Payment anomaly detection method and device, equipment, medium and program product

Abstract

The invention provides a payment anomaly detection method, relates to the field of artificial intelligence, and can be applied to the field of financial science and technology. The method comprises the following steps: in response to acquired payment data, inputting the payment data into a pre-trained data diffusion model, and extracting potential features of the payment data; fusing the potential features with the payment data, inputting a pre-trained data classification model, and obtaining a classification result that the payment data accords with the abnormal transaction; the data diffusion model training method comprises the following steps: gradually adding noise into a payment data sample according to a predetermined probability rule to form noise data; noise is predicted step by step from the noise data, denoising is carried out step by step based on a predetermined probability rule, and payment data conforming to expected similarity with payment data sample distribution is restored. The invention further provides a payment anomaly detection device and equipment, a storage medium and a program product. The embodiment of the invention has the advantage of improving the classification prediction accuracy of the payment transaction data.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, specifically to the field of financial technology, and more specifically to a method, apparatus, device, medium, and program product for real-time payment anomaly detection. Background Technology

[0002] The advancement of internet technology and the widespread adoption of mobile internet have spurred the practical application of internet finance, mobile payment, and third-party payment in the financial sector. Third-party payment, in particular, serves not only as a channel for the inflow and outflow of funds in internet finance but is also a core focus of banks and other financial institutions. However, along with the rapid development of third-party payment technology, insecure network environments and a lack of effective anomaly detection methods have brought risks and challenges to the application of third-party payment. The ability to detect anomalies in payment data needs further improvement. Summary of the Invention

[0003] In view of the above problems, this application provides payment anomaly detection methods, apparatus, equipment, media and program products to improve the accuracy of payment transaction data classification and prediction.

[0004] According to a first aspect of this application, a payment anomaly detection method is provided, comprising: in response to acquiring payment data, inputting the payment data into a pre-trained data diffusion model to extract latent features of the payment data; fusing the latent features with the payment data and inputting the fused latent features into a pre-trained data classification model to obtain a classification result indicating that the payment data conforms to an abnormal transaction; wherein the training method of the data diffusion model includes: progressively adding noise to the payment data sample according to a predetermined probability rule to form noisy data; progressively predicting noise from the noisy data, progressively removing noise based on the predetermined probability rule, and restoring payment data with an expected similarity to the distribution of the payment data sample; the data classification model is trained based on the dataset after the payment data sample is expanded by the data diffusion model.

[0005] According to an embodiment of this application, the method further includes: determining the generation weight of the first time interval for the abnormal transaction type to which the payment data belongs, based on the classification result deviation of the payment data as an abnormal transaction within the first time interval; updating and training the data diffusion model based on the generation weight of the first time interval; wherein the generation weight is used to influence the noise addition rate of the abnormal transaction type to which the payment data belongs.

[0006] According to an embodiment of this application, updating and training the data diffusion model based on the generation weights in the first time interval includes: determining the generation weights of the second time interval for the abnormal transaction type to which the payment data belongs based on the classification result deviation of the payment data as an abnormal transaction in the second time interval; obtaining calibrated generation weights by combining the generation weights in the first time interval and the generation weights in the second time interval; and updating and training the data diffusion model based on the calibrated generation weights; wherein the second time interval is longer than the first time interval.

[0007] According to an embodiment of this application, the method further includes: in response to the expected deviation of the classification result of payment data as abnormal transactions in the third time interval, reducing the generation weight of the first time interval; wherein the end time of the third time interval is later than that of the first time interval.

[0008] According to an embodiment of this application, the noise is Gaussian noise; the noise is predicted step by step from the noise data, and the noise is gradually denoised based on a predetermined probability rule, including: parameterizing the Gaussian distribution through a neural network, solving the previous step's true distribution from the noise data step by step in the form of a Markov chain, training the network by optimizing the log-likelihood variational lower bound to obtain the mean and variance of the neural network parameterization, and generating the step-by-step denoising result.

[0009] According to embodiments of this application, restoring payment data that matches the expected similarity to the distribution of payment data samples includes: when the similarity is less than expected, increasing the number of steps to form noisy data from the payment data samples, and / or reducing the variance of the predicted noise distribution during the denoising process.

[0010] A second aspect of this application provides a payment anomaly detection device, comprising: a data augmentation module, configured to, in response to acquiring payment data, input the payment data into a pre-trained data diffusion model to extract latent features of the payment data; and an anomaly detection module, configured to fuse the latent features with the payment data and input the fused data into a pre-trained data classification model to obtain a classification result indicating that the payment data conforms to an abnormal transaction; wherein, the training method of the data diffusion model includes: progressively adding noise to the payment data sample according to a predetermined probability rule to form noisy data; progressively predicting noise from the noisy data; progressively denoising based on the predetermined probability rule to restore payment data with a distribution that conforms to the expected similarity to the payment data sample; and the data classification model being trained on the dataset augmented by the data diffusion model.

[0011] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0012] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0013] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0014] The embodiments of this application utilize a data diffusion model to extract latent features from payment transaction data, which are then fused with the original payment transaction data and input into a data classification model for detection. Because the data diffusion model progressively denoises based on predetermined probability rules during training, restoring payment data with the expected similarity to the distribution of the payment data samples, the detection phase leverages the data diffusion model's ability to capture complex distributions and subtle patterns in transaction data. This enriches feature dimensions, uncovers hidden correlations, and provides the data classification model with more comprehensive and in-depth information, effectively improving the accuracy and robustness of payment transaction data classification prediction. Especially when identifying complex transaction patterns, the richer features enhance the model's ability to capture abnormal patterns, contributing to accurate decision-making. Attached Figure Description

[0015] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0016] Figure 1 The illustration shows an application scenario diagram of a payment anomaly detection method, apparatus, device, medium, and program product according to an embodiment of this application;

[0017] Figure 2 A flowchart illustrating a first payment anomaly detection method according to an embodiment of this application is shown schematically;

[0018] Figure 3 A flowchart illustrating a second payment anomaly detection method according to an embodiment of this application is shown schematically.

