Abnormal transaction behavior detection method and device and electronic equipment

Abstract

The invention discloses an abnormal transaction behavior detection method and device and electronic equipment. The specific scheme is as follows: obtaining transaction behavior data corresponding to at least one target account within a preset duration; according to the at least one target account and the transaction behavior data corresponding to each target account, determining a transaction topological graph sequence corresponding to a preset duration; performing feature extraction processing on the transaction topological graph sequence, and determining at least one node feature sequence corresponding to the transaction topological graph sequence; processing the at least one node feature sequence based on a transaction behavior evaluation model to obtain a transaction behavior evaluation attribute corresponding to each target account; and determining an abnormal account and an abnormal transaction behavior corresponding to the abnormal account based on the transaction behavior evaluation attribute corresponding to each target account and the evaluation attribute threshold. According to the invention, the accuracy and efficiency of abnormal transaction behavior detection are improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, apparatus, and electronic device for detecting abnormal transaction behavior. Background Technology

[0002] Abnormal transaction behavior can be the act of making illegally obtained assets appear legitimate through a series of complex business transactions, thereby concealing their illegal origin and nature.

[0003] Currently, detection of abnormal trading behavior mainly relies on rules or shallow machine learning models. However, these methods require manual setting of rules and thresholds, making it difficult to adapt to constantly changing trading behaviors and patterns. They exhibit significant blind spots in feature representation and lag in trading pattern recognition, resulting in low accuracy and efficiency in identifying abnormal trading behavior. Summary of the Invention

[0004] This invention provides a method, apparatus, and electronic device for detecting abnormal transaction behavior, which improves the accuracy and efficiency of detecting abnormal transaction behavior.

[0005] According to one aspect of the present invention, a method for detecting abnormal transaction behavior is provided, the method comprising:

[0006] Acquire transaction behavior data corresponding to at least one target account within a preset time period, wherein the transaction behavior data includes at least one business transaction behavior corresponding to each target account and associated data corresponding to the business transaction behavior;

[0007] Based on at least one target account, at least one business transaction behavior corresponding to each target account, and associated data, a transaction topology sequence corresponding to a preset duration is determined; wherein, the transaction topology sequence includes a first transaction topology corresponding to at least one time slice within the preset duration;

[0008] Feature extraction processing is performed on the transaction topology graph sequence to determine at least one node feature sequence corresponding to the transaction topology graph sequence, wherein the number of node feature sequences is consistent with the number of target accounts;

[0009] Based on the transaction behavior evaluation model, at least one node feature sequence is processed to obtain the transaction behavior evaluation attribute corresponding to each target account;

[0010] Based on the transaction behavior evaluation attributes and evaluation attribute thresholds corresponding to each target account, abnormal accounts and abnormal transaction behaviors corresponding to abnormal accounts are identified.

[0011] According to another aspect of the present invention, an abnormal transaction behavior detection device is provided, the device comprising:

[0012] The data acquisition module is used to acquire transaction behavior data corresponding to at least one target account within a preset time period. The transaction behavior data includes at least one business transaction behavior corresponding to each target account and associated data corresponding to the business transaction behavior.

[0013] The topology sequence determination module is used to determine a transaction topology sequence corresponding to a preset duration based on at least one target account, at least one business transaction behavior corresponding to each target account, and associated data; wherein, the transaction topology sequence includes a first transaction topology corresponding to at least one time slice within the preset duration;

[0014] The node feature sequence determination module is used to perform feature extraction processing on the transaction topology graph sequence and determine at least one node feature sequence corresponding to the transaction topology graph sequence, wherein the number of node feature sequences is consistent with the number of target accounts;

[0015] The evaluation attribute determination module is used to process at least one node feature sequence based on the transaction behavior evaluation model to obtain the transaction behavior evaluation attributes corresponding to each target account.

[0016] The abnormal transaction behavior identification module is used to identify abnormal accounts and the abnormal transaction behaviors corresponding to abnormal accounts based on the transaction behavior evaluation attributes and evaluation attribute thresholds for each target account.

[0017] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0018] At least one processor; and

[0019] A memory that is communicatively connected to at least one processor; wherein,

[0020] The memory stores a computer program that can be executed by at least one processor, such that the at least one processor is able to execute the abnormal transaction behavior detection method of any embodiment of the present invention.

[0021] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the abnormal transaction behavior detection method of any embodiment of the present invention.

[0022] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, characterized in that the computer program, when executed by a processor, implements an abnormal transaction behavior detection method as described in any embodiment of the present invention.

[0023] The technical solution of this invention involves acquiring transaction behavior data corresponding to at least one target account within a preset time period, and determining a transaction topology sequence corresponding to the preset time period based on the at least one target account and at least one business transaction behavior and related data from the transaction behavior data. Feature extraction processing is performed on the transaction topology sequence to obtain at least one node feature sequence corresponding to the transaction topology sequence. This achieves feature extraction of the transaction topology sequence corresponding to the time sequence of the preset time period, fully preserving the temporal causal characteristics of the transaction flow, facilitating accurate identification of abnormal transaction behavior. The at least one node feature sequence is processed using a transaction behavior evaluation model to obtain transaction behavior evaluation attributes corresponding to each target account. Abnormal accounts and their corresponding abnormal transaction behaviors are determined using the transaction behavior evaluation attributes and threshold values ​​corresponding to each target account. This invention solves the problem of low accuracy and efficiency in identifying abnormal transaction behavior caused by manually setting rules or thresholds in existing technologies. By constructing a transaction topology sequence and processing the at least one node feature sequence corresponding to the transaction topology sequence based on a transaction behavior evaluation model, the accuracy of identifying abnormal transaction behavior in complex transaction scenarios can be improved. Transaction behavior evaluation models can enhance the sensitivity to local transaction mutations and improve the efficiency of identifying abnormal transaction behaviors in complex transaction scenarios.

