An abnormal transaction identification method and system based on spatio-temporal correlation

Abstract

The application provides an abnormal transaction identification method and system based on space-time correlation, and relates to the technical field of data processing. The method comprises the following steps: collecting multivariate time series transaction data, and performing standardization processing on the multivariate time series transaction data; dividing the data after the standardization processing into a plurality of target time series transaction data according to a time window, and constructing a graph structure input; extracting space-time features by using a graph attention network based on the graph structure input; using a Transformer model to reconstruct features based on the space-time features and the data after the standardization, so as to obtain reconstruction data corresponding to the target transaction data; obtaining an abnormal score by calculating the reconstruction error between the target time series transaction data and the reconstruction data; judging whether the target data is abnormal according to the comparison between the abnormal score and a dynamic threshold; and sending the identified abnormal transaction data to a management personnel for manual confirmation.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data processing, and more particularly, relates to an abnormal transaction identification method and system based on spatio-temporal correlation. BACKGROUND

[0002] With the rapid development of financial markets and the continuous increase of transaction data, abnormal detection of transaction systems has become an important means to ensure the healthy operation of financial markets. Abnormal transactions usually refer to transaction behaviors that deviate from normal patterns, such as market manipulation, fraudulent behavior, or other unexpected transaction patterns. In order to timely discover these abnormal transactions, many methods and technologies have been proposed, among which the abnormal transaction identification method based on spatio-temporal correlation has become a research hotspot in recent years.

[0003] The spatio-temporal correlation anomaly detection method can better capture complex patterns in transaction behavior by comprehensively considering the spatial and temporal characteristics of transaction data. In time series data, the continuity in time and the correlation in space often lead to potential correlations between transaction activities in different time periods. This spatio-temporal correlation provides more rich clues for anomaly detection, especially in the case of multi-dimensional time series data, which can effectively improve the accuracy of anomaly identification.

[0004] However, existing methods usually assume that data conforms to a certain known distribution, which is difficult to effectively handle in the face of transaction data showing high nonlinearity and complexity, resulting in low accuracy of abnormal transaction identification. At the same time, the existing evaluation mechanism is mostly fixed threshold, which is easy to appear false alarm and miss.

[0005] For example, Chinese patent document CN119693111A discloses a financial transaction anomaly detection and risk assessment method and device based on artificial intelligence, which includes: collecting and preprocessing multi-source financial transaction related data to obtain a multi-dimensional transaction data set; performing feature engineering and abnormal pattern recognition on the multi-dimensional transaction data set to obtain abnormal transaction identification results; constructing a financial domain knowledge graph based on the abnormal transaction identification results and the multi-dimensional transaction data to obtain a relationship network between transaction entities; performing multi-dimensional risk assessment on the relationship network between transaction entities to obtain risk scores and risk description data; based on the risk scores, performing time series analysis and trend extrapolation on the risk description data to obtain dynamic risk warning signals; performing scenario simulation and multi-factor analysis on the dynamic risk warning signals to obtain risk management strategy suggestions.

[0006] Therefore, the application designs an abnormal transaction identification method and system based on spatio-temporal correlation. SUMMARY

[0007] The present application aims to overcome at least one of the above-mentioned defects of the prior art, and provides an abnormal transaction identification method based on spatio-temporal correlation, so as to solve the problem that the existing method generally assumes that the data conforms to a certain known distribution, and it is difficult to effectively process the transaction data showing high nonlinearity and complexity, resulting in low accuracy of abnormal transaction identification. At the same time, the existing evaluation mechanism is a fixed threshold, which is prone to false positives and false negatives.

[0008] The present application also discloses an abnormal transaction identification system based on spatio-temporal correlation.

[0009] The detailed technical solutions of the present application are as follows:

[0010] An abnormal transaction identification method based on spatio-temporal correlation, the method comprising:

[0011] S1, collecting multi-element time series transaction data;

[0012] S2, performing data standardization processing on the multi-element time series transaction data, converting data of different characteristics to the same scale, eliminating the influence of different dimensions, units and numerical ranges, and after standardization processing, the data will have the same mean and standard deviation, so that the values between different characteristics are more comparable, thereby improving the training effect of the model;

[0013] S3, dividing the multi-element time series transaction data after data standardization processing into a plurality of target multi-element time series transaction data according to time windows;

[0014] S4, constructing a graph structure input based on each target multi-element time series transaction data;

[0015] S5, taking the graph structure input as the input of a graph attention network, and outputting the spatio-temporal features of the graph structure input;

[0016] S6, using a Transformer model to reconstruct features based on the spatio-temporal features and each target multi-element time series transaction data, to obtain reconstructed multi-element time series transaction data in one-to-one correspondence with each target multi-element time series transaction data;

[0017] S7, calculating the reconstruction error between each target multi-element time series transaction data and the corresponding reconstructed multi-element time series transaction data as the abnormal score of each target multi-element time series transaction data;

[0018] S8, judging whether the abnormal score of each target multi-element time series transaction data is less than a dynamic abnormal score threshold; if yes, identifying the target multi-element time series transaction data as normal transaction data; otherwise, identifying the target multi-element time series transaction data as abnormal transaction data;

[0019] S9, sending the abnormal transaction data to a manager for manual confirmation, and generating a report about the abnormal transaction data.

