Transaction volume anomaly detection method, system and device and computer readable storage medium

Abstract

A transaction volume anomaly detection method, system and device and a computer readable storage medium relate to the technical field of security transactions, and specifically comprise: extracting target features in target transaction data, the target features comprising a time feature, a user feature, a transaction feature and an actual transaction volume; inputting the target feature into a preset linear regression model to obtain a first predicted transaction volume; inputting the first predicted transaction volume, the time feature, the user feature and the transaction feature into a preset random forest anomaly detection model to output a second predicted transaction volume; and determining a transaction volume anomaly detection result based on the second predicted transaction volume and the actual transaction volume. According to the invention, the accuracy of transaction volume anomaly detection is improved.

Description

Technical Field

[0001] The present application relates to the field of securities trading technology, and in particular to a method, system, device, and computer-readable storage medium for detecting abnormal trading volume. Background Art

[0002] With the continuous development of the securities trading market, trading volume data of trading units has become a core indicator reflecting market dynamics and trading behavior; financial institutions, regulatory authorities and investors all rely heavily on trading volume data for risk control, market order maintenance and decision support.

[0003] At present, a traditional threshold detection method is to determine whether there is an anomaly in trading volume by setting a fixed upper or lower limit on trading volume; however, this method ignores factors such as market fluctuations and seasonal business changes of trading units, and cannot cope with dynamic changes in the market, which may lead to a large number of misjudgments, resulting in poor accuracy in trading volume anomaly detection; in addition, another method based on statistical analysis is to define the anomaly range by calculating the mean and standard deviation. Although it takes into account the statistical characteristics of trading volume data, it often cannot accurately reflect the complex distribution and changing trends of trading volume when faced with complex financial transaction data. Moreover, this method usually assumes that trading volume data follows a specific distribution, while actual trading data often exhibits non-normal and nonlinear characteristics, resulting in poor trading volume anomaly detection results based on statistical analysis methods.

[0004] Therefore, how to improve the accuracy of transaction volume anomaly detection is an urgent problem that needs to be solved. Summary of the Invention

[0005] The present application provides a transaction volume anomaly detection method, system, device, and computer-readable storage medium, which can improve the accuracy of transaction volume anomaly detection.

[0006] In a first aspect, an embodiment of the present application provides a method for detecting anomaly in transaction volume, the method comprising: Extracting target features from target transaction data, wherein the target features include time features, user features, transaction features, and actual transaction volume; Inputting the target feature into a preset linear regression model to obtain a first predicted transaction volume; Inputting the first predicted transaction volume, time features, user features, and transaction features into a preset random forest anomaly detection model to output a second predicted transaction volume; A transaction volume anomaly detection result is determined based on the second predicted transaction volume and the actual transaction volume.

[0007] In conjunction with the first aspect, in one embodiment, before the step of extracting target features from the target transaction data, the method further includes: Obtaining raw transaction data corresponding to the target transaction type; The original transaction data is preprocessed to obtain target transaction data, which includes transaction time, user data and transaction volume data.

[0008] In conjunction with the first aspect, in one embodiment, preprocessing the original transaction data to obtain target transaction data includes: Clean the raw transaction data to remove noise and erroneous values ​​and generate processed transaction data; The missing values ​​in the processed transaction data are filled based on linear interpolation technology to obtain the target transaction data.

[0009] In conjunction with the first aspect, in one embodiment, extracting target features from target transaction data includes: Perform sinusoidal encoding on the transaction time in the target transaction data to generate time features; Classify user data in the target transaction data to generate user features; The transaction volume data in the target transaction data is averaged to generate transaction features.

[0010] In conjunction with the first aspect, in one embodiment, determining the transaction volume anomaly detection result based on the second predicted transaction volume and the actual transaction volume includes: If it is detected that the difference between the second predicted transaction volume and the actual transaction volume is less than a preset difference threshold, it is determined that there is no abnormality in the transaction volume; If it is detected that the difference between the second predicted transaction volume and the actual transaction volume is not less than a preset difference threshold, it is determined that there is an abnormality in the transaction volume.

