Transaction room abnormal transaction behavior identification method and device, electronic equipment and storage medium

Abstract

The invention discloses a transaction room abnormal transaction behavior identification method and device, electronic equipment and a storage medium, and relates to the field of artificial intelligence and financial science and technology. The method comprises the following steps: performing user action detection on image data of a transaction room to obtain a user abnormal action, user abnormal time and user abnormal confidence; the abnormal actions of the user comprise a shielding action, a communication equipment carrying action or a suspicious gesture action; analyzing the transaction behavior sequence of the to-be-identified account and the reference account to obtain transaction abnormal behaviors, transaction abnormal time and transaction abnormal confidence; the transaction abnormal behaviors comprise mode similarity abnormity, strong correlation abnormity or behavior lag abnormity; and determining an abnormal behavior recognition result according to the user abnormal action, the user abnormal time, the user abnormal confidence coefficient, the transaction abnormal behavior, the transaction abnormal time and the transaction abnormal confidence coefficient. According to the technical scheme, the accuracy of abnormal transaction behavior recognition is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, in particular to the fields of artificial intelligence and financial technology, and specifically to a method, device, electronic device, and storage medium for identifying abnormal trading behavior in a trading room. Background Art

[0002] Convergence trading is a common form of insider trading. Specifically, insiders exploit their work privileges to obtain undisclosed trading instructions for stocks, bonds, and other securities. They then manipulate the accounts of others to conduct trades, either personally or through email, phone, or other communication methods. Leveraging the vast funds of financial institutions, they establish or exit positions ahead of institutional orders, thereby illegally profiting. Although relevant regulations clearly stipulate measures to prevent information leaks, such as prohibiting the bringing of mobile phones and other communication devices into trading rooms or investment areas during trading hours, some individuals, tempted by the enormous profits, still defy these regulations.

[0003] Therefore, how to effectively identify abnormal trading behavior has become a key technical issue that needs to be urgently addressed in the field of financial technology. Summary of the Invention

[0004] The present application provides a method, device, electronic device and storage medium for identifying abnormal trading behavior in a trading room to improve the accuracy of identifying abnormal trading behavior.

[0005] In a first aspect, an embodiment of the present application provides a method for identifying abnormal trading behavior in a trading room, comprising:

[0006] Perform user action detection on the image data of the trading room to obtain abnormal user actions, abnormal user time, and user abnormality confidence; abnormal user actions include blocking behavior, carrying communication devices, or suspicious gestures;

[0007] Analyze the transaction behavior sequences of the identified account and the benchmark account to obtain abnormal transaction behavior, abnormal transaction time, and transaction abnormality confidence; the abnormal transaction behavior includes pattern similarity abnormality, strong correlation abnormality, or behavior lag abnormality;

[0008] An abnormal behavior recognition result is determined according to the abnormal user action, the abnormal user time, and the user abnormality confidence, as well as the abnormal transaction behavior, the abnormal transaction time, and the transaction abnormality confidence.

[0009] In a second aspect, an embodiment of the present application further provides a device for identifying abnormal trading behavior in a trading room, comprising:

[0010] An image detection module is used to detect user actions on the image data of the trading room to obtain abnormal user actions, abnormal user time, and user abnormality confidence; abnormal user actions include blocking behavior, carrying communication devices, or suspicious gestures;

[0011] A transaction analysis module is used to analyze the transaction behavior sequences of the identified account and the benchmark account to obtain abnormal transaction behavior, abnormal transaction time, and transaction abnormality confidence; the abnormal transaction behavior includes pattern similarity abnormality, strong correlation abnormality, or behavior hysteresis abnormality;

[0012] The behavior recognition module is used to determine an abnormal behavior recognition result based on the abnormal user action, the abnormal user time and the user abnormality confidence, as well as the abnormal transaction behavior, the abnormal transaction time and the transaction abnormality confidence.

[0013] In a third aspect, an embodiment of the present application further provides an electronic device, the electronic device comprising:

[0014] one or more processors;

[0015] a storage device for storing one or more programs;

[0016] When one or more programs are executed by one or more processors, the one or more processors implement any one of the methods for identifying abnormal trading behavior in a trading room provided in the embodiments of the present application.

[0017] In a fourth aspect, an embodiment of the present application further provides a storage medium comprising computer-executable instructions, which, when executed by a computer processor, are used to execute any one of the methods for identifying abnormal trading behavior in a trading room provided in the embodiments of the present application.

[0018] This application performs user action detection on the image data of the trading room based on computer vision to obtain the user abnormal time and user abnormal confidence of abnormal user actions such as occlusion behavior, carrying communication equipment or suspicious gestures; and compares and analyzes the transaction behavior sequences between the account to be identified and the benchmark account to obtain the transaction abnormal time and transaction abnormal confidence of abnormal transaction behaviors such as pattern similarity anomaly, strong correlation anomaly or behavior lag anomaly; the abnormal behavior identification result is determined by combining the user abnormal time, user abnormal confidence of the abnormal user action, the transaction abnormal time and transaction abnormal confidence of the abnormal transaction behavior, which has the advantages of strong real-time performance, high accuracy in concealed behavior identification, strong traceability, etc., and improves the accuracy of abnormal transaction behavior identification.

