Digital transaction anomaly detection method and system based on big data

Abstract

The invention relates to the technical field of exception management, in particular to a digital transaction exception detection method and system based on big data. The method comprises the following steps: obtaining a digital transaction volume data set corresponding to multi-source heterogeneous, and carrying out heterogeneous unification, cleaning standardization and multi-dimensional transaction feature analysis to obtain various digital transaction features corresponding to each transaction sample; performing normal transaction behavior range statistics on each digital transaction feature corresponding to each transaction sample to obtain a normal transaction behavior feature range domain; acquiring real-time digital transaction data and performing transaction deviation anomaly detection to obtain an abnormal transaction detection result corresponding to the real-time digital transaction; and if the abnormal transaction detection result corresponding to the real-time digital transaction is judged to have the abnormal transaction, obtaining historical transaction data corresponding to the abnormal transaction and performing transaction risk assessment and early warning to obtain risk level early warning information corresponding to the abnormal transaction. According to the invention, accurate identification and real-time early warning of the digital transaction abnormity can be realized.

Description

Technical Field

[0001] The present invention relates to the field of exception management technology, and in particular to a digital transaction anomaly detection method and system based on big data. Background Art

[0002] With the rapid development of the digital economy, digital transactions have become one of the primary modes of global commerce. The growth of e-commerce, financial technology, and various online payment platforms has promoted the popularization of digital transactions, bringing unprecedented convenience. In recent years, anomaly detection methods based on big data analysis and machine learning have been widely studied. By deeply mining large-scale digital transaction data and utilizing machine learning algorithms such as deep learning, decision trees, and random forests, these methods can automatically identify potential anomaly patterns in transaction data and predict and evaluate future transactions based on historical data. These methods can detect anomalies in real time during transactions, improving detection efficiency and accuracy. However, most existing digital transaction anomaly detection methods rely on traditional rule engines or statistical models. These methods are typically based on fixed transaction patterns or set rules. Rule engines require manual rule setting and are difficult to update as transaction patterns change. Statistical models, on the other hand, lack the ability to process complex nonlinear relationships and large-scale data, and lack the ability to identify unknown anomalous behavior, which increases the false positive rate of anomaly detection. Summary of the Invention

[0003] Based on this, it is necessary for the present invention to provide a digital transaction anomaly detection method and system based on big data to solve at least one of the above technical problems.

[0004] To achieve the above objectives, a method for detecting anomalies in digital transactions based on big data is provided, comprising the following steps: Step S1: Obtain a digital transaction volume data set corresponding to multiple sources and heterogeneity, and perform heterogeneous unification and cleaning and standardization on the digital transaction volume data set to obtain a standardized digital transaction volume set; Step S2: Perform multi-dimensional transaction feature analysis on the standardized digital transaction set to obtain various digital transaction features corresponding to each transaction sample; perform normal transaction behavior range statistics on the various digital transaction features corresponding to each transaction sample based on the standardized digital transaction set to obtain a normal transaction behavior feature range domain; Step S3: Acquire real-time digital transaction data, and perform transaction deviation anomaly detection on the real-time digital transaction data based on a normal transaction behavior feature range domain to obtain abnormal transaction detection results corresponding to the real-time digital transactions; Step S4: If it is determined that the abnormal transaction detection result corresponding to the real-time digital transaction indicates that there is an abnormal transaction, the historical transaction data corresponding to the abnormal transaction is obtained, and a propagation and diffusion transaction network corresponding to the abnormal transaction is constructed based on the historical transaction data corresponding to the abnormal transaction; based on the propagation and diffusion transaction network corresponding to the abnormal transaction, a transaction risk assessment and warning is performed on the abnormal transaction to obtain risk level warning information corresponding to the abnormal transaction.

[0005] Furthermore, step S1 includes the following steps: Step S11: Acquire a multi-source heterogeneous digital transaction data set from multiple data sources including transaction platforms, payment systems, and bank accounts, including transaction process data corresponding to each digital transaction; Step S12: performing a unified data format conversion on the digital transaction volume data sets corresponding to the multi-source heterogeneous data sets to obtain a digital transaction volume data set with a unified format; Step S13: performing duplicate record removal processing on the digital transaction volume data set after the format is unified, so as to remove duplicate digital transaction records and invalid transaction records with obvious errors, thereby obtaining a deduplicated digital transaction volume data set; Step S14: performing fitting smoothing filling on the deduplicated digital transaction volume dataset to fit and smoothly fill the corresponding missing transaction records, thereby obtaining a digital transaction volume dataset after smoothing filling; Step S15: performing transaction standardization processing on the digital transaction volume data set after smooth filling to obtain a standardized digital transaction volume set.

[0006] Furthermore, step S2 includes the following steps: Step S21: performing time sequence synchronization processing on the standardized digital transaction body set to obtain a corresponding digital transaction body set under the same time sequence; Step S22: Analyzing the transaction time characteristics of the corresponding digital transaction sets in the same time sequence to obtain the digital transaction time-related characteristics corresponding to each transaction sample, including the transaction time, transaction interval, and transaction peak period distribution; analyzing the transaction frequency characteristics of the corresponding digital transaction sets in the same time sequence to obtain the digital transaction frequency characteristics corresponding to each transaction sample, including the number of transactions per unit time and the transaction frequency change rate; Step S23: Analyze the transaction share characteristics of the standardized digital transaction set to obtain the digital transaction share-related characteristics corresponding to each transaction sample, including the single transaction share, cumulative transaction share, and share fluctuation range; Step S24: Analyze transaction device characteristics of the standardized digital transaction volume set to obtain digital transaction device information characteristics corresponding to each transaction sample, including device type, device geographic location, and device usage frequency; perform multi-dimensional merging of digital transaction time-related characteristics, digital transaction frequency characteristics, digital transaction share-related characteristics, and digital transaction device information characteristics corresponding to each transaction sample to obtain various digital transaction characteristics corresponding to each transaction sample; Step S25: Based on the standardized digital transaction body set, normal transaction behavior range statistics are performed on each digital transaction feature corresponding to each transaction sample to obtain a normal transaction behavior feature range domain.

[0007] Furthermore, the analysis of transaction time characteristics of the corresponding digital transaction volume set in the same time sequence in step S22 includes the following steps: Determining the transaction time of each digital transaction body for a set of digital transaction bodies corresponding to the same time sequence to obtain the transaction moment corresponding to each digital transaction body; Perform transaction time interval statistics on the corresponding digital transaction body set under the same time sequence, so as to statistically calculate the transaction interval corresponding to any two adjacent transactions of the same digital transaction body; Obtain the number of digital transactions corresponding to each time point through the corresponding digital transaction body set in the same time sequence, and draw a distribution of the number of digital transactions corresponding to each time point to generate a distribution of the number of digital transactions; Obtaining the digital transaction distribution mean and the digital transaction distribution standard deviation corresponding to the time series through the digital transaction number distribution, and determining the transaction number distribution threshold based on the digital transaction distribution mean and the digital transaction distribution standard deviation corresponding to the time series to obtain the digital transaction number distribution threshold; Based on the digital transaction number distribution threshold, the peak period of the digital transaction number corresponding to each time point is determined to obtain the peak period of the digital transaction number; the transaction peak distribution statistics are performed according to the corresponding digital transaction number within the peak period of the digital transaction number to obtain the transaction peak distribution.

[0008] Furthermore, step S25 includes the following steps: Step S251: performing principal component dimensionality reduction processing on each digital transaction feature corresponding to each transaction sample to remove redundant digital transaction features and obtain the reduced dimensionality digital transaction feature corresponding to each transaction sample; Step S252: Constructing a corresponding digital transaction behavior clustering model based on the standardized digital transaction set, and performing different transaction behavior clustering on the digital transaction features after dimensionality reduction corresponding to each transaction sample based on the digital transaction behavior clustering model, so as to obtain various digital transaction features corresponding to normal transaction behavior samples and abnormal transaction behavior samples; Step S253: performing normal transaction behavior range statistics based on the corresponding digital transaction features in the normal transaction behavior samples and the abnormal transaction behavior samples to obtain a normal transaction behavior feature range domain.

[0009] Furthermore, step S253 includes the following steps: Obtain the distribution mean and distribution curvature of each digital transaction feature corresponding to the normal transaction behavior sample by using the digital transaction features corresponding to the normal transaction behavior sample; Sum the characteristic distribution slope deviations of each digital transaction feature corresponding to the abnormal transaction behavior sample to obtain the sum of the abnormal transaction feature distribution slope deviations; Based on the slope deviation of the abnormal transaction feature distribution and the distribution mean and distribution curvature corresponding to each transaction feature under the normal transaction behavior sample, the normal transaction behavior range statistics are performed to obtain the normal transaction behavior feature range domain.

[0010] Furthermore, step S3 includes the following steps: Step S31: Acquire real-time digital transaction data; Step S32: performing a consistent multi-dimensional transaction feature analysis on the real-time digital transaction data to obtain various digital transaction features corresponding to the real-time transaction data; Step S33: Obtaining the characteristic distribution change amplitude corresponding to each of the real-time transaction characteristics based on each of the digital transaction characteristics corresponding to the real-time transaction data, and performing a comparative calculation based on the degree of deviation between the characteristic distribution change amplitude corresponding to each of the real-time transaction characteristics and the range of normal transaction behavior characteristics to obtain the degree of deviation corresponding to each of the real-time transaction characteristics; Step S34: performing weighted calculation on the degree of deviation corresponding to each feature of the real-time transaction to obtain the overall degree of deviation between the real-time transaction data and the range of normal transaction behavior features; Step S35: performing transaction deviation anomaly detection on the real-time digital transaction data based on the overall deviation between the real-time transaction data and the normal transaction behavior feature range domain to obtain abnormal transaction detection results corresponding to the real-time digital transaction.

[0011] Furthermore, step S4 includes the following steps: Step S41: If it is determined that the abnormal transaction detection result corresponding to the real-time digital transaction contains an abnormal transaction, then historical transaction data corresponding to the abnormal transaction is obtained, including the past abnormal transaction records and abnormal transaction behavior patterns of the subject corresponding to the abnormal transaction; Step S42: Obtaining upstream and downstream transaction parties and transaction links related to the abnormal transaction based on historical transaction data corresponding to the abnormal transaction; Step S43: Constructing a propagation and diffusion transaction network corresponding to the abnormal transaction based on the upstream and downstream transaction parties and transaction links related to the abnormal transaction; Step S44: performing a transaction risk assessment calculation on the abnormal transaction based on the propagation and diffusion transaction network corresponding to the abnormal transaction to obtain a transaction risk level score corresponding to the abnormal transaction; Step S45: performing transaction risk warning processing on the abnormal transaction based on the transaction risk level score corresponding to the abnormal transaction to obtain risk level warning information corresponding to the abnormal transaction.

[0012] Furthermore, step S44 includes the following steps: Determine the length of the propagation and diffusion link corresponding to the abnormal transaction in the propagation and diffusion transaction network through the propagation and diffusion transaction network corresponding to the abnormal transaction, and perform an abnormal transaction impact assessment based on the propagation and diffusion link length corresponding to the abnormal transaction in the propagation and diffusion transaction network to obtain the propagation and diffusion impact range corresponding to the abnormal transaction; Determine the number of affected transactions in the propagation and diffusion transaction network corresponding to the abnormal transaction based on the scope of the propagation and diffusion impact of the abnormal transaction, so as to obtain the total number of affected transaction parties in the propagation and diffusion transaction network corresponding to the abnormal transaction; By counting the distances between the transaction party corresponding to the abnormal transaction and each transaction party within the total number of affected transaction parties in the diffusion transaction network, and comparing the distance with half the diffusion link length, it is judged that if the distance is greater than half the diffusion link length, there is an indirect impact; otherwise, there is a direct impact. At the same time, the transaction losses between the transaction parties corresponding to the direct and indirect impacts and the transaction party are assessed to obtain the degree of direct loss and indirect loss corresponding to the abnormal transaction. Perform a weighted average summation based on the direct loss and indirect loss levels corresponding to the abnormal transaction to obtain the corresponding loss level caused by the abnormal transaction; Based on the scope of the spread and diffusion of the abnormal transaction and the corresponding degree of loss caused by the abnormal transaction, a transaction risk assessment calculation is performed on the abnormal transaction to obtain a transaction risk level score corresponding to the abnormal transaction.