[0011] In a second aspect, an embodiment of the present application provides a transaction volume anomaly detection system, the transaction volume anomaly detection system comprising: a first processing module configured to extract target features from target transaction data, wherein the target features include time features, user features, transaction features, and actual transaction volume; A second processing module is configured to input the target feature into a preset linear regression model to obtain a first predicted transaction volume; a third processing module, configured to input the first predicted transaction volume, time features, user features, and transaction features into a preset random forest anomaly detection model to output a second predicted transaction volume; The fourth processing module is used to determine a transaction volume anomaly detection result based on the second predicted transaction volume and the actual transaction volume.

[0012] In conjunction with the second aspect, in one embodiment, the first processing module is specifically configured to: Obtaining raw transaction data corresponding to the target transaction type; The original transaction data is preprocessed to obtain target transaction data, which includes transaction time, user data and transaction volume data.

[0013] In conjunction with the second aspect, in one embodiment, the first processing module is further configured to: Clean the raw transaction data to remove noise and erroneous values ​​and generate processed transaction data; The missing values ​​in the processed transaction data are filled based on linear interpolation technology to obtain the target transaction data.

[0014] In a third aspect, an embodiment of the present application provides a trading volume anomaly detection device, which includes a processor, a memory, and a trading volume anomaly detection program stored on the memory and executable by the processor, wherein when the trading volume anomaly detection program is executed by the processor, the steps of the trading volume anomaly detection method as described in any of the above items are implemented.

[0015] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a transaction volume anomaly detection program is stored. When the transaction volume anomaly detection program is executed by a processor, the steps of the transaction volume anomaly detection method as described in any of the above items are implemented.

[0016] The beneficial effects of the technical solutions provided in the embodiments of the present application include: By extracting target features from target transaction data, including time features, user features, transaction features, and actual transaction volume, we can more comprehensively capture various factors affecting transaction volume and avoid the limitations of single indicators and fixed thresholds, thereby improving the accuracy of anomaly detection. The target features are input into a preset linear regression model to obtain a first predicted transaction volume, where the first predicted transaction volume takes into account time, users, and the average of transactions of the same type, thereby deriving a more reasonable expected transaction volume. The first predicted transaction volume, time features, user features, and transaction features are input into a preset random forest anomaly detection model to output a second predicted transaction volume. Compared with methods based on statistical analysis, the random forest anomaly detection model does not rely on specific data distribution assumptions and can more accurately capture the non-normal and nonlinear characteristics of transaction volume, thereby improving the accuracy of transaction volume prediction. Finally, the transaction volume anomaly detection result is determined based on the second predicted transaction volume and the actual transaction volume, which can effectively improve the accuracy of transaction volume anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flow chart of an embodiment of the method for detecting abnormal transaction volume in this application; Figure 2 For this application Figure 1 Detailed flow chart of step S10; Figure 3 For this application Figure 1 Detailed flow chart of step S40; Figure 4 This is a functional module diagram of an embodiment of the transaction volume anomaly detection system of the present application; Figure 5 This is a schematic diagram of the hardware structure of the transaction volume anomaly detection device involved in the embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0019] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0020] In a first aspect, an embodiment of the present application provides a method for detecting transaction volume anomalies.

[0021] In one embodiment, referring to Figure 1 , Figure 1 This is a flow chart of an embodiment of the method for detecting abnormal transaction volume in this application. Figure 1 As shown, the transaction volume anomaly detection method includes: Step S10: extracting target features from the target transaction data, wherein the target features include time features, user features, transaction features, and actual transaction volume.

[0022] For example, in the embodiment of the present application, target transaction data refers to the original data containing transaction behavior information; target features are key indicators extracted from the target transaction data, which are used to describe and analyze the user's transaction behavior; target features include time features, user features, transaction features and actual transaction volume, among which time features are extracted from the timestamp of the transaction, which include month, week and time point, reflecting the timeliness of the transaction; user features include the number of transaction unit users, the number of transaction unit institutional users, etc.; transaction features are statistical analysis of the overall market transaction data, which reflects the overall market transaction intensity and inertia, including the current time trading volume of the Shanghai Composite Index, the current time rise and fall of the Shanghai Composite Index, and the current time average trading volume of the same type of transaction units; actual transaction volume refers to the actual transaction volume that occurred within a certain time period.