[0024] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart of an abnormal transaction behavior detection method provided in an embodiment of the present invention;

[0027] Figure 2 This is a flowchart of an abnormal transaction behavior detection method provided in an embodiment of the present invention;

[0028] Figure 3 This is a schematic diagram of the structure of an abnormal transaction behavior detection device provided in an embodiment of the present invention;

[0029] Figure 4 This is a schematic diagram of the structure of an electronic device that implements the abnormal transaction behavior detection method of this invention. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] Example 1

[0033] Figure 1 This is a flowchart of an abnormal transaction behavior detection method provided in Embodiment 1 of the present invention. This embodiment is applicable to the detection of abnormal transaction behavior. The method can be executed by an abnormal transaction behavior detection device, which can be implemented in hardware and / or software. This device can be configured in electronic devices such as mobile phones, computers, or servers. Figure 1 As shown, the method includes:

[0034] S110. Obtain transaction behavior data corresponding to at least one target account within a preset time period, wherein the transaction behavior data includes at least one business transaction behavior corresponding to each target account and associated data corresponding to the business transaction behavior.

[0035] The preset duration can be a pre-set timeframe corresponding to the period of time for collecting transaction behavior data of the target users. For example, the preset duration could be 30 days, meaning that the transaction behavior data of the target users within the 30 days prior to the current moment would be collected. The target account can be the account that conducts the business transaction. The transaction behavior data can be the business transaction behavior and related data corresponding to the current target account's transactions with other target accounts. Related data can include the transaction timestamp, transaction processing cost, and transaction frequency corresponding to the business transaction behavior. The transaction processing cost can be understood as the value that needs to be transferred when the target account transacts with other target accounts.

[0036] Specifically, for at least one target account, acquire at least one business transaction behavior between each target account and other target accounts within a preset time period, as well as the associated data corresponding to the business transaction behavior.

[0037] S120. Based on at least one target account, at least one business transaction behavior corresponding to each target account, and associated data, determine a transaction topology sequence corresponding to a preset duration.

[0038] The transaction topology graph sequence includes a first transaction topology graph corresponding to at least one time slice within a preset time period. The at least one time slice can be a duration obtained by sliding division of the preset time period according to a preset time window. The first transaction topology graph can be a topology graph representing the transaction information of at least one target account within the time slice. The nodes of the first transaction topology graph are target accounts, and the edges of the first transaction topology graph are the transaction behaviors corresponding to the target accounts.

[0039] Specifically, based on at least one business transaction between at least one target account and other target accounts within a preset time period, and the associated data corresponding to the business transaction, a dynamic transaction topology graph with edge weights is constructed. A graph snapshot process is then performed on the dynamic transaction topology graph corresponding to the preset time period using a preset time window to obtain a first transaction topology graph corresponding to at least one time slice within the preset time period. Based on at least one first transaction topology graph, a sequence of transaction topology graphs corresponding to the preset time period is constructed.

[0040] In this embodiment of the invention, the method for determining the transaction topology sequence may be as follows: An initial dynamic transaction topology is determined based on the transaction timestamps in the associated data, at least one target account, and at least one business transaction behavior; wherein the edges of the initial dynamic transaction topology correspond to the business transaction behaviors of the target accounts, and the nodes of the initial dynamic transaction topology correspond to the target accounts; the edge weights corresponding to each edge in the initial dynamic transaction topology are determined based on the transaction behavior attribute data in the associated data; wherein the transaction behavior attribute data includes at least the transaction processing cost, transaction frequency, transaction region, and transaction account attributes; the initial dynamic transaction topology with corresponding edge weights is used as the target dynamic transaction topology, and the target dynamic transaction topology is divided according to a preset time window to obtain a first transaction topology under at least one time slice within a preset duration; based on at least one first transaction topology, a transaction topology sequence is determined.

[0041] The initial dynamic transaction topology is constructed using target accounts as nodes and business transaction behaviors between target accounts as edges, and it changes with the transaction timestamp. Transaction behavior attribute data can be attribute data associated with business transaction behaviors. Transaction behavior attribute data includes at least transaction processing cost, transaction frequency, transaction region, and transaction account attributes. Transaction processing cost can be understood as the value that needs to be transferred when a target account transacts with other target accounts. Transaction frequency can be the frequency with which the same type of business transaction behavior occurs. Transaction region can be the geographical location of the target accounts involved in the business transaction behavior. Transaction account attributes can be the type of target account involved in the business transaction behavior.

[0042] It should be noted that transaction behavior attribute data can be divided into static attribute data and dynamic attribute data based on whether it is related to the transaction timestamp. This can be understood as follows: the transaction's region and account attributes are generally unrelated to the transaction timestamp; that is, changes in the transaction timestamp do not typically affect the region and account attributes. Therefore, the transaction's region and account attributes can be considered static attribute data corresponding to the target account. Transaction processing costs and transaction frequency are generally related to the transaction timestamp; that is, changes in the transaction timestamp usually affect the transaction processing costs and transaction frequency. Therefore, transaction processing costs and transaction frequency can be considered dynamic attribute data corresponding to the target account.

[0043] Edge weights can be determined based on the transaction attribute data of the business transaction behavior, representing the weight value of the edge corresponding to that business transaction behavior. The target dynamic transaction topology graph can be the topology graph after assigning corresponding weight values ​​to each edge of the initial dynamic transaction topology graph. The preset time window can be a pre-set duration. The time length corresponding to the preset sliding window does not exceed the preset duration.

[0044] Specifically, using at least one target account as a node and at least one business transaction corresponding to each target account as an edge, an initial dynamic transaction topology is determined based on the transaction timestamp corresponding to each business transaction. Based on the transaction behavior attribute data in the associated data corresponding to each business transaction, the edge weight corresponding to each business transaction is determined, and the edge weight is added to the edge corresponding to the corresponding business transaction, resulting in an initial dynamic transaction topology with the corresponding edge weight, i.e., the target dynamic transaction topology. The target dynamic transaction topology corresponding to a preset duration is dynamically partitioned into snapshots based on a preset time window, resulting in a first transaction topology corresponding to each time slice of the preset duration. Based on at least one first transaction topology, a sequence of transaction topology diagrams corresponding to the preset duration is determined.