[0019] Therefore, the technical solution of this application solves the problem and achieves the desired effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1a This is a flow chart of a method for identifying abnormal trading behavior in a trading room provided in accordance with the first embodiment of the present application;

[0021] Figure 1b This is a schematic diagram of a principle for identifying abnormal trading behavior in a trading room according to the first embodiment of the present application;

[0022] Figure 1c 1 is a schematic structural diagram of a backbone network and a detection head of a small target detection network according to the first embodiment of the present application;

[0023] Figure 2 This is a flow chart of another method for identifying abnormal trading behavior in a trading room provided in accordance with the second embodiment of the present application;

[0024] Figure 3 This is a schematic diagram of the structure of a device for identifying abnormal trading behavior in a trading room according to the third embodiment of the present application;

[0025] Figure 4 It is a structural diagram of an electronic device that implements the method for identifying abnormal trading behavior in a trading room according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0027] It should be noted that the terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Example 1

[0029] Figure 1aThis is a flow chart of a method for identifying abnormal trading behavior in a trading room according to the first embodiment of the present application. This embodiment is applicable to identifying abnormal trading behaviors such as possible insider trading by users in the trading room. It can be performed by a device for identifying abnormal trading behavior in the trading room. The device can be implemented in the form of hardware and / or software, and the device can be configured in a computer device. Figure 1a As shown, the method includes:

[0030] S101. Perform user action detection on the image data of the trading room to obtain abnormal user actions, abnormal user time, and user abnormality confidence; the abnormal user actions include blocking behavior, carrying communication devices, or suspicious gestures;

[0031] S102. Analyze the transaction behavior sequences of the account to be identified and the reference account to obtain abnormal transaction behavior, abnormal transaction time, and transaction abnormality confidence; the abnormal transaction behavior includes pattern similarity abnormality, strong correlation abnormality, or behavior hysteresis abnormality;

[0032] S103: Determine an abnormal behavior recognition result based on the abnormal user action, the abnormal user time, and the user abnormality confidence, as well as the abnormal transaction behavior, the abnormal transaction time, and the transaction abnormality confidence.

[0033] refer to Figure 1b , the following two branches are used to identify whether there are abnormal trading behaviors of users in the trading room: the first branch collects image data of the trading room through the image acquisition module, and performs abnormal motion detection on the image data through the user action detection module to obtain abnormal user actions, abnormal user times, and abnormal user confidence levels. Abnormal user actions include blocking behaviors, carrying communication devices, or suspicious gestures; the second branch determines the accounts to be identified and the benchmark accounts associated with the users in the trading room, such as institutional proprietary accounts and historical suspicious accounts, and obtains the transaction data of the accounts to be identified and the benchmark accounts respectively through the transaction data acquisition module. The transaction data of the accounts to be identified and the benchmark accounts are analyzed through the transaction behavior analysis module to obtain abnormal transaction behaviors, abnormal transaction times, and abnormal transaction confidence levels. Abnormal transaction behaviors include pattern similarity anomalies, strong correlation anomalies, or behavior lag anomalies; and the user action detection results of the first branch and the transaction behavior analysis results of the second branch are integrated to obtain abnormal behavior identification results.

[0034] Among them, the image acquisition module can perform preliminary screening of the collected video data according to manually set rules, such as filtering out non-business hours such as nighttime and holidays, and screening securities trading periods on weekdays, and perform multi-threaded frame extraction processing on the video data at a set frequency, such as 1 frame per minute, to process the video data into a set of pictures. For example, the optical flow algorithm can be used to calculate the motion field of the pixels in the image data to be identified to generate a dense optical flow; if the optical flow is significantly reduced and a close object appears, it is determined that an occlusion behavior has been identified. Since the collected image data is 1920×1080 in size, and the detection target of the communication equipment or suspicious gesture action is less than 60×60 pixels in the image, it is a small target. Reference Figure 1c , also provides the backbone network (backbone) and detection head (head) of the small object detection network. To capture more small object features, the SPD-Conv component is designed. SPD-Conv includes space-to-depth (SPD) layers and non-strided convolution (Non-strided Convolution) layers to replace the strided convolution and pooling layers in traditional convolutional neural networks (CNNs). The SPD layer is used to downsample the spatial dimension of the feature map while rearranging the spatial information into the channel dimension, preserving all information without losing details. Non-strided convolution is used to further process the feature map using non-strided convolution after the SPD layer, ensuring the integrity and learnability of fine-grained feature information.

[0035] If a mobile phone, headset, tablet, or other communication device is identified through the small target detection network, it is determined that the person is carrying a communication device. Suspicious gestures refer to the continuous movement of a hand near the desktop or face. If the "hand" detected based on the hand small target is given a unique ID, the "hand" ID target in the image of the consecutive frames is tracked. The tracking method is to determine the intersection of the coordinate frames of the ID in the previous and next frames to construct the continuous movement path of the hand. Based on the path, it is determined whether it overlaps with the coordinate frame of the framed desktop / face. If it overlaps, it is determined that a suspicious gesture has been detected.

