Transaction abnormality monitoring system based on multi-source data collaborative analysis

Abstract

The present application relates to the technical field of anomaly monitoring, in particular to a transaction anomaly monitoring system based on multi-source data collaborative analysis, which comprises a capture node unit, a correlation anomaly unit and a fraud node unit. The fraud node unit selects nodes from a preliminary anomaly candidate set, constructs a local graph structure of the nodes and their jump neighbors to form a high-order subgraph pattern, reconstructs the high-order subgraph pattern, calculates a subgraph reconstruction error, screens out nodes of an abnormal high-order subgraph pattern, narrows down the anomaly candidate set, splices the abnormal nodes in the narrowed-down anomaly candidate set, calculates the importance score of the feature vector of the spliced abnormal nodes, detects the abnormal nodes in the narrowed-down anomaly candidate set as fraud nodes by using the importance score, and effectively narrows down the range of the anomaly candidate set by screening out the nodes of the abnormal high-order subgraph pattern, so that the anomaly candidate set can be concentrated on a small number of abnormal nodes, the calculation amount and detection time are greatly reduced, and the detection efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of anomaly monitoring, in particular to a transaction anomaly monitoring system based on multi-source data collaborative analysis. BACKGROUND

[0002] Traditional transaction anomaly monitoring usually relies on rule engines or machine learning models based on a single data source. For example, some systems mainly analyze transaction data itself, identifying risks by setting fixed threshold rules (such as excessively large single amount, high-frequency transactions in a short period of time). Although this method is simple and intuitive, the rules are rigid and difficult to adapt to changing patterns of fraudulent behavior, and it can easily generate a large number of false positives, disrupting the transaction experience of normal users. Some others introduce machine learning technology, building models by analyzing users' historical transaction records to predict the risk of current transactions. Although this method has certain adaptive ability, its analysis is limited to a single user transaction history dimension, and for complex fraudulent behavior using stolen accounts, newly registered accounts, or multiple accounts in collaboration, it often cannot effectively identify due to lack of sufficient data support. In particular, for organized fraud gangs, they often operate collaboratively through multiple seemingly unrelated accounts and devices, forming complex fraud networks. In this scenario, any monitoring method that only focuses on a single user or a single transaction will "only see the trees, not the forest", failing to discover potential and hidden associations between entities, resulting in ineffective monitoring. Therefore, we provide a transaction anomaly monitoring system based on multi-source data collaborative analysis. SUMMARY

[0003] The present application aims to provide a transaction anomaly monitoring system based on multi-source data collaborative analysis to solve the problems raised in the background.

[0004] To achieve the above-mentioned purpose, the present application provides a transaction anomaly monitoring system based on multi-source data collaborative analysis, comprising a capture node unit, an association anomaly unit and a fraud node unit;

[0005] The capture node unit transaction platform captures user transaction data and classifies it into numerical features and categorical features, integrates it into a standardized feature vector, and abstracts the standardized feature vector into user nodes, transaction nodes, device nodes and merchant nodes into merchant nodes;

[0006] The association anomaly unit is used to receive the user nodes, transaction nodes, device nodes and merchant nodes in the capture node unit to construct an association graph, determine the transaction anomaly of the association graph, and perform the following steps:

[0007] The user node, the transaction node, the device node and the merchant node are integrated into a node set, and a use edge, an initiation edge and an occurrence edge are formed and integrated into an edge set, and the association graph is constructed through the node set and the edge set;

[0008] The association graph cooperatively analyzes the mouse cursor law, the user consumption habit, the geographical distribution range of transaction and the user keystroke law, and cooperatively analyzes that the user consumption habit presents high consumption or the geographical distribution range of transaction is in a remote area or the mouse cursor law presents chaos or the user keystroke law presents chaos, so that it is determined that the association graph has transaction anomaly;