[0045] S130. Perform feature extraction processing on the transaction topology graph sequence to determine at least one node feature sequence corresponding to the transaction topology graph sequence.

[0046] The node feature sequence can be a set of time-series feature vectors corresponding to nodes in the transaction topology graph sequence. The number of node feature sequences is consistent with the number of target accounts.

[0047] Specifically, feature extraction processing is performed on the transaction topology graph sequence to determine the node feature sequence corresponding to each node in the transaction topology graph sequence, that is, to obtain the node feature sequence corresponding to each target account.

[0048] In this embodiment of the invention, the method for extracting features from the transaction topology graph sequence may be as follows: encoding at least one transaction timestamp corresponding to the transaction topology graph sequence based on a graph convolutional neural network model to determine the encoding features corresponding to at least one transaction timestamp; updating the transaction topology graph sequence based on the encoding features to obtain an updated transaction topology graph sequence; and performing time-series aggregation processing on the updated transaction topology graph sequence based on a long short-term memory network model to determine the node feature sequence of each target account.

[0049] The graph convolutional neural network model can include at least one time-aware graph convolutional layer. The encoded features can be features obtained by positionally encoding transaction timestamps. By positionally encoding at least one transaction timestamp, discrete timestamps can be converted into continuous vectors. Long Short-Term Memory (LSTM) network models can be used to capture temporal dependencies in the updated transaction topology graph sequence.

[0050] Specifically, at least one time-aware graph convolutional layer in the graph convolutional neural network model is used to encode at least one transaction timestamp corresponding to the transaction topology graph sequence, and the encoding features corresponding to at least one transaction timestamp are determined to enhance the aggregation ability of nodes in the transaction topology graph sequence to their temporal neighbors.

[0051] Optionally, the transaction timestamp t can be encoded as shown in the following formula.

[0052]

[0053] Where d represents the preset embedding dimension, i represents the preset dimension index to achieve continuous representation of transaction timestamps, and t represents the transaction timestamp. PE(t,2i) and PE(t,2i+1) represent the encoding features of transaction timestamp t.

[0054] The transaction topology graph sequence is updated by encoding features to obtain an updated transaction topology graph sequence. A Long Short-Term Memory (LSTM) network model is then used to update the features of at least one node corresponding to each time slice in the updated transaction topology graph sequence, determining the temporal feature vector of each target account. Based on the temporal feature vector of each target account in each time slice, the node feature sequence corresponding to each target account within a preset time period is determined.

[0055] Optionally, the feature update process for the node v corresponding to the time slice [t-Δt,t] in the updated transaction topology sequence can be performed using a long short-term memory network model, as shown below.

[0056]

[0057] LSTM stands for Long Short-Term Memory network model. This indicates a splicing operation. Let N(v) represent the attributes of edge (u,v) at time t (including the encoded features of transaction timestamps), and let N(v) represent the set of neighbors of node v. This represents the temporal feature vector of node v.

[0058] S140. Based on the transaction behavior evaluation model, process at least one node feature sequence to obtain the transaction behavior evaluation attribute corresponding to each target account.

[0059] The trading behavior evaluation model can be a pre-trained network model based on an attention mechanism. Trading behavior evaluation attributes can be used to characterize whether the trading behavior of the target account is abnormal. Optionally, trading behavior evaluation attributes can be represented by trading behavior evaluation values. For example, a trading behavior evaluation attribute could be an anomaly score.

[0060] Specifically, the transaction behavior assessment model is used to process the feature sequence of at least one node to determine the transaction behavior assessment attribute corresponding to each target account, so as to determine whether the target account is an abnormal account through the transaction behavior assessment attribute.

[0061] S150. Based on the transaction behavior evaluation attributes and evaluation attribute thresholds corresponding to each target account, determine the abnormal accounts and the abnormal transaction behaviors corresponding to the abnormal accounts.

[0062] The evaluation attribute threshold can be a standard value for the evaluation attribute of trading behavior. An abnormal account can be a target account whose trading behavior evaluation attribute exceeds the evaluation attribute threshold. Abnormal trading behavior can be determined based on abnormal accounts and the sequence of trading topology graphs, specifically the abnormal trading behavior corresponding to the abnormal account.

[0063] Specifically, for at least one target account, if the target account's transaction behavior evaluation attribute exceeds the evaluation attribute threshold, the target account is identified as an abnormal account. Based on the abnormal account and the transaction topology sequence, the abnormal transaction behavior corresponding to the abnormal account is determined, and early warning processing is carried out based on the abnormal account and abnormal transaction behavior.

[0064] In this embodiment of the invention, before processing the transaction behavior evaluation attributes based on the evaluation attribute threshold, the evaluation attribute threshold can be determined first. Specifically, this can be done by: determining the mean and standard deviation of the evaluation attributes based on the transaction behavior evaluation attributes of at least one target account; and then processing the mean, standard deviation, and preset reliability parameters using an adaptive threshold algorithm to determine the evaluation attribute threshold.

[0065] The evaluation attribute mean can be the mean data determined based on the trading behavior evaluation attributes of at least one target account and the number of target accounts. The evaluation attribute standard deviation can be the standard deviation data determined based on the evaluation attribute mean and the trading behavior evaluation attributes of at least one target account. An adaptive threshold algorithm is used to dynamically adjust the evaluation attribute threshold. The preset reliability parameter can be a confidence level value set according to actual needs. For example, the preset reliability parameter can be 95%.

[0066] Specifically, before processing the evaluation attributes of trading behavior using evaluation attribute thresholds, the evaluation attribute thresholds can be determined first. Using the trading behavior evaluation attributes of at least one target account, the mean and standard deviation of the evaluation attribute corresponding to at least one trading behavior evaluation attribute are determined. An adaptive threshold algorithm is then used to analyze and process the evaluation attribute mean, standard deviation, and pre-set reliability parameters to obtain the evaluation attribute threshold.