[0019] Figure 4 This illustration schematically shows a framework diagram for real-time payment anomaly detection according to an embodiment of this application;

[0020] Figure 5 This schematically illustrates a structural block diagram of a payment anomaly detection device according to an embodiment of this application; and

[0021] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a payment anomaly detection method according to an embodiment of this application. Detailed Implementation

[0022] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0023] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0024] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0025] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0026] In machine learning-based transaction anomaly risk identification, there are two main types: supervised and unsupervised. Supervised anomaly detection methods build models based on samples labeled as normal or abnormal transactions, and then perform binary classification prediction on new transactions. Commonly used supervised machine learning algorithms include decision trees, support vector machines, logistic regression, and optimized distributed gradient boosting libraries. Unsupervised anomaly detection methods mainly consist of clustering algorithms represented by K-means clustering and anomaly detection algorithms represented by Isolation Forest. In the field of deep learning, with the emergence of neural networks, model performance is improved through parameter selection, network structure adjustment, model ensemble, and feature reconstruction. Genetic algorithms and annealing algorithms are commonly used to adjust the structure and parameters of neural network models to identify abnormal transactions in various scenarios. In addition, gradient descent is used to train artificial neural networks, assigning more penalty weights to misclassified samples to improve the model's fitting effect. For time-series data in actual trading behavior, Long Short-Term Memory (LSTM) networks are used to process time-series information, effectively extracting user transaction trajectories to participate in training classification models and improving model prediction performance.

[0027] Because negative samples are scarce in actual abnormal transactions, there is a significant data imbalance problem. To identify abnormal transactions in third-party payments, methods such as sampling positive and negative samples with different weights can be used to extract the feature differences between normal and abnormal transactions. Alternatively, generative adversarial networks (GANs) can be used to simulate minority class samples to construct a balanced dataset. A self-compiler and a restricted Boltzmann machine can then be used to learn the sample distribution of normal transactions, classifying abnormal transactions that do not conform to this distribution as abnormal. However, GANs also suffer from training instability, gradient vanishing, and pattern collapse due to the need to achieve Nash equilibrium.

[0028] Therefore, generating high-quality minority class negative sample data is of great significance in solving the problem of poor detection accuracy caused by the lack of negative samples in detection models.

[0029] Applying conventional models directly to the generation of payment anomaly detection data presents the following challenges.

[0030] 1. Categorical Feature Processing: Conventional data augmentation models are used for continuous data (such as image pixel values). However, a large number of high-cardinality categorical features in payment data (such as user identifiers, transaction identifiers, and device fingerprint hashes) are discrete. Directly applying continuous diffusion processes makes it difficult to effectively model their distribution, and the generated categorical values ​​may be meaningless or destroy important correlations between features.

[0031] 2. Complex Dependency Modeling Between Features: The dependencies between payment features (such as the transaction amount distribution of a specific merchant type in a specific time period) are very complex and non-linear. It is necessary to effectively capture these dependencies to generate realistic and discriminative anomalous samples and avoid generating invalid or misleading data.

[0032] 3. Data Dynamism and Timeliness: The generated abnormal transaction samples need to reflect the characteristics of current (or recent) abnormal transaction patterns to adapt to the rapid evolution of abnormal transaction methods. The model needs to be able to update efficiently or learn incrementally to adapt to changes in data distribution.

[0033] To enable the model to accurately learn the characteristics of abnormal transaction data, and considering the quality of generated samples and the stability of the generated model structure, embodiments of this application provide a payment anomaly detection method to improve the accuracy, real-time performance, and adaptability of payment anomaly detection, meeting the diverse and complex anomaly detection needs of current payment systems. Embodiments of this application use a data diffusion model to perform denoising modeling and feature enhancement on payment data to generate simulated abnormal transaction data. The latent features generated by the data diffusion model are combined with real transaction features, utilizing a data classification model, a real-time detection module, and a feedback update mechanism to effectively improve the ability to identify known but unknown abnormal transaction models. Embodiments of this application use a denoising diffusion probability model composed of multiple convolutional layers to oversample a small number of abnormal transaction data samples, constructing a balanced dataset. Furthermore, addressing the problem of high training difficulty and long response time for detection models caused by the high dimensionality and multi-coupling characteristics of user transaction data, the data classification model of this application directly processes the category features in the data. Through optimization of the gradient boosting algorithm, it maintains high accuracy while achieving rapid training and prediction.

[0034] Figure 1 The illustration shows an application scenario of a payment anomaly detection method, apparatus, device, medium, and program product according to an embodiment of this application.

[0035] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, and a third terminal device 103. Network 104 serves as a medium for providing communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0036] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0037] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0038] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0039] It should be noted that the payment anomaly detection method provided in this application embodiment can generally be executed by server 105. Correspondingly, the payment anomaly detection device provided in this application embodiment can generally be located in server 105. The payment anomaly detection method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the payment anomaly detection device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0040] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0041] The following will be based on Figure 1 The described scene, through Figures 2-4 A payment anomaly detection method according to an embodiment of this application will be described in detail.

[0042] Figure 2 The flowchart of a payment anomaly detection method according to an embodiment of this application is illustrated schematically.

[0043] like Figure 2 As shown, a payment anomaly detection method in this embodiment includes operations S210 to S220, and the payment anomaly detection method can be executed in the following manner.

[0044] In operation S210, in response to acquiring payment data, the payment data is input into a pre-trained data diffusion model to extract latent features from the payment data. The training method for the data diffusion model includes: progressively adding noise to the payment data samples according to a predetermined probability rule to form noisy data; progressively predicting noise from the noisy data; progressively denoising based on the predetermined probability rule to reconstruct payment data with the expected similarity to the distribution of the payment data samples; the latent features are extracted during the denoising process.

[0045] After fusing latent features with payment data in operation S220, the data is input into a pre-trained data classification model to obtain a classification result indicating that the payment data conforms to abnormal transactions. The data classification model is trained on a dataset augmented with payment data samples using a data diffusion model.

[0046] In operation S210, the role of the data diffusion model in the embodiments of this application includes: 1. During the data classification model training phase, the diffusion model generates minority class abnormal transaction samples to balance the training dataset and solve the problem of poor detection accuracy caused by data imbalance. 2. During the payment anomaly detection phase using the trained data classification model, the data diffusion model extracts latent features from the transaction data. These latent features are then combined with real transaction features to deeply mine the distribution of the original data. This allows the model to simultaneously learn the explicit features and implicit patterns of the transaction data, improving its ability to identify known but unknown abnormal transaction patterns.