[0009] The association graph is input into the graph neural network, and time series data is extracted from the node and the adjacent node, and the data reconstruction error is calculated, the node in the time series data is identified as abnormal through the reconstruction error, and is used as a preliminary abnormal candidate set;

[0010] The fraud node unit is used for receiving the preliminary abnormal candidate set in the association anomaly unit to detect the fraud node, and performing the following steps:

[0011] The node is selected from the preliminary abnormal candidate set , the local graph structure of the node and the jump neighbor is constructed, so as to form a high-order subgraph mode, calculate the subgraph reconstruction error, and screen out the node with abnormal high-order subgraph mode to reduce the abnormal candidate set;

[0012] The abnormal nodes in the reduced abnormal candidate set are spliced, and the importance score of the feature vector of the spliced abnormal node is calculated, and the importance score is used to detect that the abnormal node in the reduced abnormal candidate set is a fraud node.

[0013] As a further improvement of the technical solution, the association graph module integrates the user node, the transaction node, the device node and the merchant node into a node set, connects the user node and the device node to form a use edge, connects the user node and the transaction node to form an initiation edge, and connects the transaction node and the merchant node to form an occurrence edge, integrates the use edge, the initiation edge and the occurrence edge into an edge set, and constructs the association graph through the node set and the edge set;

[0014] The association graph cooperatively analyzes the mouse cursor trajectory, the historical consumption data, the device fingerprint data and the user keystroke frequency, and cooperatively analyzes the mouse cursor law, the user consumption habit, the geographical distribution range of transaction and the user keystroke law;

[0015] The multi-source data of user consumption habits, geographical distribution range of transactions, mouse cursor rules and user keystroke rules are cooperatively analyzed, and if the user consumption habits present high consumption or the geographical distribution range of transactions is in a remote area or the mouse cursor rules present chaos or the user keystroke rules present chaos, it is determined that the association graph exists transaction anomaly.

[0016] As a further improvement of the technical solution, the preliminary anomaly module inputs the association graph into a graph neural network, the graph neural network extracts time series data from nodes and adjacent nodes respectively, calculates distance metrics of nodes and adjacent nodes according to the time series data of the nodes and the adjacent nodes, calculates distances between time series according to the distance metrics of the nodes and the adjacent nodes through dynamic time warping, and determines whether to trigger the autoencoder using the distances between the time series.

[0017] The time series data in the nodes are reconstructed using the autoencoder, the data reconstruction error is calculated, and the existence of the anomaly in the nodes in the time series data is identified through the reconstruction error, when the reconstruction error is greater than a fixed reconstruction error threshold, the existence of the anomaly in the nodes in the time series data is identified, and the anomaly candidate set is obtained.

[0018] As a further improvement of the technical solution, the fraud node unit receives the preliminary anomaly candidate set in the preliminary anomaly module, selects nodes from the preliminary anomaly candidate set , constructs the local graph structure of the nodes and their jump neighbors, thereby forming a high-order subgraph pattern, reconstructs the high-order subgraph pattern using a graph autoencoder, calculates a subgraph reconstruction error, screens out nodes with abnormal high-order subgraph patterns, narrows down the anomaly candidate set, splices the abnormal nodes in the narrowed-down anomaly candidate set, calculates the importance score of the feature vector of the spliced abnormal nodes, and detects the abnormal nodes in the narrowed-down anomaly candidate set as fraud nodes using the importance score.

[0019] Compared with the prior art, the present application has the following advantages:

[0020] In this transaction anomaly monitoring system based on multi-source data collaborative analysis, the fraud node unit selects nodes from an initial anomaly candidate set, constructs a local graph structure of the nodes and their hop neighbors, thus forming a higher-order subgraph pattern. A graph autoencoder is used to reconstruct the higher-order subgraph pattern, calculates the subgraph reconstruction error, and filters out nodes with abnormal higher-order subgraph patterns, narrowing down the anomaly candidate set. The anomaly nodes in the narrowed anomaly candidate set are then concatenated, and the importance score of the feature vector of the concatenated anomaly node is calculated. The importance score is used to detect fraudulent nodes in the narrowed anomaly candidate set. By filtering out nodes with abnormal higher-order subgraph patterns, the scope of the anomaly candidate set can be effectively narrowed, focusing on these few anomaly nodes, greatly reducing computation and detection time, and improving detection efficiency. Simultaneously, narrowing the anomaly candidate set reduces the possibility of false positives, enabling more accurate location of truly anomaly nodes, reducing misjudgments of normal nodes, and improving the accuracy of detection results. Attached Figure Description