[0013] Furthermore, the present invention also provides a digital transaction anomaly detection system based on big data, which is used to execute the digital transaction anomaly detection method based on big data as described above. The digital transaction anomaly detection system based on big data includes: The digital transaction data processing module is used to obtain digital transaction data sets corresponding to multiple sources and heterogeneity, and to unify and cleanse the digital transaction data sets to obtain standardized digital transaction data sets; The transaction behavior range statistics module is used to perform multi-dimensional transaction feature analysis on the standardized digital transaction set to obtain various digital transaction features corresponding to each transaction sample; based on the standardized digital transaction set, normal transaction behavior range statistics are performed on the various digital transaction features corresponding to each transaction sample to obtain the normal transaction behavior feature range domain; A real-time transaction anomaly detection module is used to obtain real-time digital transaction data and perform transaction deviation anomaly detection on the real-time digital transaction data based on the range of normal transaction behavior characteristics to obtain abnormal transaction detection results corresponding to the real-time digital transactions; The abnormal transaction risk warning module is used to obtain historical transaction data corresponding to the abnormal transaction if it is determined that the abnormal transaction detection result corresponding to the real-time digital transaction contains an abnormal transaction, and to construct a propagation and diffusion transaction network corresponding to the abnormal transaction based on the historical transaction data corresponding to the abnormal transaction; based on the propagation and diffusion transaction network corresponding to the abnormal transaction, conduct a transaction risk assessment and warning for the abnormal transaction to obtain risk level warning information corresponding to the abnormal transaction.

[0014] Beneficial effects of the present invention: 1. Compared with the prior art, the digital transaction anomaly detection method based on big data proposed by the present invention has the beneficial effect of ensuring the uniformity, clarity and accuracy of the acquired digital transaction data set. Due to the heterogeneity of data sources, the original data comes from different systems, formats or platforms, and there are inconsistencies between the data, such as different timestamps, transaction identifiers, data accuracy, etc. Therefore, by performing data denoising, format unification, and null value filling, the data quality problem is solved and the reliability of subsequent analysis is ensured. Standardization not only allows data from different sources to be processed under the same data model, but also eliminates the interference caused by different units, dimensions or data granularity, thereby making each transaction sample comparable. Through this stage of cleaning and standardization, the algorithms of the subsequent steps can be calculated and analyzed in a consistent data environment, thereby improving the accuracy and application effect of the model. Secondly, by analyzing the multi-dimensional features of each transaction sample, the laws of digital transaction behavior can be fully explored from different angles. For example, factors such as the share, frequency, time, and object of each transaction can be analyzed to identify the normal fluctuation range of each feature. This process is not only for building the basic data set required for the model, but also can reveal the pattern and range of normal trading behavior. Through in-depth analysis of these transaction characteristics, typical trading patterns in different markets, time periods, and conditions can be identified, thereby providing a basis for subsequent abnormal transaction detection. By statistically analyzing the range of normal trading behavior, the upper and lower limits of normal trading behavior can be accurately set, and any trading behavior that exceeds this range can be marked as abnormal. Especially in a big data environment, efficient monitoring of real-time trading behavior depends on the work at this stage. It provides a reliable benchmark and basis for subsequent anomaly detection and early warning processes, enabling transaction monitoring to more accurately identify potential risk factors. Then, by obtaining real-time digital transaction data, it is possible to monitor and analyze transaction data in real time while digital transactions occur, and compare it with the characteristic range of normal transaction behavior. If a certain transaction data deviates from the set normal range, it can be quickly marked as an abnormal transaction. By comparing it with the characteristic range of normal transaction behavior, it can effectively identify potential risky transaction behaviors in the market. This process can timely discover and isolate abnormal transaction behaviors to avoid further negative impact on the market. Real-time transaction deviation anomaly detection is highly sensitive and immediate, and is a guarantee to ensure the healthy operation of the market. This step can also continuously optimize the anomaly detection algorithm and improve the recognition accuracy through the feedback mechanism, thereby enhancing the ability to identify unknown abnormal behaviors.Finally, when an abnormal transaction is detected in real time, the historical data of the transaction will be further mined to analyze the transaction network and potential propagation and diffusion relationship behind it. This process is very critical because in complex financial markets, a single abnormal transaction often does not exist in isolation, but is interconnected with other transaction behaviors to form a broad propagation chain. By constructing a propagation and diffusion transaction network, the source and scope of abnormal transactions can be tracked, other suspicious behaviors related to it can be identified, and timely measures can be taken to intervene. This network analysis not only helps to reveal the source of risks in the market, but also predicts the further impact of abnormal trading behaviors on the market, and provides multi-level and multi-dimensional risk assessment information. On this basis, it can issue early warnings based on the risk level of abnormal transactions, help transactions take corresponding risk prevention measures, reduce the false alarm rate caused by insufficient anomaly detection capabilities, and ensure the stability and transparency of the digital trading market.

[0015] 2. The digital transaction anomaly detection system based on big data proposed in the present invention is generally composed of a digital transaction data processing module, a transaction behavior range statistics module, a real-time transaction anomaly detection module, and an abnormal transaction risk warning module. It can implement any digital transaction anomaly detection method based on big data described in the present invention, and is used to combine the operations between computer programs running on various modules to implement the digital transaction anomaly detection method based on big data. The internal structures of the system cooperate with each other, which can greatly reduce duplication of work and manpower investment, and can quickly and effectively provide a more accurate and efficient digital transaction anomaly detection process based on big data, thereby simplifying the operational process of the digital transaction anomaly detection system based on big data. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments thereof made with reference to the following drawings: Figure 1 This is a flowchart of the steps of the method for detecting anomalies in digital transactions based on big data according to the present invention; Figure 2 for Figure 1 Detailed step flow diagram of step S1; Figure 3 for Figure 1 Detailed step flow chart of step S2 in FIG. DETAILED DESCRIPTION

[0017] The following is a clear and complete description of the technical method of the present invention in conjunction with the accompanying drawings. It is obvious that the embodiments described are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts are within the scope of protection of the present invention.

[0018] In addition, the accompanying drawings are merely schematic illustrations of the present invention and are not necessarily drawn to scale. Identical reference numerals in the figures denote identical or similar parts, and thus repetitive descriptions thereof will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor and / or microcontroller approaches.

[0019] It should be understood that although the terms "first," "second," and the like may be used herein to describe various items, these items should not be limited by these terms. These terms are used solely to distinguish one item from another. For example, a first item may be referred to as a second item, and similarly, a second item may be referred to as a first item without departing from the scope of the exemplary embodiments. The term "and / or" as used herein includes any and all combinations of one or more of the listed associated items.

[0020] To achieve this, please refer to Figures 1 to 3 The present invention provides a method for detecting anomalies in digital transactions based on big data, the method comprising the following steps: Step S1: Obtain a digital transaction volume data set corresponding to multiple sources and heterogeneity, and perform heterogeneous unification and cleaning and standardization on the digital transaction volume data set to obtain a standardized digital transaction volume set; Step S2: Perform multi-dimensional transaction feature analysis on the standardized digital transaction set to obtain various digital transaction features corresponding to each transaction sample; perform normal transaction behavior range statistics on the various digital transaction features corresponding to each transaction sample based on the standardized digital transaction set to obtain a normal transaction behavior feature range domain; Step S3: Acquire real-time digital transaction data, and perform transaction deviation anomaly detection on the real-time digital transaction data based on a normal transaction behavior feature range domain to obtain abnormal transaction detection results corresponding to the real-time digital transactions; Step S4: If it is determined that the abnormal transaction detection result corresponding to the real-time digital transaction indicates that there is an abnormal transaction, the historical transaction data corresponding to the abnormal transaction is obtained, and a propagation and diffusion transaction network corresponding to the abnormal transaction is constructed based on the historical transaction data corresponding to the abnormal transaction; based on the propagation and diffusion transaction network corresponding to the abnormal transaction, a transaction risk assessment and warning is performed on the abnormal transaction to obtain risk level warning information corresponding to the abnormal transaction.

[0021] In the embodiment of the present invention, please refer to Figure 1FIG. 1 is a flow chart of the steps of the method for detecting anomalies in digital transactions based on big data according to the present invention. In this example, the method for detecting anomalies in digital transactions based on big data includes the following steps: Step S1: Obtain a digital transaction volume data set corresponding to multiple sources and heterogeneity, and perform heterogeneous unification and cleaning and standardization on the digital transaction volume data set to obtain a standardized digital transaction volume set; In an embodiment of the present invention, a connection is established with an e-commerce platform, a third-party payment system, and a core banking system in a large digital transaction data center through a data interface to obtain a multi-source heterogeneous digital transaction data set. The transaction data from the e-commerce platform is presented in JSON format, including information such as order number, transaction time, transaction share, buyer and seller IDs, etc. The third-party payment system provides data in CSV format, covering fields such as payment serial number, payment time, transaction share, and payment method. The banking system outputs text data in a fixed format, recording content such as transaction date, transaction type, transaction share, and counterparty account. In order to achieve heterogeneous unification, all data are first converted into relational The format of the data is recognizable by the database. For JSON data, it is converted into a table form through a parsing tool; CSV data is directly imported into the database; fixed-format text data is split according to field length and position and then imported, followed by data cleaning, eliminating invalid records such as transaction shares of 0 and missing transaction time. The transaction time field is uniformly converted to Unix timestamp format, accurate to seconds, and then standardized. The transaction share is proportionally scaled to the range of 0-10000. For example, if the original transaction share is 500000, it is proportionally scaled to 500. After the above operations, a standardized digital transaction set with unified structure and data specifications is finally obtained, laying the foundation for subsequent analysis.

[0022] Step S2: Perform multi-dimensional transaction feature analysis on the standardized digital transaction set to obtain various digital transaction features corresponding to each transaction sample; perform normal transaction behavior range statistics on the various digital transaction features corresponding to each transaction sample based on the standardized digital transaction set to obtain a normal transaction behavior feature range domain; In this embodiment of the present invention, multi-dimensional transaction feature analysis is performed on a standardized set of digital transactions. Regarding transaction time features, the transaction time of each transaction is extracted, and the time interval between two adjacent transactions by the same transaction entity is calculated. For example, a transaction entity performs transactions at timestamps 1640995200 and 1641006800, with an interval of 11,600 seconds. The number of transactions within each window is counted using a one-hour window, and the distribution of peak transaction times is analyzed. Transaction frequency feature analysis involves counting the number of transactions per transaction entity within a day and comparing the change in transaction counts between two consecutive days. For example, if a transaction entity performs 10 transactions on the first day and 15 transactions on the second day, the transaction frequency increases by 5. Regarding transaction share features, the share of each transaction is extracted, the cumulative transaction share of the same transaction entity over a period of time is calculated, the maximum and minimum transaction shares are identified, and the fluctuation range is determined. Transaction device feature analysis involves extracting device type (e.g., mobile phone, PC), device location (via IP address resolution), and device usage frequency (number of transactions per device in a week) from the transaction data. By combining these features, we obtain the digital transaction characteristics corresponding to each transaction sample. Based on these characteristics, we filter out sample data marked as normal transactions from the standardized digital transaction set and analyze the value range of each characteristic. For example, if the minimum value of the transaction share in the normal transaction sample is 100 and the maximum value is 5000, we can determine that the normal value range of the transaction share is 100-5000. Similarly, we can determine the normal range of other characteristics, and ultimately obtain the characteristic range of normal transaction behavior.