[0020] According to the application, preferably, the multi-dimensional time series transaction data specifically includes:

[0021] transaction price, highest transaction price, lowest transaction price, transaction volume, transaction number and price fluctuation range.

[0022] According to the application, preferably, the S3 specifically includes:

[0023] S301: setting the time step of the time window;

[0024] S302: based on the time step, dividing the multi-dimensional time series transaction data after data standardization processing into t target multi-dimensional time series transaction data in a sliding window manner:

[0025] (1)

[0026] wherein, denotes a set of multi-dimensional time series transaction data, denotes the tth time window data, and P denotes the total number of time windows.

[0027] According to the application, preferably, the S4 specifically includes:

[0028] S401: dividing a single time series in each target multi-dimensional time series transaction data into a plurality of time period sequences;

[0029] S402: taking each time period sequence as a graph node to construct a set of graph nodes, wherein each graph node represents a transaction feature:

[0030] (2)

[0031] wherein E denotes a data matrix of graph structure input, denotes a real number field, K denotes the total number of time periods, N denotes the number of features of multi-dimensional time series, and l denotes the time step;

[0032] S403: connecting transaction features with spatial correlation in the same time window to construct edges containing spatial correlation;

[0033] S404: connecting transaction features with temporal correlation in different time windows to construct edges containing temporal correlation;

[0034] S405: combining each graph node with corresponding edges to form the graph structure input.

[0035] According to the application, preferably, the S5 specifically comprises:

[0036] S501: calculating an attention score between each pair of nodes in the graph structure input:

[0037] (3)

[0038] wherein, represents the attention score between the i th node and the j th node, LeakyReLU represents an activation function, represents the feature vector of the i th node, represents the original feature vector of the j th node, and W represents a weight matrix, represents a learned attention coefficient, and T represents a transpose operation, represents a column-wise concatenation, represents a set of neighbor nodes of the i th node;

[0039] S502: normalizing the attention score between each pair of nodes to obtain a normalized attention score:

[0040] (4)

[0041] wherein, represents the normalized attention score between the i th node and the j th node, and exp represents an exponential function, represents the attention score between the i th node and the d th node;

[0042] S503: based on the normalized attention score, performing weighted aggregation on the corresponding neighbor node features to obtain a plurality of aggregated features:

[0043] (5)

[0044] wherein, represents the aggregated feature of the i th node, represents an activation function, and W represents a weight matrix, represents an updated feature vector of the j th node;

[0045] S504: combining each of the aggregated features as a spatiotemporal feature output of the graph structure input.

[0046] According to the application, preferably, the S6 specifically comprises:

[0047] S601: Dimension transformation is performed on the spatio-temporal features input by the graph structure, the dimension of the spatio-temporal features is adjusted, the originally complex and multi-dimensional spatio-temporal features are adjusted to a unified dimension conforming to the input requirements of the Transformer, while the rich characteristics of the graph structure input are retained;

[0048] S602: The spatio-temporal features after the dimension transformation are merged with each of the target multi-element time series transaction data to obtain merged data;

[0049] S603: The merged data is output to the Transformer model to calculate a query vector, a key vector and a value vector:

[0050] (6)

[0051] (7)

[0052] (8)

[0053] wherein Q represents the query vector in the Transformer model, F represents the merged data, represents the weight matrix of the query vector, represents the bias term of the query vector, K represents the key vector in the Transformer model, represents the weight matrix of the key vector, represents the bias term of the key vector, and V represents the value vector in the Transformer model;

[0054] S604: A target attention score is calculated by using the relationship between the query vector and the key vector:

[0055] (9)

[0056] wherein represents the target attention score, represents a softmax operation, T represents a transpose operation, and d represents the dimension of the query vector and the key vector;

[0057] S605: The value vector is weighted and aggregated according to the target attention score to obtain a node weighted feature:

[0058] (10)

[0059] wherein s represents the node weighted feature, and LayerNorm represents layer normalization;

[0060] S606: High-dimensional features of the node weighted feature are extracted by using a feedforward layer of the Transformer model:

[0061] (11)

[0062] wherein S represents the high-dimensional feature calculated by the feedforward layer, ReLU represents an activation function, represents a weight matrix of the first layer, represents a bias term of the first layer, represents a weight matrix of the second layer, represents a bias term of the second layer;

[0063] S607: reconstructing the high-dimensional feature into reconstructed multivariate time series transaction data in one-to-one correspondence with each of the target multivariate time series transaction data through a decoder of the Transformer model:

[0064] (12)

[0065] wherein, represents the reconstructed multivariate time series transaction data, represents a weight matrix of the third layer, represents a bias term of the third layer.