[0021] Fig. 1 This is a block diagram of the overall system structure of the present invention;

[0022] Fig. 2 This is a block diagram of the module units of the present invention.

[0023] The meanings of the labels in the diagram are as follows:

[0024] 1. Capture Node Unit; 11. Capture Monitoring Module; 12. Feature Node Module;

[0025] 2. Association Anomaly Unit; 21. Association Graph Module; 22. Preliminary Anomaly Module; 3. Fraud Node Unit. Detailed Implementation

[0026] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] Example 1

[0028] This invention provides a transaction anomaly monitoring system based on multi-source data collaborative analysis. Please refer to [link / reference]. Figs. 1-2 It includes a node capture unit 1, an anomaly association unit 2, and a fraudulent node unit 3;

[0029] The capture node unit 1 captures user transaction data through the transaction platform and classifies it into numerical and categorical features, integrating them into a standardized feature vector. This standardized feature vector is then abstracted into user nodes, transaction nodes, device nodes, and merchant nodes. The association anomaly unit 2 receives user nodes, transaction nodes, device nodes, and merchant nodes from the capture node unit 1, integrates them into a node set, and then forms a usage edge, an initiating edge, and an occurrence edge, integrating them into an edge set. A correlation graph is constructed using the node set and the edge set. The correlation graph collaboratively analyzes mouse activity. The system analyzes cursor patterns, user spending habits, the geographical distribution of transactions, and user keystroke patterns. If the analysis reveals high-value spending habits, transactions located in remote areas, or chaotic mouse cursor or keystroke patterns, then an anomaly is identified in the correlation graph. The correlation graph is then input into a graph neural network, from which time-series data is extracted from nodes and their neighbors. The data reconstruction error is calculated, and this error is used to identify nodes with anomalies in the time-series data, forming a preliminary anomaly candidate set. Fraudulent node unit 3 receives the preliminary anomaly candidate set from the correlation anomaly unit 2 to construct node... and The local graph structure of the jump neighbors is used to form a higher-order subgraph pattern. The subgraph reconstruction error is calculated, and nodes with abnormal higher-order subgraph patterns are screened to narrow down the abnormal candidate set. The abnormal nodes in the narrowed abnormal candidate set are concatenated, and the importance score of the feature vector of the concatenated abnormal node is calculated. The importance score is used to detect that the abnormal nodes in the narrowed abnormal candidate set are fraudulent nodes.

[0030] The following is a detailed breakdown of the above units;

[0031] The capture node unit 1 includes a capture monitoring module 11 and a feature node module 12;

[0032] During the operation of the trading platform, the capture and monitoring module 11 of the trading platform relies on the API interface... The system captures the user's transaction amount and merchant ID at any time (transaction time), and collects user profiles (including user account age and historical consumption data) and device fingerprint data (including device ID, IP address, transaction location, and historical transaction location). Then, it extracts user account age and historical consumption data from the user profile data.

[0033] Meanwhile, the trading platform uses front-end tracking technology to monitor users' mouse movements on web pages or application interfaces, recording the coordinates, speed, and dwell time of the mouse cursor in real time. It sets speed and dwell time thresholds and uses the mouse cursor's speed and dwell time to monitor whether the user's mouse cursor coordinates are the mouse cursor's dwell point. When the mouse cursor's speed equals the speed threshold (assuming the threshold is 0) and the mouse cursor's dwell time equals the dwell time threshold (assuming the threshold is 0), the user's mouse cursor coordinates are detected as the mouse cursor's dwell point, and the mouse cursor dwell points are connected to form the mouse cursor trajectory.

