Payment terminal real-time anti-fraud decision-making method based on machine learning

Abstract

The invention belongs to the technical field of fraud detection, and relates to a payment terminal real-time anti-fraud decision-making method based on machine learning, and the method comprises the steps: carrying out the time-space slicing of a payment transaction flow through a sliding window, injecting abnormal features through combining with a generative adversarial network, and enhancing the tensor of the time-space features; a three-dimensional dynamic adversarial graph is constructed by using a spatial topology layer, a transaction association layer and a device fingerprint layer, and a complex relationship of transaction data is deeply mined through weight fusion of an attention mechanism; carrying out convolution operation on the deformable space-time convolution and then carrying out multi-dimensional space-time fingerprint fusion so as to generate a space-time fingerprint and a hidden group clustering result of each terminal device; finally, real-time fraud decision making is carried out in combination with the space-time fingerprints of the terminal equipment and the current context, and dynamic and real-time monitoring and blocking of payment fraud behaviors are achieved. The accuracy and timeliness of fraud detection are remarkably improved, the adaptive capacity of the system to novel fraud behaviors is enhanced, and the safety and defense capacity of the payment system are improved.

Description

Technical Field

[0001] The present application belongs to the field of fraud detection technology, and more specifically, to a real-time anti-fraud decision-making method for payment terminals based on machine learning. Background Art

[0002] With the continuous advancement of payment technology, payment terminals (such as smart POS terminals and mobile payment terminals) have become an essential component of the modern payment system. Especially with the rapid growth of internet finance, payment terminals are widely used in various transaction scenarios, such as online payments and offline QR code payment. However, this also exposes the payment sector to an increasing number of security threats, one of the most serious of which is payment fraud.

[0003] Payment fraud typically involves illegal payment operations through identity forgery, account theft, and transaction data tampering, resulting in significant losses for both consumers and payment platforms. To address this challenge, many payment platforms and financial institutions have begun adopting real-time fraud detection methods based on machine learning and data analytics.

[0004] Currently, many payment fraud detection systems use traditional rule-based methods or simple machine learning models (such as decision trees and logistic regression) to monitor transactions. These methods mainly rely on static features such as historical transaction data, account information, and transaction amounts to determine whether a payment transaction is fraudulent. As a result, they only rely on static features in transaction data (such as account information and transaction amounts), ignoring changes in spatiotemporal factors such as time and space. This makes it difficult for traditional models to identify fraudulent behavior based on changes in spatiotemporal features. Summary of the Invention

[0005] The present invention provides a real-time anti-fraud decision-making method for payment terminals based on machine learning, which aims to solve the technical problem that traditional models ignore changes in spatiotemporal factors such as time and space, making it difficult to identify fraudulent behaviors with changes in spatiotemporal characteristics.

[0006] The real-time anti-fraud decision-making method for payment terminals based on machine learning includes the following steps: Spatiotemporal data stream slicing: Spatiotemporal slicing of the original payment transaction stream is performed through a sliding window, cutting the data into spatiotemporal cubes containing time, space, and device information; Abnormal data injection: Based on the space-time cube, a generative adversarial network is used to inject abnormal features into the space-time data, generate adversarial perturbations, and obtain enhanced space-time feature tensors and space-time cube metadata; 3D dynamic adversarial graph construction: This includes the construction of the spatial topology layer, the transaction association layer, and the device fingerprint layer, resulting in three sub-graphs. A weighted attention mechanism is then introduced to fuse and update these three sub-graphs, outputting the updated dynamic graph structure. Hidden group spatiotemporal fingerprint encoding: Based on the spatiotemporal features in the dynamic graph structure, multi-dimensional spatiotemporal fingerprint fusion is performed after the deformable spatiotemporal convolution operation, and the spatiotemporal fingerprint of each terminal device and the latent group clustering results are output; Real-time adversarial decision-making and blocking: Make real-time fraud decisions based on the spatiotemporal fingerprint and current context of the terminal device and obtain real-time decision results.

[0007] The present invention performs spatiotemporal slicing of the payment transaction flow through a sliding window, injects abnormal features in combination with a generative adversarial network, and enhances the spatiotemporal feature tensor; constructs a three-dimensional dynamic adversarial graph using the spatial topology layer, transaction association layer, and device fingerprint layer, and deeply mines the complex relationships of transaction data through weighted fusion through the attention mechanism; adopts deformable spatiotemporal convolution and multi-dimensional spatiotemporal fingerprint fusion to generate the spatiotemporal fingerprint of each terminal device and the latent group clustering results; finally, combines the spatiotemporal fingerprint of the terminal device with the current context to make real-time fraud decisions, realizing dynamic and real-time monitoring and blocking of payment fraud behaviors; not only significantly improves the accuracy and timeliness of fraud detection, but also enhances the system's adaptability to new fraud behaviors, and improves the security and defense capabilities of the payment system.

[0008] Preferably, the spatiotemporal data stream slicing comprises the following steps: Time verification: Using the IEEE1588 precision time protocol, the clock deviation of each terminal is controlled within ±100ns; Spatial calibration: Combines GPS coordinates and base station signal strength to calculate the actual terminal location through least squares optimization, eliminating outliers that exceed physical motion constraints. Points with a credibility below a predetermined threshold are considered outliers. Window setting: Using 5ms as the baseline time window length, the data stream is divided into continuous segments according to the transaction timestamp; then, by monitoring the transaction density in real time, the window length is dynamically contracted or expanded: ; Where: Indicates the transaction density of the current window; is the previous window length; Indicates the adjusted window length; Space-time cube construction: Spatial slicing: The Earth's surface is divided into Geohash-12 grids. Terminals within each grid are grouped into the same spatial unit. For terminals in edge areas, adjacent 3×3 grids are merged to form a super unit. Time slicing: Generates time series codes at 1ms granularity within the window and builds a time axis index; Device sharding: The combined hash value of the SIM card number hash and the device driver layer features is used to construct the device fingerprint. Devices with similarity greater than the similarity threshold are grouped into the same cluster.