[0023] Specifically, time features can be extracted by parsing time data, which helps capture the timeliness of transactions. User features can be extracted by analyzing user data, which can reveal user behavior patterns and preferences. The average of transaction data can be calculated to describe user trading habits over a period of time. Actual transaction volume can be extracted as a key feature, which is valuable for predicting trading behavior. These features together form a multi-dimensional feature set, providing a crucial basis for analyzing and modeling target transaction data from different perspectives.

[0024] Step S20: Input the target feature into a preset linear regression model to obtain a first predicted transaction volume.

[0025] Exemplarily, in the embodiment of the present application, the preset linear regression model is a statistical model that aims to predict trading volume by learning the linear relationship between input data (i.e., target features) and output variables (i.e., the first predicted trading volume); its basic principle is to use the target features as independent variables and calculate the predicted results of trading volume by linearly combining the target features, that is, by constructing a linear equation to fit the relationship between trading volume and target features; the first predicted trading volume is the preliminary trading volume prediction result obtained by the linear regression model based on the target feature input.

[0026] Specifically, for example, assuming that the first predicted transaction volume is the dependent variable y, and the time feature, user feature, transaction feature, etc. are the independent variables x1, x2, ..., x n , the linear regression model can be expressed as y=β0+β1x1+...+β n x n +∈, where β 0、 β1...β nis the regression coefficient to be determined, and ∈ represents the random error term. During the training process, the regression coefficient is continuously adjusted to minimize the sum of squared errors between the predicted value and the actual value, thereby determining an optimal set of regression coefficients to obtain a linear relationship between the trading volume and the target feature under normal circumstances. Based on this, the model can predict the input target feature to obtain the predicted trading volume value (i.e., the first predicted trading volume), thereby providing key new features for subsequent anomaly detection.

[0027] Step S30: Input the first predicted transaction volume, time features, user features, and transaction features into a preset random forest anomaly detection model to output a second predicted transaction volume.

[0028] For example, in an embodiment of the present application, the random forest anomaly detection model is an integrated learning algorithm that improves the accuracy and stability of the overall prediction by constructing multiple decision trees and integrating the prediction results of all decision trees, and performs well in anomaly detection tasks; the second predicted trading volume is the prediction result of the random forest anomaly detection model, which provides a trading volume estimate that is more in line with actual conditions and can better reflect potential market fluctuations, providing an important basis for subsequent trading volume anomaly detection.

[0029] It should be noted that the features in the historical transaction data can be processed by a preset linear regression model to obtain the historical predicted transaction volume, and then a random forest anomaly detection model is constructed based on the historical predicted transaction volume, historical time features, historical user features and historical transaction features. The key hyperparameters of the random forest decision trees, such as the number, maximum depth, minimum number of samples, and feature selection ratio, are set. Multiple decision trees are constructed by randomly selecting features, and these decision trees are combined into a random forest. During the training process, each decision tree in the random forest anomaly detection model randomly selects a part of the features and data samples from the original transaction data for training to generate a decision tree. By integrating the outputs of multiple decision trees, the random forest can effectively reduce the overfitting problem that may be caused by a single decision tree, thereby improving the generalization ability of the model. It is understandable that during the training process of the random forest anomaly detection model, the average absolute error (MAE) and the mean absolute error (MAPE) can be used to calculate the average absolute error (MAE). Error (mean absolute percentage error) is used to adjust hyperparameters such as the number of decision trees and maximum depth to optimize model performance. Evaluation indicators such as accuracy and recall can also be used to evaluate model performance. If the model's performance indicators decline, new transaction data can be collected to re-perform data preprocessing, feature extraction, model training, and anomaly detection evaluation to update and optimize the model.

[0030] Specifically, when the first predicted transaction volume, time features, user features, and transaction features are input into the preset random forest model, the model will preprocess these features to meet the model requirements; during the node splitting process of each decision tree, a portion of the preprocessed features (such as time features, user features, etc.) will be randomly selected for consideration, and the optimal splitting method will be found to construct a decision tree; the splitting process will be recursively performed until the stopping condition is met; finally, the mean of the prediction results of all decision trees is taken as the prediction result of the random forest model, thereby obtaining the second predicted transaction volume.