[0047] The data diffusion model in this application is a generative model, consisting of two parts: forward noise addition and backward noise removal. The data diffusion model progressively transforms the original data into noise through forward noise addition, and then uses a neural network to iteratively remove noise from the reverse side. During the process of learning the data distribution mapping relationship, abstract patterns and rules, i.e., latent features, hidden in the original data are extracted.

[0048] The working principle of the data diffusion model is to generate high-quality data by gradually adding noise to the data and learning how to remove noise from the data. Its technical characteristics are mainly as follows.

[0049] 1. Gradually generate the denoising process.

[0050] Forward Process: Noise is gradually added to the original data to make the data gradually approach a standard normal distribution. This process is fixed and does not depend on the model parameters.

[0051] The reverse process involves progressively denoising from pure noise to reconstruct the data. This process is learned by a model, which can be a parameterized neural network, such as a U-shaped network. Each step of the data diffusion model's generation process is a Markov chain, thus it is a step-by-step process.

[0052] 2. Probability-based modeling.

[0053] Each step of the data diffusion model in this embodiment can be based on a conditional probability distribution. It learns to generate data from one time step to another. It uses a variational inference optimization process to maximize the Evidence Lower Bound (ELBO) to approximate the data distribution.

[0054] 3. Stepwise optimization and controllable generation process for denoising. The goal of the data diffusion model in this embodiment is to learn how to predict a noise-free version of data contaminated with noise. The model is trained using the Mean-Square Error (MSE) loss function to predict intermediate states before noise is introduced. Furthermore, by adjusting parameters in the denoising process (such as the number of steps and intensity), the generation quality and speed can be balanced.

[0055] In this embodiment, the pre-trained data classification model can first generate abnormal transaction samples by modeling data using historical payment transaction data during the training phase, and then evaluate the data. Then, it can be combined with the pre-processed historical payment transaction features to form a balanced payment transaction training set for training. Specifically, it can be implemented as follows.

[0056] Step 1: Data Preprocessing. Collect historical transaction data from the payment platform as training and testing datasets. Remove duplicate transactions or obviously invalid data (null and missing values). Fill in missing values ​​for important features using imputation. Finally, normalize the feature data, scaling the data values ​​to the [0,1] range to accelerate model convergence.

[0057] Step 2: Data Generation and Feature Augmentation. During the noise addition process, each step adds forward noise to the distribution q(x0) of the original data x0, for a total of T steps. If the number of time steps is long, the data will eventually become random noise. By employing parameter renormalization techniques during the noise addition process, the final random noise can be obtained directly without iterating at each step.

[0058] In the embodiments of this application, the data diffusion model is based on the premise that the noise distribution can be modeled and calculated. Therefore, in this embodiment, noise is gradually added to the payment data sample according to a predetermined probability rule. From the original data x0 to the complete noise x... t In the forward noise addition process, the change in the probability distribution of the noise can be clearly described by mathematical formulas (such as probability density functions and Markov chain transition probabilities), and the result of each noise addition step can be accurately calculated. From the noisy sample x... t In the reverse denoising process to x0, its probability distribution needs to be mathematically derived into a target that can be learned by the neural network, and the computation process must be engineering-feasible. This allows the neural network to learn only from x0. t The denoising step can be completed by predicting the original noise at time step T.

[0059] In this embodiment, the added noise can be Gaussian noise, discrete noise, Laplace noise, Student's t-distribution noise, etc. The discrete noise addition process involves randomly replacing discrete feature values, while the denoising process predicts the class probability of the original features. The addition and denoising processes of discrete noise lack the smoothness of continuous Gaussian noise, easily leading to "jump errors" in the generated samples. Laplace noise is suitable for simulating outlier noise in data, such as simulating sudden large-amount abnormal transaction noise. Student's t-distribution noise can simulate more extreme noise. In this embodiment, Gaussian noise is preferred. The data x at step t of the noise addition process... t The distribution formula is as follows:

[0060]

[0061] Where x0 is the preprocessed input data, x t This is the representation data after adding noise at step t, where I is the identity matrix and β is the noise level. t It is the noise addition rate. Through multiple iterations, the original data is gradually transformed into data that follows a standard normal distribution.

[0062] This embodiment can use cosine similarity to test the similarity between the generated data and real abnormal transactions, in order to determine the payment data that matches the expected similarity to the distribution of the payment data sample. The expected similarity can be, for example, greater than or equal to 0.7.

[0063] In this embodiment, latent features refer to the abstract information hidden in the original data that plays a key descriptive role in the distribution and structure of the data, which is learned and captured by the neural network during the denoising process of the model by gradually adding noise to the original data and then denoising it in reverse.

[0064] Specifically, in the forward noise-adding stage, noise is gradually added to the original transaction data according to predetermined rules, transforming it into noise-dominated data. In the reverse denoising process, the neural network takes the noisy data and time steps as input and is trained by optimizing the lower bound of the log-likelihood variation, learning how to recover the original data from the noise. During this process, the mapping relationship between the data from the noisy state to the original state, the key parameters of the data distribution, and the abstract representation of the complex dependencies between data features learned by the neural network can constitute the latent features of the data diffusion model. The activation values ​​of the intermediate layers, such as the output of the attention mechanism, represent the model's attention to different feature dimensions and can be regarded as explicit representations of the latent features. After model training, features can be extracted from the intermediate layers of the U-shaped network as latent features.

[0065] The data diffusion model is used to extract latent features from transaction data. The specific steps are as follows.

[0066] Step 1: Input the payment data into a pre-trained data diffusion model and gradually add noise according to predetermined rules. (Using noisy data x...) t Using time step t as input, predict the noise distribution parameters (mean, variance) during the noise addition process. Based on the probability rule of forward noise addition, a Markov chain is used to predict the noise distribution parameters (mean, variance) from the pure noise x. t Begin the reverse iteration. At each step, using the noise parameters predicted by the neural network and combining them with Bayes' theorem to derive the true distribution of the data from the previous step, the noise is progressively corrected, generating the denoised result x. t-1 .

[0067] Step 2: Once the reverse iteration is complete (reaching the preset number of steps T), the generated x0, which closely approximates the original data, along with intermediate results such as noise prediction and distribution reconstruction learned by the network during the iteration process, together constitute the potential features of the transaction data. These features include both the key patterns of the original transaction data and the model's abstract understanding of the data distribution.

[0068] After fusing latent features with payment data in operation S220, the data is input into a pre-trained data classification model to obtain a classification result indicating that the payment data conforms to abnormal transactions. The data classification model is trained on a dataset augmented with payment data samples using a data diffusion model.