[0009] Preferably, the abnormal data injection includes the following steps: Spatial forgery: By controlling the terminal's virtual velocity and acceleration, abnormal trajectories that conform to kinematic laws are created: ; Where: Indicates the displacement of the current position; Indicates the virtual moving speed; Indicates the time difference between two transactions; represents random acceleration; Device masquerading: Generate multiple virtual devices using the device's hash value to trick the system into identifying them as multiple legitimate devices. Time synchronization: When generating fraud samples, we generate transaction time series from different time zones to ensure that the transaction time difference between different time zones is kept within 2 seconds; Feature space adversarial training: The generator generates virtual samples, the discriminator judges the samples, and the WGAN optimization algorithm is used to train the generator and discriminator. This adversarial training generates more realistic fraud functions. Spatial feature extraction: All samples extract the complexity of the terminal's movement trajectory and base station switching frequency within the window; Time feature modeling: The autocorrelation function of the trading time interval is constructed for all samples to capture periodic patterns; Device feature hardening: Calculate device stability indicators based on the driver layer feature matching and the rate of change of variable parameters, and introduce a smoothing factor in the calculation process; Based on this, an enhanced feature tensor and spatiotemporal cube metadata are generated.

[0010] Preferably, the construction of the spatial topology layer includes the following steps: Construct spatial adjacent candidate pairs: traverse any two terminals A and B, calculate their spatial correlation index, and select terminal pairs with Geohash prefix overlap ≥ 6 bits as candidate edge sets; Spatial edge weight calculation: ; Where: and Represents the Geohash codes of terminals A and B respectively; express and The number of prefix matches; Indicates the degree of overlap of the base station scan set; and Both represent the set of base stations scanned by the terminal; and Indicates the Timing Advance value of the corresponding terminal, which is the estimated distance between it and the nearest base station; Edge filtering and dynamic pruning: If the terminal pair ( ) In consecutive T=3 time windows, it satisfies: or , it is determined that the spatial overlap disappears and the corresponding spatial edge is deleted ( ); Adversarial perturbation edge generation: Through adversarial training between the generator and the discriminator, the optimization objective is as follows: ; Where: represents the true edge weight; represents the generated edge weight; and denote the real and generated edge distributions respectively; represents the regularization hyperparameter; represents the Kullback-Leibler divergence; Spatial subgraph output: Based on adversarial perturbation generation, a spatial subgraph is obtained, where nodes represent all terminal devices, edge sets represent valid spatial proximity relationships, and edge weights represent the true degree of geographical or signal overlap.

[0011] Preferably, the construction of the transaction association layer includes the following steps: Multi-stage transaction edge generation: Direct transaction edge: If terminal A transfers money directly to terminal B, the edge weight is calculated based on the following formula: ; Where: Indicates the transaction amount; Indicates the transaction time interval; Indirect transaction edge: If there is a path , then generate an edge , the weight is: ; Where: k represents the number of intermediate nodes in the path; Represents node A and intermediate node Direct transaction edge weights between them; Indicates an intermediate node The weight of the direct transaction edge with node B; and Represent the degrees of node A and node B respectively; Adversarial transaction pattern injection: The generator constructs a virtual transaction path, whose characteristics include the closed-loop flow of large amounts of funds within time m and the standard differences in cross-regional transaction amounts. The discriminator detects forged edges through transaction flow analysis, where the loss function is: ; Where: represents the discriminator function; represents the real transaction edge set; represents the generated virtual transaction edge set; represents the weight coefficient of the smoothing term; represents the time series smoothing term; ; Where: represents the transaction edge set at time t; represents the transaction edge set at time t-1; represents the Frobenius norm; Based on this, a transaction-related subgraph is output, including a node set and a transaction-related edge set, where the edge weight reflects the intensity of capital flow.

[0012] Preferably, the construction of the device fingerprint layer includes the following steps: Device similarity calculation: Calculate the device association weights of terminals A and B: ; Where: Indicates the characteristics of the device driver layer similarity; The edit distance of the SIM card number is the minimum number of edge set operations between the SIM card numbers of two devices; Adversarial device cluster generation: The generator constructs virtual device clusters with characteristics such as clusters of devices with the same driver version but completely different MAC addresses; clusters of devices with highly similar sensor noise patterns but dispersed geographically; The discriminator detects fake associations by analyzing device activity time, where the loss function is as follows: ; Where: represents the cross-over loss function, which is used to measure the distance between the model output p and the true label y; represents the discriminator’s prediction value for the real device edge; Represents the discriminator’s prediction value for the generated device edge; 1 represents the label of the real device edge; 0 represents the label of the generated device edge; represents the weight coefficient of the smoothing term; To constrain the association consistency between the device layer and the space layer; ; Where: Indicates the weight of the device layer; Represents the weight of the spatial topology layer; represents the L1 norm, which measures the difference between two weights; Based on this, the device fingerprint subgraph is output, which includes a set of nodes and a set of edges at the device fingerprint layer, where the weight of the edge reflects the hardware association strength.

