Financial transaction anomaly detection method and device, storage medium and electronic equipment

Abstract

The invention discloses a financial transaction anomaly detection method and device, a storage medium and electronic equipment. The method comprises the steps of obtaining a transaction anomaly score of target transaction data; the transaction exception score is obtained by performing exception detection on the target transaction data by adopting a diffusion model deployed in the block chain network; the diffusion model associates the parameter hash of the model parameter with the zero-knowledge proof and then deploys the model parameter to the block chain network; obtaining a local judgment result determined by the block chain node in the block chain network based on the local anomaly threshold and the transaction anomaly score; determining an anomaly detection result of the target transaction data based on the voting weight corresponding to the block chain node, the local judgment result and the global anomaly threshold; wherein the voting weight is determined based on the node contribution rate of the block chain node; the node contribution rate is in negative correlation with the continuous active duration of the block chain node. By executing the method, the accuracy of anomaly detection can be improved, the false alarm rate is reduced, meanwhile, data leakage is avoided, and the data security is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the fields of artificial intelligence technology, blockchain technology and deep learning technology, and can be applied to the financial technology scene. The present application specifically relates to a financial transaction anomaly detection method and device, a storage medium and an electronic equipment. BACKGROUND

[0002] With the rapid development of financial technology, the scale of financial transactions has shown explosive growth. Abnormal financial transaction behaviors have also proliferated, causing huge losses, especially in cross-border payment and high-frequency trading scenarios. At the same time, financial regulatory agencies have increasingly strict requirements for transaction transparency and privacy protection. How to protect user privacy while achieving efficient financial transaction anomaly detection has become a core problem in the financial technology field that needs to be solved.

[0003] In related technologies, the joint modeling ability of multi-scale features is lacking when using machine learning models such as long short-term memory (LSTM) or isolation forest to process financial time series data, making it difficult to capture both high-frequency noise such as second-level transaction fluctuations and low-frequency trends such as cross-day capital flow. There are problems of low accuracy and high false positive rate in anomaly detection. Furthermore, there is a lack of protection for user privacy, and data security is difficult to guarantee. SUMMARY

[0004] The present application provides a financial transaction anomaly detection method, device, storage medium and electronic equipment, which can improve the accuracy of financial transaction anomaly detection, reduce the false positive rate, and avoid data leakage and improve data security.

[0005] According to a first aspect of the present application, a financial transaction anomaly detection method is provided, the method comprising:

[0006] obtaining a transaction anomaly score of target transaction data; wherein the transaction anomaly score is obtained by using a diffusion model deployed in a blockchain network to detect anomalies in the target transaction data; the diffusion model is deployed in the blockchain network by associating the parameter hash of the model parameter with the zero-knowledge proof;

[0007] obtaining a local decision result determined by a blockchain node in the blockchain network based on a local anomaly threshold and the transaction anomaly score;

[0008] determining an anomaly detection result of the target transaction data based on the voting weight corresponding to the blockchain node, the local decision result and a global anomaly threshold;

[0009] The voting weight is determined based on voting accuracy and node contribution of the blockchain node.

[0010] According to a second aspect of the present application, a financial transaction anomaly detection apparatus is provided, the apparatus comprising:

[0011] a transaction anomaly score obtaining module configured to obtain a transaction anomaly score of target transaction data, wherein the transaction anomaly score is obtained by performing anomaly detection on the target transaction data using a diffusion model deployed in a blockchain network, and the diffusion model is deployed in the blockchain network by associating a parameter hash of a model parameter with a zero-knowledge proof.

[0012] a local decision result determining module configured to obtain a local decision result determined by a blockchain node in the blockchain network based on a local anomaly threshold and the transaction anomaly score;

[0013] an anomaly detection result determining module configured to determine an anomaly detection result of the target transaction data based on a voting weight corresponding to the blockchain node, the local decision result and a global anomaly threshold.

[0014] The voting weight is determined based on node contribution of the blockchain node, and the node contribution is negatively correlated with a continuous active duration of the blockchain node.

[0015] According to a third aspect of the present application, an embodiment of the present application provides a computer readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the financial transaction anomaly detection method according to an embodiment of the present application.

[0016] According to a fourth aspect of the present application, an embodiment of the present application provides an electronic device comprising a memory, a processor and a computer program stored in the memory and executable by the processor, the processor implementing the financial transaction anomaly detection method according to an embodiment of the present application when executing the computer program.

[0017] According to a fifth aspect of the present application, an embodiment of the present application provides a computer program product comprising a computer program, the computer program being executed by a processor to implement the financial transaction anomaly detection method according to an embodiment of the present application.

[0018] The technical scheme of the application can detect target transaction data for abnormalities based on a diffusion model through a gradual noise adding and de-noising mechanism, can accurately model multi-scale features in financial time series data, and is beneficial to improving the accuracy of financial transaction anomaly detection and reducing the false positive rate. The application introduces blockchain technology in the financial transaction scene, determines the local decision result based on the local anomaly threshold and the transaction anomaly score of the blockchain node in the blockchain network, and can accurately adapt to the risk level difference of different business scenarios. The local decision result is combined with the global anomaly threshold to calibrate the decentralized decision of the blockchain node, which can balance the risk sensitivity and business flexibility. The voting weight of the blockchain node is introduced when determining the anomaly detection result, and the node contribution degree on which the voting weight is based is negatively correlated with the continuous active duration of the blockchain node, which effectively suppresses the attack path of malicious nodes accumulating the right to speak through long-term activity, ensures the decision reliability of the blockchain node, and is beneficial to improving the accuracy of financial transaction anomaly detection. The model parameters of the diffusion model are anchored to the blockchain through hash and zero-knowledge proof, ensuring that the model is tamper-proof and the reasoning process is verifiable. The blockchain node provides a local decision result, realizes the availability of data, avoids data leakage, and improves data security.