[0067] Optionally, the evaluation attribute threshold can be obtained by processing the mean, standard deviation, and preset reliability parameters of the evaluation attribute using a dynamic threshold determination function of an adaptive threshold algorithm. The dynamic threshold determination function is shown below.

[0068]

[0069] Where μ represents the mean of the evaluation attribute, σ represents the standard deviation of the evaluation attribute, ξ represents the shape parameter of the generalized Pareto distribution, γ represents the pre-set reliability parameter, q represents the empirical quantile, and τ represents the threshold of the evaluation attribute.

[0070] In this embodiment of the invention, the method of determining abnormal transaction behavior by transaction behavior evaluation attributes and evaluation attribute thresholds may be as follows: if the transaction behavior evaluation attribute of the target account is higher than the evaluation attribute threshold, the target account is determined to be an abnormal account; based on the transaction topology graph sequence, the weight of the edge to be compared for at least one business transaction behavior corresponding to the abnormal account is determined; when the weight of the edge to be compared is higher than the preset edge weight threshold, the business transaction behavior corresponding to the weight of the edge to be compared is determined to be an abnormal transaction behavior.

[0071] The edge weights to be compared can be the edge weights corresponding to the abnormal accounts in the transaction topology graph sequence. The preset edge weight threshold can be a pre-set standard value for the edge weights.

[0072] Specifically, for at least one target account, if the target account's transaction behavior evaluation attribute is higher than the evaluation attribute threshold, the target account is determined to be an abnormal account. Based on the node corresponding to the abnormal account in the transaction topology graph sequence, the weight of at least one edge corresponding to that node is determined to be a comparison edge. If the weight of the comparison edge is higher than a preset edge weight threshold, the business transaction behavior corresponding to the comparison edge weight is determined to be an abnormal transaction behavior. Conversely, if the weight of the comparison edge is not higher than the preset edge weight threshold, the business transaction behavior corresponding to the comparison edge weight is determined not to be an abnormal transaction behavior.

[0073] Optionally, after identifying abnormal accounts and abnormal transaction behaviors, a suspicious report can be generated based on the abnormal accounts and abnormal transaction behaviors, and an early warning can be issued based on the suspicious report, so that relevant staff can handle the abnormal accounts and abnormal transaction behaviors based on the suspicious report.

[0074] The technical solution of this embodiment obtains transaction behavior data corresponding to at least one target account within a preset time period, and determines a transaction topology sequence corresponding to the preset time period based on at least one target account and at least one business transaction behavior and related data in the transaction behavior data. Feature extraction processing is performed on the transaction topology sequence to obtain at least one node feature sequence corresponding to the transaction topology sequence, realizing feature extraction of the transaction topology sequence corresponding to the time sequence of the preset time period, fully preserving the temporal causal characteristics of transaction flow, facilitating accurate identification of abnormal transaction behavior. The at least one node feature sequence is processed through a transaction behavior evaluation model to obtain transaction behavior evaluation attributes corresponding to each target account. Abnormal accounts and the abnormal transaction behaviors corresponding to abnormal accounts are determined through the transaction behavior evaluation attributes and evaluation attribute thresholds corresponding to each target account. This invention solves the problem of low accuracy and efficiency in identifying abnormal transaction behavior caused by manually setting rules or thresholds in the prior art. By constructing a transaction topology sequence and processing the at least one node feature sequence corresponding to the transaction topology sequence based on a transaction behavior evaluation model, the accuracy of identifying abnormal transaction behavior in complex transaction scenarios can be improved. Transaction behavior evaluation models can enhance the sensitivity to local transaction mutations and improve the efficiency of identifying abnormal transaction behaviors in complex transaction scenarios.

[0075] Example 2

[0076] Figure 2 This is a flowchart of an abnormal transaction behavior detection method provided in Embodiment 2 of the present invention. This embodiment refines the step of "processing at least one node feature sequence based on a transaction behavior evaluation model to obtain transaction behavior evaluation attributes corresponding to each target account" based on the above embodiments. For specific implementation details, please refer to the technical solution of this embodiment. Technical terms that are the same as or corresponding to those in the above embodiments will not be repeated here. Figure 2 As shown, the method includes:

[0077] S210. Obtain transaction behavior data corresponding to at least one target account within a preset time period, wherein the transaction behavior data includes at least one business transaction behavior corresponding to each target account and associated data corresponding to the business transaction behavior.

[0078] S220. Based on at least one target account, at least one business transaction behavior corresponding to each target account, and associated data, determine a transaction topology sequence corresponding to a preset duration.

[0079] The transaction topology sequence includes a first transaction topology corresponding to at least one time slice within a preset duration.

[0080] S230. Perform feature extraction processing on the transaction topology graph sequence to determine at least one node feature sequence corresponding to the transaction topology graph sequence.

[0081] The number of node feature sequences corresponds to the number of target accounts.

[0082] S240. Based on the attention mechanism encoding module in the transaction behavior evaluation model, at least one node feature sequence is processed to determine the node feature sequence matrix corresponding to each target account.

[0083] The attention mechanism encoding module is used to enable at least one node's feature sequence to learn global transaction correlations through a self-attention mechanism. The node feature sequence matrix can be a feature matrix obtained by processing the node feature sequences based on the attention mechanism encoding module.

[0084] Specifically, the attention mechanism encoding module in the transaction behavior evaluation model processes at least one node feature sequence to enable it to learn global transaction correlations, resulting in a node feature sequence matrix corresponding to each target account. The number of node feature sequence matrices is consistent with the number of target accounts.

[0085] S250. Perform similarity evaluation processing on at least one node feature sequence matrix to determine the first evaluation attribute between each target account and other target accounts.