[0034] By listening to keyboard key events through front-end listening technology, the trigger time of user key presses is recorded to calculate key press interval time, and then the user's key press frequency is calculated based on the key press interval time. Finally, the mouse cursor trajectory and user key press frequency are regarded as user behavior.

[0035] Transaction amount, merchant ID, user profile, device fingerprint, and user behavior data are categorized into numerical features (such as transaction amount and account age) and categorical features (such as merchant ID and geographical location).

[0036] Example:

[0037] At a certain moment on the trading platform, a user made a purchase transaction of 5,000 yuan (transaction amount) on January 1, 2025 at 10:30 AM. The merchant ID was 12345, and user profile and device fingerprint data were collected. The user profile data showed that the user's account age was 3 years, and the device fingerprint data showed that the device ID of this transaction was 67890, the IP address was 192.168.1.100, and the geographical location was [not specified].

[0038] The feature node module 12 receives numerical features and categorical features from the capture and monitoring module 11, and then normalizes the numerical features to obtain normalized numerical features. This eliminates the adverse effects of differences in the dimensions and numerical ranges of different features on the subsequent analysis model. The normalization method is used, and at the same time, the categorical features are one-hot encoded to obtain one-hot encoded categorical features. The one-hot encoding technique can avoid the possible order relationship between categories from misleading the model analysis. In addition, only the position element corresponding to the category in the feature is 1, and the rest of the elements are 0. The normalized numerical features and the one-hot encoded categorical features are integrated into a standardized, high-dimensional feature vector using the feature concatenation method, thereby obtaining a standardized feature vector. This feature vector covers all the key information in the original data and has a unified format and scale.

[0039] When the standardized feature vectors are known, abstract the users in the standardized feature vectors as user nodes , and correspond to the user feature vectors , the user feature vectors include user portrait feature vectors (including user account age, historical consumption data), device fingerprint feature vectors and user behavior feature vectors (including mouse cursor trajectory, user keystroke frequency), abstract the transactions as transaction nodes , and correspond to the transaction feature vectors (including transaction amount, transaction time and merchant ID), abstract the devices as device nodes , and correspond to the device fingerprint feature vectors (including device ID, IP address, geographic location of the transaction), and abstract the merchants as merchant nodes (including merchant type, credit rating);

[0040] The association anomaly unit 2 includes an association graph module 21 and a preliminary anomaly module 22;

[0041] The association graph module 21 receives the user nodes, transaction nodes, device nodes and merchant nodes in the feature node module 12 to integrate into a node set , connect the user nodes and the device nodes to form a use edge , wherein represents the "initiate" relationship, meaning that the user uses the device to operate, and connect the user nodes and the transaction nodes to form an initiation edge , wherein represents the "initiate" relationship, indicating that the user initiated this transaction, and use the transaction node to connect with the merchant node to form an occurrence edge , wherein represents the "occurrence" relationship, indicating that this transaction is conducted at the merchant, and integrate the use edge, the initiation edge and the occurrence edge into an edge set , construct an association graph through the node set and the edge set ;

[0042] The correlation graph collaboratively analyzes mouse cursor trajectories, historical consumption data, device fingerprint data, and user keystroke frequency. When the correlation graph collaboratively analyzes mouse cursor patterns (e.g., the number of mouse cursor stops during normal movement is less than a set threshold), user consumption habits (e.g., small-amount, high-frequency daily consumption), the geographical distribution of transactions (e.g., the distribution of locations where users frequently transact), and user keystroke patterns (e.g., the user keystroke frequency during normal clicks is less than a set threshold), it further collaborates with multi-source data on user consumption habits, geographical distribution of transactions, mouse cursor patterns, and user keystroke patterns to collaboratively analyze... If a user's spending habits show high spending or the geographical distribution of transactions is in a remote area, or if the mouse cursor pattern is chaotic (e.g., the number of mouse cursor hover points is greater than the set threshold for the number of mouse cursor hover points), or if the user's keystroke pattern is chaotic (e.g., the user's keystroke frequency during normal clicking is less than the set threshold for the user's keystroke frequency), then it is determined that there is an abnormal transaction in the correlation graph.