[0069] To ensure response time, the real-time detection section employs a stream-based batch processing approach, acquiring and processing data in batches according to time windows, thus reducing latency in real-time inference. The working principle of operation S220 can be represented as follows: Let the input payment transaction data be... Each transaction It is a high-dimensional feature vector. The data diffusion model generates latent feature representations through a diffusion process. These two features are then merged to form extended features. , which is expressed as follows.

[0070]

[0071] Then, it is input into the trained data classification model for classification prediction, as shown in the following formula.

[0072]

[0073] in, This indicates the probability that a transaction is an abnormal transaction. This indicates a classification. This embodiment utilizes a low-latency streaming processing system to ensure that real-time transaction data can be instantly predicted for anomalies and output real-time decision results, effectively preventing abnormal trading behavior.

[0074] In this embodiment, the data classification model, i.e. the classifier, can be a tree model or an ensemble learning classifier, such as gradient boosting tree or random forest; it can also be a deep learning class, such as multilayer perceptron, convolutional neural network, or long short-term memory network; or it can be a linear or traditional statistical class, such as logistic regression or support vector machine.

[0075] For example, categorical feature enhancement algorithms are classification enhancement algorithms based on gradient boosting decision tree optimization. Their core idea is to improve the processing of categorical features, gradient estimation methods, and overfitting control, thereby making the model perform better on high-dimensional complex data and demonstrating high efficiency and accuracy in the field of payment anomaly detection. This embodiment can fuse the high-dimensional latent features generated by the data diffusion model with the preprocessed transaction features. The classification enhancement algorithm directly inputs the original categorical features after embedding processing and the fused feature h. i It leverages its ordered target encoding and ordered boosting mechanism for efficient and robust training. By constructing a data classification model based on the classification boosting algorithm, it learns the mapping relationship between transaction behavior and abnormal transaction labels to predict whether a transaction is abnormal. After training the classification boosting model, a test set can be used to test the data classification model, verifying its ability to identify abnormal transactions and evaluating its performance.

[0076] The loss function in this embodiment can take the form of the following.

[0077]

[0078] Where n is the number of training samples; y i L(y) is the true label of the i-th sample. i ,F(x i )) is the loss function for a single sample, f k It is the output of the k-th tree. It is the regularization term for the k-th tree, which typically includes the number of leaf nodes and the sum of squares of the weights of the leaf nodes.

[0079]

[0080] Where T is the number of leaf nodes in the current tree, γ and λ are regularization coefficients, and w j It is the output weight of the j-th leaf node.

[0081] This embodiment uses a classification boosting algorithm as the data classification model, which has the following advantages.

[0082] (1) Natively and efficiently handles categorical features: It performs ordered target encoding, avoiding one-hot encoding of categorical features (which can lead to dimensionality explosion in payment data, greatly increasing computational burden and memory consumption, and seriously affecting real-time performance). It encodes based on the statistical information of the target variable (such as expected value), and cleverly solves the target leakage problem by introducing random permutation and calculation order. This is crucial for payment data containing a large number of high cardinality categorical features such as transaction identifiers, user identifiers (partial), and device identifiers, and can directly, efficiently, and leak-free utilize these key discriminative information.

[0083] (2) It can automatically combine category features to discover abnormal risk patterns such as "specific equipment type + specific country + specific time period", further enhancing the model's discriminative power. It does not require manual coding or reliance on decision tree paths.

[0084] (3) Excellent real-time prediction performance: Symmetric tree and fast scoring. A fully balanced (symmetric) decision tree is constructed. This structure has extremely high caching efficiency on the CPU, making the model prediction speed much faster than that of random forests that construct asymmetric trees (especially when the tree depth is large). This is a decisive advantage for real-time payment anomaly detection scenarios that require millisecond-level response.

[0085] (4) Robustness against overfitting and data drift: Ordered boosting effectively solves the prediction bias problem. It uses a special arrangement order to build the tree, ensuring that at each step of gradient boosting, the samples used to calculate the gradient of the current tree do not depend on the current tree itself. It is more robust to handling payment data containing a lot of noise and volatile patterns, has stronger generalization ability, and is more adaptable to changes in data distribution.

[0086] (5) Synergy with features generated by data diffusion models: High-dimensional latent features generated by data diffusion models may contain complex nonlinear patterns. Gradient boosting tree structures are very good at capturing such complex relationships. At the same time, they are not sensitive to the scale of input features and can well integrate the original features and the generated latent features.

[0087] This embodiment utilizes a data diffusion model to extract latent features from payment transaction data, which are then fused with the original payment transaction data and input into a data classification model for detection. Because the data diffusion model progressively denoises based on predetermined probability rules during training, restoring payment data with the expected similarity to the distribution of the payment data samples, it can capture complex data distributions and subtle patterns during the detection phase. This enriches feature dimensions, uncovers hidden correlations, and provides the data classification model with more comprehensive and in-depth information, effectively improving the accuracy and robustness of payment transaction data classification prediction. Especially when identifying complex transaction patterns, the richer features enhance the model's ability to capture abnormal patterns, contributing to accurate decision-making.

[0088] In some embodiments of this application, the input representation layer of the data diffusion model may incorporate categorical feature embedding techniques. Specifically, each categorical feature value is mapped to a low-dimensional, dense real-valued vector (embedding vector). These embedding vectors are concatenated with the original numerical features and encoded time-series features (such as temporal embeddings extracted through a Long Short-Term Memory network or transformer) to jointly constitute the input feature vector X0 of the data diffusion model. Both the diffusion process (adding noise) and the inverse process (denoising) operate on this continuous hybrid representation space composed of numerical features, temporal embeddings, and categorical embeddings.

[0089] In some embodiments of this application, categorical feature embedding is used to process discrete features, attention / gating mechanisms are introduced into the denoising network to capture feature dependencies, and incremental / periodic updates are supported to maintain the timeliness of generated samples. During evaluation, not only statistical similarity is considered, but also the semantic coherence of the categorical features of the generated samples and their effectiveness in downstream classification tasks.

[0090] This implementation of the data diffusion model learns the complex dependencies between category features and other features, and generates semantically coherent and effective category feature representations (through their embedding vectors) during the generation process, rather than directly generating discrete and potentially invalid category labels. When the generated samples are used for downstream training, meaningful category values ​​can be reconstructed by finding the prototype embedding closest to the generated embedding or by using a decoder.