[0086] The similarity assessment process can be used to determine the similarity between the static attribute vectors corresponding to the static attribute data of each target account and other target accounts. The first assessment attribute can be the similarity between the static attribute vectors.

[0087] Specifically, based on at least one node feature sequence matrix, a static attribute vector corresponding to the static attribute data of each target account is determined. For example, the static attribute vector may be a feature vector corresponding to the region to which the transaction belongs and / or a feature vector corresponding to the attributes of the transaction account. For at least one target account, based on the static attribute vector of the current target account and the static attribute vectors of other target accounts, a first evaluation attribute is determined between the static attribute vector of the current target account and the static attribute vectors of other target accounts.

[0088] It should be noted that other target accounts are at least one target account other than the current target account.

[0089] In this embodiment of the invention, the method for determining the first evaluation attribute may be: based on the node feature sequence matrix corresponding to each target account, determine the static attribute vector corresponding to each target account; for at least one target account, perform similarity evaluation processing on the static attribute vector of each target account and the static attribute vector of other target accounts based on the similarity evaluation function, determine the similarity evaluation attribute between each target account and other target accounts, and determine the similarity evaluation attribute as the first evaluation attribute.

[0090] Static attribute vectors can be used to represent the feature vectors corresponding to static attribute data in the associated data of a target account. Similarity evaluation attributes are used to characterize the degree of similarity between static attribute vectors. Similarity evaluation functions can be used to calculate the similarity between static attribute vectors.

[0091] Optionally, the similarity evaluation function can be expressed as:

[0092]

[0093] Among them, Prior ij S represents the similarity assessment attribute between the target account corresponding to node i and the target account corresponding to node j, k represents other target accounts, N represents the total number of other target accounts, and S represents the similarity assessment attribute between node i and node j. i S represents the static attribute vector of the target account corresponding to node i. k S represents the static attribute vector corresponding to other target accounts. j Let T represent the static attribute vector of the target account corresponding to node j, and T denote the transpose.

[0094] Specifically, based on the node feature sequence matrix of each target account, the static attribute vector corresponding to the static attribute data in the associated data of each target account is determined. For at least one target account, the static attribute vector of each target account is evaluated for similarity with the static attribute vectors of other target accounts using the aforementioned similarity evaluation function. The similarity evaluation attribute is then determined as the first evaluation attribute, and the target account is used to determine whether it is an abnormal account.

[0095] S260. Perform anomaly deviation evaluation processing on at least one node feature sequence matrix to determine the second evaluation attribute between each target account and other target accounts.

[0096] The second evaluation attribute can be used to characterize the degree of abnormal deviation between the node feature sequence matrices of different target accounts.

[0097] Specifically, for at least one target account, anomaly deviation assessment processing is performed on the node feature sequence matrix corresponding to the current target account and the node feature sequence matrix corresponding to other target accounts to determine a second assessment attribute, so as to determine whether the target account is an abnormal account based on at least one second assessment attribute corresponding to each target account.

[0098] In this embodiment of the invention, the method for determining the second evaluation attribute may be: multiplying the node feature sequence matrix corresponding to each target account with the first weight parameter to determine the first matrix to be processed corresponding to each target account; and multiplying the node feature sequence matrix corresponding to each target account with the second weight parameter to determine the second matrix to be processed corresponding to each target account; for at least one target account, processing the first matrix to be processed of each target account and the second matrix to be processed of other target accounts based on the abnormal deviation evaluation function to determine the second evaluation attribute between each target account and other target accounts.

[0099] The first weight parameter can be a pre-set, learnable parameter. The first matrix to be processed can be the feature matrix obtained by multiplying the node feature sequence matrix by the first weight parameter. The second weight parameter can be a pre-set, learnable parameter. The second matrix to be processed can be the feature matrix obtained by multiplying the node feature sequence matrix by the second weight parameter. The anomaly deviation evaluation function can be used to calculate the second evaluation attribute between the node feature sequence matrices of different target accounts.

[0100] Optionally, the abnormal deviation evaluation function can be expressed as:

[0101]

[0102] Among them, Posterior ij H represents the second evaluation attribute between the target account corresponding to node i and the target account corresponding to node j, and W represents the node feature sequence matrix. Q Let W represent the first weight parameter, Q represent the first matrix to be processed, and W represent the first weight parameter. K This represents the second weight parameter, and K represents the second matrix to be processed. K represents the transpose of the first matrix to be processed for the target account corresponding to node i. j Let K represent the second unprocessed matrix for the target account corresponding to node j. Let k represent other target accounts, and N represent the total number of other target accounts. k This represents the second matrix to be processed for other target accounts.

[0103] Specifically, the node feature sequence matrix corresponding to each target account is multiplied by the first weight parameter to determine the first matrix to be processed for each target account. Then, the node feature sequence matrix corresponding to each target account is multiplied by the second weight parameter to determine the second matrix to be processed for each target account. For at least one target account, an anomaly deviation evaluation function is used to evaluate the first matrix to be processed for the current target account and the second matrices to be processed for other target accounts to obtain a second evaluation attribute. Based on this, at least one second evaluation attribute can be obtained for each target account.

[0104] S270. Based on the first evaluation attribute, the second evaluation attribute, and the target evaluation attribute determination function corresponding to each target account, determine the transaction behavior evaluation attribute corresponding to each target account.

[0105] The target evaluation attribute determination function can be a KL (Kullback-Leibler, KL) divergence function used to measure the difference between the first and second evaluation attributes. Optionally, the target evaluation attribute determination function can be expressed as:

[0106]

[0107] Among them, Score i This represents the transaction behavior evaluation attribute corresponding to node i, and N represents the total number of other target accounts. Prior ij Posterior represents the similarity assessment attribute (first assessment attribute) between the target account corresponding to node i and the target account corresponding to node j. ij This represents the second evaluation attribute between the target account corresponding to node i and the target account corresponding to node j. It should be noted that Score... i The larger the value, the more the business transaction behavior of the target account corresponding to node i deviates from the pattern expected by its static attributes.