[0031] Step S40: Determine a transaction volume anomaly detection result based on the second predicted transaction volume and the actual transaction volume.

[0032] For example, in an embodiment of the present application, the difference between the actual trading volume and the second predicted trading volume can be determined by comparing the two. The size of the difference value directly reflects whether there is a significant deviation between the second predicted trading volume and the actual trading volume. The trading volume anomaly detection result can then be determined based on the deviation, so that potential market risks or operational problems can be effectively identified and handled based on the anomaly detection result.

[0033] This application extracts target features including time features, user features, transaction features and actual transaction volume from target transaction data to more comprehensively capture various factors affecting transaction volume, avoid the limitations of single indicators and fixed thresholds, and thus improve the accuracy of anomaly detection; the target features are input into a preset linear regression model to obtain a first predicted transaction volume. The first predicted transaction volume takes into account time, users and the average of transactions of the same type, thereby deriving a more reasonable expected transaction volume; the first predicted transaction volume, time features, user features and transaction features are input into a preset random forest anomaly detection model to output a second predicted transaction volume. Compared with the method based on statistical analysis, the random forest anomaly detection model does not rely on specific data distribution assumptions and can more accurately capture the non-normal and nonlinear characteristics of transaction volume, thereby improving the accuracy of transaction volume prediction; finally, the transaction volume anomaly detection result is determined based on the second predicted transaction volume and the actual transaction volume, which can effectively improve the accuracy of transaction volume anomaly detection.

[0034] Furthermore, in one embodiment, before the step of extracting target features from the target transaction data, the method further includes: Obtaining raw transaction data corresponding to the target transaction type; The original transaction data is preprocessed to obtain target transaction data, which includes transaction time, user data and transaction volume data.

[0035] For example, it should be noted that the trading unit is obtained by the securities company applying for the exchange, and is generally divided by business department. A trading unit refers to a specific trading channel. Users with special needs will be allocated dedicated trading units, and the user composition under different trading units will be different; the target transaction type in this embodiment refers to a certain type of trading unit of the same type that needs to be paid attention to or analyzed in the entire transaction data; the original transaction data refers to the unprocessed transaction records directly obtained from the trading system or database, which contains transaction information corresponding to the target transaction type, such as the daily trading volume of the trading unit, the market trading volume of the day, the index change of the day, the trading volume of the same type of trading units, the number of users, the user type, the transaction time, the transaction amount, the information of the buyer and seller, etc.; the role of the original transaction data is to provide a complete and real basic data source for subsequent data processing and analysis; preprocessing refers to the process of cleaning and formatting the original transaction data.

[0036] Specifically, since transaction data may include multiple transaction types (such as stock transactions, futures transactions, commodity transactions, etc.), it is necessary to clarify the target transaction type in order to extract the original transaction data corresponding to the target transaction type; then, by preprocessing the extracted original transaction data, the original transaction data can be converted into target transaction data with a standardized structure, clarity and accuracy, thereby ensuring the accuracy and reliability of subsequent analysis results.

[0037] Furthermore, in one embodiment, the preprocessing of the original transaction data to obtain the target transaction data includes: Clean the raw transaction data to remove noise and erroneous values ​​and generate processed transaction data; The missing values ​​in the processed transaction data are filled based on linear interpolation technology to obtain the target transaction data.

[0038] For example, in an embodiment of the present application, noise and error values ​​in the original transaction data can be identified and removed by detecting outliers, deleting duplicate data, and correcting the data format, and the data from which noise and error values ​​have been removed is used as the processed transaction data. The purpose of the cleaning process is to ensure the quality of the data and eliminate interference factors that may affect subsequent analysis. However, the cleaned data may still contain missing values. To address this problem, a filling method using linear interpolation technology can be used. The filling process can effectively restore the integrity of the data and ensure the continuity and consistency of the data, ultimately obtaining more accurate target transaction data. It should be noted that the principles and implementation process of linear interpolation technology are common knowledge in this field and will not be repeated here for the sake of brevity.

[0039] Furthermore, in one embodiment, referring to Figure 2As shown, the step of extracting target features from target transaction data includes: Perform sinusoidal encoding on the transaction time in the target transaction data to generate time features; Classify user data in the target transaction data to generate user features; The transaction volume data in the target transaction data is averaged to generate transaction features.