[0066] According to the application, preferably, the calculation method of the anomaly score is specifically:

[0067] (13)

[0068] wherein, represents the anomaly score of the tthtime window, represents the value of the nthfeature in the target multivariate time series transaction data at the kthtime step, N represents the total number of features, and L represents the total number of time steps, represents the value of the nthfeature in the reconstructed data at the kthtime step.

[0069] According to the application, preferably, the calculation method of the dynamic anomaly score threshold is specifically:

[0070] (14)

[0071] (15)

[0072] (16)

[0073] wherein, represents the dynamic anomaly score threshold of the tthtime window, represents the mean of the anomaly score of the tthtime window, represents the standard deviation of the anomaly score of the tthtime window, represents a sensitivity coefficient, P represents the anomaly score of the i-th historical time window, and P represents the total number of time windows.

[0074] In another aspect of the present application, an abnormal transaction identification system based on spatio-temporal correlation is also provided, comprising:

[0075] a processor;

[0076] a memory, wherein computer readable instructions are stored on the memory, and the computer readable instructions are executed by the processor to implement the abnormal transaction identification method based on spatio-temporal correlation as described above.

[0077] Compared with the prior art, the present application has the following beneficial effects:

[0078] The multi-element time series transaction data of the present application removes the scale difference and effectively captures the time series correlation through standardization processing and time window division. The input construction based on the graph structure and the graph attention network successfully learn the spatio-temporal dependence in the data, avoid the assumption of data distribution, and can better process complex and nonlinear transaction data. The Transformer model automatically extracts complex spatio-temporal features and reconstructs the features through the self-attention mechanism, further improving the identification accuracy. At the same time, the dynamic anomaly score threshold is introduced, which can automatically adjust the threshold according to the change of the data environment, thereby effectively reducing false positives and false negatives and improving the adaptability of the model. BRIEF DESCRIPTION OF DRAWINGS

[0079] Figure 1 The flowchart of the abnormal transaction identification method based on spatio-temporal correlation of the present application.

[0080] Figure 2 The structure diagram of the abnormal transaction identification system based on spatio-temporal correlation provided by the embodiment of the present application. DETAILED DESCRIPTION

[0081] The present disclosure will be further described below in conjunction with the drawings and embodiments.

[0082] It should be pointed out that the following detailed description is exemplary and is intended to provide further description of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as generally understood by those skilled in the art to which the present disclosure belongs.

[0083] It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments in accordance with the present disclosure. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, steps, operations, devices, components and / or combinations thereof, but do not preclude the presence or addition of one or more other features, steps, operations, devices, components and / or combinations thereof.

[0084] Embodiments in the present disclosure and features in embodiments can be combined if there is no conflict.

[0085] Embodiment 1,

[0086] Referring to Figure 1 The embodiment of the present application provides an abnormal transaction identification method based on space-time correlation. The method can be implemented by an abnormal transaction identification device based on space-time correlation. The device can be a terminal or a server. The processing flow of the abnormal transaction identification method based on space-time correlation can include the following steps:

[0087] S1: Collecting multi-dimensional time series transaction data.

[0088] The multi-dimensional time series transaction data refers to a data set recording the changes of multiple different types of transaction characteristics over time within a period of time. These data are usually used in financial markets to help analyze market dynamics, identify trends, predict price fluctuations, and detect abnormal transaction behavior, etc. The characteristic is that it contains sequences formed by multiple different indicators (characteristics) changing over time.

[0089] In a possible implementation, the multi-dimensional time series transaction data specifically includes:

[0090] Transaction price, highest transaction price, lowest transaction price, trading volume, number of transactions, and price fluctuation range.

[0091] In the embodiment of the present application, by collecting multiple different types of transaction characteristics such as transaction price, highest transaction price, lowest transaction price, trading volume, number of transactions, and price fluctuation range, the dynamic changes of the market can be comprehensively reflected from multiple dimensions. Such multi-dimensional data helps to provide more detailed market analysis and avoid the limitations that may be brought by a single feature. At the same time, the transaction data of the financial market often shows complex nonlinear relationships. By considering the interaction between multiple features at the same time, these complex dynamic behaviors can be better modeled, and the adaptability and accuracy of the model to market changes can be improved.