[0019] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the application, nor is it intended to limit the scope of the application. Other features of the application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0021] Figure 1 is a flowchart of the financial transaction anomaly detection method provided according to embodiment one;

[0022] Figure 2 is a flowchart of the financial transaction anomaly detection method provided according to embodiment two;

[0023] Figure 3 is a structural schematic diagram of the financial transaction anomaly detection device provided by the third embodiment of the application;

[0024] Figure 4 is a structural schematic diagram of an electronic device provided by the fourth embodiment of the application. DETAILED DESCRIPTION

[0025] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application, so that those skilled in the art can better understand the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first", "second", "target" and "candidate" and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0027] Embodiment one

[0028] Figure 1 The flowchart of the financial transaction anomaly detection method according to embodiment one is provided, the present embodiment can be applied to the case of detecting the anomaly of the financial transaction, the method is executed by the financial transaction anomaly detection model, and can be executed by the financial transaction anomaly detection device configured in the financial transaction anomaly detection model. The financial transaction anomaly detection device is realized in the form of hardware and / or software, and can be integrated in the electronic device running this system.

[0029] As shown in Figure 1 , the method comprises:

[0030] S110, obtaining a transaction anomaly score of target transaction data; wherein the transaction anomaly score is obtained by using a diffusion model deployed in a blockchain network to detect the anomaly of the target transaction data; the diffusion model is deployed in the blockchain network by associating the parameter hash of the model parameter with the zero-knowledge proof.

[0031] S120, obtaining a local decision result determined by a blockchain node in the blockchain network based on a local anomaly threshold and the transaction anomaly score.

[0032] S130, determining an anomaly detection result of the target transaction data based on the voting weight corresponding to the blockchain node, the local decision result and a global anomaly threshold.

[0033] The voting weight is determined based on voting accuracy and node contribution of the blockchain node.

[0034] The target transaction data is financial transaction data that needs to be detected for abnormalities. Optionally, a diffusion model deployed in the blockchain network is called to detect abnormalities in the target transaction data to obtain a transaction abnormality score of the target transaction data. The diffusion model detects whether the financial transaction data is abnormal through noise disturbance and reconstruction difference.

[0035] The transaction abnormality score is used to quantify the possibility of the target transaction data belonging to abnormal financial transactions. The target transaction data is held by the blockchain node and is not shared with the blockchain nodes in the blockchain network.

[0036] The blockchain nodes in the blockchain network correspond to the participants in the financial transaction anomaly detection. Optionally, the blockchain nodes correspond to the bank institutions, the regulatory authorities, and the model providing institutions, respectively.

[0037] The model providing institution is a third party other than the bank institutions and the regulatory authorities, and is used to train the diffusion model to provide computing services for the bank institutions and the regulatory authorities. The bank institutions and the regulatory authorities participate in the detection of abnormalities in the financial transactions.

[0038] The diffusion model is pre-trained off-chain by the model providing institution. After the model providing institution trains the diffusion model off-chain, a zero-knowledge proof of the model parameters is generated.

[0039] Optionally, based on π θ = ZK-SNARK.Prove(θ, r) s.t. Hash(θ) = h θ A zero-knowledge proof of the model parameters is generated. Correspondingly, ZK-SNARK.Verify(h θ , π θ ) = True is used for on-chain contract verification.

[0040] wherein π θ is the zero-knowledge proof evidence, and θ is the model parameter of the diffusion model. π θ is used to prove the validity of the model parameter. Wherein, r is a random salt value, which is used to prevent replay attacks in the proof process. h θThe parameter hash is obtained by hashing the model parameters θ. Optionally, the parameter hash can be generated using the SHA-256 algorithm. ZK-SNARK.Prove(·) is a core function in the zero-knowledge proof protocol, used to generate a verifiable zero-knowledge proof evidence. ZK-SNARK.Verify(·) is a verification function in the zero-knowledge proof protocol and the function ZK-SNARK.Prove(·) function constitutes a complete non-interactive proof system. The effectiveness of the diffusion model is verified using zero-knowledge proof, without disclosing the model parameters of the diffusion model, achieving parameter concealment of the diffusion model.

[0041] After the diffusion model is trained, the trained diffusion model is lightweight and deployed to the blockchain network to facilitate anomaly detection of financial transaction data.

[0042] The transaction anomaly score of the target transaction data is shared by the blockchain nodes participating in the anomaly detection of the financial transaction in the blockchain network.

[0043] The blockchain nodes participating in the anomaly detection of the financial transaction hold a local anomaly threshold in the blockchain network. The local anomaly threshold is used to determine the local decision result of the target transaction data. The local anomaly threshold is determined by the blockchain nodes based on their respective business scenarios, and the specific value of the local anomaly threshold is not limited here. For example, the local anomaly threshold is dynamically floating in the interval determined by τ global × [0.9, 1.1], where τ global is the global anomaly threshold. The local anomaly thresholds of different blockchain nodes are independent and unrelated. That is, for the same transaction anomaly score, the local decision result determined by the blockchain node corresponding to the bank may be normal. However, the local decision result determined by the blockchain node corresponding to the regulatory agency may be abnormal.

[0044] The blockchain node corresponds to a voting weight. Optionally, the voting weight of the blockchain node is determined by a proof of stake (PoS) improved consensus algorithm. The voting weight is related to the voting accuracy of the blockchain node and the node contribution. The node contribution is negatively correlated with the continuous active duration of the blockchain node. That is, the longer the continuous active time of the blockchain node, the more limited the growth of its contribution weight. Optionally, the temperature coefficient T is used to dynamically adjust the node contribution to avoid monopoly of long-term active nodes.