[0036] The transaction data collection module can obtain account-level transaction data such as buying and selling direction, underlying assets, price, quantity, and timestamps; it can also obtain snapshot market data of the underlying assets, such as transaction price, fluctuation range, and volatility. The transaction behavior analysis module slices the transaction behavior data of the identified account and the benchmark account into time windows and generates standardized transaction behavior sequences. Dynamic time warping (DTW) and cross-correlation algorithms can be used to perform temporal similarity analysis on the transaction behavior sequences of the identified account and the benchmark account. Pattern similarity anomalies and strong correlations both indicate that the transaction behaviors of the identified account and the benchmark account are at risk of convergence; behavioral lag anomalies refer to time delays or lags in the transaction behavior of the identified account relative to the benchmark account.

[0037] The system combines abnormal user actions, abnormal user time, and user abnormality confidence level, as well as abnormal transaction behavior, abnormal transaction time, and transaction abnormality confidence level to determine a comprehensive user abnormality confidence level. If the user abnormality confidence level exceeds the preset confidence threshold, the account under investigation is determined to have engaged in abnormal behavior, such as similar transactions. If the account under investigation exhibits similar transaction patterns to institutional accounts within 5 minutes prior to a large institutional transaction, and the user used their phone or blocked the screen 5-10 minutes prior, the abnormality level is significantly increased.

[0038] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data comply with relevant laws, regulations and standards of the relevant regions.

[0039] The technical solution of this embodiment performs user action detection on the image data of the trading room based on computer vision to obtain the user abnormal time and user abnormal confidence of abnormal user actions such as occlusion behavior, carrying communication equipment or suspicious gestures; and compares and analyzes the transaction behavior sequences between the account to be identified and the benchmark account to obtain the transaction abnormal time and transaction abnormal confidence of abnormal transaction behaviors such as pattern similarity anomaly, strong correlation anomaly or behavior lag anomaly; and combines the user abnormal time, user abnormal confidence of the abnormal user action, the transaction abnormal time and transaction abnormal confidence of the abnormal transaction behavior to determine the abnormal behavior identification result, which has the advantages of strong real-time performance, high precision in concealed behavior identification, strong traceability, etc., and improves the accuracy of abnormal transaction behavior identification.

[0040] In an optional embodiment, the transaction behavior sequences of the account to be identified and the benchmark account are analyzed to obtain abnormal transaction behaviors, including: using a dynamic time warping method to calculate the cumulative minimum distance between the transaction behavior sequences of the account to be identified and the benchmark account; if the cumulative minimum distance is less than a preset distance threshold, it is determined that a pattern similarity anomaly exists; the transaction behavior sequence includes at least one of transaction direction, transaction quantity, transaction amount, and transaction target code; cross-correlation analysis is performed on the transaction behavior sequences of the account to be identified and the benchmark account to obtain a maximum correlation coefficient and a lag period; if the maximum correlation coefficient is greater than a preset correlation coefficient threshold, it is determined that a strong correlation anomaly exists; if the lag period is less than a preset time threshold, it is determined that a behavior lag anomaly exists.

[0041] During the transaction behavior detection process, the transaction data of each account can be sorted in ascending order by timestamp; a fixed-granularity time window can be constructed, such as 5 minutes, 15 minutes, or 1 hour; each time window generates the following dimensions of features: transaction direction (for example, buy is +1, sell is -1); transaction quantity; transaction amount; weighted average price; stock code, which can be converted into a one-hot encoding or embedded feature representation. A continuous transaction behavior sequence is constructed for each account: T = [t1, t2, ..., t n ], where each t n It is the vector corresponding to the transaction behavior [direction, quantity, amount, target code] in the nth time window, where n is a positive integer.

[0042] Dynamic Time Warping (DTW) can be used to calculate the cumulative minimum distance D between the transaction behavior sequences of the account to be identified and the benchmark account. For example, an m×n distance matrix is ​​constructed, where m and n are the lengths of the two transactions, respectively. Each element D[i][j] in the distance matrix represents the distance between the i-th transaction behavior vector of the account to be identified and the j-th transaction behavior vector of the benchmark account. A cumulative distance matrix C of the same size as the distance matrix is ​​created, where C[i][j] = D[i][j] + min(C[i-1][j], C[i][j-1], C[i-1][j-1]), i.e., the current cumulative distance is equal to the current distance plus the minimum cumulative distance of the previous step. Starting from the lower right corner C[m-1][n-1] of the cumulative distance matrix C, backtracking along the direction of the minimum cumulative distance to C[0][0], the optimal alignment path is obtained, and the cumulative distance along the optimal alignment path is used as the cumulative minimum distance D. If the cumulative minimum distance D is less than a preset distance threshold, such as 0.3, a pattern similarity anomaly is determined. The timestamp of the account to be identified is used as the transaction anomaly time. The confidence level of the transaction anomaly corresponding to the pattern similarity anomaly is then determined based on the cumulative minimum distance. The smaller the cumulative minimum distance, the greater the corresponding transaction anomaly confidence level and the higher the risk.