[0023] Step S3: Acquire real-time digital transaction data, and perform transaction deviation anomaly detection on the real-time digital transaction data based on a normal transaction behavior feature range domain to obtain abnormal transaction detection results corresponding to the real-time digital transactions; In an embodiment of the present invention, real-time digital transaction data is continuously acquired through a real-time data interface. The format of this data is consistent with the original data acquired in step S1. After acquisition, the real-time data is first subjected to the same heterogeneous unification and cleaning and standardization processing as in step S1 to conform to the established standard format. The various transaction features in the real-time digital transaction data are compared with the normal transaction behavior feature range determined in step S2. If the transaction share of a real-time transaction is 6,000, which exceeds the normal range of 100-5,000; or the transaction time interval is extremely short, which obviously does not conform to the time interval pattern of normal transactions; or the transaction equipment is frequently replaced in a short period of time and the geographical location spans a large range, which is inconsistent with the normal equipment usage frequency and geographical location characteristics, as long as any one feature exceeds the normal range, the transaction is determined to be an abnormal transaction. By comparing the features of each real-time transaction data, the abnormal transaction detection results corresponding to the real-time digital transaction are finally obtained, and it is clear which transactions have abnormal situations.

[0024] Step S4: If it is determined that the abnormal transaction detection result corresponding to the real-time digital transaction indicates that there is an abnormal transaction, the historical transaction data corresponding to the abnormal transaction is obtained, and a propagation and diffusion transaction network corresponding to the abnormal transaction is constructed based on the historical transaction data corresponding to the abnormal transaction; based on the propagation and diffusion transaction network corresponding to the abnormal transaction, a transaction risk assessment and warning is performed on the abnormal transaction to obtain risk level warning information corresponding to the abnormal transaction.

[0025] In an embodiment of the present invention, when it is determined that an abnormal transaction detection result corresponding to a real-time digital transaction contains an abnormal transaction, for example, an abnormal transaction involving 3,000 shares is detected, and the transaction subjects are Company A and Company B. All transaction data of Company A and Company B in the past five years are immediately retrieved from the historical transaction database. Based on these historical transaction data, a graph database is used as a tool, and the transaction subjects are used as nodes and transaction relationships as edges to construct a transaction relationship graph. Starting from the two nodes of Company A and Company B, a graph traversal algorithm is used to find the upstream and downstream transaction parties such as Company C and Company D that directly trade with them, and record the transaction links, such as Company A → Company C → Company E. Continuous in-depth mining is carried out to determine indirect upstream and downstream transaction parties, form a complete transaction link network, and construct a propagation and diffusion transaction network corresponding to the abnormal transaction. Based on the propagation and diffusion transaction network, the risk of abnormal transactions is comprehensively assessed, and the past abnormal transaction records of the transaction subjects Company A and Company B are analyzed. If Company A has experienced a sudden surge and then a sharp decrease in transaction shares many times, it means that its transaction risk is relatively high. Consider the complexity of the transaction chain. If the chain involves multiple high-risk transaction parties, the possibility of risk transmission is high. The number of affected transaction parties is counted. If the abnormal transaction affects more than 10 other companies, the risk impact is wide. Based on these factors, a comprehensive assessment of the abnormal transaction is conducted to determine the risk level. If the assessment is high risk, the system automatically generates risk level warning information, including the abnormal transaction subject, transaction share, risk level, etc., and sends it to the risk management department via SMS, email, etc., and highlights it in the transaction monitoring system so that preventive measures can be taken in a timely manner.

[0026] Furthermore, step S1 includes the following steps: Step S11: Acquire a multi-source heterogeneous digital transaction data set from multiple data sources including transaction platforms, payment systems, and bank accounts, including transaction process data corresponding to each digital transaction; Step S12: performing a unified data format conversion on the digital transaction volume data sets corresponding to the multi-source heterogeneous data sets to obtain a digital transaction volume data set with a unified format; Step S13: performing duplicate record removal processing on the digital transaction volume data set after the format is unified, so as to remove duplicate digital transaction records and invalid transaction records with obvious errors, thereby obtaining a deduplicated digital transaction volume data set; Step S14: performing fitting smoothing filling on the deduplicated digital transaction volume dataset to fit and smoothly fill the corresponding missing transaction records, thereby obtaining a digital transaction volume dataset after smoothing filling; Step S15: performing transaction standardization processing on the digital transaction volume data set after smooth filling to obtain a standardized digital transaction volume set.

[0027] As an embodiment of the present invention, refer to Figure 2 As shown, Figure 1 Detailed step flow diagram of step S1 in FIG. 1 , in this embodiment, step S1 includes the following steps: Step S11: Acquire a multi-source heterogeneous digital transaction data set from multiple data sources including transaction platforms, payment systems, and bank accounts, including transaction process data corresponding to each digital transaction; In an embodiment of the present invention, a data collection system built by a financial technology company acquires multi-source, heterogeneous digital transaction datasets from three data sources. A data interface is established with an e-commerce trading platform, and order transaction data is collected hourly. This data includes fields such as order number, transaction time (accurate to the second), product name, transaction share (to two decimal places), buyer ID, and seller ID. Approximately 100,000 order data items are collected at a time. Payment flow data is pulled from a third-party payment system at minute intervals, covering information such as payment flow number, payment time, payment method, payment share, and transaction accounts of both parties. Approximately 50,000 records are collected each time. The system is connected to a banking system to obtain account transaction data daily, including transaction date, transaction type (e.g., transfer, purchase), transaction share, counterparty account, and balance change. The daily data volume is approximately 30,000 items. These data sources have significant differences in data format: the e-commerce platform stores data in JSON format, the payment system uses CSV format, and the banking system uses fixed-width text format. These raw data sets, containing transaction process data corresponding to each digital transaction, are integrated and stored to form an initial, multi-source, heterogeneous digital transaction dataset, providing the raw data foundation for subsequent processing.

[0028] Step S12: performing a unified data format conversion on the digital transaction volume data sets corresponding to the multi-source heterogeneous data sets to obtain a digital transaction volume data set with a unified format; In the embodiment of the present invention, by converting the data format of the previously acquired multi-source heterogeneous digital transaction data set into a unified format, a data parsing program is written for the JSON format data of the e-commerce platform, and the fields in each JSON object are extracted and rearranged according to a unified data structure. For example, the order number is mapped to the "transaction identifier" field, and the transaction time is mapped to the "timestamp" field (converted to the Unix timestamp format, that is, from January 1, 1970 00:00:00 The transaction share is converted to a numeric type with two decimal places. For the CSV format data of the payment system, a data processing tool is used to read the data line by line, and the payment serial number is mapped to the "transaction identifier". The payment time is converted to a Unix timestamp, and the payment share is also standardized as a numeric type with two decimal places. For the fixed-width text format data of the banking system, the corresponding data is extracted and formatted according to the pre-defined field length and position. For example, the transaction date is converted to a Unix timestamp, and the transaction share is adjusted to a standard numeric format. After the above processing, all data are uniformly converted to a unified format containing fields such as "transaction identifier", "timestamp", "transaction type", "transaction share", and "transaction party identifier". A digital transaction data set with unified format is obtained, so that data from different sources have a consistent structure, which is convenient for subsequent processing.

[0029] Step S13: performing duplicate record removal processing on the digital transaction volume data set after the format is unified, so as to remove duplicate digital transaction records and invalid transaction records with obvious errors, thereby obtaining a deduplicated digital transaction volume data set; In an embodiment of the present invention, duplicate records are removed from a standardized digital transaction data set. Four fields, "transaction identifier," "timestamp," "transaction share," and "transaction party identifiers," are defined as key combinations for determining the uniqueness of transaction records. A hash algorithm is then used to hash the key combination fields for each record to generate a unique hash value. For example, for a transaction record with the key combination fields of "T001," "1640995200," "199.99," and "Buyer001-Seller001," a hash value of "abc123" is calculated using a hash function. The calculated hash value is then compared with the recorded hash value. If the hash values ​​are identical, the transaction record is identified as a duplicate and deleted. At the same time, a reasonable range of transaction shares is set, such as the transaction share must be greater than 0 and not more than 1,000,000. Transaction records outside this range are determined to be invalid transaction records with obvious errors and deleted. Assume that after processing, 20,000 duplicate transaction records and 500 invalid transaction records were identified and deleted from the 180,000 data with unified formats, and finally a digital transaction data set after deduplication was obtained, and the data volume was reduced to about 159,500.

[0030] Step S14: performing fitting smoothing filling on the deduplicated digital transaction volume dataset to fit and smoothly fill the corresponding missing transaction records, thereby obtaining a digital transaction volume dataset after smoothing filling; In this embodiment of the present invention, missing transaction records are processed by fitting and smoothing the deduplicated digital transaction data set. The data is arranged in chronological order based on the "timestamp" field. Missing time points in the time series are filled using linear interpolation. Assume that a record is missing between timestamps 1640995200 and 1640995800. It is known that the transaction shares of the two records are 100 and 120 respectively. According to the linear interpolation formula: ,in is the timestamp of the missing record (assuming it is 1640995500), 、 The timestamp of the previous and next known records, 、 For the corresponding transaction share, substitute the data and calculate: =110, that is, the filled transaction share is 110, and other fields are reasonably filled according to the logic of the previous and next records. For a small number of missing values ​​in numerical fields such as transaction share, the mean filling method is used to calculate the average value of all non-missing values ​​of the field. For example, if the sum of non-missing values ​​of the transaction share field is 1595000 and the number of non-missing records is 159499, the average value is 1595000 / 159499≈10.00. The missing transaction share is filled with this average value. Through the above fitting smooth filling operation, the digital transaction volume dataset after smooth filling is obtained to ensure the integrity and continuity of the data.

[0031] Step S15: performing transaction standardization processing on the digital transaction volume data set after smooth filling to obtain a standardized digital transaction volume set.

[0032] In the embodiment of the present invention, transaction normalization processing is performed on the digital transaction volume dataset after smooth filling. First, the "transaction share" field is normalized using the Z-score normalization method. The formula is: ,in is the original transaction share, is the mean of transaction shares, is the standard deviation, assuming the mean of the transaction share field =100, standard deviation =20, for a record with a transaction share of 120, the normalized value is =1, for the "timestamp" field, map it to the range of 0-1 and use the normalization formula: ,in is the original timestamp, and are the minimum and maximum timestamps in the dataset, respectively. Assuming the minimum timestamp is 1640995200 and the maximum is 1641081600, for the record with a timestamp of 1641000000, the normalized value is ≈0.056. For categorical fields such as "transaction party identifier," one-hot encoding is used for conversion. For example, the transaction party identifiers can have different values, such as "Buyer001-Seller001" and "Buyer002-Seller002." These are converted into binary vector representations, with "Buyer001-Seller001" represented as [1, 0, 0, ...] and "Buyer002-Seller002" as [0, 1, 0, ...]. After this standardization process, a standardized set of digital transaction bodies is obtained, giving the data a unified metric and format, providing high-quality data input for big data-based digital transaction anomaly detection.