[0092] S2: Data standardization processing is performed on the multi-dimensional time series transaction data.

[0093] Among them, data normalization processing is an important step of data preprocessing, which aims to convert data of different features to the same scale and eliminate the influence of different dimensions, units and numerical ranges. After standardization processing, the data will have the same mean and standard deviation, so that the values between different features are more comparable, thereby improving the training effect of the model.

[0094] Optionally, the data normalization processing is specifically:

[0095] Through Z-score standardization, the data is converted into a distribution with a mean of 0 and a standard deviation of 1.

[0096] In the embodiments of the present application, by converting the data into a distribution with a mean of 0 and a standard deviation of 1, the scale difference between different features is effectively eliminated. In actual transaction data, there may be price, volume, price change range and other features, whose numerical range and unit may be completely different. After Z-score standardization, the numerical range of each feature is unified, so that they are compared on the same scale, avoiding the excessive influence of certain features on model training.

[0097] S3: The multivariate time series transaction data after data normalization processing is divided into a plurality of target multivariate time series transaction data according to a time window.

[0098] Among them, the time window is a commonly used technology in time series data analysis, which divides continuous time series data into fixed length time periods, so as to analyze, process or model the data in each time period. This method is particularly suitable for processing time series data, which can help the model capture the dynamic characteristics of data changing over time.

[0099] In one possible implementation, S3 specifically includes:

[0100] S301: Set the time step of the time window.

[0101] Among them, the time step is a key concept in time series data processing, which usually refers to the time interval between data in time series data. When analyzing time series data, the time step determines the frequency and granularity of the model processing data at each time point.

[0102] S302: Based on the time step, the multivariate time series transaction data after data normalization processing is divided into a plurality of target multivariate time series transaction data in a sliding window manner:

[0103] (1)

[0104] Among them, a set of multi-variate time series data, denotes the t-th time window data, P denotes the total number of time windows.

[0105] In embodiments of the present application, a reasonable time step can help capture short-term price fluctuations and abnormal behavior. For time series data with strong periodicity, appropriate time steps can help identify changes within the period without missing critical information due to too sparse data. At the same time, the data collection interval may be irregular, and setting the time step can effectively divide the data at irregular time points, avoiding analysis bias caused by irregular data points. For example, in financial markets, sudden events may occur in certain time periods, and a reasonable time step can help the model better capture the impact of these events on the market.

[0106] S4: constructing a graph structure input based on each target multi-variate time series data.

[0107] In machine learning and deep learning, graph structure input refers to representing data as a graph structure, so as to use nodes and edges in the graph to represent features of data and their mutual relationships. In time series data analysis, especially multi-variate time series data, graph structure input can effectively capture complex spatio-temporal dependencies in data. The nodes of the graph structure represent certain features of the data, and the edges represent the relevance between the features.

[0108] In one possible implementation, S4 specifically includes:

[0109] S401: dividing a single time series in each target multi-variate time series data into a plurality of time period sequences.

[0110] A time period sequence generally refers to a sub-sequence obtained by dividing a continuous time series into a plurality of time periods (or "segments") of fixed length. Each time period represents a part of the data, and these parts can be independently analyzed or modeled to capture local features and time series changes of the data.

[0111] S402: constructing a set of graph nodes by taking each time period sequence as a graph node, wherein each graph node represents a trading feature:

[0112] (2)

[0113] E denotes a data matrix of the graph structure input, denotes a real field, K denotes the total number of time periods, N denotes the number of features of the multi-variate time series, and l denotes the time step.

[0114] In the embodiment of the present application, after the time series is divided into multiple time period sequences, each time period sequence is processed as a graph node, which can effectively capture local patterns and short-term fluctuations.

[0115] S403: connecting transaction features with spatial correlation in the same time window to construct edges containing spatial correlation.

[0116] S404: connecting transaction features with temporal correlation in different time windows to construct edges containing temporal correlation.

[0117] S405: combining each graph node with corresponding edges to form a graph structure input.

[0118] Specifically, first, the time series in each target multivariate time series transaction data is divided into multiple time period sequences, and each time period sequence is taken as a node of the graph. Then, the edges of the graph are constructed to represent the dependency relationship between different nodes: the related features in the same time window are connected by edges, representing spatial correlation. Features with temporal correlation between different time windows are connected by edges, representing temporal dependency. Finally, the set of nodes and edges constitutes the graph structure input, providing spatio-temporal features for subsequent graph neural networks to learn and predict.