[0043] The preliminary anomaly module 22 receives the correlation graph from the correlation graph module 21, inputs the correlation graph into the graph neural network, and the graph neural network extracts time series data from the nodes. Extracting time series data from neighboring nodes ,in, Represents a node In time behavioral characteristics Indicates adjacent nodes In time Behavioral characteristics, for example, when a node For user nodes At that time, equal , Indicates the user node at time Behavioral characteristics (such as user account age, historical consumption data), when adjacent nodes When it is a transaction node, then equal , Indicates the transaction node in time Behavioral characteristics (such as transaction amount, transaction time, and merchant ID) based on node In time Behavioral characteristics and neighboring nodes In time Behavioral characteristics are used to calculate the distance metric between a node and its neighboring nodes. , the distance between time series is calculated by dynamic time warping (DTW) according to the distance metric of nodes and adjacent nodes , wherein, refers to a time alignment path, a distance threshold between time series is set again, and whether to trigger the autoencoder is judged by using the distance threshold between time series and the distance between time series, when the distance between time series is greater than the distance threshold between time series, the autoencoder is triggered, the time series data in the node is reconstructed using the autoencoder, and a data reconstruction error is calculated , wherein, is the time series reconstructed by the autoencoder, a fixed reconstruction error threshold is set in advance, whether the node in the time series data is abnormal is identified by the reconstruction error and the fixed reconstruction error threshold, when the reconstruction error is greater than the fixed reconstruction error threshold, it is identified that the node in the time series data is abnormal, and serves as a preliminary abnormal candidate set.

[0044] The fraud node unit 3 receives the preliminary abnormal candidate set in the preliminary abnormal module 22, selects nodes from the preliminary abnormal candidate set, constructs a node , and a hop neighbor (a node from which a node can be reached through at most edges constitutes a node , and the local graph structure of the hop neighbor set of the node forms a high-order subgraph pattern, the high-order subgraph pattern is reconstructed using a graph autoencoder, and a subgraph reconstruction error is calculated , a fixed subgraph reconstruction error threshold is set, the nodes with abnormal high-order subgraph patterns are screened out by the subgraph reconstruction error and the fixed subgraph reconstruction error threshold, the abnormal candidate set is reduced, when the subgraph reconstruction error is greater than the fixed subgraph reconstruction error threshold, the node corresponding to the subgraph is screened out as having an abnormal high-order subgraph pattern, the abnormal nodes in the reduced abnormal candidate set are spliced, the importance score of the feature vector of the spliced abnormal nodes is calculated, and the abnormal nodes in the reduced abnormal candidate set are detected as fraud nodes by using the importance score and the set importance score threshold.

[0045] The basic principles, main features and advantages of the present application are shown and described above. It should be understood by those skilled in the art that the present application is not limited by the above examples, the above examples and descriptions in the specification are only preferred examples of the present application, and are not intended to limit the present application, various changes and improvements can be made to the present application without departing from the spirit and scope of the present application, and these changes and improvements all fall within the scope of the claimed present application. The scope of protection of the present application is defined by the appended claims and their equivalents.