[0033] Furthermore, step S2 includes the following steps: Step S21: performing time sequence synchronization processing on the standardized digital transaction body set to obtain a corresponding digital transaction body set under the same time sequence; Step S22: Analyzing the transaction time characteristics of the corresponding digital transaction sets in the same time sequence to obtain the digital transaction time-related characteristics corresponding to each transaction sample, including the transaction time, transaction interval, and transaction peak period distribution; analyzing the transaction frequency characteristics of the corresponding digital transaction sets in the same time sequence to obtain the digital transaction frequency characteristics corresponding to each transaction sample, including the number of transactions per unit time and the transaction frequency change rate; Step S23: Analyze the transaction share characteristics of the standardized digital transaction set to obtain the digital transaction share-related characteristics corresponding to each transaction sample, including the single transaction share, cumulative transaction share, and share fluctuation range; Step S24: Analyze transaction device characteristics of the standardized digital transaction volume set to obtain digital transaction device information characteristics corresponding to each transaction sample, including device type, device geographic location, and device usage frequency; perform multi-dimensional merging of digital transaction time-related characteristics, digital transaction frequency characteristics, digital transaction share-related characteristics, and digital transaction device information characteristics corresponding to each transaction sample to obtain various digital transaction characteristics corresponding to each transaction sample; Step S25: Based on the standardized digital transaction body set, normal transaction behavior range statistics are performed on each digital transaction feature corresponding to each transaction sample to obtain a normal transaction behavior feature range domain.

[0034] As an embodiment of the present invention, refer to Figure 3 As shown, Figure 1 Detailed step flow diagram of step S2 in the embodiment, step S2 includes the following steps: Step S21: performing time sequence synchronization processing on the standardized digital transaction body set to obtain a corresponding digital transaction body set under the same time sequence; In an embodiment of the present invention, a standardized digital transaction set is used as the operation object. The data set includes transaction data from e-commerce platforms, third-party payment systems, and bank accounts. The transaction time recording accuracy of each data source varies. The e-commerce platform is accurate to the second, and the bank account is accurate to the minute. To achieve time synchronization, the Unix timestamp is used as the benchmark, and the time information of all transaction records is converted into seconds from 00:00:00 UTC on January 1, 1970. For transaction data recorded at the minute level in bank accounts, the starting time of the minute is used as the unified timestamp for all transactions within that period. For example, if a bank account transaction record shows the transaction time as "2024-01-01 10:05", its timestamp is recorded as 1704046800 (corresponding to the Unix timestamp of 10:05:00 on January 1, 2024). For transaction records with repeated timestamps, millisecond increments are added to them in the order of the transaction records in the dataset (starting from 0 and increasing by 1 each time), ensuring that each transaction record has a unique and ordered time identifier. After this processing, the differences in time records from different data sources are eliminated, and the corresponding digital transaction body set in the same time sequence is obtained, providing a unified time benchmark for subsequent feature analysis.

[0035] Step S22: Analyzing the transaction time characteristics of the corresponding digital transaction sets in the same time sequence to obtain the digital transaction time-related characteristics corresponding to each transaction sample, including the transaction time, transaction interval, and transaction peak period distribution; analyzing the transaction frequency characteristics of the corresponding digital transaction sets in the same time sequence to obtain the digital transaction frequency characteristics corresponding to each transaction sample, including the number of transactions per unit time and the transaction frequency change rate; In an embodiment of the present invention, transaction time characteristics are analyzed for a set of digital transactions in the same time sequence. The transaction time (i.e., Unix timestamp) of each transaction sample is extracted using transaction records as units. For transaction intervals, the transaction records of the same transaction subject are sorted by transaction time, and the time difference between two adjacent transactions is calculated. For example, the timestamps of two transactions by a transaction subject are 1704046800 and 1704047400, respectively, and the transaction interval is 600 seconds. To determine the distribution of transaction peaks, the time is divided into several time windows of fixed length (e.g., 1 hour, i.e., 3600 seconds), and the number of transactions in each time window is counted. Assuming that in a day's transaction data, the number of transactions in the 09:00-10:00 time window is 200, and the number of transactions in the 10:00-11:00 time window is 300, by comparing the number of transactions in each time window, a set of time windows with a significantly higher transaction number than the average level is found. When determining the peak trading period and analyzing the transaction frequency characteristics, the number of transactions per unit time (e.g., 1 hour) is calculated for each transaction sample. For the transaction frequency change rate, the change ratio of the number of transactions per unit time in adjacent periods is calculated, taking a fixed time period (e.g., 1 day) as the unit. Assuming that the average number of transactions per hour for a trading entity on the first day is 10 and the average number of transactions per hour on the second day is 15, then its transaction frequency change rate is (15-10) / 10=0.5, which means that the transaction frequency has increased by 50%. Through the above operations, the digital transaction time-related characteristics and transaction frequency characteristics corresponding to each transaction sample are finally obtained.

[0036] Step S23: Analyze the transaction share characteristics of the standardized digital transaction set to obtain the digital transaction share-related characteristics corresponding to each transaction sample, including the single transaction share, cumulative transaction share, and share fluctuation range; In this embodiment of the present invention, transaction share characteristics are analyzed on a standardized set of digital transactions to extract the individual transaction share of each transaction sample. For all transactions by the same transaction subject over a period of time, the cumulative transaction share is calculated. For example, if a transaction subject conducts five transactions in a week, with individual transaction shares of 100, 200, 150, 300, and 50, respectively, its cumulative transaction share is 100 + 200 + 150 + 300 + 50 = 800. To calculate the share fluctuation range, the maximum and minimum individual transaction shares of the transaction subject over a specific time period are first found, and the difference between the two is the share fluctuation range. For the transaction subject in this case, the maximum individual transaction share over the week is 300, and the minimum is 50, resulting in a share fluctuation range of 300 - 50 = 250. By processing all transaction samples, digital transaction share-related characteristics such as individual transaction share, cumulative transaction share, and share fluctuation range are ultimately obtained for each transaction sample, comprehensively reflecting the distribution and fluctuation of transaction share.

[0037] Step S24: Analyze transaction device characteristics of the standardized digital transaction volume set to obtain digital transaction device information characteristics corresponding to each transaction sample, including device type, device geographic location, and device usage frequency; perform multi-dimensional merging of digital transaction time-related characteristics, digital transaction frequency characteristics, digital transaction share-related characteristics, and digital transaction device information characteristics corresponding to each transaction sample to obtain various digital transaction characteristics corresponding to each transaction sample; In an embodiment of the present invention, transaction device feature analysis is performed on a standardized set of digital transaction volumes. The device type (e.g., mobile phone, PC, POS machine, etc.), device geographic location (determined by the device's IP address or GPS location information at the time of the transaction), and device usage frequency (the number of transactions the device participated in within a specific time period) corresponding to each transaction sample are extracted from the transaction records. For example, if a transaction sample shows the device type as a mobile phone, and the device geographic location is "Chaoyang District, Beijing" through IP address resolution, and the device participated in 20 transactions in a month, its device usage frequency is 20 times / month, then the digital transaction time-related features (transaction time, transaction interval, transaction peak distribution), digital transaction frequency features (number of transactions per unit time, transaction frequency change rate), digital transaction share-related features (single transaction share, cumulative transaction share, share fluctuation range), and digital transaction device information features (device type, device geographic location, device usage frequency) corresponding to each transaction sample are multi-dimensionally merged. A data set containing complete digital transaction features is formed in the form of a data table, with each feature as a column and each transaction sample as a row. This clearly presents the multi-dimensional information of each transaction sample, facilitating subsequent analysis and processing.

[0038] Step S25: Based on the standardized digital transaction body set, normal transaction behavior range statistics are performed on each digital transaction feature corresponding to each transaction sample to obtain a normal transaction behavior feature range domain.

[0039] In an embodiment of the present invention, a standardized digital transaction set is used as the processing object. The data set contains transaction data from e-commerce platforms, third-party payment systems and bank accounts. Each transaction sample covers 20 digital transaction features such as transaction share, transaction time interval, transaction time, and number of transactions at the same time point. The principal component analysis (PCA) method is used for dimensionality reduction processing so that the contribution rate of each principal component is greater than or equal to 0.85, thereby obtaining the digital transaction features corresponding to each transaction sample after dimensionality reduction. At the same time, based on the standardized set of digital transaction bodies, a digital transaction behavior clustering model is constructed using the DBSCAN (density-based spatial clustering application) algorithm. The algorithm needs to set two key parameters: the neighborhood radius ϵ and the minimum number of samples MinPts. Assume ϵ=0.5, MinPts=5. For each transaction sample in the data set, the corresponding digital transaction feature vector after dimensionality reduction is taken as the center, and the number of neighborhood samples within the radius ϵ is calculated. If the number of neighborhood samples of a sample is greater than or equal to MinPts, the sample is a core point; if the sample is in the neighborhood of the core point, but the number of its own neighborhood samples is less than MinPts, it is a boundary point; other samples are noise points. Starting from the core point, the density-reachable samples are connected into clusters to form different transaction behavior clusters. For example, during the processing, it was discovered that the transaction shares of a portion of transaction samples were concentrated in a smaller range, with relatively regular transaction time intervals. These samples were clustered into one category; while the transaction shares of another portion of transaction samples fluctuated greatly, with no obvious regularity in the transaction time intervals, and were therefore classified into another category. By processing a large number of transaction samples, all transaction samples were ultimately divided into normal transaction behavior clusters and abnormal transaction behavior clusters. By inputting the dimensionality-reduced digital transaction features corresponding to each transaction sample into the aforementioned model, the corresponding digital transaction features for normal transaction behavior samples and abnormal transaction behavior samples were output. Then, by calculating the distribution mean and distribution curvature of each digital transaction feature corresponding to the normal transaction behavior sample, the deviation sum of the abnormal transaction feature distribution slope was calculated for each data point on the abnormal transaction share distribution curve. Based on the previously obtained deviation sum of the abnormal transaction feature distribution slope, combined with the distribution mean and distribution curvature corresponding to each transaction feature in the normal transaction behavior sample, the normal transaction behavior range was determined, using the formula minimum = distribution mean - Sum maximum = distribution mean - Calculate the range boundaries of normal trading behavior, where and is the adjustment coefficient (assuming = =2), using the same method, calculate the normal transaction behavior range boundaries for other digital transaction features respectively, integrate the normal ranges of all digital transaction features, and form a normal transaction behavior feature range domain, which clearly defines the value range of each digital transaction feature under normal transaction behavior.

[0040] Furthermore, the analysis of transaction time characteristics of the corresponding digital transaction volume set in the same time sequence in step S22 includes the following steps: Determining the transaction time of each digital transaction body for a set of digital transaction bodies corresponding to the same time sequence to obtain the transaction moment corresponding to each digital transaction body; In an embodiment of the present invention, transaction times are determined for transaction data in the same time series based on a standardized digital transaction set. This digital transaction set contains transaction data from e-commerce platforms, third-party payment systems, and bank accounts. All transaction times have been uniformly converted to Unix timestamp format. Each transaction record in the digital transaction set is sequentially traversed to extract the "timestamp" field. For example, the "timestamp" field value of a transaction record is 1640995200, which represents the number of seconds from 00:00:00 UTC on January 1, 1970 to the time the transaction occurred. This is the transaction time corresponding to the digital transaction record. For a digital transaction set containing 159,500 records, the transaction time is accurately determined for each transaction record by extracting and confirming each record one by one, forming a list containing transaction records and corresponding transaction times, providing accurate time dimension data for subsequent analysis.