[0040] For example, in the present embodiment, sinusoidal encoding of the transaction time in the target transaction data is performed to convert time information into features that can be effectively processed by machine learning algorithms. Specifically, sinusoidal encoding can be used to convert time data into periodic function values. Periodic features of time, such as weekdays, months, and time points, can then be captured based on these periodic function values, allowing the algorithm to understand the cyclical patterns of time. For example, sinusoidal encoding of weekdays yields the value sin(2π×Day / 5), while sinusoidal encoding of months yields the value sin(2π×Day / 12), where Day is the date. Encoding the time point 09:30 AM yields the feature 930. User data can be categorized into several distinct categories based on significant user characteristics (such as purchase frequency, spending amount, and activity level) to distinguish different user needs and behavior patterns. This ultimately provides the model with more structured user features, improving subsequent analysis and prediction.

[0041] It's understandable that averaging the trading volume data within the target transaction data is intended to reduce noise and volatility in the data, thereby extracting more representative and stable features. Specifically, calculating the average trading volume over a period of time can eliminate the impact of short-term fluctuations, thereby ensuring that trading features more accurately reflect the overall market activity, thereby providing smoother and more reliable input data for subsequent analysis and model building. The aforementioned feature processing steps complement each other, aiming to transform the time, user, and trading volume information in the raw transaction data into features that are easily understood and processed by machine learning algorithms, thereby improving the model's predictive performance and generalization capabilities.

[0042] Furthermore, in one embodiment, referring to Figure 3 As shown, determining the transaction volume anomaly detection result based on the second predicted transaction volume and the actual transaction volume includes: If it is detected that the difference between the second predicted transaction volume and the actual transaction volume is less than a preset difference threshold, it is determined that there is no abnormality in the transaction volume; If it is detected that the difference between the second predicted transaction volume and the actual transaction volume is not less than a preset difference threshold, it is determined that there is an abnormality in the transaction volume.

[0043] For example, in the embodiment of the present application, the specific value of the preset difference threshold can be determined according to actual needs and is not limited here; specifically, when it is detected that the difference between the second predicted transaction volume and the actual transaction volume is less than the preset threshold, it indicates that the deviation between the actual transaction volume and the predicted transaction volume is within the allowable range, further indicating that the change in the actual transaction volume is in line with the normal fluctuation range of the market, and it can be determined that the transaction volume is not abnormal; on the contrary, when it is detected that the difference between the second predicted transaction volume and the actual transaction volume is not less than the preset threshold, it indicates that the deviation between the actual transaction volume and the predicted transaction volume is large, further indicating that the fluctuation of the actual transaction volume exceeds the normal fluctuation range of the market, that is, the actual transaction volume is very likely to be affected by special events or abnormal factors, and it can be determined that the transaction volume is abnormal, and corresponding measures can be taken for the impact. The above process determines whether the transaction volume is abnormal by setting a difference threshold, ensuring that the system can automatically identify abnormal transaction volume, thereby maintaining the accuracy and effectiveness of monitoring and analysis.

[0044] In a second aspect, an embodiment of the present application also provides a transaction volume anomaly detection system.

[0045] In one embodiment, referring to Figure 4 , Figure 4 This is a functional module diagram of an embodiment of the transaction volume anomaly detection system of this application. Figure 4 As shown, the trading volume anomaly detection system includes: a first processing module configured to extract target features from target transaction data, wherein the target features include time features, user features, transaction features, and actual transaction volume; A second processing module is configured to input the target feature into a preset linear regression model to obtain a first predicted transaction volume; a third processing module, configured to input the first predicted transaction volume, time features, user features, and transaction features into a preset random forest anomaly detection model to output a second predicted transaction volume; The fourth processing module is used to determine a transaction volume anomaly detection result based on the second predicted transaction volume and the actual transaction volume.

[0046] Furthermore, in one embodiment, the first processing module is specifically configured to: Obtaining raw transaction data corresponding to the target transaction type; The original transaction data is preprocessed to obtain target transaction data, which includes transaction time, user data and transaction volume data.