[0043] For example, the following formula can be used to perform cross-correlation analysis on the transaction behavior sequences of the identified account and the benchmark account:

[0044]

[0045] Among them, ρ A，B (τ) is the correlation coefficient, X A (t) is the transaction behavior sequence of the account to be identified at time t, X B(t+τ) is the transaction behavior sequence of the benchmark account at time t+τ, and |||| is the norm symbol. The largest correlation coefficient is selected from each correlation coefficient to obtain the maximum correlation coefficient, and the τ value corresponding to the maximum correlation coefficient is taken as the hysteresis period length. If the maximum correlation coefficient is greater than the preset correlation coefficient threshold (for example, 0.85), it is determined that a strong correlation anomaly exists; if the hysteresis period length is less than the preset time threshold (for example, within 5 minutes or within 10 minutes), it is determined that a behavioral hysteresis anomaly exists; and, the time t corresponding to the maximum correlation coefficient is taken as the transaction anomaly time, and the corresponding transaction anomaly confidence is determined according to the maximum correlation coefficient and the hysteresis period. The larger the maximum correlation coefficient, the higher the corresponding transaction anomaly confidence; if the hysteresis period is less than the preset time threshold, the corresponding transaction anomaly confidence takes the first value, otherwise it takes the second value, and the first value is greater than the second value. By using the dynamic time warping method to calculate the cumulative minimum distance between the transaction behavior sequences of the account to be identified and the benchmark account, the problem of asynchronous transaction timing can be effectively handled. By capturing the similarity of behavioral patterns through nonlinear alignment, anomalies can be accurately identified even if there is a deviation in the time of transaction occurrence. In addition, through cross-correlation analysis of the maximum correlation coefficient and the lag period, the correlation strength and time delay characteristics of transaction behavior can be further quantified, thereby accurately detecting pattern similarity anomalies, strong correlation anomalies and behavioral lag anomalies, covering a variety of violation scenarios and further improving the accuracy of abnormal transaction identification.

[0046] Example 2

[0047] Figure 2 This is a flowchart of another method for identifying abnormal trading behavior in a trading room according to the second embodiment of this application. The technical solution of this embodiment is based on the above technical solution and refines the abnormal trading behavior identification by combining the user action detection results and the trading behavior sequence analysis results. Figure 2 A method for identifying abnormal trading behavior in a trading room is shown, comprising:

[0048] S201: Detect user actions on the image data of the trading room to obtain abnormal user actions, abnormal user time, and abnormal user confidence; abnormal user actions include blocking behavior, carrying communication devices, or suspicious gestures;

[0049] S202: Analyze the transaction behavior sequences of the account to be identified and the reference account to obtain abnormal transaction behavior, abnormal transaction time, and transaction abnormality confidence; the abnormal transaction behavior includes pattern similarity abnormality, strong correlation abnormality, or behavior hysteresis abnormality;

[0050] S203: Determine a temporal correlation factor between the abnormal user time corresponding to the abnormal user action and the abnormal transaction time corresponding to the abnormal transaction behavior, wherein the temporal correlation factor is used to represent the temporal proximity between the abnormal user action and the abnormal transaction behavior;

[0051] S204. Sort the corresponding abnormal user actions and abnormal transaction behaviors according to the abnormal user time and abnormal transaction time to generate a current pattern sequence; the current pattern sequence includes abnormal user actions and abnormal transaction actions sorted in chronological order;

[0052] S205, matching the current pattern sequence with a pre-constructed candidate pattern sequence to obtain a pattern matching degree;

[0053] S206: Fusing the user anomaly confidence, the transaction anomaly confidence, the time series correlation factor, and the pattern matching degree to obtain a total anomaly confidence, and determining an abnormal behavior recognition result based on the total anomaly confidence.

[0054] The time series correlation factor ranges from (0 to 1) and is negatively correlated with the time difference between the user's abnormal behavior and the transaction's abnormal behavior. The smaller the time difference, the closer the time series correlation factor is to 1; the larger the time difference, the closer the time series correlation factor is to 0. By introducing the time series correlation factor to characterize the temporal correlation between abnormal user actions and abnormal transaction behaviors, and integrating it with the abnormal behavior identification results, the accuracy of abnormal behavior identification is further improved.