[0041] Preferably, the transaction time interval statistics of the same digital transaction body are performed on the corresponding digital transaction body set under the same time sequence, so as to statistically calculate the transaction interval corresponding to any two adjacent transactions of the same digital transaction body; In the embodiment of the present invention, based on the determined transaction time of each digital transaction entity, the transaction time interval of the same digital transaction entity is counted, and the digital transaction entity set is grouped according to the transaction party identification, so as to ensure that the transaction records of the same transaction subject are grouped together. For example, for a group of transaction records with the transaction party identifications of "Buyer001-Seller001", the transaction time is sorted from small to large. Assuming that there are three transaction records in the group, the transaction times are t1=1640995200, t2=1640995 800, t3=1641000000, then the interval between the first and second transactions is Δt1=t2−t1=1640995800−1640995200=600 seconds, and the interval between the second and third transactions is Δt2=t3−t2=4200 seconds. The adjacent transaction intervals are calculated for the transaction records in all groups to form a transaction time interval statistics table for each transaction entity. The table contains information such as the identification of the two transaction parties, the adjacent transaction times, and the corresponding transaction interval duration, providing data support for analyzing transaction frequency characteristics.

[0042] Preferably, the number of digital transactions corresponding to each time point is obtained by the corresponding digital transaction volume set in the same time sequence, and the number of digital transactions corresponding to each time point is plotted to generate a digital transaction number distribution; In an embodiment of the present invention, the number of digital transactions corresponding to each time point in a digital transaction set under the same time sequence is counted in units of a fixed time window (e.g., 1 hour, corresponding to 3600 seconds). The entire time span is divided into multiple time windows. For example, from timestamp 1640995200 to 1641081600, the time span is 86400 seconds, which can be divided into 86400 ÷ 3600 = 24 time windows. For the first time window (timestamps 1640995200-1640998800), the digital transaction set is traversed and the number of transaction records within this transaction time range is counted. Assuming that there are 500 transaction records, the number of digital transactions at this time point is 500. In this way, the number of transactions in each time window is calculated to obtain a set of transaction number data, such as [500, 480, 520, ...]. Based on this set of transaction count data, a bar chart or line chart is drawn with the time window as the horizontal axis and the transaction count as the vertical axis. During the drawing process, the coordinate axis scales and data labels are accurately marked to ensure that the chart clearly shows the distribution of digital transaction counts at each time point, and finally a digital transaction count distribution chart is generated that intuitively reflects the trend of transaction counts over time.

[0043] Preferably, the digital transaction distribution mean and the digital transaction distribution standard deviation corresponding to the time series are obtained through the digital transaction distribution, and the transaction distribution threshold is determined based on the digital transaction distribution mean and the digital transaction distribution standard deviation corresponding to the time series to obtain the digital transaction distribution threshold; In the embodiment of the present invention, based on the generated digital transaction frequency distribution, the corresponding digital transaction distribution mean and digital transaction distribution standard deviation under the time series are calculated, wherein the digital transaction distribution mean The calculation formula is ,in is the number of time windows, For the The number of transactions in a time window. Assume there are 24 time windows, and the number of transactions is , the total number of transactions is 12000, then =500, standard deviation of digital transaction distribution The calculation formula is , square the difference between the number of transactions in each time window and the mean, sum it up, divide it by the number of time windows and take the square root. Assume that after calculation, =24000, then ≈31.62, according to the calculated mean and standard deviation, using The transaction number distribution threshold is determined by is the multiplication coefficient (assuming =2), then the transaction count distribution threshold is 500+2×31.62=563.24, which is the digital transaction count distribution threshold, which is used to determine the transaction peak period.

[0044] Preferably, the peak period of the number of digital transactions corresponding to each time point is determined based on the digital transaction number distribution threshold to obtain the peak period of the number of digital transactions; and the transaction peak distribution statistics are performed according to the corresponding digital transaction number within the peak period of the number of digital transactions to obtain the transaction peak distribution.

[0045] In an embodiment of the present invention, the number of digital transactions corresponding to each time point is determined based on a determined digital transaction count distribution threshold to determine a peak period. The digital transaction count distribution data is then traversed. When the number of transactions within a time window exceeds the threshold of 563.24, the time window and its preceding and succeeding time windows, each with a transaction count greater than the threshold, are merged to form a peak period. Assuming that the transaction counts within time windows 10-15 are all greater than the threshold, the peak period for digital transactions is the time period corresponding to the 10th-15th time windows. The number of transactions in each time window within the peak period is counted, and its proportion to the total number of transactions during the peak period is calculated to obtain a peak transaction distribution. For example, if the total number of transactions during the peak period is 3000 and the 10th time window has 600 transactions, its proportion is 600 / 3000 = 0.2. By calculating the proportion of the transaction count for each time window, a peak transaction distribution table is generated, including the time window, the number of transactions, and the proportion. This table clearly presents the distribution characteristics of digital transactions during the peak period and provides a key time dimension analysis basis for big data-based digital transaction anomaly detection.

[0046] Furthermore, step S25 includes the following steps: Step S251: performing principal component dimensionality reduction processing on each digital transaction feature corresponding to each transaction sample to remove redundant digital transaction features and obtain the reduced dimensionality digital transaction feature corresponding to each transaction sample; In this embodiment of the present invention, a standardized digital transaction set is used as the processing object. The data set contains transaction data from e-commerce platforms, third-party payment systems, and bank accounts. Each transaction sample covers 20 digital transaction features, such as transaction share, transaction time interval, transaction time, and number of transactions at the same time point. The principal component analysis (PCA) method is used for dimensionality reduction. First, the covariance matrix of the digital transaction features is calculated. A sample of transactions, digital transaction features (here Assume it is 100,000. =20), covariance matrix Su The calculation formula is: ,in Indicates the The transaction sample eigenvalues, It is The mean of the features, then the eigenvalue decomposition of the covariance matrix is ​​performed to obtain the eigenvalue and the corresponding eigenvector , calculate the contribution rate of each principal component, The contribution rate of the principal components The formula is: , set the cumulative contribution rate to 85% as the dimensionality reduction standard, and select the front principal components (assuming =8), so that 0.85, the original digital transaction features, by comparing with the selected The eigenvectors are linearly transformed to obtain the dimensionality-reduced digital transaction features, e.g. The transaction samples after dimensionality reduction eigenvalues The calculation formula is: ,Finally, we obtain the digital transaction features corresponding to each ,transaction sample after dimensionality reduction, effectively removing redundant ,features and simplifying the data structure.

[0047] Step S252: Constructing a corresponding digital transaction behavior clustering model based on the standardized digital transaction set, and performing different transaction behavior clustering on the digital transaction features after dimensionality reduction corresponding to each transaction sample based on the digital transaction behavior clustering model, so as to obtain various digital transaction features corresponding to normal transaction behavior samples and abnormal transaction behavior samples; In the embodiment of the present invention, a digital transaction behavior clustering model is constructed based on the standardized digital transaction set, using the DBSCAN (density-based spatial clustering application) algorithm. The algorithm requires setting two key parameters: neighborhood radius And the minimum number of samples MinPts, assuming =0.5, MinPts=5, for each transaction sample in the data set, the corresponding digital transaction feature vector after dimensionality reduction is taken as the center and the radius is calculated. The number of neighborhood samples within a range is determined by the number of neighboring samples. If the number of neighboring samples for a sample is greater than or equal to MinPts, the sample is considered a core point. If a sample is within the neighborhood of a core point but has fewer than MinPts of its own neighborhood samples, it is considered a boundary point. Other samples are noise points. Starting from the core point, density-reachable samples are connected into clusters to form different transaction behavior clusters. For example, during processing, it was found that the transaction share of some transaction samples was concentrated in a small range and the transaction time intervals were relatively regular. These samples were clustered into one category. However, other transaction samples had large fluctuations in transaction share and no obvious pattern in transaction time intervals. These samples were classified into another category. By processing a large number of transaction samples, all transaction samples were ultimately divided into normal transaction behavior clusters and abnormal transaction behavior clusters. The corresponding digital transaction features for normal and abnormal transaction behavior samples were obtained. In the clusters of normal transaction behavior samples, features such as transaction share and time interval exhibited a stable and predictable distribution pattern. In the clusters of abnormal transaction behavior samples, the feature distribution was relatively discrete and irregular.

[0048] Step S253: performing normal transaction behavior range statistics based on the corresponding digital transaction features in the normal transaction behavior samples and the abnormal transaction behavior samples to obtain a normal transaction behavior feature range domain.

[0049] In an embodiment of the present invention, the distribution mean and distribution curvature of each digital transaction feature corresponding to the normal transaction behavior sample are calculated under the normal transaction behavior sample, and the distribution of each transaction feature under the normal transaction behavior sample is used as a reference standard curve. When calculating the abnormal transaction feature distribution slope deviation, for each data point on the abnormal transaction share distribution curve, the vertical coordinate corresponding to the horizontal coordinate on the normal transaction share distribution curve is found, the slope deviation between the two points is calculated, the slope deviations of all data points are added together to obtain the abnormal transaction feature distribution slope deviation of the transaction feature, and finally the slope deviations of all digital transaction features are added together to obtain the abnormal transaction feature distribution slope deviation sum. Then, based on the previously obtained abnormal transaction feature distribution slope deviation sum, combined with the distribution mean and distribution curvature corresponding to each transaction feature under the normal transaction behavior sample, the normal transaction behavior range is determined, so as to be obtained through the formula minimum = distribution mean - Sum maximum = distribution mean - Calculate the range boundaries of normal trading behavior, where and is the adjustment coefficient (assuming = =2), using the same method, calculate the normal transaction behavior range boundaries for other digital transaction features respectively, integrate the normal ranges of all digital transaction features, and form a normal transaction behavior feature range domain, which clearly defines the value range of each digital transaction feature under normal transaction behavior.

[0050] Furthermore, step S253 includes the following steps: Obtain the distribution mean and distribution curvature of each digital transaction feature corresponding to the normal transaction behavior sample by using the digital transaction features corresponding to the normal transaction behavior sample; In an embodiment of the present invention, in a digital transaction anomaly detection scenario based on big data, 100,000 sample data items marked as normal transaction behaviors are screened from historical transaction data. These samples cover transaction records of e-commerce platforms, third-party payment systems, and bank accounts, and contain multiple digital transaction features such as transaction share, transaction time interval, transaction time, and number of transactions at the same time point. For the feature of transaction share, its distribution mean under normal transaction behavior samples is calculated, and the formula is: ,in =100000 is the sample size, Indicates the The transaction share of the transaction records, assuming that the total transaction share of these 100,000 samples is 50,000,000, then =500. When calculating the distribution curvature, we first sort the transaction share data and divide it into 100 intervals. Then we count the number of transactions in each interval to obtain the frequency distribution data. We use the second-order derivative to approximate the distribution curvature. interval, its curvature The calculation method is: ,in For the The frequency of transactions in the interval, For the interval width, it is assumed that in a certain transaction share interval distribution, the distribution curvature of this feature is calculated to be 0.005. In the same way, for other digital transaction features such as transaction time interval, transaction time, and number of transactions at the same time point, the distribution mean and distribution curvature under normal transaction behavior samples are calculated respectively, forming a statistical table containing the mean and curvature of each feature, providing basic data for subsequent analysis.

[0051] Preferably, the characteristic distribution slope deviations of the digital transaction characteristics corresponding to the abnormal transaction behavior samples are summed to obtain the abnormal transaction characteristic distribution slope deviation sum; In an embodiment of the present invention, 20,000 sample data items marked as abnormal transaction behaviors are selected from historical transaction data. The distribution slope deviation of each digital transaction feature, such as transaction share and transaction time interval, is analyzed. Taking transaction share as an example, the transaction share data of the abnormal transaction sample are first sorted from small to large and divided into 50 intervals. The number of transactions in each interval is counted, and a distribution curve of the abnormal transaction share is drawn. At the same time, the distribution of transaction share under the normal transaction behavior sample in the previous step is used as a reference standard curve. When calculating the distribution slope deviation of the abnormal transaction feature, for each data point on the abnormal transaction share distribution curve, , find the horizontal coordinate on the normal transaction share distribution curve The corresponding vertical coordinate , calculate the slope deviation between two points , add up the slope deviations of all data points to get the slope deviation of the abnormal transaction characteristic distribution of the transaction share feature Repeat the above operation for other digital transaction features such as transaction time interval, transaction time, number of transactions at the same time point, etc., and calculate the slope deviation of each abnormal transaction feature distribution respectively. Finally, add up the slope deviations of all digital transaction features to obtain the slope deviation and ,in is the number of digital transaction features, assuming that after calculation =12.5.