[0045] Optionally, the voting weight of the blockchain node is determined by where i and j are node identifiers of the blockchain node, and n is the number of blockchain nodes participating in the anomaly detection of the financial transaction in the blockchain network.

[0046] represents the voting weight of the blockchain node i in the k+1th round. represents the voting accuracy of the node i in the kth round. The voting accuracy is determined based on the proportion of the number of correct votes in the total number of votes in the first k rounds. is the node contribution of the blockchain node i in the kth round. T is the temperature coefficient. represents the exponential scaling of the node contribution by introducing the temperature coefficient T. The larger T is, the weaker the amplification effect of the node contribution, which avoids the formation of monopoly by the blockchain nodes that long-term occupy high weights.

[0047] wherein the global anomaly threshold is dynamically adjusted based on the market risk level. The global anomaly threshold is used to finally determine the anomaly detection result of the target transaction data.

[0048] Optionally, after the blockchain node gives the local decision result of the target transaction data, the local decision result is integrated and summarized by using the voting weight of the blockchain node, and then compared with the global anomaly threshold to determine the anomaly detection result of the target transaction data. Combining the global anomaly threshold with the voting weight of the blockchain node to determine the anomaly detection result of the target transaction data can eliminate local bias and prevent malicious node manipulation.

[0049] The technical scheme of the present application can accurately model the multi-scale features in financial time series data by gradually adding noise and denoising mechanism based on the diffusion model for anomaly detection of target transaction data, which is beneficial to improve the accuracy of financial transaction anomaly detection and reduce the false positive rate. The present application introduces blockchain technology in the financial transaction scene, and the local decision result determined by the blockchain nodes in the blockchain network based on the local anomaly threshold and the transaction anomaly score can accurately adapt to the risk level difference of different business scenarios. Combining the local decision result with the global anomaly threshold to calibrate the decentralized decision of the blockchain nodes can balance the risk sensitivity and business flexibility. The voting weight of the blockchain node is introduced when determining the anomaly detection result, and the node contribution and the continuous active duration of the blockchain node are designed to be negatively correlated, which effectively suppresses the attack path of malicious nodes accumulating the right to speak through long-term activity, ensures the reliability of the decision of the blockchain node, and is beneficial to improve the accuracy of financial transaction anomaly detection. The type parameters of the diffusion model are anchored to the blockchain through hash and zero-knowledge proof, ensuring that the model is tamper-proof and the reasoning process is verifiable.

[0050] In an optional embodiment, the abnormality detection result of the target transaction data is determined based on the voting weight corresponding to the blockchain node, the local determination result, and a global abnormality threshold. The global abnormality threshold is determined based on a market risk level. The weighted voting result of the target transaction data is determined based on the local determination result and the voting weight corresponding to the blockchain node. The global abnormality threshold is weighted by a preset sensitivity coefficient to obtain a threshold weighting result. The abnormality detection result of the target transaction data is determined according to the relative size relationship between the threshold weighting result and the weighted voting result.

[0051] The market risk level refers to a quantitative evaluation level of potential loss caused by price fluctuation of a financial product or the whole market in the financial field. The higher the market risk level, the smaller the global abnormality threshold, and the higher the detection sensitivity of transaction abnormality. The global abnormality threshold can reflect the dynamic change of the market risk level.

[0052] Optionally, the local determination result includes existence of abnormality and non-existence of abnormality. The local determination result is related to the local abnormality threshold of the blockchain node. In the case that the transaction abnormality score of the target transaction data is greater than the local abnormality threshold, the blockchain node determines that the local determination result is existence of abnormality. In the case that the transaction abnormality score of the target transaction data is less than or equal to the local abnormality threshold, the blockchain node determines that the local determination result is non-existence of abnormality. The local determination result is integrated and summarized by using the voting weight of the blockchain node to obtain the weighted voting result of the target transaction data. The weighted voting result is compared with the threshold weighting result, and the abnormality detection result of the target transaction data is determined based on the relative size relationship between the threshold weighting result and the weighted voting result.

[0053] The threshold weighting result is obtained by weighting the global abnormality threshold by using a preset sensitivity coefficient. The preset sensitivity coefficient is related to the fluctuation degree of the market risk level, and the specific value of the preset sensitivity coefficient is determined according to actual business requirements, which is not limited here. For example, the preset sensitivity coefficient is 1.2 or 1.5. Generally, the preset sensitivity coefficient is set to 1.2. In the case that the fluctuation range of the market risk level increases, the preset sensitivity coefficient is set to 1.5.

[0054] Optionally, in the case that the weighted voting result is greater than the threshold weighting result, it is determined that the abnormality detection result of the target transaction data is existence of abnormality. In the case that the weighted voting result is less than or equal to the threshold weighting result, it is determined that the abnormality detection result of the target transaction data is non-existence of abnormality.

[0055] Optionally, the abnormality detection result of the target transaction data is determined based on the voting weight corresponding to the blockchain node, the local determination result, and a global abnormality threshold. The abnormality detection result of the target transaction data is determined. The threshold weighting result is obtained by weighting the global abnormality threshold by using a preset sensitivity coefficient. iW is the local decision threshold of the blockchain node i i is the voting weight of the blockchain node i. x is the target transaction data, S(x) is the transaction anomaly score of the target transaction data. II(·) is an indicator function, which is 1 when S(x) > τ i , 0 when S(x)≤τ i . n is the number of blockchain nodes participating in the financial transaction anomaly detection in the blockchain network. τ global represents the global anomaly threshold. η is the sensitivity coefficient.