Claims

1. A transaction anomaly monitoring system based on multi-source data collaborative analysis, comprising a capture node unit (1), wherein the capture node unit (1) captures user transaction data on the transaction platform and classifies it into numerical features and categorical features, integrates them into a standardized feature vector, and abstracts the standardized feature vector into user nodes, transaction nodes, device nodes, and merchant nodes, characterized in that, Also includes: The association anomaly unit (2) is used to receive user nodes, transaction nodes, device nodes and merchant nodes from the capture node unit (1) to construct an association graph, determine the transaction anomalies in the association graph, identify the preliminary anomaly candidate set, and perform the following steps: User nodes, transaction nodes, device nodes, and merchant nodes are integrated into a node set, and then a use edge, an initiation edge, and an occurrence edge are formed and integrated into an edge set. A relational graph is constructed through the node set and the edge set. The correlation graph is used to analyze mouse cursor patterns, user spending habits, geographical distribution of transactions, and user keystroke patterns. Further analysis reveals that if user spending habits show high spending, or if the geographical distribution of transactions is in remote areas, or if mouse cursor patterns or user keystroke patterns are chaotic, then the correlation graph is determined to contain transaction anomalies. The association graph is input into the graph neural network and time series data is extracted from the nodes and their neighbors. Then, the data reconstruction error is calculated. The reconstruction error is used to identify nodes with anomalies in the time series data and to serve as a preliminary anomaly candidate set. Fraud node unit (3) is used to receive the preliminary set of anomaly candidates from the associated anomaly unit (2) to perform fraud node detection and to perform the following steps: Select nodes from the initial set of anomaly candidates Build nodes and By jumping to the local graph structure of neighbors, a higher-order subgraph pattern is formed. The subgraph reconstruction error is calculated, and nodes with abnormal higher-order subgraph patterns are screened out to narrow down the abnormal candidate set. in, Jumping neighbors refers to starting from a node Departure, passing through the most All nodes reachable by an edge constitute a node. of Jump to neighbor set; The abnormal nodes in the narrowed abnormal candidate set are concatenated, and the importance score of the feature vector of the concatenated abnormal node is calculated. The importance score is used to detect that the abnormal nodes in the narrowed abnormal candidate set are fraudulent nodes.

2. The transaction anomaly monitoring system based on multi-source data collaborative analysis according to claim 1, characterized in that: The capture node unit (1) includes a capture monitoring module (11) and a feature node module (12). The capture and monitoring module (11) captures the user's transaction amount and merchant ID through the transaction platform, and collects user profile and device fingerprint data. It extracts the user's account age and historical consumption data from the user profile data, and then captures the mouse cursor trajectory through the transaction platform. The steps for capturing the mouse cursor trajectory are as follows: The trading platform uses front-end tracking technology to monitor users' mouse movements on web pages or application interfaces, recording the coordinates of the user's mouse cursor, movement speed, and dwell time. The mouse cursor's movement speed and dwell time are used to monitor the coordinates of the user's mouse cursor, which are then used as mouse cursor dwell points. These mouse cursor dwell points are then connected to form the mouse cursor trajectory.

3. The transaction anomaly monitoring system based on multi-source data collaborative analysis according to claim 2, characterized in that: The capture and monitoring module (11) listens to keyboard key events through front-end listening technology, records the trigger time of the user's key press, calculates the key press interval time, and then calculates the user's keystroke frequency based on the key press interval time, taking the mouse cursor trajectory and the user's keystroke frequency as user behavior. Transaction amount, merchant ID, user profile, device fingerprint, and user behavior data are categorized into numerical features and categorical features.

4. The transaction anomaly monitoring system based on multi-source data collaborative analysis according to claim 3, characterized in that: The feature node module (12) receives numerical features and categorical features from the capture and monitoring module (11) to derive a standardized feature vector. The process of deriving the standardized feature vector includes the following steps: The numerical features are normalized using a normalization method, while the categorical features are encoded using a one-hot encoding technique. The feature concatenation method is used to integrate the normalized numerical features and the one-hot encoded categorical features into a standardized, high-dimensional feature vector, thus obtaining the standardized feature vector.