[0108] Specifically, the target evaluation attribute determination function is used to process at least one first evaluation attribute and at least one second evaluation attribute corresponding to each target account to obtain the transaction behavior evaluation attribute corresponding to each target account, so as to determine whether the target account is an abnormal account through the transaction behavior evaluation attribute.

[0109] S280. Based on the transaction behavior evaluation attributes and evaluation attribute thresholds corresponding to each target account, determine the abnormal accounts and the abnormal transaction behaviors corresponding to the abnormal accounts.

[0110] The technical solution of this embodiment obtains transaction behavior data corresponding to at least one target account within a preset time period, and determines a transaction topology sequence corresponding to the preset time period based on at least one target account and at least one business transaction behavior and related data in the transaction behavior data. Feature extraction processing is performed on the transaction topology sequence to obtain at least one node feature sequence corresponding to the transaction topology sequence, realizing feature extraction of the transaction topology sequence corresponding to the time sequence of the preset time period, fully preserving the temporal causal characteristics of transaction flow, facilitating accurate identification of abnormal transaction behavior. The at least one node feature sequence is processed using the attention mechanism model of the transaction behavior evaluation model to obtain a node feature sequence matrix corresponding to each target account, which can enhance the sensitivity to local transaction mutations and improve the identification efficiency of abnormal transaction behavior in complex transaction scenarios. Similarity evaluation processing is performed on the at least one node feature sequence matrix to determine a first evaluation attribute between each target account and other target accounts, and anomaly deviation evaluation processing is performed on the at least one node feature sequence matrix to determine a second evaluation attribute between each target account and other target accounts, so as to determine the transaction behavior evaluation attribute through the first evaluation attribute and the second evaluation attribute. Abnormal accounts and abnormal transaction behaviors corresponding to abnormal accounts are determined through the transaction behavior evaluation attributes corresponding to each target account and the evaluation attribute threshold. This invention addresses the problem of low accuracy and efficiency in identifying abnormal transaction behavior caused by manually setting rules or thresholds in existing technologies. By constructing a transaction topology graph sequence and processing the feature sequence of at least one node corresponding to the transaction topology graph sequence based on a transaction behavior evaluation model, abnormal transaction behavior can be effectively identified, achieving accurate identification of the entire chain of abnormal transaction behavior. This comprehensively enhances the analytical capability of the transaction behavior evaluation model for complex abnormal transaction behavior and improves the accuracy of identifying abnormal transaction behavior in complex transaction scenarios.

[0111] Example 3

[0112] Figure 3 This is a schematic diagram of the structure of an abnormal transaction behavior detection device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a data acquisition module 310, a topology graph sequence determination module 320, a node feature sequence determination module 330, an evaluation attribute determination module 340, and an abnormal transaction behavior determination module 350.

[0113] The data acquisition module 310 is used to acquire transaction behavior data corresponding to at least one target account within a preset time period, wherein the transaction behavior data includes at least one business transaction behavior corresponding to each target account and associated data corresponding to the business transaction behavior; the topology graph sequence determination module 320 is used to determine a transaction topology graph sequence corresponding to the preset time period based on at least one target account, at least one business transaction behavior corresponding to each target account, and associated data; wherein the transaction topology graph sequence includes a first transaction topology graph corresponding to at least one time slice within the preset time period; the node feature sequence determination module 330 is used to perform feature extraction processing on the transaction topology graph sequence to determine at least one node feature sequence corresponding to the transaction topology graph sequence, wherein the number of node feature sequences is consistent with the number of target accounts; the evaluation attribute determination module 340 is used to process at least one node feature sequence based on a transaction behavior evaluation model to obtain a transaction behavior evaluation attribute corresponding to each target account; the abnormal transaction behavior determination module 350 is used to determine abnormal accounts and abnormal transaction behaviors corresponding to abnormal accounts based on the transaction behavior evaluation attributes corresponding to each target account and the evaluation attribute threshold.

[0114] The technical solution of this embodiment obtains transaction behavior data corresponding to at least one target account within a preset time period, and determines a transaction topology sequence corresponding to the preset time period based on at least one target account and at least one business transaction behavior and related data in the transaction behavior data. Feature extraction processing is performed on the transaction topology sequence to obtain at least one node feature sequence corresponding to the transaction topology sequence, realizing feature extraction of the transaction topology sequence corresponding to the time sequence of the preset time period, fully preserving the temporal causal characteristics of transaction flow, facilitating accurate identification of abnormal transaction behavior. The at least one node feature sequence is processed through a transaction behavior evaluation model to obtain transaction behavior evaluation attributes corresponding to each target account. Abnormal accounts and the abnormal transaction behaviors corresponding to abnormal accounts are determined through the transaction behavior evaluation attributes and evaluation attribute thresholds corresponding to each target account. This invention solves the problem of low accuracy and efficiency in identifying abnormal transaction behavior caused by manually setting rules or thresholds in the prior art. By constructing a transaction topology sequence and processing the at least one node feature sequence corresponding to the transaction topology sequence based on a transaction behavior evaluation model, the accuracy of identifying abnormal transaction behavior in complex transaction scenarios can be improved. Transaction behavior evaluation models can enhance the sensitivity to local transaction mutations and improve the efficiency of identifying abnormal transaction behaviors in complex transaction scenarios.

[0115] Based on the above embodiments, optionally, a topology sequence determination module is used to determine an initial dynamic transaction topology based on transaction timestamps, at least one target account, and at least one business transaction behavior in the associated data; wherein, the edges of the initial dynamic transaction topology correspond to the business transaction behavior of the target account, and the nodes of the initial dynamic transaction topology correspond to the target account; the edge weights corresponding to each edge in the initial dynamic transaction topology are determined based on transaction behavior attribute data in the associated data; wherein, the transaction behavior attribute data includes at least transaction processing cost, transaction frequency, transaction region, and transaction account attribute; the initial dynamic transaction topology with corresponding edge weights is used as the target dynamic transaction topology, and the target dynamic transaction topology is divided according to a preset time window to obtain a first transaction topology under at least one time slice within a preset duration; and a transaction topology sequence is determined based on at least one first transaction topology.