[0091] In some embodiments of this application, to effectively capture the complex nonlinear dependencies between payment features (such as the coupling relationship between "transaction amount" and "merchant type," "geographical location," and "time"), this embodiment introduces attention or gating mechanisms into the denoising neural network of the data diffusion model. These mechanisms enable the model to dynamically focus on the interactions between different feature dimensions during the denoising process, learn a more refined joint distribution, and thus generate samples that are more realistic in feature combination patterns and better reflect the characteristics of real abnormal transactions. This is crucial for simulating complex abnormal transaction patterns that depend on multiple abnormal combinations of features.

[0092] To address the rapid evolution of payment anomaly patterns, the data diffusion module in this application supports incremental learning or periodic retraining. When a new anomaly is confirmed, it can be added to the training set for rapid fine-tuning using existing model parameters, or retrained periodically using recent data to ensure that the generated anomaly transaction samples always represent the characteristics of currently active anomaly transaction methods.

[0093] In some embodiments of this application, the payment anomaly detection method further includes: determining the generation weight of the first time interval for the abnormal transaction type to which the payment data belongs, based on the classification result deviation of the payment data as an abnormal transaction within the first time interval; updating and training the data diffusion model based on the generation weight of the first time interval; wherein the generation weight is used to influence the noise addition rate of the abnormal transaction type to which the payment data belongs.

[0094] As abnormal transaction methods continue to evolve, statically trained models cannot learn new features in a timely manner, leading to a decline in detection accuracy over time. To improve the adaptability of payment anomaly detection methods to emerging abnormal transaction patterns, a real-time feedback mechanism is introduced to dynamically adjust the noise intensity based on the generated weights wt. The initial values ​​of the generated weights can be initialized with equal weights to 1 / N or empirically set to 0.3~0.5, and upper and lower limits can be set as needed.

[0095] In this embodiment, the forward process of the data diffusion model progressively adds Gaussian noise to the abnormal transaction sample x at time steps t=1,2,...,T, with the noise intensity dynamically adjusted by wt. The higher the weight, the higher the β... t ∙w t The overall effect on noise addition is that the actual noise addition is slower and more original features are preserved. The formula can be expressed as follows.

[0096]

[0097] in, ~N(0,1) represents Gaussian noise.

[0098] For example, during the past two hours of detection, when the detection system misclassified an abnormal transaction as normal (a missed detection), or misclassified a normal transaction as abnormal (a false positive), the payment data classification results were biased. The system automatically generates a weight w for the abnormal transaction type to which the sample belongs. t Increase by 20%; when a normal transaction is misjudged as an abnormal transaction, reduce the sample weight of the corresponding normal type by 10%. Because the noise addition rate in the formula is related to the generation weight, the higher the weight, the slower the actual noise addition is due to the overall impact on noise addition.

[0099] This embodiment can flexibly adapt to new abnormal transaction types. When the detection system misjudges and triggers a weight adjustment, the noise addition rate will slow down when the weight of abnormal transaction samples is increased, thus preserving more original features. When the weight of normal samples is reduced, the noise addition will also be affected by the formula. Essentially, the rhythm of noise addition is dynamically controlled by the weight, allowing the model to focus more on the feature restoration of samples that are prone to misjudgment.

[0100] In some embodiments of this application, updating and training the data diffusion model based on the generation weights in the first time interval includes: determining the generation weights of the second time interval for the abnormal transaction type to which the payment data belongs based on the classification result deviation of the payment data as an abnormal transaction in the second time interval; obtaining calibrated generation weights by combining the generation weights in the first time interval and the generation weights in the second time interval; and updating and training the data diffusion model based on the calibrated generation weights; wherein the second time interval is longer than the first time interval.

[0101] When a real-time feedback mechanism is introduced, the noise intensity varies with w t Dynamic adjustment. This may cause short-term fluctuations in the model. In this embodiment, the generation weights of the first time interval can be adjusted using a second time interval that is longer than the first time interval to eliminate the impact of short-term fluctuations.

[0102] For example, the weighting benchmark can be recalibrated daily at midnight based on the full monthly data to eliminate the cumulative impact of short-term fluctuations. Specifically, each morning, based on the classification deviation of payment data for abnormal transactions in the current month (second time interval), the generation weight for the abnormal transaction type of the payment data for that month is determined; the calibrated generation weight is obtained by combining the generation weight of the current day (first time interval) and the generation weight of the current month (second time interval); the data diffusion model is then updated and trained based on the calibrated generation weight. The calculation of the generation weight for the second time interval can refer to the calculation method for the generation weight of the first time interval.

[0103] This embodiment can be fused by averaging the generated weights of the first time interval and the generated weights of the second time interval, or a balancing system can be set to fuse them in the following way. The formula for generating weights can be expressed as follows.

[0104]

[0105] Here, α is a balancing coefficient used to balance real-time performance and stability. α can be set based on empirical values, such as 0.7.

[0106] This embodiment obtains calibrated generation weights by combining the generation weights in the first time interval and the generation weights in the second time interval. This eliminates the cumulative impact of short-term fluctuations, allowing the model to learn the core patterns of the data and ultimately making the potential features extracted by the model more stable and representative. This results in more accurate and robust decisions from downstream classification models, especially in scenarios such as transaction data that are affected by high-frequency random factors, which can directly improve the reliability of business analysis.

[0107] In some embodiments of this application, the method further includes: in response to the expected deviation of the classification result of payment data as abnormal transactions in the third time interval, reducing the generation weight of the first time interval; wherein the end time of the third time interval is later than that of the first time interval.

[0108] During the detection process, when certain abnormal transaction patterns have been contained, the generation weight of such abnormal transaction patterns can be reduced in a timely manner.

[0109] For example, for anomaly types that have no missed or false alarms for 7 consecutive days after the first time interval (the third time interval), their generation weight is automatically reduced by 5%. This avoids long-term bias in weighting towards a certain outdated anomaly pattern, reduces overfitting to outdated anomaly transaction patterns, and improves the detection capability for new anomaly transactions. As another example, for anomaly transaction types that have no missed or false alarms for 30 consecutive days, their generation weight is automatically reduced by 10%.