[0056] The technical solution provides a feasible anomaly detection result determination scheme. The local decision result is combined with the global anomaly threshold to jointly calibrate the decentralized decision of the blockchain node, which can balance the risk sensitivity and business flexibility. The voting weight of the blockchain node is introduced when determining the anomaly detection result, and the node contribution degree on which the voting weight is based is designed to be negatively correlated with the continuous active duration of the blockchain node, which effectively suppresses the attack path of malicious nodes accumulating the right to speak through long-term activity, ensures the decision reliability of the blockchain node, and is conducive to improving the accuracy of financial transaction anomaly detection.

[0057] In an optional embodiment, after determining the anomaly detection result of the target transaction data based on the voting weight corresponding to the blockchain node, the local decision result and the global anomaly threshold, the method further comprises: generating a spatio-temporal hash fingerprint of the target transaction data based on geographical location information, transaction time information and transaction data content of the target transaction data; associating the transaction anomaly score, the local decision result and the anomaly detection result of the target transaction data to the spatio-temporal hash fingerprint of the target transaction data to obtain transaction evidence data, and generating a data storage transaction request; and storing the transaction evidence data into the blockchain network based on the data storage transaction request.

[0058] Wherein, the spatio-temporal hash fingerprint is a digital fingerprint combining time dimension and space features. Optionally, the transaction data content of the target transaction data is first hashed to obtain a transaction content hash.

[0059] Then, the geographical location information, transaction time information and transaction content hash of the target transaction data are spliced, and the spliced result is hashed to obtain the hash calculation result as the spatio-temporal hash fingerprint of the target transaction data. Optionally, an unforgeable spatio-temporal hash fingerprint of the target transaction data is generated by using a spatio-temporal Merkle tree evidence structure.

[0060] Optionally, based on

[0061] H st(x) = SHA3(Timestamp / / Geohash / / TransactionHash)

[0062] determining a spatiotemporal hash fingerprint of the target transaction data, wherein the Timestamp is transaction time information, the Geohash is geographic location information, and the TransactionHash is transaction content hash of the target transaction data; and

[0063] The transaction evidence data needs to be stored in the blockchain network. Storing the transaction evidence data in the blockchain network can facilitate the supervision agency to trace abnormal financial transactions from the time dimension, the space dimension, or the transaction dimension. Optionally, the transaction evidence data is stored in the blockchain network in the form of a key-value pair, wherein the spatiotemporal hash fingerprint of the target transaction data is the key, and the transaction anomaly score, the local decision result, and the anomaly detection result of the target transaction data are the values.

[0064] The data storage transaction request is used to request to store the transaction evidence data in the blockchain network. Optionally, the smart contract is called based on the data storage transaction request to submit the transaction evidence data to the blockchain network, and after the transaction evidence data is verified, the transaction evidence data is stored in the blockchain network.

[0065] The above technical solution generates an unforgeable spatiotemporal hash fingerprint for the target transaction data, and associates the transaction anomaly score, the local decision result, and the anomaly detection result of the target transaction data to the spatiotemporal hash fingerprint to obtain the transaction evidence data, and then stores the transaction evidence data in the blockchain network, thereby providing technical support for the supervision agency to trace abnormal financial transactions from the time dimension, the space dimension, or the transaction dimension, and meeting the requirements of the supervision agency for transparent auditing.

[0066] In an optional embodiment, the noise scheduling coefficient of the diffusion model is adjusted based on the adjustment opinions provided by the blockchain nodes and the voting weights corresponding to the blockchain nodes during the training process of the diffusion model.

[0067] The diffusion model performs anomaly detection on the target transaction data through a gradual noise adding and denoising mechanism. In the diffusion model, the noise scheduling coefficient is a core parameter for controlling the forward diffusion and reverse denoising processes. The noise control coefficient is used to control the intensity and rhythm of noise addition or removal.

[0068] The adjustment opinions include a numerical adjustment direction, and the numerical adjustment direction includes numerical increase, numerical decrease, and numerical invariance. The voting weight of the blockchain node determines the effectiveness of the adjustment opinions. Optionally, the noise scheduling coefficient of the diffusion model is adjusted after the adjustment opinions are weighted based on the voting weights corresponding to the blockchain nodes.

[0069] The technical solution adjusts the noise scheduling coefficient of the diffusion model through blockchain node voting in the training process of the diffusion model. On the one hand, the blockchain node proposes adjustment opinions according to local data distribution, so that the noise scheduling can dynamically adapt to different data characteristics. On the other hand, through the multi-node voting weight mechanism, the manipulation of the noise scheduling by a single malicious node can be effectively resisted, and the stability of the training process is ensured.

[0070] In an optional embodiment, adjusting the noise scheduling coefficient of the diffusion model based on the adjustment opinions provided by the blockchain nodes and the voting weights corresponding to the blockchain nodes comprises: determining the numerical adjustment direction provided by the blockchain node for the noise scheduling coefficient based on the adjustment opinions provided by the blockchain node; weighting the numerical adjustment direction based on the voting weight corresponding to the blockchain node to obtain an adjustment weight of the reference noise intensity; and weighting the reference noise intensity using the adjustment weight to obtain the noise scheduling coefficient of the diffusion model.