[0119] In the embodiment of the present application, in multivariate time series transaction data, time and space are often two important features that cannot be separated. By adding edges with time correlation and spatial correlation in the graph structure, the model can consider the interaction of these two dimensions when learning, thereby improving the comprehensive understanding of transaction data changes. At the same time, the graph structure can effectively identify abnormal behaviors that do not conform to the regular pattern in the data. By modeling the spatio-temporal association between transaction features, abnormal transaction patterns often appear as unusual nodes or edge connections in the graph. Graph neural networks can identify these abnormal patterns through abnormal graph structures, thereby improving the precision and accuracy of anomaly detection.

[0120] S5: taking the graph structure input as the input of the graph attention network, and outputting the spatio-temporal features of the graph structure input.

[0121] Among them, the graph attention network (Graph Attention Network, GAT for short) is a deep learning model based on graph neural network (GNN), which is specifically used to process graph data structure. The core idea of GAT is to dynamically assign different weights to the neighbors of each node through attention mechanism (Attention Mechanism), which enables the model to automatically learn and adjust the influence of different neighbor nodes.

[0122] In one possible implementation, S5 specifically includes:

[0123] S501: Calculate the attention score between each pair of nodes in the graph structure input:

[0124] (3)

[0125] wherein, represents the attention score between the i th node and the j th node, LeakyReLU represents an activation function, represents the feature vector of the i th node, represents the original feature vector of the j th node, and W represents a weight matrix, represents a learned attention coefficient, and T represents a transpose operation, represents column-wise concatenation, represents the set of neighbor nodes of the i th node.

[0126] S502: Normalize the attention score between each pair of nodes to obtain a normalized attention score:

[0127] (4)

[0128] wherein, represents the normalized attention score between the i th node and the j th node, and exp represents an exponential function, represents the attention score between the i th node and the d th node.

[0129] In the embodiments of the present application, the graph attention network can effectively process the nonlinear relationship between nodes in the graph by calculating the attention score and normalization. The relationship between nodes is usually complex, especially in spatio-temporal data, the relationship between nodes is often not a simple linear dependence. The attention mechanism allows the model to flexibly capture these nonlinear dependencies, improving the model's adaptability to complex data patterns.

[0130] S503: Based on the normalized attention score, the corresponding neighbor node features are weighted and aggregated to obtain a plurality of aggregated features:

[0131] (5)

[0132] wherein, represents the aggregated feature of the i th node, represents an activation function, and W represents a weight matrix, represents the updated feature vector of the j th node.

[0133] S504: Combine each aggregated feature as the spatio-temporal feature output of the graph structure input.

[0134] In the embodiments of the present application, the graph attention network dynamically assigns different weights to the neighbors of each node through the attention mechanism. This means that for each node, the model can decide which neighbors have a greater impact on the current node according to the features of its neighbor nodes, thereby adaptively adjusting the influence of the neighbor nodes. This mechanism can automatically learn and capture complex local relationships in the graph without pre-setting any fixed weight rules, thereby improving the expression ability of the model. At the same time, by inputting the graph structure as the input of the graph attention network, the model can simultaneously learn the feature dependencies in both time and space dimensions. For example, adjacent time windows in time may have correlations, and different transaction features (such as price, trading volume, etc.) in space may also have dependencies. Through the weighted aggregation of the graph attention network, these spatio-temporal features can be effectively combined, making the model's modeling of time series data more accurate.

[0135] S6: Based on the spatio-temporal features and the target multi-element time series transaction data, a Transformer model is used for feature reconstruction to obtain reconstructed multi-element time series transaction data in one-to-one correspondence with the target multi-element time series transaction data.

[0136] The core idea of the Transformer model is to capture the relationships between positions in the input sequence through a self-attention mechanism (Self-Attention) without relying on traditional sequential recursion. This allows the Transformer to process sequence data in parallel, improving computational efficiency and better capturing long-range dependencies.

[0137] In one possible implementation, S6 specifically includes:

[0138] S601: Dimension transformation is performed on the spatio-temporal features of the graph structure input to adjust the dimensions of the spatio-temporal features to be suitable for input into the Transformer model.

[0139] S602: The dimension-transformed spatio-temporal features are merged with the target multi-element time series transaction data to obtain merged data.

[0140] In the embodiments of the present application, the spatio-temporal features are combined with the target multi-element time series transaction data, allowing the Transformer to process these different types of data simultaneously. This fusion approach allows the model to consider both spatio-temporal features and original transaction data patterns during the learning process, further improving the accuracy of feature reconstruction and helping the model learn more comprehensive information from multiple dimensions.

[0141] S603: The merged data is output to the Transformer model to calculate query vectors, key vectors, and value vectors:

[0142] (6)

[0143] (7)

[0144] (8)

[0145] wherein Q represents a query vector in the Transformer model, F represents merged data, represents a weight matrix of the query vector, represents a bias term of the query vector, K represents a key vector in the Transformer model, represents a weight matrix of the key vector, represents a bias term of the key vector, and V represents a value vector in the Transformer model.