[0013] Preferably, the latent group spatiotemporal fingerprint encoding comprises the following steps: Neighbor node feature aggregation: Based on the enhanced spatiotemporal feature tensor and dynamic graph structure, each node is aligned with its corresponding spatiotemporal feature by mapping the node ID to the feature vector, and the aligned node feature matrix is ​​output. Convolution kernel operation: The neighbor information of the node is aggregated through the graph convolution operation, where the neighbor nodes are connected through the spatial adjacency matrix. The convolution kernel weightedly aggregates the features of each neighbor node to obtain the spatiotemporal encoding feature matrix; Physical trajectory: Based on the spatial features in the original GPS trajectory sequence and the enhanced spatiotemporal feature tensor, the missing points of the trajectory data points are filled using the cubic spline interpolation method to generate an equally spaced trajectory point sequence. The motion features are then calculated based on the generated equally spaced trajectory point sequence. The motion features and spatial features are then spliced ​​together and the dimension is reduced to obtain the physical trajectory feature matrix. Capital trajectory: A dynamic graph is constructed using terminals as nodes and transaction amounts as edge weights. Temporal convolution is then applied to the transaction time series to obtain periodic features. The obtained periodic features, the dynamic graph, and the time features of the enhanced spatiotemporal feature tensor are fused to obtain the capital trajectory feature matrix. Spatiotemporal attention fusion: Based on the physical trajectory feature matrix, the capital trajectory feature matrix, and the spatiotemporal coding feature matrix, the attention mechanism is used for weighted fusion, and the fused features are compressed to obtain the compressed feature matrix; Dynamic density clustering: Based on the compressed feature matrix, the DBSCAN clustering algorithm is used to generate a group label set; based on the fusion features of the nodes in the group, the spatiotemporal fingerprint set of the group is generated by hashing.

[0014] Preferably, in the convolution kernel operation, the convolution kernel adopts a dynamic convolution kernel, and the shape of the convolution kernel is adjusted by the node movement speed and direction: ; Where: Represents a dynamic convolution kernel, which is used to weight the neighborhood of a node during graph convolution; represents a multilayer perceptron; represents the speed of node i; and Represents the direction angle The cosine and sine of ; The dynamically adjusted The following physical motion constraints need to be met: ; Where: Represents the Frobenius norm of the convolution kernel; Indicates the maximum speed of the device; Indicates a time interval; Apply the adjusted convolution kernel that meets the physical motion constraints to the graph convolution operation, aggregating the information of the domain nodes to update the node features: ; Where: represents the spatial neighborhood of node i; represents the weight of the spatial adjacency relationship between node i and node j; represents the activation function; represents the bias term.

[0015] Preferably, the real-time confrontation decision-making and blocking includes the following steps: Individual abnormal coefficient: In the time dimension, a dynamic time warping algorithm is used to compare the matching degree between the current transaction time series and the historical pattern; In the spatial dimension, the rationality of the device movement path is calculated by the cosine similarity of the geographic trajectory; The results of the two dimensions are normalized to an abnormal coefficient of 0-1, where higher abnormal values ​​represent more significant deviations from the normal pattern; Group risk weight: Dynamically assess group risk based on latent group clustering results: Count the fraud trigger rate of each group member every hour, calculate the group risk weight, and automatically increase the risk level if a sudden change in group behavior is detected; Fusion: Based on individual abnormal coefficients and group risk weights, a dynamic weighting algorithm is used to generate a comprehensive risk score; Decision: Determine whether to block based on the generated comprehensive risk score and the set threshold.

[0016] The beneficial effects of the present invention include: The present invention performs spatiotemporal slicing of the payment transaction flow through a sliding window, injects abnormal features in combination with a generative adversarial network, and enhances the spatiotemporal feature tensor; constructs a three-dimensional dynamic adversarial graph using the spatial topology layer, transaction association layer, and device fingerprint layer, and deeply mines the complex relationships of transaction data through weighted fusion through the attention mechanism; adopts deformable spatiotemporal convolution and LSTM model for multi-dimensional spatiotemporal fingerprint fusion, thereby generating the spatiotemporal fingerprint of each terminal device and the latent group clustering results; finally, combines the spatiotemporal fingerprint of the terminal device with the current context to make real-time fraud decisions, realizing dynamic and real-time monitoring and blocking of payment fraud behaviors; not only significantly improves the accuracy and timeliness of fraud detection, but also enhances the system's adaptability to new fraud behaviors, and improves the security and defense capabilities of the payment system. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0018] Figure 1 This is a flowchart of the overall steps provided by an embodiment of the present invention.

[0019] Figure 2 A schematic diagram of an exemplary dynamic graph structure provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the technical problems, technical solutions and beneficial effects to be solved by this application more clearly understood, this application is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0021] See also Figure 1 As shown, the real-time anti-fraud decision-making method for payment terminals based on machine learning includes the following steps: Spatiotemporal data stream slicing: Spatiotemporal slicing of the original payment transaction stream is performed through a sliding window, cutting the data into spatiotemporal cubes containing time, space, and device information; The spatiotemporal data stream slicing comprises the following steps: Time verification: Using the IEEE1588 precision time protocol, the clock deviation of each terminal is controlled within ±100ns; Spatial calibration: Combine GPS coordinates and base station signal strength to calculate the actual terminal location through least squares optimization, eliminate outliers that exceed physical motion constraints, and identify those with a credibility lower than a predetermined threshold as outliers; Example: ; Where: Indicates credibility; ; Indicates the number of satellites; ; Indicates base station signal strength; Window setting: Using 5ms as the baseline time window length, the data stream is divided into continuous segments according to the transaction timestamp; then, by monitoring the transaction density in real time, the window length is dynamically contracted or expanded: ; Where: Indicates the transaction density of the current window; is the previous window length; Indicates the adjusted window length; Space-time cube construction: Spatial slicing: The Earth's surface is divided into Geohash-12 grids. Terminals within each grid are grouped into the same spatial unit. For terminals in edge areas, adjacent 3×3 grids are merged to form a super unit. Time slicing: Generates time series codes at 1ms granularity within the window and builds a time axis index; Device sharding: The combined hash value of the SIM card number hash and the device driver layer features is used to construct the device fingerprint. Devices with similarity greater than the similarity threshold are grouped into the same cluster.