[0071] The diffusion model generates latent variables x1, x2,..., xT by adding noise to the financial transaction data through T steps. T The noise scheduling formula used is:

[0072]

[0073] where β t is the noise scheduling coefficient, β t ∈(0, 1), and the noise scheduling coefficient determines the intensity of noise addition: the larger the value of β t , the stronger the single-step noise and the more severe the destruction of the financial transaction data; q(x t ||x t-1 ) is the noise transition distribution, which gives the probability rule for generating the current noisy data x t-1 given the previous step data x t ; N is a Gaussian distribution, which defines the randomness of the noise addition process as a normal distribution; represents the coefficient of the reserved signal intensity, is the scaling of the previous step data x t-1 , which reserves part of the original information; β t I is the variance, which controls the noise intensity added at the current step.

[0074] In the training process of the diffusion model, the noise scheduling coefficient of the diffusion model is dynamically adjusted through blockchain node voting. Optionally, the noise scheduling coefficient is adjusted based on .

[0075] wherein, is a noise scheduling coefficient for the t-th step in the k-th round of training, and the value range of the noise scheduling coefficient is (0, 1); is a reference noise intensity, wherein the reference noise intensity is pre-set, and the value of the reference noise intensity is not limited here, and is determined according to actual business requirements, and for example, the reference noise intensity is 0.02; γ is a multiplication factor, which determines the influence intensity of the adjustment opinion of the blockchain node on the reference noise intensity. γ is determined through cross-validation, and the experience value is usually between 0.1 and 0.3. i (k) is a voting weight of the blockchain node i in the k-th round; is an adjustment opinion of the blockchain node i on the t-th step noise scheduling coefficient, and the value of the adjustment opinion is -1, 0 and 1, wherein -1 represents a value decrease, 0 represents a value unchanged, and 1 represents a value increase; τ β is a noise adjustment normalization reference value, τ β is 0 by default. is an adjustment weight of the reference noise intensity.

[0076] The above technical solution provides a feasible noise scheduling coefficient adjustment scheme, which is beneficial to improving the rationality of noise scheduling coefficient adjustment and the training stability of the diffusion model. It provides technical support for subsequent use of the diffusion model to detect financial transaction data.

[0077] Embodiment Two

[0078] Figure 2 is a flowchart of the financial transaction anomaly detection method provided in Embodiment Two. This embodiment is further optimized on the basis of the above-mentioned embodiments.

[0079] As shown in Figure 2 , the method comprises:

[0080] S210, generating a model calling transaction request based on the target transaction data and the diffusion control parameters, and calling the diffusion model deployed in the blockchain network based on the model calling transaction request.

[0081] After the training of the diffusion model is completed, the diffusion model will be deployed to the blockchain network after being lightened. Optionally, the diffusion model is deployed to the blockchain network by associating the parameter hash of the model parameters with the zero-knowledge proof. The model calling transaction request is used to trigger the diffusion model deployed on the blockchain network to perform anomaly detection on the target transaction data.

[0082] The model call transaction request is generated based on the target transaction data and diffusion control parameters. The diffusion control parameters are used to control how the diffusion model reconstructs the target transaction data. Optionally, the diffusion control parameters include at least a time step. The time step controls the sequence of noise removal steps and determines the current noise intensity.

[0083] Optionally, a transaction request based on the model is used to call a smart contract in the blockchain network, and the lightweight diffusion model is triggered by the smart contract to perform anomaly detection on the target transaction data.

[0084] S220 , performing denoising and reconstruction on the target transaction data using the diffusion model based on the diffusion control parameters and the noise scheduling coefficient determined during the training process to obtain reconstructed transaction data.

[0085] The noise scheduling coefficient is determined during the training of the diffusion model. The noise scheduling coefficient of the diffusion model is adjusted during the training of the diffusion model based on the adjustment opinions provided by the blockchain nodes and the corresponding voting weights of the blockchain nodes.

[0086] Optional, based on Reconstruct the target transaction data. t is the single-step noise retention coefficient, is the cumulative noise retention rate, z is a standard Gaussian distributed random variable, ∈ θ is the denoising neural network in the diffusion model, and the input is the target transaction data x t and time step t, the output is the reconstructed transaction data; σ t is the random noise scale, σ t The default value is 0.1.

[0087] S230: Determine a transaction anomaly score for the target transaction data based on the target transaction data, the reconstructed transaction data, and the noise transfer distribution defined for the diffusion model during the training process.

[0088] The transaction anomaly score is obtained by detecting anomalies in the target transaction data using a diffusion model deployed on the blockchain network. Optionally, the target transaction data and reconstructed transaction data are compared to determine the degree of data anomaly. The noise transfer distribution defined for the diffusion model during training is compared to the noise baseline distribution to determine the degree of distribution deviation.

[0089] Then, the transaction anomaly score of the target transaction data is determined based on the degree of data anomaly and the degree of distribution deviation.

[0090] S240, obtaining a local determination result of the target transaction data determined by the blockchain node in the blockchain network based on the local anomaly threshold and the transaction anomaly score.

[0091] S250, determining an anomaly detection result of the target transaction data based on the voting weight corresponding to the blockchain node, the local determination result, and a global anomaly threshold.

[0092] The voting weight is determined based on a voting accuracy rate of the blockchain node and a node contribution degree. The node contribution degree is negatively correlated with a continuous active duration of the blockchain node.

[0093] The technical scheme of the present application provides a feasible anomaly score determination scheme. The trained diffusion model is deployed to the blockchain network after being lightened. The lightened diffusion model is triggered by a model calling transaction request to denoise and reconstruct the target transaction data based on the noise scheduling coefficient determined in the training process. Then, the transaction anomaly score of the target transaction data is determined based on the reconstructed transaction data, the target transaction data, and the noise transfer distribution defined for the diffusion model in the training process. The local determination result determined by the blockchain node based on the local anomaly threshold and the transaction anomaly score provides data support for determining the anomaly detection result of the target transaction data. The present application combines the efficient generation capability of the lightened diffusion model with the verifiability of the blockchain network, and provides an auditable anomaly detection framework for the financial risk control field.