[0047] Furthermore, in one embodiment, the first processing module is further configured to: Clean the raw transaction data to remove noise and erroneous values ​​and generate processed transaction data; The missing values ​​in the processed transaction data are filled based on linear interpolation technology to obtain the target transaction data.

[0048] Furthermore, in one embodiment, the first processing module is further configured to: Perform sinusoidal encoding on the transaction time in the target transaction data to generate time features; Classify user data in the target transaction data to generate user features; The transaction volume data in the target transaction data is averaged to generate transaction features.

[0049] Furthermore, in one embodiment, the fourth processing module is specifically configured to: If it is detected that the difference between the second predicted transaction volume and the actual transaction volume is less than a preset difference threshold, it is determined that there is no abnormality in the transaction volume; If it is detected that the difference between the second predicted transaction volume and the actual transaction volume is not less than a preset difference threshold, it is determined that there is an abnormality in the transaction volume.

[0050] This application extracts target features including time features, user features, transaction features and actual transaction volume from target transaction data to more comprehensively capture various factors affecting transaction volume, avoid the limitations of single indicators and fixed thresholds, and thus improve the accuracy of anomaly detection; the target features are input into a preset linear regression model to obtain a first predicted transaction volume. The first predicted transaction volume takes into account time, users and the average of transactions of the same type, thereby deriving a more reasonable expected transaction volume; the first predicted transaction volume, time features, user features and transaction features are input into a preset random forest anomaly detection model to output a second predicted transaction volume. Compared with the method based on statistical analysis, the random forest anomaly detection model does not rely on specific data distribution assumptions and can more accurately capture the non-normal and nonlinear characteristics of transaction volume, thereby improving the accuracy of transaction volume prediction; finally, the transaction volume anomaly detection result is determined based on the second predicted transaction volume and the actual transaction volume, which can effectively improve the accuracy of transaction volume anomaly detection.

[0051] Among them, the functional implementation of each module in the above-mentioned trading volume anomaly detection system corresponds to the various steps in the above-mentioned trading volume anomaly detection method embodiment, and its functions and implementation processes will not be repeated here one by one.

[0052] In a third aspect, an embodiment of the present application provides a transaction volume anomaly detection device, which may be a personal computer (PC), a laptop computer, a server, or other device with data processing capabilities.

[0053] Reference Figure 5 , Figure 5Schematic diagram of the hardware structure of the transaction volume anomaly detection device involved in the embodiment of the present application. In the embodiment of the present application, the transaction volume anomaly detection device may include a processor, a memory, a communication interface, and a communication bus.

[0054] The communication bus may be of any type and is used to interconnect the processor, memory, and communication interface.

[0055] Communication interfaces include input / output (I / O) interfaces, physical interfaces, and logical interfaces, which interconnect components within the transaction volume anomaly detection device and connect it to other devices (such as other computing devices or user devices). Physical interfaces can include Ethernet, fiber optic, and ATM interfaces; user devices can include displays and keyboards.

[0056] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0057] The processor can be a general-purpose processor that can invoke the trading volume anomaly detection program stored in the memory and execute the trading volume anomaly detection method provided in the embodiments of the present application. For example, the general-purpose processor can be a central processing unit (CPU). The method executed when the trading volume anomaly detection program is invoked can be referenced in the various embodiments of the trading volume anomaly detection method of the present application and will not be further described here.

[0058] Those skilled in the art will understand that Figure 5 The hardware structure shown in the figure does not constitute a limitation to the present application and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0059] In a fourth aspect, an embodiment of the present application also provides a readable storage medium.

[0060] The readable storage medium of the present application stores a transaction volume anomaly detection program, wherein when the transaction volume anomaly detection program is executed by a processor, the steps of the transaction volume anomaly detection method as described above are implemented.

[0061] Among them, the method implemented when the transaction volume anomaly detection program is executed can refer to the various embodiments of the transaction volume anomaly detection method of this application, and will not be repeated here.

[0062] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit the "first", "second" and "third" to different types.

[0063] In the description of the embodiments of this application, the words "exemplary," "for example," or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary," "for example," or "for example" in the embodiments of this application should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary," "for example," or "for example" is intended to present the relevant concepts in a concrete manner.