[0116] Optionally, a node feature sequence determination module is used to encode at least one transaction timestamp corresponding to the transaction topology graph sequence based on a graph convolutional neural network model to determine the encoded features corresponding to at least one transaction timestamp; update the transaction topology graph sequence based on the encoded features to obtain an updated transaction topology graph sequence; and perform time-series aggregation processing on the updated transaction topology graph sequence based on a long short-term memory network model to determine the node feature sequence of each target account.

[0117] Optionally, the evaluation attribute determination module includes: a node feature sequence matrix determination unit, used to process at least one node feature sequence based on the attention mechanism encoding module in the transaction behavior evaluation model to determine the node feature sequence matrix corresponding to each target account; a first evaluation attribute determination unit, used to perform similarity evaluation processing on at least one node feature sequence matrix to determine the first evaluation attribute between each target account and other target accounts; a second evaluation attribute determination unit, used to perform abnormal deviation evaluation processing on at least one node feature sequence matrix to determine the second evaluation attribute between each target account and other target accounts; and a transaction behavior evaluation attribute determination unit, used to determine the transaction behavior evaluation attribute corresponding to each target account based on the first evaluation attribute, the second evaluation attribute, and the target evaluation attribute determination function corresponding to each target account.

[0118] Optionally, the first evaluation attribute determination unit is used to determine the static attribute vector corresponding to each target account based on the node feature sequence matrix corresponding to each target account; for at least one target account, the static attribute vector of each target account and the static attribute vector of other target accounts are subjected to similarity evaluation processing based on the similarity evaluation function to determine the similarity evaluation attribute between each target account and other target accounts, and the similarity evaluation attribute is determined as the first evaluation attribute.

[0119] Optionally, the second evaluation attribute determination unit is used to multiply the node feature sequence matrix corresponding to each target account with the first weight parameter to determine the first matrix to be processed for each target account, and to multiply the node feature sequence matrix corresponding to each target account with the second weight parameter to determine the second matrix to be processed for each target account; for at least one target account, the first matrix to be processed for each target account and the second matrix to be processed for other target accounts are processed based on the abnormal deviation evaluation function to determine the second evaluation attribute between each target account and other target accounts.

[0120] Optionally, the device further includes: an evaluation attribute threshold determination module, used to evaluate attributes based on the transaction behavior of at least one target account, determine the mean and standard deviation of the evaluation attributes; and process the mean, standard deviation, and preset reliability parameters of the evaluation attributes based on an adaptive threshold algorithm to determine the evaluation attribute threshold.

[0121] Optionally, the abnormal transaction behavior determination module is used to determine that the target account is an abnormal account if the transaction behavior evaluation attribute of the target account is higher than the evaluation attribute threshold; determine the comparison edge weight of at least one business transaction behavior corresponding to the abnormal account based on the transaction topology graph sequence; and determine that the business transaction behavior corresponding to the comparison edge weight belongs to abnormal transaction behavior when the comparison edge weight is higher than the preset edge weight threshold.

[0122] The abnormal transaction behavior detection device provided in the embodiments of the present invention can execute the abnormal transaction behavior detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0123] Example 4

[0124] Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0125] like Figure 4As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0126] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0127] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as abnormal transaction behavior detection methods.

[0128] In some embodiments, the abnormal transaction behavior detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the abnormal transaction behavior detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the abnormal transaction behavior detection method by any other suitable means (e.g., by means of firmware).

[0129] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0130] Computer programs used to implement the abnormal transaction behavior detection method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0131] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication unit 19, or installed from storage unit 18, or installed from ROM 12. When the computer program is executed by processor 11, it performs the functions defined in the methods of the embodiments of the present invention.

[0132] Example 5

[0133] Embodiment 5 of the present invention also provides a computer-readable storage medium storing computer instructions for causing a processor to execute an abnormal transaction behavior detection method, the method comprising:

[0134] The process involves: acquiring transaction behavior data for at least one target account within a preset time period, including at least one business transaction behavior corresponding to each target account and associated data related to those business transactions; determining a transaction topology sequence corresponding to the preset time period based on the at least one target account, the at least one business transaction behavior corresponding to each target account, and the associated data; the transaction topology sequence including a first transaction topology sequence corresponding to at least one time slice within the preset time period; performing feature extraction processing on the transaction topology sequence to determine at least one node feature sequence corresponding to the transaction topology sequence, wherein the number of node feature sequences is consistent with the number of target accounts; processing the at least one node feature sequence based on a transaction behavior evaluation model to obtain transaction behavior evaluation attributes corresponding to each target account; and determining abnormal accounts and abnormal transaction behaviors corresponding to abnormal accounts based on the transaction behavior evaluation attributes and evaluation attribute thresholds corresponding to each target account.

[0135] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0136] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0137] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0138] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0139] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0140] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for detecting abnormal transaction behavior, characterized in that, include: Acquire transaction behavior data corresponding to at least one target account within a preset time period, wherein the transaction behavior data includes at least one business transaction behavior corresponding to each target account and associated data corresponding to the business transaction behavior; Based on the at least one target account, at least one business transaction behavior corresponding to each target account, and the associated data, a transaction topology sequence corresponding to the preset duration is determined; wherein, the transaction topology sequence includes a first transaction topology corresponding to at least one time slice within the preset duration; The transaction topology graph sequence is subjected to feature extraction processing to determine at least one node feature sequence corresponding to the transaction topology graph sequence, wherein the number of node feature sequences is consistent with the number of target accounts; The feature sequence of at least one node is processed based on the transaction behavior evaluation model to obtain the transaction behavior evaluation attribute corresponding to each target account; Based on the transaction behavior evaluation attributes and evaluation attribute thresholds corresponding to each target account, abnormal accounts and abnormal transaction behaviors corresponding to the abnormal accounts are identified.