[0055] Abnormal user actions and abnormal transaction behaviors are sorted by abnormal user time and abnormal transaction time, that is, by timestamp, to generate a current pattern sequence. For example, sorting by timestamp yields the following current pattern sequence (or current pattern chain): [occlusion behavior, suspicious gesture, pattern similarity anomaly]. A candidate pattern sequence (or candidate pattern chain) is a typical abnormal pattern sequence. The current pattern sequence and candidate pattern sequence are matched to obtain a pattern matching degree. By introducing a pattern matching degree to represent the spatial correlation between the user's current behavior pattern and the typical abnormal behavior pattern, the pattern matching degree is integrated to determine the abnormal behavior recognition result, further improving the accuracy of abnormal behavior recognition. The user anomaly confidence level of abnormal user actions and the transaction anomaly confidence level of abnormal transaction behaviors can be integrated to obtain a basic confidence level. Using a temporal correlation factor and pattern matching degree, the basic confidence level is modified in the temporal and spatial dimensions to obtain a total anomaly confidence level, improving the accuracy of the total anomaly confidence level.

[0056] In an optional embodiment, determining the timing correlation factor between the user abnormal time corresponding to the user abnormal action and the transaction abnormal time corresponding to the transaction abnormal behavior includes: for each transaction abnormal behavior, obtaining the user abnormal action that occurs within a set time threshold before and after the corresponding transaction abnormal time; if at least two user abnormal actions are obtained, selecting the user abnormal time with the smallest time difference with the transaction abnormal time from the corresponding at least two user abnormal times; and calculating the timing correlation factor based on the transaction abnormal time and the selected user abnormal time.

[0057] For each abnormal transaction behavior, determine whether an abnormal user action occurs within a set time threshold (for example, 5 minutes) before and after the abnormal transaction time of the abnormal transaction behavior; if a unique abnormal user action is obtained, calculate the timing correlation factor based on the user abnormal time corresponding to the unique abnormal user action and the abnormal transaction time; if at least two abnormal user actions are obtained, select the user abnormal time with the smallest time difference with the abnormal transaction time from the corresponding at least two user abnormal times; select the most recent user abnormal time based on the abnormal transaction time and calculate the timing correlation factor; if no abnormal user action occurs, the timing correlation factor is 0.

[0058] For example, the temporal correlation factor between the abnormal user time and the abnormal transaction time can be calculated by the following formula:

[0059]

[0060] Among them, a is an adjustable parameter used to control the speed of time decay, and its value range is (0,1); F temporal is the temporal correlation factor; T v , T t They are user abnormal time and transaction abnormal time respectively.

[0061] Using the abnormal transaction time as a benchmark, the algorithm retrieves abnormal user actions occurring within a set time threshold before and after the abnormal transaction time. If multiple abnormal user actions are retrieved, the abnormal user time with the smallest absolute time difference with the abnormal transaction time is selected as the correlation object. By prioritizing the nearest neighbor event, it effectively reduces noise interference within the time window, avoids correlation ambiguity when multiple events coexist, and improves the accuracy of the calculation of the temporal correlation factor.

[0062] In an optional embodiment, the current pattern sequence and a pre-constructed candidate pattern sequence are matched to obtain a pattern matching degree, including: calculating the edit distance between the current pattern sequence and the pre-constructed candidate pattern sequence, and selecting the candidate pattern sequence with the smallest edit distance as the target pattern sequence; selecting the maximum value from the sequence length of the current pattern sequence and the sequence length of the target pattern sequence as the longest sequence length; and calculating the pattern matching degree based on the minimum edit distance and the longest sequence length.

[0063] A variety of candidate pattern sequences can be provided in advance, each of which is a permutation and combination of abnormal user behavior and / or abnormal transaction behavior. The edit distance between the current pattern sequence and each candidate pattern sequence is calculated separately. Taking the current pattern sequence as [occluding behavior, suspicious gesture, abnormal pattern similarity] and the candidate pattern sequence as [occluding behavior, carrying communication equipment, abnormal pattern similarity] as an example, the edit distance between the two is 1; the candidate pattern sequence with the smallest edit distance is selected as the target pattern sequence; the sequence length of the current pattern sequence and the target pattern sequence, that is, the number of abnormal events contained in the corresponding sequence, is obtained respectively, and the maximum value of the two is selected as the longest sequence length; based on the longest sequence length, the pattern matching degree M between the current pattern sequence and the target pattern sequence is calculated by the following formula pattern :

[0064]

[0065] By calculating the edit distance between the current pattern sequence and each candidate pattern sequence respectively, the target pattern sequence with the smallest edit distance, that is, the most similar sequence structure, is selected to obtain the minimum edit distance; the maximum value of the current sequence and the target sequence length is selected as the longest sequence length, and the pattern matching degree is calculated based on the minimum edit distance and the longest sequence length. Specifically, the normalization process eliminates the influence of sequence length differences on the matching results, ensuring that the pattern matching degree can accurately reflect the structural similarity between sequences, thereby improving the accuracy of the pattern matching degree.

[0066] In an optional embodiment, the user anomaly confidence, the transaction anomaly confidence, the timing correlation factor and the pattern matching degree are integrated to obtain a total anomaly confidence, including: weighting the user anomaly confidence and the transaction anomaly confidence to obtain a basic confidence; weighting a preset basic factor, the timing correlation factor and the pattern matching degree to obtain a dynamic adjustment factor; and calculating the product between the basic confidence and the dynamic adjustment factor to obtain the total anomaly confidence.