[0022] Abnormal data injection: Based on the space-time cube, a generative adversarial network is used to inject abnormal features into the space-time data, generate adversarial perturbations, and obtain enhanced space-time feature tensors and space-time cube metadata; The abnormal data injection comprises the following steps: Spatial forgery: By controlling the virtual speed and acceleration of the terminal, abnormal trajectories that conform to the laws of kinematics are created: ; Where: Indicates the displacement of the current position; Indicates the virtual moving speed; Indicates the time difference between two transactions; represents random acceleration; Device masquerading: Generate multiple virtual devices through the device's hash value, deceiving the system into identifying them as multiple legitimate devices; example: ; Where: Indicates the number of fake devices generated; is the actual number of devices; Specifically, by copying the driver layer hash value of the real device, modifying the MAC address and other variable parameters, simulating different devices, and generating a number of Mixing virtual device data into transaction flows makes fraud detection more difficult. Time synchronization: When generating fraud samples, we generate transaction time series from different time zones to ensure that the transaction time difference between different time zones is kept within 2 seconds; Feature space adversarial training: The generator generates virtual samples, and the discriminator judges the samples. The WGAN optimization algorithm is used to train the generator and discriminator. Through adversarial training, more realistic fraud samples are generated. Specifically, the objective function is as follows: ; Where: represents the real sample; represents the fake samples generated by the generator; represents a random noise vector; Represents the judgment of the discriminator on the input sample; represents the gradient penalty coefficient; Represents the linear interpolation of generated samples and real samples; Express The L2 norm of the gradient on ; Spatial feature extraction: All samples extract the terminal's movement trajectory complexity and base station switching frequency within the window. The movement trajectory complexity is calculated based on the following formula: ; Where: Indicates the number of location points; Indicates the i+1th position point; represents the i-th position point; Indicates a time interval; Indicates the complexity of the moving trajectory; The base station switching frequency is obtained by counting the number of CID changes of the terminal connection within the window; Time feature modeling: The autocorrelation function of the trading time interval is constructed for all samples to capture periodic patterns; ; Where: Indicates the transaction status at time t (0 / 1 indicates whether there is a transaction); represents the time lag parameter; represents the autocorrelation value; Representing time series The mean of Indicates the total length of the time series; Extract the time series difference features of the transaction amount: ; represents the transaction amount at time t; Represents the differential characteristics of transaction amount at time t; Device feature hardening: Calculate device stability indicators based on the driver layer feature matching and the variable parameter change rate, and introduce a smoothing factor in the calculation process; for example: ; in: represents the smoothing factor; Indicates the device stability index; Based on this, an enhanced feature tensor and spatiotemporal cube metadata are generated; for example, each terminal outputs a 128-dimensional feature vector, which is distributed according to the following proportions: ,in arrive is the spatial feature; arrive is the device feature; arrive is the time feature; The space-time cube metadata contains the following information: time window label, spatial network topology, etc.

[0023] See also Figure 2 As shown in the figure, the three-dimensional dynamic adversarial graph is constructed: including the construction of the spatial topology layer, the transaction association layer, and the device fingerprint layer, to obtain three sub-graphs. The attention mechanism is introduced to weight the three sub-graphs to fuse and update them and output the updated dynamic graph structure. The spatial topology layer construction includes the following steps: Construct spatial adjacent candidate pairs: traverse any two terminals A and B, calculate their spatial correlation index, and select terminal pairs with Geohash prefix overlap ≥ 6 bits as candidate edge sets; Spatial edge weight calculation: ; Where: and Represents the Geohash codes of terminals A and B respectively; express and The number of prefix matches; Indicates the degree of overlap of the base station scan set; and Both represent the set of base stations scanned by the terminal; and Indicates the Timing Advance value of the corresponding terminal, which is the estimated distance between it and the nearest base station; Edge filtering and dynamic pruning: If the terminal pair ( ) In consecutive T=3 time windows, it satisfies: or , it is determined that the spatial overlap disappears and the corresponding spatial edge is deleted ( ); Adversarial perturbation edge generation: Through adversarial training between the generator and the discriminator, the optimization objective is as follows: ; Where: represents the true edge weight; represents the generated edge weight; and denote the real and generated edge distributions respectively; represents the regularization hyperparameter; represents the Kullback-Leibler divergence; Spatial subgraph output: Based on adversarial perturbation generation, a spatial subgraph is obtained, where nodes represent all terminal devices, edge sets represent valid spatial proximity relationships, and edge weights represent the true degree of geographical or signal overlap.