[0052] Preferably, based on the abnormal transaction feature distribution slope deviation and the distribution mean and distribution curvature corresponding to each transaction feature under normal transaction behavior samples, normal transaction behavior range statistics are performed to obtain the normal transaction behavior feature range domain.

[0053] In the embodiment of the present invention, based on the previously obtained abnormal transaction feature distribution slope deviation and =12.5, combined with the distribution mean and distribution curvature of each transaction feature under normal transaction behavior samples, determine the normal transaction behavior range. For transaction share characteristics, the distribution mean is used. =500 as the center, according to the distribution curvature =0.005 and the slope deviation of the abnormal transaction characteristic distribution and , through the formula and Calculate the range boundaries of normal trading behavior, where and is the adjustment coefficient (assuming = =2), substituting the data into =−4500. Since the transaction share cannot be negative, 0 is taken as the lower limit; =5500, that is, the normal transaction behavior range of the transaction share is [0, 5500]. Using the same method, the normal transaction behavior range boundaries of other digital transaction features such as transaction time interval, transaction time, and number of transactions at the same time point are calculated respectively. The normal ranges of all digital transaction features are integrated to form a normal transaction behavior feature range domain. This range domain clearly defines the value interval of each digital transaction feature under normal transaction behavior, and provides a judgment standard for subsequent digital transaction anomaly detection based on big data. Once the feature value in the actual transaction data exceeds this range domain, it can be preliminarily determined to be an abnormal transaction behavior.

[0054] Furthermore, step S3 includes the following steps: Step S31: Acquire real-time digital transaction data; In an embodiment of the present invention, a real-time data interface is established in a financial transaction monitoring system with an e-commerce platform, a third-party payment system, and a core bank transaction system to obtain real-time digital transaction data. The interface uses message queue technology to receive transaction information pushed by each system on a per-second basis. For example, each time an order transaction is generated on the e-commerce platform, transaction data containing fields such as the order number, transaction time (Unix timestamp accurate to the second), transaction share, buyer ID, and seller ID are immediately sent to the message queue. The third-party payment system pushes data such as the payment serial number, payment time, payment method, and the accounts of both parties to the transaction upon each successful payment. The bank system transmits information such as the transaction date, transaction type, transaction share, and counterparty account in real time after each transfer or consumption operation is completed. The bank system continuously monitors the message queue and captures these transaction data in real time. After preliminary data cleaning, format errors and incomplete transaction records are removed to ultimately obtain accurate real-time digital transaction data, providing a basis for subsequent analysis.

[0055] Step S32: performing a consistent multi-dimensional transaction feature analysis on the real-time digital transaction data to obtain various digital transaction features corresponding to the real-time transaction data; In an embodiment of the present invention, the acquired real-time digital transaction data is processed using the same multidimensional feature analysis method used for analyzing historical data. For transaction time feature analysis, the transaction time of each transaction is extracted. For transactions by the same transaction subject, the intervals between adjacent transactions are calculated chronologically. Time is divided into one-hour windows, and the number of transactions within each window is counted to determine the distribution of peak transaction periods. For transaction frequency feature analysis, the number of transactions per hour is calculated, and the rate of change in transaction frequency is calculated on a daily basis. For example, if an account averaged two transactions per hour the previous day and three transactions per hour during the same time period on the same day, the rate of change in transaction frequency is 50%. For transaction share feature analysis, the share of each transaction is extracted, and the cumulative transaction share of multiple transactions by the same transaction subject is calculated. The maximum and minimum values ​​of the share of each transaction within a specific time period are identified to determine the share fluctuation range. For transaction device feature analysis, the device type, geographic location, and frequency of use are extracted from the transaction data. Through this consistent multidimensional transaction feature analysis, various digital transaction features corresponding to the real-time transaction data are ultimately obtained.

[0056] Step S33: Obtaining the characteristic distribution change amplitude corresponding to each of the real-time transaction characteristics based on each of the digital transaction characteristics corresponding to the real-time transaction data, and performing a comparative calculation based on the degree of deviation between the characteristic distribution change amplitude corresponding to each of the real-time transaction characteristics and the range of normal transaction behavior characteristics to obtain the degree of deviation corresponding to each of the real-time transaction characteristics; In the embodiment of the present invention, the amplitude of the characteristic distribution change is calculated for each digital transaction feature corresponding to the real-time transaction data. Taking the transaction share as an example, the distribution of the transaction share in the historical normal transaction data is first counted. Assuming that the mean of the historical normal transaction share is =500, and the standard deviation is =80, for real-time transaction data, calculate the average of the current transaction share and standard deviation , assuming the average real-time transaction share =800, standard deviation =120, the characteristic distribution change amplitude calculation formula is: , the characteristic distribution change amplitude of the transaction share is about 302.65 when substituting the data. Then, the deviation degree of the characteristic distribution change amplitude of each feature of real-time transaction is compared with the characteristic range of normal transaction behavior. Taking the transaction share as an example, the characteristic range of normal transaction behavior is [260, 740], and the deviation degree calculation formula is: ,According to this method, the deviation degree of each feature, such as transaction time, ,transaction frequency, and transaction equipment, is calculated respectively, and ,finally the deviation degree corresponding to each feature of real-time transaction ,is obtained.

[0057] Step S34: performing weighted calculation on the degree of deviation corresponding to each feature of the real-time transaction to obtain the overall degree of deviation between the real-time transaction data and the range of normal transaction behavior features; In an embodiment of the present invention, the overall deviation between the real-time transaction data and the normal transaction behavior feature range is determined by performing a weighted calculation on the degree of deviation corresponding to each feature of the real-time transaction. According to the importance of each feature in the detection of digital transaction anomalies, the transaction time, transaction frequency, transaction share, and transaction device features are assigned weights w1=0.2, w2=0.2, w3=0.4, and w4=0.2, respectively. Assuming that the deviation degree of the transaction time feature is d1=0.8, the deviation degree of the transaction frequency feature is d2=0.9, the deviation degree of the transaction share feature is d3=1.1, and the deviation degree of the transaction device feature is d4=0.7, the overall deviation degree is calculated to be 0.92. Through this weighted calculation, the deviation degree of the real-time transaction data from the normal transaction pattern is comprehensively reflected.

[0058] Step S35: performing transaction deviation anomaly detection on the real-time digital transaction data based on the overall deviation between the real-time transaction data and the normal transaction behavior feature range domain to obtain abnormal transaction detection results corresponding to the real-time digital transaction.

[0059] In an embodiment of the present invention, transaction deviation anomaly detection is performed on real-time digital transaction data based on the calculated overall deviation between the real-time transaction data and the normal transaction behavior feature range domain. The anomaly detection threshold is set to 0.8. When the overall deviation is greater than the threshold, it is determined that abnormal transactions exist in the real-time digital transaction data. For example, the overall deviation calculated for a batch of real-time transaction data is 0.92, which is greater than the threshold value 0.8. The batch of transaction data is marked as abnormal. Further analysis of the deviation of various features shows that the deviation of the transaction share feature is relatively high, indicating that the abnormal transaction is related to the abnormal fluctuation of the transaction share. The abnormal transaction detection results are recorded and a detailed report is generated, including the specific time of the abnormal transaction, the transaction subjects involved, the deviation of various features and other information, for risk control personnel to conduct subsequent investigation and processing, thereby realizing effective anomaly detection of real-time digital transactions.

[0060] Furthermore, step S4 includes the following steps: Step S41: If it is determined that the abnormal transaction detection result corresponding to the real-time digital transaction contains an abnormal transaction, then historical transaction data corresponding to the abnormal transaction is obtained, including the past abnormal transaction records and abnormal transaction behavior patterns of the subject corresponding to the abnormal transaction; In an embodiment of the present invention, when abnormal transaction detection results corresponding to real-time digital transactions indicate the presence of an abnormal transaction in a certain transaction monitoring system, a data retrieval program is immediately triggered. For example, an abnormal transaction involving 5,000 shares is detected, with the transaction subjects being Company X and Company Y. All transaction data for the past three years for Company X and Company Y, the entities involved in the abnormal transaction, is extracted from a historical transaction database. Specific filtering conditions are set for filtering historical transaction data: the transaction time range is three years prior to the occurrence of the abnormal transaction, and the transaction subject includes either Company X or Company Y. During the extraction process, an SQL query statement is used to retrieve all records that meet the conditions from the transaction record table. A total of 10 abnormal transaction records for Company X and 8 abnormal transaction records for Company Y are obtained. Furthermore, patterns in these abnormal transaction behaviors are extracted, such as the frequent large-scale share transactions by Company X within a short period of time and the frequent share transactions by Company Y with high-risk companies. These historical transaction data are integrated to form a complete historical transaction dataset corresponding to the abnormal transaction, providing a data foundation for subsequent analysis.

[0061] Step S42: Obtaining upstream and downstream transaction parties and transaction links related to the abnormal transaction based on historical transaction data corresponding to the abnormal transaction; In an embodiment of the present invention, based on previously acquired historical transaction data corresponding to abnormal transactions, a data analysis algorithm is used to mine upstream and downstream transaction parties and transaction links related to the abnormal transaction. Based on a graph database, the transaction subjects are regarded as nodes and transaction behaviors as edges to construct a transaction relationship graph. Starting from the nodes of Company X and Company Y, the subjects of the abnormal transaction, a depth-first search algorithm of the graph is used to traverse along the transaction edges. During the traversal process, Company Z, Company W, and other companies that directly transact with Company X and Company Y are recorded as direct upstream and downstream transaction parties. Further traversal is continued to identify other companies that have transactions with Company Z and Company W as indirect upstream and downstream transaction parties. At the same time, the transaction links from the abnormal transaction subject to each upstream and downstream transaction party are recorded, such as Company X → Company Z → Company M, Company Y → Company W → Company N, etc. After comprehensive search and analysis, a total of 6 direct upstream and downstream transaction parties and 8 indirect upstream and downstream transaction parties related to the abnormal transaction are identified, forming a complete list of upstream and downstream transaction parties and corresponding transaction link information, clearly presenting the association context of the abnormal transaction in the transaction network.

[0062] Step S43: Constructing a propagation and diffusion transaction network corresponding to the abnormal transaction based on the upstream and downstream transaction parties and transaction links related to the abnormal transaction; In an embodiment of the present invention, a propagation and diffusion transaction network corresponding to the abnormal transaction is constructed based on the identified upstream and downstream transaction parties and transaction links associated with the abnormal transaction. This model employs a directed graph model from graph theory, with transaction entities as nodes, whose attributes include information such as company name and the number of past abnormal transactions. The transaction links are directed edges, whose attributes include information such as transaction time and transaction share. For example, in the constructed network, the node for Company X is labeled with 10 past abnormal transactions, and the directed edge from Company X to Company Z is labeled with May 1, 2023, and a transaction share of 2,000. By accurately mapping all upstream and downstream transaction parties and transaction link information into the directed graph, a complete propagation and diffusion transaction network is formed. This network intuitively illustrates the potential propagation paths and impact range of abnormal transactions, providing visual and structured data support for subsequent risk assessment.