[0110] This embodiment employs a weight decay strategy to prevent long-term weight bias towards outdated abnormal trading patterns. This enhances the model's adaptability to the evolution of abnormal trading patterns, endowing it with dynamic adaptability. By actively mitigating the impact of outdated abnormal trading patterns, it addresses the adaptive lag problem caused by weight fixation in traditional models. Ultimately, this results in greater sensitivity to new abnormal trading patterns, fewer misjudgments of normal behavior, and lower long-term maintenance costs. Especially in trading scenarios where abnormal trading methods iterate rapidly, this is a key mechanism for ensuring the long-term effectiveness of the risk control model.

[0111] In some embodiments of this application, the noise is Gaussian noise; the noise is predicted step by step from the noise data, and the noise is gradually denoised based on a predetermined probability rule, including: parameterizing the Gaussian distribution through a neural network, solving the previous step's true distribution from the noise data step by step in the form of a Markov chain, training the network by optimizing the log-likelihood variational lower bound to obtain the mean and variance of the neural network parameterization, and generating the step-by-step denoising result.

[0112] In this data diffusion model, the forward process uses data from time T, while the backward process uses known noise x. t Solve the true distribution of the previous step step by step in reverse. , to obtain x t-1 The ultimate goal is to generate latent features that are consistent with the original data distribution. This process follows a Markov chain, as shown in the following equation.

[0113]

[0114] For a parameterized Gaussian distribution, where and These are the mean and variance of the neural network parameters, which need to be learned through neural network training. The neural network parameters are trained by optimizing the variational lower bound of the log-likelihood.

[0115]

[0116] in, This indicates that the variational distribution (approximate posterior) is parameterized by a neural network. This represents the inverse denoising distribution, controlled by the parameter θ. KL(q||p) represents the divergence, which measures the difference between the two distributions. Let q(x0) represent the expectation of the variational distribution.

[0117] This embodiment parameterizes the Gaussian distribution through a neural network and solves for the true distribution from the noisy data step by step in the form of a Markov chain. Combined with the design of training network parameters by optimizing the log-likelihood variational lower bound, it can accurately capture the complex temporal dependencies and nonlinear feature patterns in the transaction data, generate high-quality denoising results, effectively restore the true transaction features that are covered by noise, and thus significantly improve the accuracy of subsequent risk identification and decision-making based on these features.

[0118] In some embodiments of this application, restoring payment data that matches the expected similarity to the distribution of payment data samples includes: when the similarity is less than expected, increasing the number of steps to form noisy data from the payment data samples, and / or reducing the variance of the predicted noise distribution during the denoising process.

[0119] More denoising steps result in more refined noise correction by the model, theoretically leading to higher generation quality, but also a linear increase in computation time. Conversely, fewer steps result in faster speed, but may lead to a decrease in quality due to insufficient denoising. For example, if the similarity remains consistently low (e.g., <0.6), it indicates that the data diffusion model has not fully learned the characteristics of real abnormal transactions. In this case, the model parameters can be adjusted in reverse by increasing the number of diffusion steps in the forward process, allowing the model to learn the feature distribution more fully.

[0120] When the generated quality is poor, the resulting samples contain obvious noise and differ greatly from the real data. Reducing the variance of the noise distribution predicted at each step in the denoising process reduces noise interference and allows the model to focus more on capturing the core features of the real distribution.

[0121] In this embodiment, when the similarity between the generated abnormal transaction sample and the real abnormal transaction sample is less than expected, the number of noise-adding steps in the payment data is increased to more finely preserve the original abnormal transaction features, and the variance of the noise distribution during the denoising process is reduced to reduce random interference. This can improve the restoration degree of the generated sample to the real abnormal transaction features, thereby enhancing the ability of the subsequent data classification model to identify complex abnormal transaction patterns.

[0122] Figure 3 The flowchart of a second payment anomaly detection method according to an embodiment of this application is illustrated schematically.

[0123] like Figure 3 As shown, the overall steps of the payment anomaly detection method in this embodiment from start to finish are as follows.

[0124] 1. Forming a training set: Historical transaction data in payment scenarios, including normal and abnormal transactions, which serves as the basic input for all subsequent models.

[0125] 2. Screening historical abnormal transactions: Real abnormal transaction samples, such as fraudulent transactions and fraudulent transactions, selected from the training set are used as raw data x0 to learn the characteristic patterns of abnormal transactions.

[0126] 3. Data standardization: Normalize historical abnormal transactions and unify characteristic units, such as transaction amount and timestamp.

[0127] 4. Establish a data diffusion model.

[0128] Set sampling time T: Sampling time T is used as the denoising step parameter of the data diffusion model to control the number of iterations to restore data from noise.

[0129] Training data diffusion model: Based on the principle of reverse denoising, the model is trained with standardized historical abnormal transactions x0 to learn the abnormal transaction features, noise, and the reversible mapping between abnormal transaction features.

[0130] Sample generation of abnormal transactions: After the model is trained, iterative denoising is performed on random noise at sampling time T to generate simulated abnormal transaction samples, which are used to supplement real abnormal transaction samples and similarity tests.

[0131] 5. Establish a data evaluation model

[0132] Inverse standardization: The generated simulated abnormal transaction samples are restored to their original dimensions to ensure comparability with real transaction data.

[0133] Similarity test: A cosine similarity model is designed to evaluate the data, comparing the generated abnormal transaction samples with the original minority class samples to test the similarity between the generated data and real abnormal transactions. The similarity between the generated sample and the real historical abnormal transaction x0 is calculated. If the similarity is lower than expected, the diffusion model parameters are adjusted, such as increasing T and optimizing noise scheduling; if the similarity meets expectations, the data proceeds to the downstream classification stage.

[0134] 6. Create a balanced dataset: Mix the generated simulated abnormal samples with the normal transaction samples in the training set to balance the class distribution.

[0135] 7. Train the data classification model: Train the data classification model using the balanced dataset to learn the mapping relationship between transaction features and whether they are abnormal.

[0136] Predicting whether a transaction is abnormal: Using a trained classification model, predict whether real-time payment data is abnormal and output a risk assessment.

[0137] This embodiment generates abnormal transaction samples based on historical payment transaction data using a data diffusion model, and evaluates the data. After passing the evaluation, the generated abnormal transaction samples are merged with historical payment transaction data to form a balanced payment transaction training set. A data classification model is pre-trained, and the trained model is used to predict real-time payment transaction data. By supplementing the lack of real abnormal transaction samples, using similarity checks to ensure generation quality, and training the classification model after balancing the dataset, the system ultimately achieves the ability to predict whether a new transaction is abnormal.