[0024] The construction of the transaction association layer includes the following steps: Multi-stage transaction edge generation: Direct transaction edge: If terminal A transfers money directly to terminal B, the edge weight is calculated based on the following formula: ; Where: Indicates the transaction amount; Indicates the transaction time interval; Indirect transaction edge: If there is a path , then generate an edge , the weight is: ; Where: k represents the number of intermediate nodes in the path; Represents node A and intermediate node Direct transaction edge weights between Indicates an intermediate node The weight of the direct transaction edge with node B; and Represent the degrees of node A and node B respectively; Adversarial transaction pattern injection: The generator constructs a virtual transaction path, the characteristics of which include the closed-loop flow of large amounts of funds within a time period of m (m < 5 seconds); the standard difference in cross-regional transaction amounts (amount fluctuation > 3); ); The discriminator detects fake edges through transaction flow analysis (e.g., PageRank value mutation), where the loss function is: ; Where: represents the discriminator function; represents the real transaction edge set; represents the generated virtual transaction edge set; represents the weight coefficient of the smoothing term; represents the time series smoothing term; ; Where: represents the transaction edge set at time t; represents the transaction edge set at time t-1; represents the Frobenius norm; Based on this, a transaction-related subgraph is output, including a node set and a transaction-related edge set, where the edge weight reflects the intensity of capital flow.

[0025] The construction of the device fingerprint layer includes the following steps: Device similarity calculation: Calculate the device association weights of terminals A and B: ; Where: Indicates the characteristics of the device driver layer similarity; The edit distance of the SIM card number is the minimum number of edge set operations between the SIM card numbers of two devices; Adversarial device cluster generation: The generator constructs virtual device clusters with characteristics such as clusters of devices with the same driver version but completely different MAC addresses; clusters of devices with highly similar sensor noise patterns but dispersed geographically; The discriminator detects fake associations by analyzing device activity time, where the loss function is as follows: ; Where: represents the cross-over loss function, which is used to measure the distance between the model output p and the true label y; represents the discriminator’s prediction value for the real device edge; Represents the discriminator’s prediction value for the generated device edge; 1 represents the label of the real device edge; 0 represents the label of the generated device edge; represents the weight coefficient of the smoothing term; To constrain the association consistency between the device layer and the space layer; ; Where: Indicates the weight of the device layer; Represents the weight of the spatial topology layer; represents the L1 norm, which measures the difference between two weights; Based on this, the device fingerprint subgraph is output, which includes a set of nodes and a set of edges at the device fingerprint layer, where the weight of the edge reflects the hardware association strength.

[0026] A dynamic graph structure is generated based on the output spatial subgraph, transaction association subgraph, and device fingerprint subgraph. The edge weight of the dynamic graph is the weighted sum of the three subgraphs: ; Where: Represents the weight of the spatial subgraph; Represents the weight of the transaction-related subgraph; Represents the weight of the device fingerprint subgraph; 、 、 Both represent weight coefficients, which are dynamically calculated through the attention mechanism; In this embodiment, by constructing a spatial topology layer, a transaction association layer, and a device fingerprint layer, the model can three-dimensionally characterize end-user or device behavior from the three dimensions of "space + transaction + device," avoiding the blind spots caused by single-feature modeling. A dynamic graph structure is introduced to dynamically update edge weights and graph structure through data analysis of continuous time windows, capturing the temporal evolution of behavior and promptly responding to disguises or behavior switches, such as fraudsters changing devices, falsifying geographic locations, or splitting transactions. A generator-discriminator structure is introduced into each subgraph layer to simulate potential attack methods (such as forged transactions, cloned devices, and fictitious locations), and adversarial training is used to enhance the model's discriminative capabilities. This allows for better identification of "disguised" edges or paths (such as closed-loop paths for large-value transfers within a short period of time), improving the model's sensitivity and generalization to abnormal behavior patterns. An attention mechanism is used to dynamically calculate the weighting coefficients of the three-layer graph, automatically adjusting the importance of the three types of information for different scenarios. For example, in geo-fraud scenarios, the spatial layer has a higher weight, while in device counterfeiting scenarios, the device fingerprint layer dominates.

[0027] Hidden group spatiotemporal fingerprint encoding: Based on the spatiotemporal features in the dynamic graph structure, multi-dimensional spatiotemporal fingerprint fusion is performed after the deformable spatiotemporal convolution operation, and the spatiotemporal fingerprint of each terminal device and the latent group clustering results are output; The latent group spatiotemporal fingerprint encoding comprises the following steps: Neighbor node feature aggregation: Based on the enhanced spatiotemporal feature tensor and dynamic graph structure, each node is aligned with its corresponding spatiotemporal feature by mapping the node ID to the feature vector, and the aligned node feature matrix is ​​output. Convolution kernel operation: The neighbor information of the node is aggregated through the graph convolution operation, where the neighbor nodes are connected through the spatial adjacency matrix. The convolution kernel weightedly aggregates the features of each neighbor node to obtain the spatiotemporal encoding feature matrix; In the convolution kernel operation, the convolution kernel adopts a dynamic convolution kernel, and the shape of the convolution kernel is adjusted by the node movement speed and direction: ; Where: Represents a dynamic convolution kernel, which is used to weight the neighborhood of a node during graph convolution; represents a multilayer perceptron; represents the speed of node i; and Represents the direction angle The cosine and sine of ; The dynamically adjusted The following physical motion constraints need to be met: ; Where: Represents the Frobenius norm of the convolution kernel; Indicates the maximum speed of the device; Indicates a time interval; Apply the adjusted convolution kernel that meets the physical motion constraints to the graph convolution operation, aggregating the information of the domain nodes to update the node features: ; Where: represents the spatial neighborhood of node i; represents the weight of the spatial adjacency relationship between node i and node j; represents the activation function; represents the bias term.