[0064] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0065] In some processes described in the embodiments of the present application, multiple operations or steps are included that appear in a specific order. However, it should be understood that these operations or steps may not be performed in the order in which they appear in the embodiments of the present application or may be performed in parallel. The sequence numbers of the operations are only used to distinguish between different operations, and the sequence numbers themselves do not represent any order of execution. In addition, these processes may include more or fewer operations, and these operations or steps may be performed in sequence or in parallel, and these operations or steps may be combined.

[0066] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0067] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, or the part that contributes to the existing technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above and includes a number of instructions for enabling a terminal device to execute the methods described in each embodiment of this application.

[0068] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for detecting abnormal trading volume, characterized in that: The transaction volume anomaly detection method includes: Extracting target features from target transaction data, wherein the target features include time features, user features, transaction features, and actual transaction volume; Inputting the target feature into a preset linear regression model to obtain a first predicted transaction volume; Inputting the first predicted transaction volume, time features, user features, and transaction features into a preset random forest anomaly detection model to output a second predicted transaction volume; A transaction volume anomaly detection result is determined based on the second predicted transaction volume and the actual transaction volume.

2. The method for detecting abnormal transaction volume according to claim 1, wherein: Before the step of extracting target features from the target transaction data, the method further includes: Obtaining raw transaction data corresponding to the target transaction type; The original transaction data is preprocessed to obtain target transaction data, which includes transaction time, user data and transaction volume data.

3. The method for detecting abnormal transaction volume according to claim 2, wherein: The preprocessing of the original transaction data to obtain the target transaction data includes: Clean the raw transaction data to remove noise and erroneous values ​​and generate processed transaction data; The missing values ​​in the processed transaction data are filled based on linear interpolation technology to obtain the target transaction data.

4. The method for detecting abnormal transaction volume according to claim 1, wherein: The extracting target features from the target transaction data includes: Perform sinusoidal encoding on the transaction time in the target transaction data to generate time features; Classify user data in the target transaction data to generate user features; The transaction volume data in the target transaction data is averaged to generate transaction features.

5. The method for detecting abnormal transaction volume according to claim 1, wherein: The determining of the transaction volume anomaly detection result based on the second predicted transaction volume and the actual transaction volume includes: If it is detected that the difference between the second predicted transaction volume and the actual transaction volume is less than a preset difference threshold, it is determined that there is no abnormality in the transaction volume; If it is detected that the difference between the second predicted transaction volume and the actual transaction volume is not less than a preset difference threshold, it is determined that there is an abnormality in the transaction volume.

6. A transaction volume anomaly detection system, characterized in that: The transaction volume anomaly detection system includes: a first processing module configured to extract target features from target transaction data, wherein the target features include time features, user features, transaction features, and actual transaction volume; A second processing module is configured to input the target feature into a preset linear regression model to obtain a first predicted transaction volume; a third processing module, configured to input the first predicted transaction volume, time features, user features, and transaction features into a preset random forest anomaly detection model to output a second predicted transaction volume; The fourth processing module is configured to determine a transaction volume anomaly detection result based on the second predicted transaction volume and the actual transaction volume.

7. The transaction volume anomaly detection system according to claim 6, wherein: The first processing module is specifically configured to: Obtaining raw transaction data corresponding to the target transaction type; The original transaction data is preprocessed to obtain target transaction data, which includes transaction time, user data and transaction volume data.

8. The transaction volume anomaly detection system according to claim 6, wherein: The first processing module is further configured to: Clean the raw transaction data to remove noise and erroneous values ​​and generate processed transaction data; The missing values ​​in the processed transaction data are filled based on linear interpolation technology to obtain the target transaction data.

9. A transaction volume anomaly detection device, characterized in that: The transaction volume anomaly detection device includes a processor, a memory, and a transaction volume anomaly detection program stored in the memory and executable by the processor, wherein when the transaction volume anomaly detection program is executed by the processor, the steps of the transaction volume anomaly detection method according to any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a transaction volume anomaly detection program, wherein when the transaction volume anomaly detection program is executed by a processor, the steps of the transaction volume anomaly detection method according to any one of claims 1 to 5 are implemented.

Images