[0094] In an optional embodiment, determining the transaction anomaly score of the target transaction data based on the target transaction data, the reconstructed transaction data, and the noise transfer distribution defined for the diffusion model in the training process comprises: determining a numerical difference degree between the target transaction data and the reconstructed transaction data, and determining a first score component based on the numerical difference degree; determining a distribution difference degree between the noise transfer distribution defined for the diffusion model in the training process and a noise reference distribution, and determining a second score component based on the distribution difference degree; and determining the transaction anomaly score of the target transaction data based on the first score component and the second score component.

[0095] Optionally, the numerical difference degree is determined by calculating the Euclidean distance between the target transaction data and the reconstructed transaction data. The distribution difference degree is determined by calculating the information divergence between the noise transfer distribution defined for the diffusion model in the training process and the noise reference distribution. Optionally, the information divergence is calculated by using the KL divergence. The noise reference distribution can reflect the normal distribution mode of the financial transaction. The noise reference distribution is used as a reference for anomaly detection of the target transaction data in the present application. Optionally, the standard Gaussian prior is used as the noise reference distribution.

[0096] The transaction anomaly score includes two sub-items, namely a first score sub-item and a second score sub-item. The first score sub-item is determined based on the numerical difference degree and is used to quantify the data anomaly degree. The second score sub-item is determined based on the distribution difference degree and is used to quantify the distribution deviation degree, and is particularly effective in identifying the gradual deviation of low-frequency fund flow.

[0097] Optionally, the first score sub-item and the second score sub-item are weighted by using a weight coefficient, and the weighted result is taken as the transaction anomaly score of the target transaction data.

[0098] Optionally, the transaction anomaly score of the target transaction data is determined based on

[0099] S(x) is the transaction anomaly score of the target transaction data; x0 is the target transaction data; is the reconstructed transaction data; q(x T ||x0) is the noise transition distribution defined for the diffusion model in the training process; p(x T ) is the noise reference distribution; λ1, λ2 are learnable weight parameters, and the initial values are 0.7 and 0.3, respectively; D KL is the KL divergence, which is used to measure the distribution deviation degree.

[0100] The above technical solution uses the ability of the diffusion model to accurately model the multi-scale features in the financial time series data to denoise and reconstruct the target transaction data to obtain the reconstructed transaction data. The numerical difference degree between the target transaction data and the reconstructed transaction data is used to determine the transaction anomaly score, which can capture millisecond-level abnormal fluctuations in high-frequency trading scenarios. The distribution difference degree between the noise transition distribution defined for the diffusion model in the training process and the noise reference distribution is used to determine the transaction anomaly score, which can effectively identify the gradual deviation of low-frequency fund flow. This is conducive to improving the accuracy of financial transaction anomaly detection.

[0101] Embodiment Three

[0102] Figure 3 FIG. 1 is a structural schematic diagram of a financial transaction anomaly detection device provided by an embodiment of the present application. The embodiment can be applicable to the case of detecting financial transaction anomalies. The device can be configured in a financial transaction anomaly detection model, realized by software and / or hardware, and integrated in an electronic device such as a smart terminal.

[0103] As shown in FIG. 1, the financial transaction anomaly detection device 300 can include: Figure 3

[0104] ​​The transaction anomaly score acquisition module 310 is configured to acquire a transaction anomaly score of target transaction data, wherein the transaction anomaly score is obtained by performing anomaly detection on the target transaction data by using a diffusion model deployed in a blockchain network; and the diffusion model is deployed in the blockchain network by associating a parameter hash of a model parameter with a zero-knowledge proof.

[0105] The local decision result determination module 320 is configured to acquire a local decision result determined by a blockchain node in the blockchain network based on a local anomaly threshold and the transaction anomaly score.

[0106] The anomaly detection result determination module 330 is configured to determine an anomaly detection result of the target transaction data based on a voting weight corresponding to the blockchain node, the local decision result, and a global anomaly threshold.

[0107] The voting weight is determined based on a voting accuracy rate of the blockchain node and a node contribution degree; and the node contribution degree is negatively correlated with a continuous active duration of the blockchain node.

[0108] The technical scheme of the present application can accurately model multi-scale features in financial time series data by performing anomaly detection on target transaction data through a gradual noise adding and de-noising mechanism based on a diffusion model, which is conducive to improving the accuracy of financial transaction anomaly detection and reducing the false positive rate. The present application introduces blockchain technology in the financial transaction scenario, and the local decision result determined by the blockchain node in the blockchain network based on the local anomaly threshold and the transaction anomaly score can accurately adapt to the risk level differences of different business scenarios. Combining the local decision result with the global anomaly threshold to calibrate the decentralized decision-making of the blockchain node can ensure the balance between risk sensitivity and business flexibility. The voting weight of the blockchain node is introduced when determining the anomaly detection result, and the node contribution degree on which the voting weight is determined is negatively correlated with the continuous active duration of the blockchain node, which effectively suppresses the attack path of malicious nodes accumulating the right to speak through long-term activity, ensures the reliability of the decision-making of the blockchain node, and is conducive to improving the accuracy of financial transaction anomaly detection. The model parameters of the diffusion model are anchored to the blockchain through hashing and zero-knowledge proof, ensuring that the model is tamper-proof and the reasoning process is verifiable.