[0138] Figure 4 A schematic diagram illustrating a real-time payment anomaly detection framework according to an embodiment of this application is provided.

[0139] like Figure 4 As shown, this embodiment is divided into two main stages: offline learning and online detection. It combines a data diffusion model to generate abnormal transaction samples and train a classification model to finally achieve real-time abnormal transaction identification. The details of each module are as follows.

[0140] First, in the offline learning phase, a data diffusion model is trained using historical data to generate simulated abnormal transaction samples, and then a classification model is trained to solve the problem of the scarcity of real abnormal transaction samples.

[0141] 1. Input data.

[0142] Historical payment transaction data: This includes full historical data of both normal and abnormal transactions, used to build the training set.

[0143] Historical abnormal transaction data: Samples of real abnormal transactions (such as fraudulent transactions) used to learn the characteristics of abnormal transactions.

[0144] After data preprocessing, the payment transaction data is constructed into the following two forms for model training.

[0145] (1) Matrix form (Batch Data): Each row represents a transaction record, and the columns represent feature dimensions. The data shape is (N, D), where N is the number of transaction samples and D is the feature dimension.

[0146] (2) Time-Series Data: Such as user behavior sequences, constructed in the form of a sliding window to represent the dynamic changes in continuous transactions. The data shape is (N, T, D), where T is the number of time steps. The fineness of the generated samples is controlled; the larger T is, the more detailed the generation process.

[0147] 2. Input the processed data into the data diffusion model. Noise is gradually added through a forward diffusion process, and then the original data distribution is gradually restored from the noisy data through a reverse generation process, generating high-dimensional latent features consistent with the distribution of the input data. These high-dimensional latent features can be used in the next step of the data classification model.

[0148] The network layers of the data diffusion model resemble a U-shaped network structure, with the dimensions of the different layers being: 1, 64, 128, 256, 512, 256, 128, 64, 1.

[0149] The forward process increases in dimension by gradually adding noise to the input historical abnormal transaction data, learning the mapping from real samples to noise; the reverse process decreases in dimension by denoising random noise in reverse to generate simulated abnormal transaction data.

[0150] By iteratively adding and removing noise, simulated samples similar to the characteristics of real abnormal transactions are generated, thus solving the problem of scarce abnormal transaction samples.

[0151] 3. Data evaluation and sample generation.

[0152] The data diffusion model generates abnormal transaction data.

[0153] Data Evaluation: Verify the similarity between the generated simulated abnormal transactions and historical abnormal transaction data to ensure the quality of the generated samples. After evaluation, output qualified simulated abnormal samples, supplement real abnormal data, and mix the generated abnormal transaction data with normal transactions in historical payment transaction data to balance the number of abnormal and normal samples, forming a balanced payment transaction training set.

[0154] 4. Train the data classification model.

[0155] The high-dimensional latent features generated by the data diffusion model in the previous step are fused with the preprocessed transaction features. By constructing a data classification model, the mapping relationship between transaction behavior and abnormal transaction labels is learned, which is used to predict whether a transaction is abnormal. After training the data classification model, it is tested using a test set to verify whether the model can identify abnormal transactions and to evaluate the model's performance.

[0156] Second, in the online detection phase, a pre-trained offline data classification model is used to determine in real time whether a new transaction is an abnormal transaction. A real-time payment anomaly detection system is constructed. The real-time detection module is the core execution part of the entire payment anomaly detection system. It uses stream processing technology to process the continuously flowing payment transaction data stream and provides risk scores or classification results for abnormal transactions within milliseconds.

[0157] 1. Input online payment transaction data, including real-time payment transactions (such as user card swipes and online payments), and assess risks immediately.

[0158] 2. Real-time anomaly detection.

[0159] This study utilizes a data classification model to extract features and make predictions from online payment transaction data. The input of online payment transaction data into the data classification model can be achieved by first extracting latent features using a data diffusion model, then fusing these latent features with the transaction data before inputting them into the model.

[0160] Transactions are categorized into normal and abnormal transactions, and warnings are issued for abnormal transactions. The model outputs a result indicating an abnormal transaction, triggering an alarm and allowing further actions such as blocking the transaction or notifying risk control personnel; otherwise, the transaction is marked as normal and allowed to proceed.

[0161] The online detection component ensures that transactions can be classified and decisions made in a very short time. Its implementation technology can be based on a stream processing architecture; for example, a high-efficiency data transmission and computation framework can enable payment transaction data to be transmitted and processed in real time. Its core function is to receive input data that has undergone preprocessing and feature generation, and then feed it into a trained data classification model for rapid prediction. To ensure response time, the real-time detection component employs a stream-based batch processing approach, acquiring and processing data in batches according to time windows, reducing latency in real-time inference.

[0162] This embodiment uses offline learning and a data diffusion model to generate simulated abnormal transaction samples. After balancing the dataset, a classification model is trained. Then, through online detection, the trained model is used to judge the risk of new transactions in real time, solving the problem of poor model performance due to the lack of abnormal transaction samples in payment scenarios, and achieving efficient and accurate anomaly detection.

[0163] Based on the above-mentioned payment anomaly detection method, this application also provides a payment anomaly detection device. The following will be combined with... Figure 5 The device is described in detail.

[0164] Figure 5 A schematic block diagram of a payment anomaly detection device according to an embodiment of this application is shown.

[0165] like Figure 5As shown, the payment anomaly detection device 500 of this embodiment includes a data enhancement module 510 and an anomaly detection module 520.

[0166] The data augmentation module 510 is used to input the payment data into a pre-trained data diffusion model in response to the acquisition of payment data, and to extract the latent features of the payment data.

[0167] The anomaly detection module 520 is used to fuse potential features with payment data and then input them into a pre-trained data classification model to obtain a classification result that the payment data conforms to an abnormal transaction.

[0168] The training method for the data diffusion model includes: gradually adding noise to the payment data samples according to a predetermined probability rule to form noisy data; gradually predicting noise from the noisy data, gradually removing noise based on the predetermined probability rule, and restoring the payment data that has the expected similarity to the distribution of the payment data samples; and training the data classification model based on the dataset after the payment data samples have been expanded by the data diffusion model.