[0146] S604: Calculate a target attention score based on the relationship between the query vector and the key vector:

[0147] (9)

[0148] wherein represents the target attention score, represents a softmax operation, T represents a transpose operation, and d represents the dimension of the query vector and the key vector.

[0149] S605: Weighted aggregation of the value vector is performed according to the target attention score to obtain a node weighted feature:

[0150] (10)

[0151] wherein s represents the node weighted feature, and LayerNorm represents layer normalization.

[0152] In the embodiments of the present application, the attention calculation and weighted aggregation process allow the model to dynamically learn the relationship between neighbor nodes according to the characteristics of the data itself. This mechanism avoids fixed weight distribution, so that the model can flexibly adjust the degree of attention to neighbor nodes according to the specific context of each node.

[0153] S606: High-dimensional features of the node weighted feature are extracted using the feedforward layer of the Transformer model:

[0154] (11)

[0155] wherein S represents high-dimensional features calculated by the feedforward layer, and ReLU represents an activation function, represents a weight matrix of the first layer, represents a bias term of the first layer, a weight matrix representing the second layer, a bias term representing the second layer.

[0156] S607: Reconstruct the high-dimensional features into reconstructed multivariate time series transaction data corresponding to each target multivariate time series transaction data through the decoder of the Transformer model:

[0157] (12)

[0158] wherein, reconstructed multivariate time series transaction data, a weight matrix representing the third layer, a bias term representing the third layer.

[0159] In the embodiments of the present application, the Transformer can output the reconstruction results consistent with the original data through the decoder based on the previous spatio-temporal features and transaction data. Due to the introduction of the attention mechanism, the model can fully utilize the historical information during reconstruction, thereby reducing the information loss caused by improper data processing or feature selection.

[0160] S7: Calculate the reconstruction error between each target multivariate time series transaction data and the corresponding reconstructed multivariate time series transaction data as the anomaly score of each target multivariate time series transaction data.

[0161] wherein, the reconstruction error is a measure of the difference between the original data and the data reconstructed by a certain model (such as autoencoder, variational autoencoder, Transformer, etc.). It is one of the commonly used indicators in anomaly detection and feature learning, especially in unsupervised learning, through which abnormal data different from the normal mode can be identified.

[0162] In one possible implementation, the calculation method of the anomaly score is specifically:

[0163] (13)

[0164] wherein, the anomaly score of the t-th time window, represents the value of the n-th feature in the k-th time step in the target multivariate time series transaction data, N represents the total number of features, and L represents the total number of time steps, represents the value of the n-th feature in the k-th time step in the reconstructed data.

[0165] In the embodiments of the present application, the reconstruction error is used as the anomaly score, which can provide a quantitative indicator for the degree of anomaly of each time window, thereby helping the model to identify potential abnormal transaction data. At the same time, by calculating the error between the target multivariate time series transaction data and its reconstruction data, the model can identify abnormal behaviors in the data through the anomaly score. For most time series data, abnormal behaviors (such as market manipulation, price manipulation, etc.) usually exhibit large fluctuations deviating from the normal pattern. By using the reconstruction error as the anomaly score, these abnormal behaviors can be effectively detected, improving the accuracy of anomaly detection.

[0166] S8: Determine whether the anomaly score of each target multivariate time series transaction data is less than the dynamic anomaly score threshold. If yes, identify the target multivariate time series transaction data as normal transaction data. Otherwise, identify the target multivariate time series transaction data as abnormal transaction data.

[0167] It should be noted that in order to better reflect the volatility and trend of the data, in each time window, the system will calculate the anomaly score threshold of the current time window according to the scores of the past T windows (i.e. historical anomaly scores).

[0168] In one possible implementation, the dynamic anomaly score threshold is calculated as follows:

[0169] (14)

[0170] (15)

[0171] (16)

[0172] wherein, represents the dynamic anomaly score threshold of the t-th time window, represents the mean of the anomaly score of the t-th time window, represents the standard deviation of the anomaly score of the t-th time window, represents the sensitivity coefficient, represents the anomaly score of the i-th historical time window, and P represents the total number of time windows.

[0173] In the embodiments of the present application, through the dynamic anomaly score threshold, the model can adapt to the changes of the data and adjust the threshold in different time periods, which enables the model to flexibly cope with the volatility changes of the market. At the same time, the introduction of the dynamic threshold can ensure that the model maintains high efficiency in anomaly detection under different market conditions, avoiding false positives or false negatives that may be caused by static thresholds.