[0067] The total anomaly confidence is a nonlinear combination of each user anomaly confidence, transaction anomaly confidence, time series correlation factor, and pattern matching degree. For example, the user anomaly confidence for abnormal user actions such as blocking, carrying communication devices, or suspicious gestures can be weighted and averaged or maximized to obtain a comprehensive user anomaly confidence; the transaction anomaly confidence for abnormal transaction behaviors such as pattern similarity anomalies, strong correlation anomalies, or behavior lag anomalies can be weighted and averaged or maximized to obtain a comprehensive user transaction confidence; and the total anomaly confidence can be calculated using the following formula:

[0068] S total =(W v ·S video +W t ·S strede )·(1+F temporal W f +M pattern W m )

[0069] Among them, S total 、S video 、S strade They are total anomaly confidence, comprehensive user anomaly confidence, and comprehensive user transaction confidence; F temporal and M pattern They are sequential correlation factor and pattern matching degree respectively; W v 、W t 、W f and W m The weights for abnormal user actions, abnormal transaction behavior, temporal correlation factors, and pattern matching are listed in order. This method for determining total anomaly confidence not only avoids the risk of misjudgment in a single dimension but also strengthens or attenuates risk signals through weight distribution and multiplication. This generates a total anomaly confidence that is both consistent with business logic and capable of real-time response, significantly improving the accuracy and robustness of anomaly detection.

[0070] The technical solution of this embodiment uses the transaction anomaly time as a benchmark to retrieve abnormal user actions occurring within a set time threshold before and after it. If multiple user abnormal actions exist, the user abnormal time with the smallest absolute time difference from the transaction anomaly time is selected as the association object. By prioritizing the nearest neighbor event, noise interference within the time window is reduced, and association ambiguity when multiple events coexist, the accuracy of the calculation of the temporal correlation factor is avoided. In addition, the edit distance between the current pattern sequence and each candidate pattern sequence is calculated to screen out the target pattern sequence with the smallest edit distance. The maximum length of the current and target sequences is taken as the longest sequence length. Normalization is performed based on the ratio of the minimum edit distance to the longest sequence length to eliminate the impact of sequence length differences on the matching results, ensuring that the pattern matching degree accurately reflects the structural similarity between sequences, thereby improving the accuracy of the pattern matching degree. Furthermore, by integrating multi-dimensional information such as the temporal correlation factor and the pattern matching degree, the risk signal is strengthened or weakened through weight allocation and multiplication to obtain the total anomaly confidence. This not only avoids the risk of misjudgment in a single dimension, but also ensures that the calculation of the total anomaly confidence degree conforms to business logic and has real-time responsiveness, thereby improving the accuracy of anomaly detection.

[0071] Example 3

[0072] Figure 3 This is a schematic diagram of the structure of a device for identifying abnormal trading behavior in a trading room according to the third embodiment of the present application. This embodiment is applicable to identifying abnormal trading behaviors such as possible insider trading by users in the trading room. The device for identifying abnormal trading behavior in the trading room can be implemented in the form of hardware and / or software, and the device can be configured in a computer device. Figure 3 The specific structure of the abnormal trading behavior identification device 300 in the trading room is as follows:

[0073] Image detection module 310 is used to detect user actions on the image data of the trading room to obtain abnormal user actions, abnormal user time, and user abnormality confidence; abnormal user actions include blocking behavior, carrying communication devices, or suspicious gestures;

[0074] The transaction analysis module 320 is used to analyze the transaction behavior sequences of the identified account and the reference account to obtain abnormal transaction behavior, abnormal transaction time, and transaction abnormality confidence. The abnormal transaction behavior includes pattern similarity abnormality, strong correlation abnormality, or behavior hysteresis abnormality.

[0075] The behavior recognition module 330 is configured to determine an abnormal behavior recognition result based on the abnormal user action, the abnormal user time, and the user abnormality confidence, as well as the abnormal transaction behavior, the abnormal transaction time, and the transaction abnormality confidence.

[0076] In an optional implementation, the behavior recognition module 330 includes:

[0077] a time series correlation determination unit, configured to determine a time series correlation factor between the abnormal user time corresponding to the abnormal user action and the abnormal transaction time corresponding to the abnormal transaction behavior, wherein the time series correlation factor is used to characterize the temporal proximity between the abnormal user action and the abnormal transaction behavior;

[0078] A pattern sequence generating unit is configured to sort the corresponding abnormal user actions and abnormal transaction behaviors according to the abnormal user time and abnormal transaction time, and generate a current pattern sequence; the current pattern sequence includes abnormal user actions and abnormal transaction actions sorted in chronological order;

[0079] A pattern matching unit, configured to match the current pattern sequence with a pre-constructed candidate pattern sequence to obtain a pattern matching degree;

[0080] The behavior recognition unit is used to fuse the user abnormality confidence, the transaction abnormality confidence, the time series correlation factor and the pattern matching degree to obtain a total abnormality confidence, and determine the abnormal behavior recognition result according to the total abnormality confidence.