[0109] Optionally, the transaction anomaly score acquisition module 310 includes: a diffusion model calling submodule, which is used to generate a model calling transaction request based on the target transaction data and the diffusion control parameters, and call the diffusion model deployed in the blockchain network based on the model calling transaction request; a data reconstruction submodule, which is used to denoise and reconstruct the target transaction data through the diffusion model based on the diffusion control parameters and the noise scheduling coefficient determined during the training process to obtain reconstructed transaction data; and a score determination submodule, which is used to determine the transaction anomaly score for the target transaction data based on the target transaction data, the reconstructed transaction data and the noise transfer distribution defined for the diffusion model during the training process.

[0110] Optionally, the score determination submodule includes: a first sub-item determination unit, used to determine the degree of numerical difference between the target transaction data and the reconstructed transaction data, and determine a first score sub-item based on the degree of numerical difference; a second sub-item determination unit, used to determine the degree of distribution difference between the noise transfer distribution and the noise baseline distribution defined by the training process for the diffusion model, and determine a second score sub-item based on the degree of distribution difference; an abnormality score determination unit, used to determine a transaction anomaly score for the target transaction data based on the first score sub-item and the second score sub-item.

[0111] Optionally, the anomaly detection result determination module 330 includes: a global threshold determination submodule, used to determine the global anomaly threshold based on the market risk level; a node quantity determination submodule, used to determine the weighted voting result of the target transaction data based on the local judgment result and the voting weight corresponding to the blockchain node; a weighted result determination submodule, used to weight the global anomaly threshold using a preset sensitivity coefficient to obtain a threshold weighted result; and an anomaly detection result determination submodule, used to determine the anomaly detection result of the target transaction data based on the relative size relationship between the threshold weighted result and the weighted voting result.

[0112] Optionally, the noise scheduling coefficient of the diffusion model is adjusted during the training process of the diffusion model based on the adjustment opinions provided by the blockchain node and the voting weight corresponding to the blockchain node.

[0113] Optionally, adjusting the noise scheduling coefficient of the diffusion model based on the adjustment opinion provided by the blockchain node and the voting weight corresponding to the blockchain node comprises: determining a numerical adjustment direction provided by the blockchain node for the noise scheduling coefficient based on the adjustment opinion provided by the blockchain node; performing weighted processing on the numerical adjustment direction based on the voting weight corresponding to the blockchain node to obtain an adjustment weight of the baseline noise intensity; and performing weighted processing on the baseline noise intensity by using the adjustment weight to obtain the noise scheduling coefficient of the diffusion model.

[0114] Optionally, the apparatus further comprises a space-time hash generation module configured to, after determining the anomaly detection result of the target transaction data based on the voting weight corresponding to the blockchain node, the local determination result and the global anomaly threshold, generate a space-time hash fingerprint of the target transaction data based on geographical location information, transaction time information and transaction data content of the target transaction data.

[0115] A record data determination module is configured to associate the transaction anomaly score, the local determination result and the anomaly detection result of the target transaction data to the space-time hash fingerprint of the target transaction data to obtain transaction record data, and generate a data storage transaction request.

[0116] A record data storage module is configured to store the transaction record data into the blockchain network based on the data storage transaction request.

[0117] The financial transaction anomaly detection apparatus provided by the embodiments of the application can execute the financial transaction anomaly detection method provided by any of the embodiments of the application, and has the corresponding performance modules and beneficial effects of executing the financial transaction anomaly detection method.

[0118] In the technical solution of the application, the target transaction data and other user data involved are information and data authorized by users or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with relevant laws, regulations and standards of countries and regions, necessary security measures are taken, public order and good customs are not violated, and corresponding operation portals are provided for users to select authorization or refusal.

[0119] Embodiment Four

[0120] According to the embodiments of the application, the application further provides an electronic device, a readable storage medium and a computer program product.

[0121] Figure 4A structural diagram of an electronic device 410 that can be used to implement the embodiments is shown. The electronic device 410 includes at least one processor 411, and a memory, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, and the like, which is communicatively connected to the at least one processor 411, wherein the memory stores a computer program that can be executed by the at least one processor. The processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or loaded from the storage unit 418 into the random access memory (RAM) 413. In the RAM 413, various programs and data required for the operation of the electronic device 410 can also be stored. The processor 411, the ROM 412, and the RAM 413 are connected to each other through a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0122] Various components in the electronic device 410 are connected to the I / O interface 415, including an input unit 416, such as a keyboard, a mouse, and the like, an output unit 417, such as various types of displays, a speaker, and the like, a storage unit 418, such as a magnetic disk, an optical disk, and the like, and a communication unit 419, such as a network card, a modem, a wireless communication transceiver, and the like. The communication unit 419 allows the electronic device 410 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0123] The processor 411 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, and the like. The processor 411 performs various methods and processes described above, such as the financial transaction anomaly detection method.

[0124] In some embodiments, the financial transaction anomaly detection method can be implemented as a computer program that is tangibly embodied in a computer readable storage medium, such as the storage unit 418. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 410 via the ROM 412 and / or the communication unit 419. When the computer program is loaded into the RAM 413 and executed by the processor 411, one or more steps of the financial transaction anomaly detection method described above can be performed. Alternatively, in other embodiments, the processor 411 can be configured to perform the financial transaction anomaly detection method by any other appropriate means, such as by means of firmware.

[0125] The various embodiments of the systems and techniques described above can be implemented in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a complex programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0126] Computer programs used to implement the processes of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable financial transaction anomaly detection device to produce a machine, such that the computer program, when executed, enables the system to implement the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as a standalone software package, and partially on a remote machine or entirely on a remote machine or server.

[0127] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store computer programs for use by or in connection with an instruction execution system, apparatus, or device. The computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0128] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0129] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), blockchain networks, and the Internet.