[0174] Further, by dynamically calculating the threshold value, the model can automatically adjust the detection standard without relying on the static threshold value set by humans. This avoids subjective errors that may occur when manually setting the threshold value, and can more objectively determine whether the current data is abnormal.

[0175] S9: Send the abnormal transaction data to the administrator for manual confirmation.

[0176] In the embodiments of the present application, although the automatic detection system can efficiently identify most abnormal transactions, due to the complexity of the market and the diversity of data, the automated model may have false positives (misjudging normal transactions as abnormal) and false negatives (failing to identify real abnormal transactions). By sending suspected abnormal transaction data to the administrator for manual confirmation, these risks can be effectively reduced, ensuring that real abnormal transactions are identified without missing any potential problems.

[0177] In one possible implementation, after S9, it further includes:

[0178] Generating a report on the abnormal transaction data.

[0179] In the embodiments of the present application, generating an abnormal transaction report can provide detailed analysis for administrators and audit teams, helping them understand the specific circumstances of abnormal transactions. The report can include detailed information such as the time of the transaction, the transaction amount, the accounts involved, and the type of abnormal pattern, which provides necessary data support for subsequent investigation, analysis, and decision-making.

[0180] The technical solutions provided by the embodiments of the present application have at least the following beneficial effects:

[0181] In the embodiments of the present application, the multi-element time series transaction data is processed by standardization and time window division, removing the scale difference and effectively capturing the time series correlation. The input construction based on the graph structure and the graph attention network successfully learn the spatio-temporal dependence in the data, avoiding assumptions about the data distribution, and can better handle complex and nonlinear transaction data. The Transformer model automatically extracts complex spatio-temporal features and reconstructs the features through the self-attention mechanism, further improving the recognition accuracy. At the same time, the dynamic abnormal score threshold is introduced, which can automatically adjust the threshold according to the changes in the data environment, thereby effectively reducing false positives and false negatives and improving the adaptability of the model.

[0182] Embodiment 2,

[0183] As Figure 2 The present embodiment also provides an abnormal transaction identification system 20 based on spatio-temporal correlation, which is applied to the above-mentioned abnormal transaction identification method based on spatio-temporal correlation, comprising:

[0184] a processor 201.

[0185] The memory 202 has computer readable instructions stored thereon, and the computer readable instructions are executed by the processor 201 to implement the abnormal transaction identification method based on space-time correlation as in the method embodiments.

[0186] The abnormal transaction identification system 20 based on space-time correlation provided by the present application can execute the abnormal transaction identification method based on space-time correlation as described above, and achieve the same or similar technical effects. To avoid repetition, the present application will not be described again.

[0187] Obviously, the above embodiments of the present application are only examples for clearly illustrating the technical solutions of the present application, and are not intended to limit the specific embodiments of the present application. Any modification, equivalent replacement and improvement made within the spirit and principle of the claims of the present application shall be included in the protection scope of the claims of the present application.

