Abnormal transaction identification method and device, equipment, storage medium and program product

Abstract

The invention discloses an abnormal transaction identification method and device, equipment, a storage medium and a program product, and relates to the technical field of computers, and the method comprises the steps: obtaining a multi-dimensional transaction attribute sequence of a receiving object corresponding to a transaction behavior; obtaining a time sequence feature of the multi-dimensional transaction attribute sequence, wherein the time sequence feature is used for representing a dependency relationship between transaction attributes of different dimensions and time; according to the multi-dimensional transaction attribute sequence, spatial features of the multi-dimensional transaction attributes are obtained, and the spatial features are used for representing a one-way dependency relationship between the transaction attributes of different dimensions; fusing the time sequence features and the space features to obtain space-time fusion features; and according to the space-time fusion feature, predicting a behavior probability that the transaction behavior belongs to an abnormal transaction behavior, and according to the behavior probability, obtaining a transaction behavior identification result of the transaction behavior, the transaction behavior identification result being used for indicating whether the transaction behavior belongs to the abnormal transaction behavior. Compared with the prior art, the transaction behavior identification method and device can improve the accuracy of transaction behavior identification.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to an abnormal transaction identification method, a transaction behavior identification device, an electronic device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] With the development of computer technology, transaction methods have gradually shifted from offline to online. The convenience of online transactions has led to a large number of abnormal transaction behaviors, such as fraudulent transactions.

[0003] Currently, abnormal transaction behavior is typically identified using predefined rules. For example, if a user makes a large number of transactions in a short period, or if a user's transaction amount far exceeds their average transaction amount, these transactions may be identified as abnormal. However, this rule-based transaction behavior identification can be bypassed through trial and error, resulting in low accuracy. Summary of the Invention

[0004] This application provides an abnormal transaction identification method, a transaction behavior identification device, an electronic device, a computer-readable storage medium, and a computer product, which can improve the accuracy of transaction behavior identification.

[0005] Firstly, the abnormal transaction identification method provided in this application includes:

[0006] Obtain the multidimensional transaction attribute sequence of the recipient corresponding to the transaction behavior;

[0007] Obtain the temporal features of the multidimensional transaction attribute sequence. The temporal features are used to characterize the dependence of different dimensions of transaction attributes on time.

[0008] Based on the multidimensional transaction attribute sequence, the spatial features of the multidimensional transaction attributes are obtained. The spatial features are used to characterize the unidirectional dependency relationship between transaction attributes of different dimensions.

[0009] By integrating temporal and spatial features, spatiotemporal fusion features are obtained;

[0010] Based on the spatiotemporal fusion characteristics, the probability of a transaction behavior belonging to abnormal transaction behavior is predicted, and the transaction behavior identification result is obtained based on the behavior probability. The transaction behavior identification result is used to indicate whether the transaction behavior belongs to abnormal transaction behavior.

[0011] Secondly, the transaction behavior identification device provided in this application includes:

[0012] The sequence acquisition module is used to acquire the multi-dimensional transaction attribute sequence of the recipient corresponding to the transaction behavior;

[0013] The temporal feature extraction module is used to obtain the temporal features of multidimensional transaction attribute sequences. The temporal features are used to characterize the dependence of different dimensions of transaction attributes on time.

[0014] The spatial feature extraction module is used to obtain the spatial features of multidimensional transaction attributes based on the multidimensional transaction attribute sequence. The spatial features are used to characterize the unidirectional dependency relationship between transaction attributes of different dimensions.

[0015] The feature fusion module is used to fuse temporal and spatial features to obtain spatiotemporal fused features;

[0016] The behavior recognition module is used to predict the probability that the transaction behavior belongs to abnormal transaction behavior based on spatiotemporal fusion features, and to obtain the transaction behavior recognition result of the transaction behavior based on the behavior probability. The transaction behavior recognition result is used to indicate whether the transaction behavior belongs to abnormal transaction behavior.

[0017] Optionally, in one embodiment, the sequence acquisition module is used to acquire the attribute values ​​of the multidimensional transaction attributes of the receiving object corresponding to the transaction behavior within a first historical time period; encode the attribute value of each dimension of the transaction attribute to obtain the attribute encoding value of each dimension of the transaction attribute; and obtain the multidimensional transaction attribute sequence of the receiving object corresponding to the transaction behavior in chronological order based on the attribute encoding value of each dimension of the transaction attribute.

[0018] Optionally, in one embodiment, the sequence acquisition module is used to obtain the attribute code value of each dimension transaction attribute based on the attribute value range in which the attribute value of each dimension transaction attribute is located, and the correspondence between the attribute value range associated with each dimension transaction attribute and the attribute code value.

[0019] Optionally, in one embodiment, the temporal feature extraction module is used to perform dilated convolution processing on the multidimensional transaction attribute sequence using the transaction behavior recognition model, and then activate it with the hyperbolic tangent activation function to obtain a first activation result; to perform dilated convolution processing on the multidimensional transaction attribute sequence using the transaction behavior recognition model, and then activate it with the S activation function to obtain a second activation result; and to perform a cross product operation on the first activation result and the second activation result using the transaction behavior recognition model to obtain the temporal features of the multidimensional transaction attribute sequence.

[0020] Optionally, in one embodiment, the spatial feature extraction module is used to obtain the adjacency matrix corresponding to the multidimensional transaction attributes through a transaction behavior recognition model based on the multidimensional transaction attribute sequence; and to perform graph convolution processing on the adjacency matrix through the transaction behavior recognition model to obtain the spatial features of the multidimensional transaction attributes.