[0028] Physical trajectory: Based on the spatial features in the original GPS trajectory sequence and the enhanced spatiotemporal feature tensor, the missing points of the trajectory data points are filled using the cubic spline interpolation method to generate an equally spaced trajectory point sequence. The motion features are then calculated based on the generated equally spaced trajectory point sequence. The motion features and spatial features are then concatenated and reduced in dimension to obtain the physical trajectory feature matrix. The motion features include acceleration and directional entropy. Capital trajectory: A dynamic graph is constructed using terminals as nodes and the logarithmically weighted sum of the transaction amounts as the edge weights. Temporal convolution is then applied to the transaction time series to obtain periodic features. The obtained periodic features, the dynamic graph, and the time features of the enhanced spatiotemporal feature tensor are then fused to obtain the capital trajectory feature matrix. The edge weight is calculated as follows: ; Where: represents the transaction amount between terminals i and j at time t; Indicates the current time; represents the time decay factor; represents the weight of the edge from node i to node j on the way; Indicates the time point when the historical transaction occurred; represents the base of natural logarithms; Spatiotemporal attention fusion: Based on the physical trajectory feature matrix, the capital trajectory feature matrix, and the spatiotemporal coding feature matrix, they are spliced ​​and weighted fused using the attention mechanism. The fused features are compressed to obtain a compressed feature matrix. For example, if a 64-dimensional feature matrix is ​​obtained, a 32-dimensional feature matrix needs to be generated through linear transformation. Dynamic density clustering: Based on the compressed feature matrix, the DBSCAN clustering algorithm is used to generate a group label set; then, based on the fusion features of the nodes in the group, a spatiotemporal fingerprint set of the group is generated through hashing; The DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm identifies the group structure of devices in the compressed feature space. It does not rely on a preset number of clusters and can automatically discover groups of any shape and identify outliers. It is suitable for the nonlinear and irregular distribution of fraudulent groups. For each data point (a compressed feature matrix represents a data point), the number of neighboring points within the neighborhood radius is calculated. If the number of neighboring points is greater than or equal to the minimum number of neighboring points, it is marked as a core point; all density-reachable points connected to the core point form a cluster, and points that cannot be classified into any cluster are marked as noise points; based on this, the entire label set of each sample is output; then the fused features of the member nodes within each group are extracted (that is, the subset corresponding to the compressed feature matrix), and hash coding is performed on them to generate the spatiotemporal fingerprint of the group; and then the spatiotemporal fingerprint set is obtained.

[0029] In this embodiment, by dynamically adjusting the shape of the convolution kernel (based on the speed and direction of movement of the node), the movement characteristics of the node in the physical space can be accurately simulated, especially in the environment of mobile devices (such as GPS tracking devices, vehicles, etc.); this adjustment mechanism fully considers the changes in the speed and direction of node movement, and can effectively improve the aggregation quality of neighborhood information during the graph convolution process, thereby obtaining more refined spatiotemporal coding features.

[0030] By jointly modeling physical and financial trajectories, this solution can provide more semantic information across time and space. For example, physical trajectories generate detailed spatiotemporal data on the physical motion characteristics of nodes by interpolating missing points and calculating acceleration and directional entropy. Financial trajectories, on the other hand, reflect the cyclical and dynamic nature of financial behavior by weighting transaction amounts and applying time decay. This combined consideration of these two types of features enables this technology to comprehensively capture spatial, temporal, and financial flow information when analyzing group behavior, making it particularly suitable for tasks such as fraud detection and group behavior recognition.

[0031] Real-time adversarial decision-making and blocking: Make real-time fraud decisions based on the spatiotemporal fingerprint and current context of the terminal device to obtain real-time decision results.

[0032] The real-time confrontation decision-making and blocking includes the following steps: Individual abnormal coefficient: In the time dimension, a dynamic time warping algorithm is used to compare the matching degree between the current transaction time series and the historical pattern; In the spatial dimension, the rationality of the device movement path is calculated by the cosine similarity of the geographic trajectory; The results of the two dimensions are normalized to an abnormal coefficient of 0-1, where higher abnormal values ​​represent more significant deviations from the normal pattern; Group risk weight: Dynamically assess group risk based on latent group clustering results: Count the fraud trigger rate of each group member every hour, calculate the group risk weight, and automatically increase the risk level if a sudden change in group behavior is detected; Fusion: Based on individual abnormal coefficients and group risk weights, a dynamic weighting algorithm is used to generate a comprehensive risk score; ; Where: and represents the weighting coefficient; represents the comprehensive risk score; represents the individual abnormality coefficient; represents the group risk weight; Decision-making: Based on the generated comprehensive risk score and the set threshold, determine whether to execute blocking. That is, if the calculated comprehensive risk score is greater than or equal to the preset threshold, the transaction is blocked.

[0033] The present invention performs spatiotemporal slicing of the payment transaction flow through a sliding window, injects abnormal features in combination with a generative adversarial network, and enhances the spatiotemporal feature tensor; constructs a three-dimensional dynamic adversarial graph using the spatial topology layer, transaction association layer, and device fingerprint layer, and deeply mines the complex relationships of transaction data through weighted fusion through the attention mechanism; adopts deformable spatiotemporal convolution and LSTM model for multi-dimensional spatiotemporal fingerprint fusion, thereby generating the spatiotemporal fingerprint of each terminal device and the latent group clustering results; finally, combines the spatiotemporal fingerprint of the terminal device with the current context to make real-time fraud decisions, realizing dynamic and real-time monitoring and blocking of payment fraud behaviors; not only significantly improves the accuracy and timeliness of fraud detection, but also enhances the system's adaptability to new fraud behaviors, and improves the security and defense capabilities of the payment system.