[0081] In an optional implementation manner, the pattern matching unit is specifically configured to:

[0082] Calculating the edit distance between the current pattern sequence and a pre-constructed candidate pattern sequence, and selecting the candidate pattern sequence with the smallest edit distance as the target pattern sequence;

[0083] Select the maximum value from the sequence length of the current pattern sequence and the sequence length of the target pattern sequence as the longest sequence length;

[0084] The pattern matching degree is calculated based on the minimum edit distance and the longest sequence length.

[0085] In an optional implementation manner, the timing association determining unit is specifically configured to:

[0086] For each abnormal transaction behavior, obtain the user's abnormal actions that occurred within the set time threshold before and after the corresponding abnormal transaction time;

[0087] If at least two abnormal user actions are obtained, the abnormal user time with the smallest time difference from the abnormal transaction time is selected from the corresponding at least two abnormal user times;

[0088] The timing correlation factor is calculated according to the transaction abnormal time and the selected user abnormal time.

[0089] In an optional implementation, the behavior recognition unit is specifically configured to:

[0090] Weighting the user anomaly confidence and the transaction anomaly confidence to obtain a basic confidence;

[0091] Weighting the preset basic factor, the timing correlation factor and the pattern matching degree to obtain a dynamic adjustment factor;

[0092] The product of the basic confidence and the dynamic adjustment factor is calculated to obtain the total abnormality confidence.

[0093] In an optional implementation, the transaction analysis module 320 includes:

[0094] a pattern similarity anomaly unit configured to calculate, using a dynamic time warping method, a cumulative minimum distance between transaction behavior sequences of the identified account and a reference account; if the cumulative minimum distance is less than a preset distance threshold, a pattern similarity anomaly is determined; the transaction behavior sequence includes at least one of transaction direction, transaction quantity, transaction amount, and transaction target code;

[0095] The cross-correlation unit is used to perform cross-correlation analysis on the transaction behavior sequences of the identified account and the benchmark account to obtain the maximum correlation coefficient and lag period;

[0096] a strong correlation anomaly unit, configured to determine that a strong correlation anomaly exists if the maximum correlation coefficient is greater than a preset correlation coefficient threshold;

[0097] The behavior hysteresis abnormality unit is configured to determine that a behavior hysteresis abnormality exists if the hysteresis period is less than a preset time threshold.

[0098] The device for identifying abnormal trading behavior in a trading room provided in the embodiments of the present application can execute the method for identifying abnormal trading behavior in a trading room provided in any embodiment of the present application, and has the corresponding functional modules and beneficial effects for executing the method for identifying abnormal trading behavior in a trading room.

[0099] According to an embodiment of the present invention, the present invention further provides an electronic device, a readable storage medium and a computer program product.

[0100] Example 4

[0101] Figure 44 is a schematic diagram of the structure of an electronic device 410 that implements the method for identifying abnormal trading behavior in a trading room according to an embodiment of the present application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application as described and / or claimed herein.

[0102] like Figure 4 As shown, the electronic device 410 includes at least one processor 411, and a memory connected to the at least one processor 411 in communication, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or the computer program loaded from the storage unit 418 to the random access memory (RAM) 413. Various programs and data required for the operation of the electronic device 410 can also be stored in the RAM 413. The processor 411, ROM 412 and RAM 413 are connected to each other via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0103] Multiple components in electronic device 410 are connected to I / O interface 415, including an input unit 416, such as a keyboard, mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a magnetic disk, optical disk, etc.; and a communication unit 419, such as a network card, modem, wireless communication transceiver, etc. The communication unit 419 allows electronic device 410 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0104] Processor 411 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any other suitable processors, controllers, microcontrollers, etc. Processor 411 executes the various methods and processes described above, such as the method for identifying abnormal trading behavior in a trading room.

[0105] In some embodiments, the method for identifying abnormal trading behavior in a trading room may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 418. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 410 via ROM 412 and / or communication unit 419. When the computer program is loaded into RAM 413 and executed by processor 411, one or more steps of the method for identifying abnormal trading behavior in a trading room described above may be performed. Alternatively, in other embodiments, processor 411 may be configured to implement the method for identifying abnormal trading behavior in a trading room by any other appropriate means (e.g., by means of firmware).

[0106] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0107] Computer programs for implementing the methods of the present application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0108] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. A computer-readable storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0109] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0110] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0111] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0112] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this application can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of this application can be achieved. This is not limited herein.

[0113] The above specific embodiments do not constitute a limitation on the scope of protection of this application. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application shall be included within the scope of protection of this application.