[0063] Step S44: performing a transaction risk assessment calculation on the abnormal transaction based on the propagation and diffusion transaction network corresponding to the abnormal transaction to obtain a transaction risk level score corresponding to the abnormal transaction; In this embodiment of the present invention, a comprehensive transaction risk assessment is performed on abnormal transactions based on the constructed propagation and diffusion transaction network. The assessment process comprehensively considers multiple key factors, including the transaction subject's abnormal transaction history, the complexity of the transaction chain, and the number of affected parties. Regarding the transaction subject's abnormal transaction history, the focus is on the frequency and scale of abnormal transactions by Company X and Company Y. Company X has 10 abnormal transactions, most of which are large-scale transactions, indicating a high transaction risk. The complexity of the transaction chain is measured by the number of nodes involved in the chain. The more nodes and the more complex the chain, the greater the possibility and scope of risk propagation. The greater the number of affected parties, the stronger the chain reaction caused by the abnormal transaction. By comprehensively considering and weighing these factors and undergoing a rigorous assessment process, a transaction risk level score corresponding to the abnormal transaction is ultimately determined. Taking this abnormal transaction as an example, after comprehensively evaluating various factors, a specific risk level score is determined. This score will serve as a key basis for subsequent risk warning processing.

[0064] Step S45: performing transaction risk warning processing on the abnormal transaction based on the transaction risk level score corresponding to the abnormal transaction to obtain risk level warning information corresponding to the abnormal transaction.

[0065] In this embodiment of the present invention, based on a previously obtained transaction risk rating of 4.86, a transaction risk warning is issued for the abnormal transaction. The risk rating scale is pre-defined: 0-2 for low risk, 2-4 for medium-low risk, 4-6 for medium risk, 6-8 for medium-high risk, and 8-10 for high risk. Based on the score of 4.86, the abnormal transaction is determined to be at a medium-high risk level. A risk level warning message is automatically generated, including the names of the parties involved in the abnormal transaction (Company X and Company Y), the transaction volume (5,000 units), the risk level (medium-high risk), and detailed risk assessment indicators (e.g., the impact range of the spread is 4.8, the extent of the loss is 4.9, etc.). This warning message is sent in real time to relevant personnel in the risk management department via various channels, such as SMS and email. Simultaneously, the abnormal transaction is highlighted in red on the transaction monitoring system interface, and the warning information is recorded in detail in the system log, allowing risk control personnel to take timely risk prevention measures, such as strengthening monitoring of the relevant transaction parties and limiting the volume of subsequent transactions.

[0066] Furthermore, step S44 includes the following steps: Determine the length of the propagation and diffusion link corresponding to the abnormal transaction in the propagation and diffusion trading network through the propagation and diffusion trading network corresponding to the abnormal transaction, and perform an abnormal transaction impact assessment based on the propagation and diffusion link length corresponding to the abnormal transaction in the propagation and diffusion trading network to obtain the propagation and diffusion impact range corresponding to the abnormal transaction; In an embodiment of the present invention, an abnormal transaction involving 50 shares is detected in a certain transaction monitoring system. The transaction subjects are Company A and Company B. Based on historical transaction data and real-time transaction associations, a propagation and diffusion transaction network corresponding to the abnormal transaction is constructed. The network uses the transaction subjects as nodes and the transaction behaviors as edges, clearly presenting the associations between the transaction parties. Using the breadth-first search (BFS) algorithm in graph theory, starting from the starting nodes of the abnormal transaction (Company A and Company B), the propagation and diffusion link length corresponding to the abnormal transaction in the propagation and diffusion transaction network is calculated. Assume that during the search process, it is found that the abnormal transaction passes through intermediate nodes such as Company C and Company D, and ultimately affects Company E, Company F, etc., and there are 4 edges from the starting node to the farthest affected node, Company E. Then the propagation and diffusion link length is 4. The impact of the abnormal transaction is evaluated based on the propagation and diffusion link length, using the formula: Propagation and diffusion impact range size = × propagation diffusion link length + × Number of affected nodes, where 、 is the weight coefficient (assuming =0.6, =0.4), and the number of affected nodes is known to be 6 (including Company C, Company D, Company E, Company F, etc.). The corresponding propagation and diffusion impact range of the abnormal transaction is: 0.6×4+0.4×6=2.4+2.4=4.8. This value quantifies the impact of the abnormal transaction in the network.

[0067] Preferably, based on the scope of the propagation and diffusion impact of the abnormal transaction, the number of affected transactions in the propagation and diffusion transaction network corresponding to the abnormal transaction is determined to obtain the total number of affected transaction parties corresponding to the abnormal transaction in the propagation and diffusion transaction network; In an embodiment of the present invention, based on the previously obtained propagation and diffusion impact range size of 4.8 corresponding to the abnormal transaction, the number of affected transactions in the propagation and diffusion transaction network corresponding to the abnormal transaction is determined, and the entire propagation and diffusion transaction network is traversed. Starting from the nodes of Company A and Company B directly related to the abnormal transaction, all affected transaction nodes are marked in sequence according to the link relationship. The depth-first search (DFS) algorithm is used to traverse along the transaction link and count the number of marked transaction nodes. During the traversal process, it is found that in addition to the starting Company A and Company B, there are four other transaction parties affected, namely Company C, Company D, Company E, and Company F. Therefore, the total number of affected transaction parties corresponding to the abnormal transaction in the propagation and diffusion transaction network is 6. This number intuitively reflects the breadth of the scope of the abnormal transaction and provides basic data for subsequent evaluation.

[0068] Preferably, the distance between the transaction party corresponding to the abnormal transaction and each transaction party within the total number of affected transaction parties in the propagation and diffusion transaction network is counted, and a comparison is made between the distance and half the length of the propagation and diffusion link. If the distance is greater than half the length of the propagation and diffusion link, an indirect impact exists; otherwise, a direct impact exists. At the same time, transaction losses are assessed between the transaction parties corresponding to the direct and indirect impacts and the transaction party, so as to obtain the degree of direct loss and the degree of indirect loss corresponding to the abnormal transaction. In the embodiment of the present invention, by counting the distances between the transaction parties (Company A and Company B) corresponding to the abnormal transaction and the total number of affected transaction parties (6) in the propagation and diffusion transaction network, the shortest path algorithm in graph theory (such as Dijkstra's algorithm) is used to calculate the shortest path length between any two transaction party nodes as the distance between them. Assuming that the distance between the transaction party Company A and the affected transaction party Company E is 3, it is compared with half of the previously obtained propagation and diffusion link length 4 (i.e., 2). Since 3>2, it is determined that there is an indirect impact between Company A and Company E; and the distance between Company A and Company C is 1, 1<2, it is determined that there is a direct impact between Company A and Company C. After determining the impact relationship, the transaction loss is determined. For loss assessment, for directly affected transaction parties (such as Company C), the degree of direct loss is calculated based on their share of related-party transactions in this transaction and the actual loss ratio. Assuming that the share of related-party transactions between Company C and Company A is 20 and the actual loss ratio is 30%, the degree of direct loss is 20×0.3=6. For indirectly affected transaction parties (such as Company E), the transaction relationship with the intermediate nodes (if it passes through two intermediate nodes) and the affected losses (the affected loss ratio is 30%) are comprehensively considered for assessment and calculation. Assuming that the indirect loss degree is determined to be (20×0.3) / 2=4 through assessment, all transaction parties with direct and indirect impacts are assessed according to this method, and finally the degree of direct loss and indirect loss corresponding to the abnormal transaction are obtained.

[0069] Preferably, a weighted average sum is performed based on the respective direct loss degrees and indirect loss degrees corresponding to the abnormal transaction to obtain the corresponding loss degree caused by the abnormal transaction; In an embodiment of the present invention, a weighted average is taken based on the direct loss levels and indirect loss levels corresponding to the abnormal transaction, with the weight of the direct loss level set to w1=0.7 and the weight of the indirect loss level set to w2=0.3. It is known that the direct loss levels are 6 and 5 (assuming there are other directly affected parties), and the indirect loss levels are 4 and 3 (assuming there are other indirectly affected parties). Then, the corresponding loss levels caused by the abnormal transaction are calculated, where the direct loss is (6×0.7+5×0.7) / 2 and the indirect loss is (4×0.3+3×0.3) / 2. This value comprehensively reflects the overall scale of losses caused to the relevant transaction parties by the abnormal transaction.

[0070] Preferably, a transaction risk assessment calculation is performed on the abnormal transaction based on the scope of the propagation and diffusion impact corresponding to the abnormal transaction and the corresponding degree of loss caused by the abnormal transaction to obtain a transaction risk level score corresponding to the abnormal transaction.

[0071] In the embodiment of the present invention, the transaction risk assessment of the abnormal transaction is performed based on the scope of the spread and diffusion of the abnormal transaction and the corresponding loss level caused by the abnormal transaction, using the formula: Transaction Risk Level Score = ×The size of the spread and impact range+ × Loss level, where 、 is the weight coefficient (assuming =0.4, =0.6), substituting the value into the formula yields: 0.4×4.8+0.6×4.9=4.86. According to the pre-set risk level standard (e.g., 0-2 is low risk, 2-4 is medium-low risk, 4-6 is medium risk, 6-8 is medium-high risk, and 8-10 is high risk), the transaction risk level score corresponding to this abnormal transaction is 4.86, which is determined to be a medium risk level. The risk level score and related assessment data are recorded and displayed to provide a strong basis for risk control decision-making so that corresponding risk prevention and disposal measures can be taken.

[0072] Furthermore, the present invention also provides a digital transaction anomaly detection system based on big data, which is used to execute the digital transaction anomaly detection method based on big data as described above. The digital transaction anomaly detection system based on big data includes: The digital transaction data processing module is used to obtain digital transaction data sets corresponding to multiple sources and heterogeneity, and to unify and cleanse the digital transaction data sets to obtain standardized digital transaction data sets; The transaction behavior range statistics module is used to perform multi-dimensional transaction feature analysis on the standardized digital transaction set to obtain various digital transaction features corresponding to each transaction sample; based on the standardized digital transaction set, normal transaction behavior range statistics are performed on the various digital transaction features corresponding to each transaction sample to obtain the normal transaction behavior feature range domain; A real-time transaction anomaly detection module is used to obtain real-time digital transaction data and perform transaction deviation anomaly detection on the real-time digital transaction data based on the range of normal transaction behavior characteristics to obtain abnormal transaction detection results corresponding to the real-time digital transactions; The abnormal transaction risk warning module is used to obtain historical transaction data corresponding to the abnormal transaction if it is determined that the abnormal transaction detection result corresponding to the real-time digital transaction contains an abnormal transaction, and to construct a propagation and diffusion transaction network corresponding to the abnormal transaction based on the historical transaction data corresponding to the abnormal transaction; based on the propagation and diffusion transaction network corresponding to the abnormal transaction, conduct a transaction risk assessment and warning for the abnormal transaction to obtain risk level warning information corresponding to the abnormal transaction.

[0073] The present invention is therefore intended to be illustrative and non-restrictive in all respects, with the scope of the invention being defined by the appended claims rather than the foregoing description, and all changes that come within the meaning and range of equivalents of the application documents are intended to be embraced therein.