[0034] The above are only preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A real-time anti-fraud decision-making method for payment terminals based on machine learning, characterized in that: The following steps are involved: Spatiotemporal data stream slicing: Spatiotemporal slicing of the original payment transaction stream is performed through a sliding window, cutting the data into spatiotemporal cubes containing time, space, and device information; Abnormal data injection: Based on the space-time cube, a generative adversarial network is used to inject abnormal features into the space-time data, generate adversarial perturbations, and obtain enhanced space-time feature tensors and space-time cube metadata; 3D dynamic adversarial graph construction: This includes the construction of the spatial topology layer, the transaction association layer, and the device fingerprint layer, resulting in three sub-graphs. A weighted attention mechanism is then introduced to fuse and update these three sub-graphs, outputting the updated dynamic graph structure. Hidden group spatiotemporal fingerprint encoding: Based on the spatiotemporal features in the dynamic graph structure, multi-dimensional spatiotemporal fingerprint fusion is performed after the deformable spatiotemporal convolution operation, and the spatiotemporal fingerprint of each terminal device and the latent group clustering results are output; Real-time adversarial decision-making and blocking: Make real-time fraud decisions based on the spatiotemporal fingerprint and current context of the terminal device and obtain real-time decision results.

2. The real-time anti-fraud decision-making method for payment terminals based on machine learning according to claim 1, characterized in that: The spatiotemporal data stream slicing comprises the following steps: Time verification: Using the IEEE1588 precision time protocol, the clock deviation of each terminal is controlled within ±100ns; Spatial calibration: Combines GPS coordinates and base station signal strength to calculate the actual terminal location through least squares optimization, eliminating outliers that exceed physical motion constraints. Points with a credibility below a predetermined threshold are considered outliers. Window setting: Using 5ms as the baseline time window length, the data stream is divided into continuous segments according to the transaction timestamp; then, by monitoring the transaction density in real time, the window length is dynamically contracted or expanded: ； Where: Indicates the transaction density of the current window; is the previous window length; Indicates the adjusted window length; Space-time cube construction: Spatial slicing: The Earth's surface is divided into Geohash-12 grids. Terminals within each grid are grouped into the same spatial unit. For terminals in edge areas, adjacent 3×3 grids are merged to form a super unit. Time slicing: Generates time series codes at 1ms granularity within the window and builds a time axis index; Device sharding: The combined hash value of the SIM card number hash and the device driver layer features is used to construct the device fingerprint. Devices with similarity greater than the similarity threshold are grouped into the same cluster.

3. The real-time anti-fraud decision-making method for payment terminals based on machine learning according to claim 1, characterized in that: The abnormal data injection comprises the following steps: Spatial forgery: By controlling the terminal's virtual velocity and acceleration, abnormal trajectories that conform to kinematic laws are created: ； Where: Indicates the displacement of the current position; Indicates the virtual moving speed; Indicates the time difference between two transactions; represents random acceleration; Device masquerading: Generate multiple virtual devices using the device's hash value to trick the system into identifying them as multiple legitimate devices. Time synchronization: When generating fraud samples, we generate transaction time series from different time zones to ensure that the transaction time difference between different time zones is kept within 2 seconds; Feature space adversarial training: The generator generates virtual samples, the discriminator judges the samples, and the WGAN optimization algorithm is used to train the generator and discriminator. This adversarial training generates more realistic fraud functions. Spatial feature extraction: All samples extract the complexity of the terminal's movement trajectory and base station switching frequency within the window; Time feature modeling: The autocorrelation function of the trading time interval is constructed for all samples to capture periodic patterns; Device feature hardening: Calculate device stability indicators based on the driver layer feature matching and the rate of change of variable parameters, and introduce a smoothing factor in the calculation process; Based on this, an enhanced feature tensor and spatiotemporal cube metadata are generated.

4. The real-time anti-fraud decision-making method for payment terminals based on machine learning according to claim 1, characterized in that: The spatial topology layer construction includes the following steps: Construct spatial adjacent candidate pairs: traverse any two terminals A and B, calculate their spatial correlation index, and select terminal pairs with Geohash prefix overlap ≥ 6 bits as candidate edge sets; Spatial edge weight calculation: ； Where: and Represents the Geohash codes of terminals A and B respectively; express and The number of prefix matches; Indicates the degree of overlap of the base station scan set; and Both represent the set of base stations scanned by the terminal; and Indicates the Timing Advance value of the corresponding terminal, which is the estimated distance between it and the nearest base station; Edge filtering and dynamic pruning: If the terminal pair ( ) In consecutive T=3 time windows, it satisfies: or , it is determined that the spatial overlap disappears and the corresponding spatial edge is deleted ( ); Adversarial perturbation edge generation: Through adversarial training between the generator and the discriminator, the optimization objective is as follows: ； Where: represents the true edge weight; represents the generated edge weight; and denote the real and generated edge distributions respectively; represents the regularization hyperparameter; represents the Kullback-Leibler divergence; Spatial subgraph output: Based on adversarial perturbation generation, a spatial subgraph is obtained, where nodes represent all terminal devices, edge sets represent valid spatial proximity relationships, and edge weights represent the true degree of geographical or signal overlap.

5. The real-time anti-fraud decision-making method for payment terminals based on machine learning according to claim 1, characterized in that: The construction of the transaction association layer includes the following steps: Multi-stage transaction edge generation: Direct transaction edge: If terminal A transfers money directly to terminal B, the edge weight is calculated based on the following formula: ； Where: Indicates the transaction amount; Indicates the transaction time interval; Indirect transaction edge: If there is a path , then generate an edge , the weight is: ； Where: k represents the number of intermediate nodes in the path; Represents node A and intermediate node Direct transaction edge weights between them; Indicates an intermediate node The weight of the direct transaction edge with node B; and Represent the degrees of node A and node B respectively; Adversarial transaction pattern injection: The generator constructs a virtual transaction path, whose characteristics include the closed-loop flow of large amounts of funds within time m and the standard differences in cross-regional transaction amounts. The discriminator detects forged edges through transaction flow analysis, where the loss function is: ； Where: represents the discriminator function; represents the real transaction edge set; represents the generated virtual transaction edge set; represents the weight coefficient of the smoothing term; represents the time series smoothing term; ； Where: represents the transaction edge set at time t; represents the transaction edge set at time t-1; represents the Frobenius norm; Based on this, a transaction-related subgraph is output, including a node set and a transaction-related edge set, where the edge weight reflects the intensity of capital flow.

