to claim 1 is characterized in that: The multivariate time series transaction data specifically includes: Transaction price, highest transaction price, lowest transaction price, transaction volume, number of transactions and price fluctuation range.

3. The abnormal transaction identification method based on spatiotemporal correlation according to claim 1 is characterized in that: The S3 specifically includes: S301: Setting the time step of the time window; S302: Based on the time step, the multivariate time series transaction data after data standardization is divided into T target multivariate time series transaction data in a sliding window manner: （1） in, Represents a collection of multivariate time series transaction data, Represents the t-th time window data, , P represents the total number of time windows.

4. The abnormal transaction identification method based on spatiotemporal correlation according to claim 1 is characterized in that: The S4 specifically includes: S401: Divide a single time series in each target multivariate time series transaction data into multiple time period series; S402: Treat each time period sequence as a graph node and construct a set of graph nodes, where each graph node represents a transaction feature: （2） Among them, E represents the data matrix of graph structure input, represents the domain of real numbers, K represents the total number of time periods, N represents the number of features of the multivariate time series, and l represents the time step; S403: Connecting transaction features with spatial correlation within the same time window to construct edges containing spatial correlation; S404: Connecting transaction features with time correlation in different time windows to construct edges containing time correlation; S405: Combine each of the graph nodes with the corresponding edges to form the graph structure input.

5. The abnormal transaction identification method based on spatiotemporal correlation according to claim 4 is characterized in that: The S5 specifically includes: S501: Calculate the attention score between each pair of nodes in the graph structure input: （3） in, represents the attention score between the i-th node and the j-th node, LeakyReLU represents the activation function, represents the feature vector of the i-th node, represents the original feature vector of the jth node, W represents the weight matrix, represents the learning attention coefficient, T represents the transposition operation, Indicates column-by-column splicing. Represents the set of neighbor nodes of the i-th node; S502: Normalize the attention scores between each pair of nodes to obtain normalized attention scores: （4） in, represents the normalized attention score between the i-th node and the j-th node, exp represents the exponential function, k represents the set of all neighbor nodes of the i-th node, Represents the attention score between the i-th node and the d-th node; S503: Based on the normalized attention score, weighted aggregation is performed on the corresponding neighbor node features to obtain multiple aggregated features: （5） in, represents the aggregated features of the i-th node, represents the activation function, W represents the weight matrix, represents the updated feature vector of the jth node; S504: Combining the aggregated features as spatiotemporal feature output of the graph structure input.

6. The abnormal transaction identification method based on spatiotemporal correlation according to claim 5 is characterized in that: The S6 specifically includes: S601: performing dimensionality transformation on the spatiotemporal features of the graph structure input, adjusting the dimensions of the spatiotemporal features, and adjusting the originally complex and multi-dimensional spatiotemporal features to a unified dimension that meets the Transformer input requirements while retaining the rich characteristics of the graph structure input; S602: Merging the spatiotemporal features after dimension transformation with each of the target multivariate time series transaction data to obtain merged data; S603: Output the merged data to the Transformer model to calculate the query vector, key vector, and value vector: （6） （7） （8） Among them, Q represents the query vector in the Transformer model, F represents the merged data, represents the weight matrix of the query vector, represents the bias term of the query vector, K represents the key vector in the Transformer model, represents the weight matrix of the key vector, represents the bias term of the key vector, and V represents the value vector in the Transformer model; S604: Calculate the target attention score using the relationship between the query vector and the key vector: （9） in, represents the target attention score, represents the softmax operation, T represents the transpose operation, and d represents the dimension of the query vector and the key vector; S605: Perform weighted aggregation on the value vector according to the target attention score to obtain a node weighted feature: （10） Among them, s represents the node weighted feature, and LayerNorm represents layer normalization; S606: Extracting high-dimensional features of the node weighted features using the feedforward layer of the Transformer model: （11） Among them, S represents the high-dimensional features calculated by the feedforward layer, ReLU represents the activation function, represents the weight matrix of the first layer, represents the bias term of the first layer, represents the weight matrix of the second layer, represents the bias term of the second layer; S607: Reconstruct the high-dimensional features into reconstructed multivariate time series transaction data in a one-to-one correspondence with each target multivariate time series transaction data through the decoder of the Transformer model: （12） in, represents the reconstructed multivariate time series transaction data, represents the weight matrix of the third layer, Represents the bias term of the third layer.

7. The abnormal transaction identification method based on spatiotemporal correlation according to claim 1 is characterized in that: The abnormality score is calculated as follows: （13） in, represents the anomaly score of the t-th time window, It represents the value of the nth feature in the target multivariate time series transaction data at the kth time step, N represents the total number of features, and L represents the total number of time steps. Represents the value of the nth feature in the reconstructed data at the kth time step.

8. The abnormal transaction identification method based on spatiotemporal correlation according to claim 1 is characterized in that: The dynamic anomaly score threshold is calculated as follows: （14） （15） （16） in, represents the dynamic anomaly score threshold of the t-th time window, represents the mean of the anomaly score in the t-th time window, represents the standard deviation of the anomaly score in the t-th time window, represents the sensitivity coefficient, represents the anomaly score of the i-th historical time window, and P represents the total number of time windows.

9. An abnormal transaction identification system based on spatiotemporal correlation, characterized in that: include: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the abnormal transaction identification method based on spatiotemporal correlation according to any one of claims 1 to 8 is implemented.

Images