[0074] The foregoing description is intended only to provide specific embodiments of the present invention, which will enable those skilled in the art to understand and implement the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown herein, but is to be construed in the widest possible manner consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting anomalies in digital transactions based on big data, characterized in that: The following steps are involved: Step S1: Obtain a digital transaction volume data set corresponding to multiple sources and heterogeneity, and perform heterogeneous unification and cleaning and standardization on the digital transaction volume data set to obtain a standardized digital transaction volume set; Step S2: Perform multi-dimensional transaction feature analysis on the standardized digital transaction set to obtain various digital transaction features corresponding to each transaction sample; perform normal transaction behavior range statistics on the various digital transaction features corresponding to each transaction sample based on the standardized digital transaction set to obtain a normal transaction behavior feature range domain; Step S3: Acquire real-time digital transaction data, and perform transaction deviation anomaly detection on the real-time digital transaction data based on a normal transaction behavior feature range domain to obtain abnormal transaction detection results corresponding to the real-time digital transactions; Step S4: If it is determined that the abnormal transaction detection result corresponding to the real-time digital transaction indicates that there is an abnormal transaction, the historical transaction data corresponding to the abnormal transaction is obtained, and a propagation and diffusion transaction network corresponding to the abnormal transaction is constructed based on the historical transaction data corresponding to the abnormal transaction; based on the propagation and diffusion transaction network corresponding to the abnormal transaction, a transaction risk assessment and warning is performed on the abnormal transaction to obtain risk level warning information corresponding to the abnormal transaction.

2. The method for detecting anomalies in digital transactions based on big data according to claim 1, characterized in that: Step S1 includes the following steps: Step S11: Acquire a multi-source heterogeneous digital transaction data set from multiple data sources including transaction platforms, payment systems, and bank accounts, including transaction process data corresponding to each digital transaction; Step S12: performing a unified data format conversion on the digital transaction volume data sets corresponding to the multi-source heterogeneous data sets to obtain a digital transaction volume data set with a unified format; Step S13: performing duplicate record removal processing on the digital transaction volume data set after the format is unified, so as to remove duplicate digital transaction records and invalid transaction records with obvious errors, thereby obtaining a deduplicated digital transaction volume data set; Step S14: performing fitting smoothing filling on the deduplicated digital transaction volume dataset to fit and smoothly fill the corresponding missing transaction records, thereby obtaining a digital transaction volume dataset after smoothing filling; Step S15: performing transaction standardization processing on the digital transaction volume data set after smooth filling to obtain a standardized digital transaction volume set.

3. The method for detecting anomalies in digital transactions based on big data according to claim 1, characterized in that: Step S2 includes the following steps: Step S21: performing time sequence synchronization processing on the standardized digital transaction body set to obtain a corresponding digital transaction body set under the same time sequence; Step S22: Analyzing the transaction time characteristics of the corresponding digital transaction sets in the same time sequence to obtain the digital transaction time-related characteristics corresponding to each transaction sample, including the transaction time, transaction interval, and transaction peak period distribution; analyzing the transaction frequency characteristics of the corresponding digital transaction sets in the same time sequence to obtain the digital transaction frequency characteristics corresponding to each transaction sample, including the number of transactions per unit time and the transaction frequency change rate; Step S23: Analyze the transaction share characteristics of the standardized digital transaction set to obtain the digital transaction share-related characteristics corresponding to each transaction sample, including the single transaction share, cumulative transaction share, and share fluctuation range; Step S24: Analyze transaction device characteristics of the standardized digital transaction volume set to obtain digital transaction device information characteristics corresponding to each transaction sample, including device type, device geographic location, and device usage frequency; perform multi-dimensional merging of digital transaction time-related characteristics, digital transaction frequency characteristics, digital transaction share-related characteristics, and digital transaction device information characteristics corresponding to each transaction sample to obtain various digital transaction characteristics corresponding to each transaction sample; Step S25: Based on the standardized digital transaction body set, normal transaction behavior range statistics are performed on each digital transaction feature corresponding to each transaction sample to obtain a normal transaction behavior feature range domain.

4. The method for detecting anomalies in digital transactions based on big data according to claim 3, characterized in that: The analysis of transaction time characteristics of the corresponding digital transaction sets in the same time sequence in step S22 includes the following steps: Determining the transaction time of each digital transaction body for a set of digital transaction bodies corresponding to the same time sequence to obtain the transaction moment corresponding to each digital transaction body; Perform transaction time interval statistics on the corresponding digital transaction body set under the same time sequence, so as to statistically calculate the transaction interval corresponding to any two adjacent transactions of the same digital transaction body; Obtain the number of digital transactions corresponding to each time point through the corresponding digital transaction body set in the same time sequence, and draw a distribution of the number of digital transactions corresponding to each time point to generate a distribution of the number of digital transactions; Obtaining the digital transaction distribution mean and the digital transaction distribution standard deviation corresponding to the time series through the digital transaction number distribution, and determining the transaction number distribution threshold based on the digital transaction distribution mean and the digital transaction distribution standard deviation corresponding to the time series to obtain the digital transaction number distribution threshold; Based on the digital transaction number distribution threshold, the peak period of the digital transaction number corresponding to each time point is determined to obtain the peak period of the digital transaction number; the transaction peak distribution statistics are performed according to the corresponding digital transaction number within the peak period of the digital transaction number to obtain the transaction peak distribution.

5. The method for detecting anomalies in digital transactions based on big data according to claim 3, characterized in that: Step S25 includes the following steps: Step S251: performing principal component dimensionality reduction processing on each digital transaction feature corresponding to each transaction sample to remove redundant digital transaction features and obtain the reduced dimensionality digital transaction feature corresponding to each transaction sample; Step S252: Constructing a corresponding digital transaction behavior clustering model based on the standardized digital transaction set, and performing different transaction behavior clustering on the digital transaction features after dimensionality reduction corresponding to each transaction sample based on the digital transaction behavior clustering model, so as to obtain various digital transaction features corresponding to normal transaction behavior samples and abnormal transaction behavior samples; Step S253: performing normal transaction behavior range statistics based on the corresponding digital transaction features in the normal transaction behavior samples and the abnormal transaction behavior samples to obtain a normal transaction behavior feature range domain.

6. The method for detecting anomalies in digital transactions based on big data according to claim 5, characterized in that: Step S253 includes the following steps: Obtain the distribution mean and distribution curvature of each digital transaction feature corresponding to the normal transaction behavior sample by using the digital transaction features corresponding to the normal transaction behavior sample; Sum the characteristic distribution slope deviations of each digital transaction feature corresponding to the abnormal transaction behavior sample to obtain the sum of the abnormal transaction feature distribution slope deviations; Based on the slope deviation of the abnormal transaction feature distribution and the distribution mean and distribution curvature corresponding to each transaction feature under the normal transaction behavior sample, the normal transaction behavior range statistics are performed to obtain the normal transaction behavior feature range domain.

7. The method for detecting anomalies in digital transactions based on big data according to claim 1, characterized in that: Step S3 includes the following steps: Step S31: Acquire real-time digital transaction data; Step S32: performing a consistent multi-dimensional transaction feature analysis on the real-time digital transaction data to obtain various digital transaction features corresponding to the real-time transaction data; Step S33: Obtaining the characteristic distribution change amplitude corresponding to each of the real-time transaction characteristics based on each of the digital transaction characteristics corresponding to the real-time transaction data, and performing a comparative calculation based on the degree of deviation between the characteristic distribution change amplitude corresponding to each of the real-time transaction characteristics and the range of normal transaction behavior characteristics to obtain the degree of deviation corresponding to each of the real-time transaction characteristics; Step S34: performing weighted calculation on the deviation degree corresponding to each feature of the real-time transaction to obtain the overall deviation degree between the real-time transaction data and the range of normal transaction behavior features; Step S35: performing transaction deviation anomaly detection on the real-time digital transaction data based on the overall deviation between the real-time transaction data and the normal transaction behavior feature range domain to obtain abnormal transaction detection results corresponding to the real-time digital transaction.

8. The method for detecting anomalies in digital transactions based on big data according to claim 1, characterized in that: Step S4 includes the following steps: Step S41: If it is determined that the abnormal transaction detection result corresponding to the real-time digital transaction contains an abnormal transaction, then historical transaction data corresponding to the abnormal transaction is obtained, including the past abnormal transaction records and abnormal transaction behavior patterns of the subject corresponding to the abnormal transaction; Step S42: Obtaining upstream and downstream transaction parties and transaction links related to the abnormal transaction based on historical transaction data corresponding to the abnormal transaction; Step S43: Constructing a propagation and diffusion transaction network corresponding to the abnormal transaction based on the upstream and downstream transaction parties and transaction links related to the abnormal transaction; Step S44: performing a transaction risk assessment calculation on the abnormal transaction based on the propagation and diffusion transaction network corresponding to the abnormal transaction to obtain a transaction risk level score corresponding to the abnormal transaction; Step S45: performing transaction risk warning processing on the abnormal transaction based on the transaction risk level score corresponding to the abnormal transaction to obtain risk level warning information corresponding to the abnormal transaction.

9. The method for detecting anomalies in digital transactions based on big data according to claim 8, characterized in that: Step S44 includes the following steps: Determine the length of the propagation and diffusion link corresponding to the abnormal transaction in the propagation and diffusion transaction network through the propagation and diffusion transaction network corresponding to the abnormal transaction, and perform an abnormal transaction impact assessment based on the propagation and diffusion link length corresponding to the abnormal transaction in the propagation and diffusion transaction network to obtain the propagation and diffusion impact range corresponding to the abnormal transaction; Determine the number of affected transactions in the propagation and diffusion transaction network corresponding to the abnormal transaction based on the scope of the propagation and diffusion impact of the abnormal transaction, so as to obtain the total number of affected transaction parties in the propagation and diffusion transaction network corresponding to the abnormal transaction; By counting the distances between the transaction party corresponding to the abnormal transaction and each transaction party within the total number of affected transaction parties in the diffusion transaction network, and comparing the distance with half the diffusion link length, it is judged that if the distance is greater than half the diffusion link length, there is an indirect impact; otherwise, there is a direct impact. At the same time, the transaction losses between the transaction parties corresponding to the direct and indirect impacts and the transaction party are assessed to obtain the degree of direct loss and indirect loss corresponding to the abnormal transaction. Perform a weighted average summation based on the direct loss extent and indirect loss extent corresponding to the abnormal transaction to obtain the corresponding loss extent caused by the abnormal transaction; Based on the scope of the spread and diffusion of the abnormal transaction and the corresponding degree of loss caused by the abnormal transaction, a transaction risk assessment calculation is performed on the abnormal transaction to obtain a transaction risk level score corresponding to the abnormal transaction.

10. A digital transaction anomaly detection system based on big data, characterized in that: For executing the digital transaction anomaly detection method based on big data as claimed in claim 1, the digital transaction anomaly detection system based on big data comprises: The digital transaction data processing module is used to obtain digital transaction data sets corresponding to multiple sources and heterogeneity, and to unify and cleanse the digital transaction data sets to obtain standardized digital transaction data sets; The transaction behavior range statistics module is used to perform multi-dimensional transaction feature analysis on the standardized digital transaction set to obtain various digital transaction features corresponding to each transaction sample; based on the standardized digital transaction set, normal transaction behavior range statistics are performed on the various digital transaction features corresponding to each transaction sample to obtain the normal transaction behavior feature range domain; A real-time transaction anomaly detection module is used to obtain real-time digital transaction data and perform transaction deviation anomaly detection on the real-time digital transaction data based on the range of normal transaction behavior characteristics to obtain abnormal transaction detection results corresponding to the real-time digital transactions; The abnormal transaction risk warning module is used to obtain historical transaction data corresponding to the abnormal transaction if it is determined that the abnormal transaction detection result corresponding to the real-time digital transaction contains an abnormal transaction, and to construct a propagation and diffusion transaction network corresponding to the abnormal transaction based on the historical transaction data corresponding to the abnormal transaction; based on the propagation and diffusion transaction network corresponding to the abnormal transaction, conduct a transaction risk assessment and warning for the abnormal transaction to obtain risk level warning information corresponding to the abnormal transaction.

Images