5. The transaction anomaly monitoring system based on multi-source data collaborative analysis according to claim 4, characterized in that: The feature node module (12) further abstracts nodes by standardizing feature vectors, including the following steps: The users in the standardized feature vector are abstracted into user nodes, which correspond to user feature vectors. User feature vectors include user profile feature vectors, device fingerprint feature vectors, and user behavior feature vectors. Transactions are abstracted into transaction nodes, which correspond to transaction feature vectors; The device is abstracted as a device node, which corresponds to a device fingerprint feature vector; Merchants are abstracted into merchant nodes.

6. The transaction anomaly monitoring system based on multi-source data collaborative analysis according to claim 5, characterized in that: The associated anomaly unit (2) includes an associated graph module (21) and a preliminary anomaly module (22); The association graph module (21) receives user nodes, transaction nodes, device nodes, and merchant nodes from the feature node module (12) to construct the association graph. The construction of the association graph includes the following steps: User nodes, transaction nodes, device nodes, and merchant nodes are integrated into a node set; Connect user nodes and device nodes to form a usage edge, then connect user nodes and transaction nodes to form an initiation edge, and finally connect transaction nodes and merchant nodes to form an occurrence edge. The edges used, the initiating edges, and the edges that occur are integrated into an edge set, and the association graph is constructed through the node set and the edge set.

7. The transaction anomaly monitoring system based on multi-source data collaborative analysis according to claim 6, characterized in that: The association graph module (21) also uses the association graph to determine if there are transaction anomalies, including the following steps: The correlation graph performs collaborative analysis of mouse cursor trajectory, historical consumption data, device fingerprint data, and user keystroke frequency to collaboratively analyze mouse cursor patterns, user consumption habits, geographical distribution of transactions, and user keystroke patterns. By conducting collaborative analysis of multi-source data such as user consumption habits, the geographical distribution of transactions, mouse cursor patterns, and user keystroke patterns, if the collaborative analysis reveals that user consumption habits show high spending, the geographical distribution of transactions is in remote areas, or the mouse cursor patterns or user keystroke patterns are chaotic, then it is determined that there are abnormal transactions in the correlation graph.

8. The transaction anomaly monitoring system based on multi-source data collaborative analysis according to claim 7, characterized in that: The preliminary anomaly module (22) receives the correlation graph from the correlation graph module (21) to trigger the autoencoder, including the following triggering steps: The association graph is input into the graph neural network, which extracts time series data from the nodes and their neighboring nodes, respectively. Calculate the distance metric between a node and its neighboring nodes based on the time-series data of the node and its neighboring nodes; Dynamic time warping is used to calculate the distance between time series based on the distance between a node and its neighboring nodes, and the distance between time series is used to determine whether an autoencoder is triggered.

9. The transaction anomaly monitoring system based on multi-source data collaborative analysis according to claim 8, characterized in that: The preliminary anomaly module (22) also identifies a preliminary set of anomaly candidates by triggering an autoencoder, including the following identification steps: An autoencoder is used to reconstruct the time series data in the nodes, and the data reconstruction error is calculated. Anomalies in the nodes of the time series data are identified by the reconstruction error. When the reconstruction error is greater than a fixed reconstruction error threshold, the nodes in the time series data are identified as anomalies and are used as a preliminary anomaly candidate set.

10. The transaction anomaly monitoring system based on multi-source data collaborative analysis according to claim 9, characterized in that: The fraud node unit (3) receives a preliminary set of anomaly candidates from the preliminary anomaly module (22) to detect fraud nodes, including the following detection steps: Select nodes from the initial set of anomaly candidates Build nodes and By jumping to the local graph structure of neighbors, a higher-order subgraph pattern can be formed; The graph autoencoder is used to reconstruct the higher-order subgraph patterns, calculate the subgraph reconstruction error, filter out nodes with abnormal higher-order subgraph patterns, and narrow down the abnormal candidate set. The abnormal nodes in the narrowed abnormal candidate set are concatenated, and the importance score of the feature vector of the concatenated abnormal node is calculated. The importance score is used to detect that the abnormal nodes in the narrowed abnormal candidate set are fraudulent nodes.

Images