[0169] According to an embodiment of this application, the anomaly detection module 520 is used to determine the generation weight of the first time interval of the abnormal transaction type to which the payment data belongs based on the classification result deviation of the payment data as an abnormal transaction within the first time interval; and to update and train the data diffusion model according to the generation weight of the first time interval; wherein, the generation weight is used to affect the noise addition rate of the abnormal transaction type to which the payment data belongs.

[0170] According to an embodiment of this application, the anomaly detection module 520 is used to update and train the data diffusion model based on the generation weights in the first time interval, including: determining the generation weights of the second time interval for the abnormal transaction type to which the payment data belongs based on the classification result deviation of the payment data as an abnormal transaction in the second time interval; obtaining calibrated generation weights by combining the generation weights in the first time interval and the generation weights in the second time interval; and updating and training the data diffusion model based on the calibrated generation weights; wherein the second time interval is longer than the first time interval.

[0171] According to an embodiment of this application, the anomaly detection module 520 is further configured to reduce the generation weight of the first time interval in response to the expected deviation of the classification result of payment data as an abnormal transaction in the third time interval.

[0172] The embodiments of this application construct an efficient, accurate, and real-time payment anomaly detection device by using a payment anomaly detection method based on a combination of a data diffusion model and a data classification model. The advantages of this method and device are as follows.

[0173] (1) By introducing a data diffusion model based on progressive noise reduction, noise is gradually added through diffusion to convert the original payment transaction data into a latent representation that follows a standard Gaussian distribution. Noise is then removed through the anti-diffusion process to restore the latent representation of the original transaction data. The latent features generated by the data diffusion model have high-dimensional representation capabilities. By oversampling abnormal transaction samples and balancing the training dataset, the data classification model focuses on the transaction data features of different labels, thereby improving the model's ability to detect abnormal transactions and solving the problem of poor detection accuracy caused by data imbalance. A classification algorithm is adopted to optimize the model's detection time, thereby improving the ability to identify real abnormal transaction patterns while improving the false alarm rate and enhancing the performance of abnormal transaction detection.

[0174] (2) The embodiments of this application are scalable. The system supports multi-dimensional feature input and can adapt to numerical, categorical, and time-series data. Both the data diffusion model and the data classification model can handle complex high-dimensional data structures. For example, it can connect to third-party access device information, IP addresses, behavioral data, etc., to further improve detection accuracy and flexibly handle the differences in feature distribution in different payment scenarios: online payment, offline card swiping, and cross-border payment. In addition, the embodiments of this application are highly portable and applicable to different financial scenarios. Besides being applicable to payment platforms, they can be extended to financial risk control scenarios such as credit scoring and loan approval.

[0175] According to embodiments of this application, any plurality of modules in the data enhancement module 510 and the anomaly detection module 520 can be combined into one module, or any one of the modules can be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules can be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the data enhancement module 510 and the anomaly detection module 520 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the data enhancement module 510 and the anomaly detection module 520 can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0176] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a payment anomaly detection method according to an embodiment of this application.

[0177] like Figure 6As shown, an electronic device 600 according to an embodiment of this application includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0178] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 602 and / or RAM 603. It should be noted that the programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0179] According to embodiments of this application, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0180] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0181] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0182] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement a payment anomaly detection method provided in the embodiments of this application.

[0183] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0184] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0185] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0186] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0187] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0188] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A payment anomaly detection method, characterized in that, include: In response to acquiring payment data, the payment data is input into a pre-trained data diffusion model to extract the latent features of the payment data; After fusing the potential features with the payment data, the data is input into a pre-trained data classification model to obtain a classification result that the payment data conforms to abnormal transactions. The data diffusion model is trained as follows: noise is gradually added to the payment data sample according to a predetermined probability rule to form noisy data; noise is gradually predicted from the noisy data, and noise is gradually removed based on the predetermined probability rule to restore the payment data that has the expected similarity to the distribution of the payment data sample. The data classification model is obtained by training the data dataset after expanding the payment data samples based on the data diffusion model.

2. The method according to claim 1, characterized in that, Also includes: Based on the deviation of the classification result of the payment data as abnormal transactions within the first time interval, the generation weight of the first time interval of the abnormal transaction type to which the payment data belongs is determined; The data diffusion model is updated and trained based on the generation weights of the first time interval; The generated weights are used to influence the noise addition rate of the abnormal transaction type to which the payment data belongs.

3. The method according to claim 2, characterized in that, The step of updating and training the data diffusion model based on the generation weights in the first time interval includes: Based on the deviation of the classification results of the payment data as abnormal transactions in the second time interval, the generation weight of the second time interval to which the payment data belongs to the abnormal transaction type is determined; The calibrated generation weights are obtained by combining the generation weights in the first time interval and the generation weights in the second time interval. The data diffusion model is updated and trained based on the calibrated generation weights; The second time interval is longer than the first time interval.

4. The method according to claim 2, characterized in that, Also includes: In response to the expected deviation in the classification result of the payment data as abnormal transactions in the third time interval, the generation weight of the first time interval is reduced; The end time of the third time interval is later than that of the first time interval.

5. The method according to claim 1, characterized in that, The noise is Gaussian noise; The stepwise prediction of noise from the noise data and the stepwise denoising based on a predetermined probability rule include: By parameterizing the Gaussian distribution through a neural network, the true distribution of the previous step is solved step by step from the noisy data in the form of a Markov chain. The mean and variance of the parameterized neural network are obtained by training the network through optimizing the log-likelihood variational lower bound, and the stepwise denoising result is generated.

6. The method according to claim 1, characterized in that, The process of reconstructing payment data that matches the expected similarity to the distribution of the payment data samples includes: When the similarity is less than expected, increase the number of steps to form noisy data from the payment data sample, and / or reduce the variance of the predicted noise distribution during the denoising process.

7. A payment anomaly detection device, characterized in that, The device includes: A data augmentation module, in response to acquiring payment data, inputs the payment data into a pre-trained data diffusion model to extract latent features from the payment data; and An anomaly detection module is used to fuse the potential features with the payment data and then input the data into a pre-trained data classification model to obtain a classification result that the payment data conforms to an abnormal transaction. The training method of the data diffusion model includes: gradually adding noise to the payment data sample according to a predetermined probability rule to form noisy data; gradually predicting noise from the noisy data; gradually removing noise based on the predetermined probability rule to restore the payment data that has the expected similarity to the distribution of the payment data sample. The data classification model is obtained by training the data dataset after expanding the payment data samples based on the data diffusion model.

8. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 6.

Images