6. The real-time anti-fraud decision-making method for payment terminals based on machine learning according to claim 1, characterized in that: The construction of the device fingerprint layer includes the following steps: Device similarity calculation: Calculate the device association weights of terminals A and B: ； Where: Indicates the characteristics of the device driver layer similarity; The edit distance of the SIM card number is the minimum number of edge set operations between the SIM card numbers of two devices; Adversarial device cluster generation: The generator constructs virtual device clusters with characteristics such as clusters of devices with the same driver version but completely different MAC addresses; clusters of devices with highly similar sensor noise patterns but dispersed geographically; The discriminator detects fake associations by analyzing device activity time, where the loss function is as follows: ； Where: represents the cross-over loss function, which is used to measure the distance between the model output p and the true label y; represents the discriminator’s prediction value for the real device edge; Represents the discriminator’s prediction value for the generated device edge; 1 represents the label of the real device edge; 0 represents the label of the generated device edge; represents the weight coefficient of the smoothing term; To constrain the association consistency between the device layer and the space layer; ； Where: Indicates the weight of the device layer; Represents the weight of the spatial topology layer; represents the L1 norm, which measures the difference between two weights; Based on this, the device fingerprint subgraph is output, which includes a set of nodes and a set of edges at the device fingerprint layer, where the weight of the edge reflects the hardware association strength.

7. The real-time anti-fraud decision-making method for payment terminals based on machine learning according to claim 1, characterized in that: The latent group spatiotemporal fingerprint encoding comprises the following steps: Neighbor node feature aggregation: Based on the enhanced spatiotemporal feature tensor and dynamic graph structure, each node is aligned with its corresponding spatiotemporal feature by mapping the node ID to the feature vector, and the aligned node feature matrix is ​​output. Convolution kernel operation: The neighbor information of the node is aggregated through the graph convolution operation, where the neighbor nodes are connected through the spatial adjacency matrix. The convolution kernel weightedly aggregates the features of each neighbor node to obtain the spatiotemporal encoding feature matrix; Physical trajectory: Based on the spatial features in the original GPS trajectory sequence and the enhanced spatiotemporal feature tensor, the missing points of the trajectory data points are filled using the cubic spline interpolation method to generate an equally spaced trajectory point sequence. The motion features are then calculated based on the generated equally spaced trajectory point sequence. The motion features and spatial features are then spliced ​​together and the dimension is reduced to obtain the physical trajectory feature matrix. Capital trajectory: A dynamic graph is constructed using terminals as nodes and transaction amounts as edge weights. Temporal convolution is then applied to the transaction time series to obtain periodic features. The obtained periodic features, the dynamic graph, and the time features of the enhanced spatiotemporal feature tensor are fused to obtain the capital trajectory feature matrix. Spatiotemporal attention fusion: Based on the physical trajectory feature matrix, the capital trajectory feature matrix, and the spatiotemporal coding feature matrix, the attention mechanism is used for weighted fusion, and the fused features are compressed to obtain the compressed feature matrix; Dynamic density clustering: Based on the compressed feature matrix, the DBSCAN clustering algorithm is used to generate a group label set; based on the fusion features of the nodes in the group, the spatiotemporal fingerprint set of the group is generated by hashing.

8. The real-time anti-fraud decision-making method for payment terminals based on machine learning according to claim 7, characterized in that: In the convolution kernel operation, the convolution kernel adopts a dynamic convolution kernel, and the shape of the convolution kernel is adjusted by the node movement speed and direction: ； Where: Represents a dynamic convolution kernel, which is used to weight the neighborhood of a node during graph convolution; represents a multilayer perceptron; represents the speed of node i; and Represents the direction angle The cosine and sine of ; The dynamically adjusted The following physical motion constraints need to be met: ； Where: Represents the Frobenius norm of the convolution kernel; Indicates the maximum speed of the device; Indicates a time interval; Apply the adjusted convolution kernel that meets the physical motion constraints to the graph convolution operation, aggregating the information of the domain nodes to update the node features: ； Where: represents the spatial neighborhood of node i; represents the weight of the spatial adjacency relationship between node i and node j; represents the activation function; represents the bias term.

9. The real-time anti-fraud decision-making method for payment terminals based on machine learning according to claim 1, characterized in that: The real-time confrontation decision-making and blocking includes the following steps: Individual abnormal coefficient: In the time dimension, a dynamic time warping algorithm is used to compare the matching degree between the current transaction time series and the historical pattern; In the spatial dimension, the rationality of the device movement path is calculated by the cosine similarity of the geographic trajectory; The results of the two dimensions are normalized to an abnormal coefficient of 0-1, where higher abnormal values ​​represent more significant deviations from the normal pattern; Group risk weight: Dynamically assess group risk based on latent group clustering results: Count the fraud trigger rate of each group member every hour, calculate the group risk weight, and automatically increase the risk level if a sudden change in group behavior is detected; Fusion: Based on individual abnormal coefficients and group risk weights, a dynamic weighting algorithm is used to generate a comprehensive risk score; Decision: Determine whether to block based on the generated comprehensive risk score and the set threshold.

Images