Claims

1. A method for identifying abnormal trading behavior in a trading room, characterized in that: include: Perform user action detection on the image data of the trading room to obtain abnormal user actions, abnormal user time, and user abnormality confidence; abnormal user actions include blocking behavior, carrying communication devices, or suspicious gestures; Analyze the transaction behavior sequences of the identified account and the benchmark account to obtain abnormal transaction behavior, abnormal transaction time, and transaction abnormality confidence; the abnormal transaction behavior includes pattern similarity abnormality, strong correlation abnormality, or behavior lag abnormality; An abnormal behavior recognition result is determined according to the abnormal user action, the abnormal user time, and the user abnormality confidence, as well as the abnormal transaction behavior, the abnormal transaction time, and the transaction abnormality confidence.

2. The method according to claim 1, characterized in that Determining the abnormal behavior identification result based on the abnormal user action, the abnormal user time, and the user abnormality confidence, as well as the abnormal transaction behavior, the abnormal transaction time, and the transaction abnormality confidence, includes: Determining a temporal correlation factor between the abnormal user time corresponding to the abnormal user action and the abnormal transaction time corresponding to the abnormal transaction behavior, wherein the temporal correlation factor is used to characterize the temporal proximity between the abnormal user action and the abnormal transaction behavior; According to the abnormal user time and abnormal transaction time, the corresponding abnormal user actions and abnormal transaction behaviors are sorted to generate a current pattern sequence; the current pattern sequence includes abnormal user actions and abnormal transaction actions sorted in chronological order; Matching the current pattern sequence with a pre-constructed candidate pattern sequence to obtain a pattern matching degree; The user anomaly confidence, the transaction anomaly confidence, the time series correlation factor and the pattern matching degree are integrated to obtain a total anomaly confidence, and an abnormal behavior recognition result is determined according to the total anomaly confidence.

3. The method according to claim 2, characterized in that The matching of the current pattern sequence with the pre-constructed candidate pattern sequence to obtain a pattern matching degree includes: Calculating the edit distance between the current pattern sequence and a pre-constructed candidate pattern sequence, and selecting the candidate pattern sequence with the smallest edit distance as the target pattern sequence; Select the maximum value from the sequence length of the current pattern sequence and the sequence length of the target pattern sequence as the longest sequence length; The pattern matching degree is calculated based on the minimum edit distance and the longest sequence length.

4. The method according to claim 2, characterized in that Determining the temporal correlation factor between the abnormal user time corresponding to the abnormal user action and the abnormal transaction time corresponding to the abnormal transaction behavior includes: For each abnormal transaction behavior, obtain the user's abnormal actions that occurred within the set time threshold before and after the corresponding abnormal transaction time; If at least two abnormal user actions are obtained, the abnormal user time with the smallest time difference from the abnormal transaction time is selected from the corresponding at least two abnormal user times; The timing correlation factor is calculated according to the transaction abnormal time and the selected user abnormal time.

5. The method according to claim 2, characterized in that The fusing of the user anomaly confidence, the transaction anomaly confidence, the time series correlation factor, and the pattern matching degree to obtain the total anomaly confidence includes: Weighting the user anomaly confidence and the transaction anomaly confidence to obtain a basic confidence; Weighting the preset basic factor, the timing correlation factor and the pattern matching degree to obtain a dynamic adjustment factor; The product of the basic confidence and the dynamic adjustment factor is calculated to obtain the total abnormality confidence.

6. The method according to claim 1, characterized in that The analysis of the transaction behavior sequences of the account to be identified and the reference account to obtain abnormal transaction behaviors includes: A dynamic time warping method is used to calculate the cumulative minimum distance between the transaction behavior sequences of the account to be identified and the reference account; if the cumulative minimum distance is less than a preset distance threshold, a pattern similarity anomaly is determined to exist; the transaction behavior sequence includes at least one of the following: transaction direction, transaction quantity, transaction amount, and transaction target code; Conduct cross-correlation analysis on the transaction behavior sequences of the identified account and the benchmark account to obtain the maximum correlation coefficient and lag period; If the maximum correlation coefficient is greater than a preset correlation coefficient threshold, it is determined that a strong correlation anomaly exists; If the hysteresis period falls within a preset time threshold, it is determined that a behavior hysteresis anomaly exists.

7. A device for identifying abnormal trading behavior in a trading room, characterized in that: include: An image detection module is used to detect user actions on the image data of the trading room to obtain abnormal user actions, abnormal user time, and user abnormality confidence; abnormal user actions include blocking behavior, carrying communication devices, or suspicious gestures; A transaction analysis module is used to analyze the transaction behavior sequences of the identified account and the benchmark account to obtain abnormal transaction behavior, abnormal transaction time, and transaction abnormality confidence; the abnormal transaction behavior includes pattern similarity abnormality, strong correlation abnormality, or behavior hysteresis abnormality; The behavior recognition module is used to determine an abnormal behavior recognition result based on the abnormal user action, the abnormal user time and the user abnormality confidence, as well as the abnormal transaction behavior, the abnormal transaction time and the transaction abnormality confidence.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for identifying abnormal trading behavior in a trading room as described in any one of claims 1-6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for identifying abnormal trading behavior in a trading room as described in any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, implements the method for identifying abnormal trading behavior in a trading room according to any one of claims 1 to 6.

Images