[0130] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0131] The embodiments of the present application further disclose a computer program product, which comprises a computer program, and the computer program, when executed by a processor, implements the financial transaction anomaly detection method provided in any of the embodiments of the present application. The program product and the financial transaction anomaly detection method disclosed in the embodiments of the present application belong to the same inventive concept, and thus will not be described here.

[0132] It should be understood that the various forms of flow shown above can be used to reorder, add, or remove steps. For example, the steps recited in the present application can be performed in parallel, in series, or in a different order, as long as the desired results of the present application are achieved, which is not limited herein.

[0133] The foregoing detailed description has not described the limitations of the scope of protection of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for detecting anomalies in financial transactions, characterized in that: The method comprises: Obtaining a transaction anomaly score for target transaction data; wherein the transaction anomaly score is obtained by performing anomaly detection on the target transaction data using a diffusion model deployed on a blockchain network; the diffusion model is deployed on the blockchain network by associating a parameter hash of a model parameter with a zero-knowledge proof; Obtaining a local determination result determined by a blockchain node in the blockchain network based on a local anomaly threshold and the transaction anomaly score; Determining an anomaly detection result of the target transaction data based on the voting weight corresponding to the blockchain node, the local determination result, and the global anomaly threshold; The voting weight is determined based on the voting accuracy and node contribution of the blockchain node; the node contribution is negatively correlated with the continuous activity duration of the blockchain node.

2. The method according to claim 1, characterized in that The step of obtaining the transaction anomaly score of the target transaction data includes: Generate a model call transaction request based on the target transaction data and the diffusion control parameter, and call the diffusion model deployed in the blockchain network based on the model call transaction request; Denoising and reconstructing the target transaction data using the diffusion model based on the diffusion control parameters and the noise scheduling coefficient determined during the training process to obtain reconstructed transaction data; A transaction anomaly score is determined for the target transaction data based on the target transaction data, the reconstructed transaction data, and a noise transfer distribution defined for the diffusion model during a training process.

3. The method according to claim 2, characterized in that Determining a transaction anomaly score for the target transaction data based on the target transaction data, the reconstructed transaction data, and the noise transfer distribution defined for the diffusion model during a training process includes: determining a numerical difference between the target transaction data and the reconstructed transaction data, and determining a first score sub-item based on the numerical difference; determining a degree of distribution difference between a noise transfer distribution and a noise reference distribution defined by the training process for the diffusion model, and determining a second score sub-item based on the degree of distribution difference; A transaction anomaly score is determined for the target transaction data based on the first scorer item and the second scorer item.

4. The method according to claim 1, wherein The determining of the anomaly detection result of the target transaction data based on the voting weight corresponding to the blockchain node, the local determination result, and the global anomaly threshold includes: Determining the global abnormality threshold based on the market risk level; Determining a weighted voting result for the target transaction data based on the local determination result and the voting weight corresponding to the blockchain node; The global abnormality threshold is weighted using a preset sensitivity coefficient to obtain a threshold weighted result; The anomaly detection result of the target transaction data is determined according to the relative size relationship between the threshold weighted result and the weighted voting result.

5. The method according to claim 1, wherein The noise scheduling coefficient of the diffusion model is adjusted during the training process of the diffusion model based on the adjustment opinions provided by the blockchain nodes and the voting weights corresponding to the blockchain nodes.

6. The method according to claim 5, characterized in that Adjusting the noise scheduling coefficient of the diffusion model based on the adjustment opinion provided by the blockchain node and the voting weight corresponding to the blockchain node includes: Determining, based on the adjustment opinion provided by the blockchain node, a numerical adjustment direction provided by the blockchain node for the noise scheduling coefficient; Performing weighted processing on the numerical adjustment direction based on the voting weight corresponding to the blockchain node to obtain an adjustment weight for the baseline noise intensity; The reference noise intensity is weighted by using the adjustment weight to obtain a noise scheduling coefficient of the diffusion model.

7. The method according to claim 1, characterized in that After determining an anomaly detection result of the target transaction data based on the voting weight corresponding to the blockchain node, the local determination result, and the global anomaly threshold, the method further includes: Generate a spatiotemporal hash fingerprint of the target transaction data based on the geographic location information, transaction time information, and transaction data content of the target transaction data; Associating the transaction anomaly score of the target transaction data, the local determination result, and the anomaly detection result with the spatiotemporal hash fingerprint of the target transaction data to obtain transaction evidence data, and generating a data storage transaction request; Based on the data storage transaction request, the transaction evidence data is stored in the blockchain network.

8. A financial transaction anomaly detection device, characterized in that: The device comprises: A transaction anomaly score acquisition module, configured to acquire a transaction anomaly score for target transaction data; wherein the transaction anomaly score is obtained by performing anomaly detection on the target transaction data using a diffusion model deployed on a blockchain network; the diffusion model is deployed on the blockchain network by associating a parameter hash of a model parameter with a zero-knowledge proof; A local determination result determination module is used to obtain a local determination result determined by a blockchain node in the blockchain network based on a local anomaly threshold and the transaction anomaly score; an anomaly detection result determination module, configured to determine an anomaly detection result of the target transaction data based on the voting weight corresponding to the blockchain node, the local determination result, and a global anomaly threshold; The voting weight is determined based on the voting accuracy and node contribution of the blockchain node; the node contribution is negatively correlated with the continuous activity duration of the blockchain node.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for detecting anomalies in financial transactions according to any one of claims 1 to 7 is implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein: When the processor executes the computer program, the method for detecting anomalies in financial transactions according to any one of claims 1 to 7 is implemented.

Images