2. The method according to claim 1, characterized in that, The step of determining the transaction topology sequence corresponding to the preset duration based on the at least one target account, at least one business transaction behavior corresponding to each target account, and the associated data includes: Based on the transaction timestamps in the associated data, the at least one target account, and the at least one business transaction behavior, an initial dynamic transaction topology is determined; wherein, the edges of the initial dynamic transaction topology correspond to the business transaction behavior of the target account, and the nodes of the initial dynamic transaction topology correspond to the target account; Based on the transaction behavior attribute data in the associated data, the edge weights corresponding to each edge in the initial dynamic transaction topology graph are determined; wherein, the transaction behavior attribute data includes at least transaction processing cost, transaction frequency, transaction region, and transaction account attributes; The initial dynamic transaction topology graph with corresponding edge weights is used as the target dynamic transaction topology graph, and the target dynamic transaction topology graph is divided according to a preset time window to obtain the first transaction topology graph under at least one time slice within the preset time period. A transaction topology sequence is determined based on at least one of the first transaction topology graphs.

3. The method according to claim 1, characterized in that, The step of performing feature extraction processing on the transaction topology graph sequence to determine at least one node feature sequence corresponding to the transaction topology graph sequence includes: The at least one transaction timestamp corresponding to the transaction topology graph sequence is encoded based on the graph convolutional neural network model to determine the encoding features corresponding to the at least one transaction timestamp; The transaction topology graph sequence is updated based on the encoded features to obtain the updated transaction topology graph sequence. The updated transaction topology sequence is time-series aggregated based on a long short-term memory network model to determine the node feature sequence of each target account.

4. The method according to claim 1, characterized in that, The process of the at least one node feature sequence based on the transaction behavior evaluation model yields transaction behavior evaluation attributes corresponding to each target account, including: The attention mechanism encoding module in the transaction behavior evaluation model is used to process the at least one node feature sequence to determine the node feature sequence matrix corresponding to each target account. A similarity evaluation process is performed on at least one of the node feature sequence matrices to determine a first evaluation attribute between each target account and other target accounts; Anomaly deviation evaluation processing is performed on at least one of the node feature sequence matrices to determine a second evaluation attribute between each target account and other target accounts; Based on the first evaluation attribute, the second evaluation attribute, and the target evaluation attribute determination function corresponding to each target account, the transaction behavior evaluation attribute corresponding to each target account is determined.

5. The method according to claim 4, characterized in that, The step of performing similarity evaluation processing on at least one of the node feature sequence matrices to determine a first evaluation attribute between each target account and other target accounts includes: Based on the node feature sequence matrix corresponding to each target account, determine the static attribute vector corresponding to each target account; For the at least one target account, a similarity evaluation process is performed on the static attribute vector of each target account and the static attribute vector of other target accounts based on a similarity evaluation function to determine the similarity evaluation attribute between each target account and other target accounts, and the similarity evaluation attribute is determined as the first evaluation attribute.

6. The method according to claim 4, characterized in that, The step of performing anomaly deviation evaluation processing on at least one of the node feature sequence matrices to determine a second evaluation attribute between each target account and other target accounts includes: The node feature sequence matrix corresponding to each target account is multiplied with the first weight parameter to determine the first matrix to be processed for each target account. The node feature sequence matrix corresponding to each target account is multiplied with the second weight parameter to determine the second matrix to be processed for each target account. For the at least one target account, the first unprocessed matrix of each target account and the second unprocessed matrix of other target accounts are processed based on the anomaly deviation evaluation function to determine the second evaluation attribute between each target account and other target accounts.

7. The method according to claim 1, characterized in that, The method further includes: Based on the transaction behavior evaluation attributes of at least one target account, determine the mean and standard deviation of the evaluation attributes; The evaluation attribute threshold is determined by processing the mean of the evaluation attribute, the standard deviation of the evaluation attribute, and the preset reliability parameter based on the adaptive threshold algorithm.

8. The method according to claim 1, characterized in that, The process of determining abnormal accounts and corresponding abnormal transaction behaviors based on transaction behavior evaluation attributes and threshold values ​​for each target account includes: If the transaction behavior assessment attribute of the target account is higher than the assessment attribute threshold, then the target account is determined to be an abnormal account; Based on the transaction topology sequence, determine the edge weight to be compared for at least one business transaction behavior corresponding to the abnormal account; When the weight of the edge to be compared is higher than a preset edge weight threshold, the business transaction behavior corresponding to the weight of the edge to be compared is determined to be an abnormal transaction behavior.

9. An abnormal transaction behavior detection device, characterized in that, include: The data acquisition module is used to acquire transaction behavior data corresponding to at least one target account within a preset time period, wherein the transaction behavior data includes at least one business transaction behavior corresponding to each target account and associated data corresponding to the business transaction behavior; The topology sequence determination module is used to determine a transaction topology sequence corresponding to the preset duration based on the at least one target account, at least one business transaction behavior corresponding to each target account, and the associated data; wherein, the transaction topology sequence includes a first transaction topology corresponding to at least one time slice within the preset duration; The node feature sequence determination module is used to perform feature extraction processing on the transaction topology graph sequence to determine at least one node feature sequence corresponding to the transaction topology graph sequence, wherein the number of node feature sequences is consistent with the number of target accounts; The evaluation attribute determination module is used to process the feature sequence of at least one node based on the transaction behavior evaluation model to obtain the transaction behavior evaluation attribute corresponding to each target account. The abnormal transaction behavior determination module is used to determine abnormal accounts and the abnormal transaction behaviors corresponding to the abnormal accounts based on the transaction behavior evaluation attributes and evaluation attribute thresholds corresponding to each target account.

10. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the abnormal transaction behavior detection method according to any one of claims 1-8.

Images