Claims

1. A method for identifying abnormal transactions based on spatiotemporal correlation, characterized in that, The method comprises: S1, collecting multi-element time series transaction data; S2, performing data standardization processing on the multi-element time series transaction data to convert data of different characteristics into the same scale, and after the standardization processing, the data will have the same mean and standard deviation; S3, dividing the multi-element time series transaction data after the data standardization processing into a plurality of target multi-element time series transaction data according to a time window; S4, constructing a graph structure input based on each target multi-element time series transaction data; S5, taking the graph structure input as the input of a graph attention network to output the spatio-temporal characteristics of the graph structure input; S6, based on the spatio-temporal characteristics and each target multi-element time series transaction data, using a Transformer model to reconstruct the features to obtain reconstructed multi-element time series transaction data in one-to-one correspondence with each target multi-element time series transaction data, specifically comprising: S601: performing dimension transformation on the spatio-temporal characteristics of the graph structure input to adjust the dimension of the spatio-temporal characteristics, adjusting the originally complex and multi-dimensional spatio-temporal characteristics to a unified dimension conforming to the input requirements of the Transformer, while retaining the rich characteristics of the graph structure input; S602: merging the dimension-transformed spatio-temporal characteristics with each target multi-element time series transaction data to obtain merged data; S603: outputting the merged data to the Transformer model to calculate a query vector, a key vector and a value vector: （6） （7） （8） wherein Q represents a query vector in the Transformer model, F represents a merged data, represents a weight matrix of the query vector, represents a bias term of the query vector, K represents a key vector in the Transformer model, represents a weight matrix of the key vector, represents a bias term of the key vector, and V represents a value vector in the Transformer model. S604: calculating a target attention score between the query vector and the key vector: （9） wherein, denotes the target attention score, denotes a softmax operation, T denotes a transpose operation, and d denotes the dimension of the query and key vectors. S605: according to the target attention score, weighting and aggregating the value vector to obtain a node weighted feature: （10） Where s represents the node weighted feature, and LayerNorm represents layer normalization; S606: using the feedforward layer of the Transformer model to extract high-dimensional features of the node weighted feature: （11） wherein S represents the high-dimensional features calculated by the feedforward layer, ReLU represents an activation function, represents a weight matrix of the first layer, represents a bias term of the first layer, represents a weight matrix of the second layer, represents a bias term of the second layer; S607: through the decoder of the Transformer model, the high-dimensional features are reconstructed into reconstructed multi-element time series transaction data in one-to-one correspondence with each target multi-element time series transaction data: （12） wherein, denotes reconstructed multi-variate time series transaction data, denotes a weight matrix of the third layer, denotes a bias term of the third layer; S7, calculating the reconstruction error between each target multi-element time series transaction data and the corresponding reconstructed multi-element time series transaction data as the abnormal score of each target multi-element time series transaction data; S8, judging whether the abnormal score of each target multi-element time series transaction data is less than a dynamic abnormal score threshold; if yes, identifying the target multi-element time series transaction data as normal transaction data; otherwise, identifying the target multi-element time series transaction data as abnormal transaction data; S9, sending the abnormal transaction data to the management personnel for manual confirmation to generate a report about the abnormal transaction data. 2.The method according to claim 1, wherein, The multi-element time series transaction data specifically comprises: transaction price, highest transaction price, lowest transaction price, transaction volume, transaction number and price fluctuation range. 3.The method of claim 1, wherein, The S3 specifically comprises: S301: setting the time step of the time window; S302: Based on the time step, the standardized multivariate time series transaction data is divided into t target multivariate time series transaction data in a sliding window manner: （1） wherein, denotes a set of multi-variate time-series transaction data, denotes the t-th time window data, P denotes the total number of time windows. 4.The method according to claim 1, wherein, The S4 specifically comprises: S401: Divide a single time series in each target multivariate time series transaction data into a plurality of time period sequences; S402: Each time period sequence is taken as a graph node to construct a set of graph nodes, wherein each graph node represents a transaction feature: （2） wherein E represents a data matrix of the graph structure input, denotes the real field, K denotes the total number of time periods, N denotes the number of features of the multivariate time series, and l denotes the time step. S403: Connect transaction features with spatial correlation in the same time window to construct edges containing spatial correlation; S404: Connect transaction features with temporal correlation in different time windows to construct edges containing temporal correlation; S405: Combine each of the graph nodes with corresponding edges to form the graph structure input. 5.The method of identifying abnormal transactions based on spatiotemporal correlations according to claim 4, characterized in that, The S5 specifically comprises: S501: Calculate the attention score between each pair of nodes in the graph structure input: （3） wherein, represents the attention score between the ith node and the jth node, LeakyReLU represents an activation function, represents the feature vector of the ith node, represents the original feature vector of the jth node, W represents a weight matrix, represents the learned attention coefficient, T represents a transpose operation, represents the concatenation by column, represents the neighbor node set of the ith node; S502: Normalize the attention score between each pair of nodes to obtain a normalized attention score: （4） wherein, represents the normalized attention score between the i-th node and the j-th node, exp represents an exponential function, represents the attention score between the i-th node and the d-th node; S503: Based on the normalized attention score, the corresponding neighbor node features are weighted and aggregated to obtain a plurality of aggregated features: （5） wherein, denotes an aggregated feature of the i-th node, denotes an activation function, W denotes a weight matrix, denotes an updated feature vector of the j-th node; S504: Combine each of the aggregated features as the spatiotemporal feature output of the graph structure input. 6.The method according to claim 1, wherein, The calculation method of the abnormal score is specifically: （13） wherein, denotes the anomaly score of the t-th time window, denotes the value of the n-th feature in the target multivariate time series transaction data at the k-th time step, N denotes the total number of features, and L denotes the total number of time steps, denotes the value of the n-th feature in the reconstructed data at the k-th time step. 7.The method according to claim 1, wherein, The calculation method of the dynamic abnormal score threshold is specifically: （14） （15） （16） wherein, denotes the dynamic anomaly score threshold for the t-th time window, denotes the mean of the anomaly scores for the t-th time window, denotes the standard deviation of the anomaly scores for the t-th time window, denotes the sensitivity coefficient, denotes the anomaly score of the i-th historical time window, P denotes the total number of time windows.

8. An abnormal transaction identification system based on spatio-temporal correlation, characterized by, It comprises: A processor; A memory, the memory has computer readable instructions stored thereon, when the computer readable instructions are executed by the processor, the abnormal transaction identification method based on spatiotemporal correlation of any one of claims 1 to 7 is realized.

Images