[0021] Optionally, in one embodiment, the spatial feature extraction module is used to obtain the adaptive embedding vector of each dimension of the transaction attribute according to the multidimensional transaction attribute sequence through the transaction behavior recognition model; and to perform unidirectional cross-similarity calculation on the adaptive embedding vectors of different transaction attributes through the transaction behavior recognition model to obtain the adjacency matrix corresponding to the multidimensional transaction attributes.

[0022] Optionally, in one embodiment, the spatial feature extraction module is used to set the k smallest matrix elements in each row of the adjacency matrix to zero through the transaction behavior recognition model to obtain a sparse adjacency matrix; and to perform graph convolution processing on the sparse adjacency matrix through the transaction behavior recognition model to obtain the spatial features of multi-dimensional transaction attributes.

[0023] Optionally, in one embodiment, the transaction behavior recognition device provided in this application further includes a model training module, configured to acquire a first historical multidimensional transaction attribute sequence of a first historical recipient corresponding to a known first historical abnormal transaction behavior, and use the first historical multidimensional transaction attribute sequence as a positive sample; acquire a second historical multidimensional transaction attribute sequence of a second historical recipient corresponding to a known first historical normal transaction behavior, and use the second historical multidimensional transaction attribute sequence as a negative sample; and train the transaction behavior recognition model based on the positive and negative samples until a first preset stopping condition is met.

[0024] Optionally, in one embodiment, the model training module is further configured to split positive samples into m sub-positive samples and negative samples into m sub-negative samples in a time sequence; and to train the transaction behavior recognition model based on the sub-positive samples and sub-negative samples until a second preset stopping condition is met.

[0025] Optionally, in one embodiment, the transaction behavior identification device provided in this application further includes a model update module, configured to: if the transaction behavior identification result indicates that the transaction behavior belongs to abnormal transaction behavior, determine the historical payment object of the recipient's historical transaction behavior within a second historical time period; send an abnormal transaction behavior collaboration request to the historical payment object, instructing the historical payment object to collaboratively confirm whether the historical transaction behavior belongs to abnormal transaction behavior; divide the historical transaction behavior into a second historical abnormal transaction behavior and a second historical normal transaction behavior according to the historical payment object's abnormal transaction behavior collaboration response; obtain a third historical multidimensional transaction attribute sequence corresponding to the second historical abnormal transaction behavior, and use the third historical multidimensional transaction attribute sequence as an update positive sample; obtain a fourth historical multidimensional transaction attribute sequence corresponding to the second historical normal transaction behavior, and use the fourth historical multidimensional transaction attribute sequence as an update negative sample; and update the model parameters of the transaction behavior identification model according to the update positive sample and update negative sample.

[0026] Optionally, in one embodiment, the transaction behavior identification device provided in this application further includes a transaction control module, used to determine the abnormality level of the recipient based on the number of transactions of the second historical abnormal transaction behavior; and to suspend the transaction function corresponding to the abnormality level of the recipient based on the abnormality level.

[0027] Thirdly, the electronic device provided in this application includes a memory and a processor. The memory stores a computer program, and the processor is used to run the computer program in the memory to implement the steps in the abnormal transaction identification method provided in this application.

[0028] Fourthly, the computer-readable storage medium provided in this application stores a computer program adapted for processor execution to implement the steps in the abnormal transaction identification method provided in this application.

[0029] Fifthly, the computer program product provided in this application includes a computer program adapted for processor execution to implement the steps in the abnormal transaction identification method provided in this application.

[0030] The transaction behavior identification scheme provided in this application does not employ a predefined rule-based approach to identify abnormal transaction behavior. Instead, it obtains a sequence of transaction attributes corresponding to the recipient of the transaction behavior across multiple dimensions, resulting in a multidimensional transaction attribute sequence. Then, it acquires the temporal features of this multidimensional transaction attribute sequence in the time dimension, and the spatial features in the spatial dimension based on the same sequence. These temporal and spatial features are then fused to obtain a spatiotemporal fusion feature. Finally, based on this spatiotemporal fusion feature, the probability that the transaction behavior is abnormal is predicted, and the transaction behavior identification result indicating whether the transaction behavior is abnormal is obtained accordingly. Compared to identification methods based on predefined rules, this application not only utilizes the dependencies between different dimensions of transaction attributes and time, but also the unidirectional dependencies between different dimensions of transaction attributes. This fully leverages the features of different dimensions of transaction attributes in both the time and spatial dimensions, providing more information for predicting abnormal transaction behavior and increasing the difficulty of bypassing attempts, thereby improving the accuracy of transaction behavior identification. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1aThis is a schematic diagram of a scenario for the transaction behavior recognition system provided in this application embodiment;

[0033] Figure 1b This is a flowchart illustrating an abnormal transaction identification method provided in an embodiment of this application;

[0034] Figure 1c This is an example diagram of the architecture of the transaction behavior recognition model provided in the embodiments of this application;

[0035] Figure 1d yes Figure 1c A schematic diagram of the architecture of a mid-temporal feature extraction network;

[0036] Figure 1e yes Figure 1d A schematic diagram of the architecture of a dilated convolutional layer;

[0037] Figure 1f yes Figure 1c A schematic diagram of the architecture of a mid-space feature extraction network;

[0038] Figure 1g This is a schematic diagram of graph convolution processing in an embodiment of this application;

[0039] Figure 1h yes Figure 1c A schematic diagram of the architecture of a behavior recognition network;

[0040] Figure 2a This is another schematic diagram of the transaction behavior recognition model provided in the embodiments of this application;

[0041] Figure 2b This is another flowchart illustrating the abnormal transaction identification method provided in the embodiments of this application;

[0042] Figure 3 This is a schematic diagram of the transaction behavior recognition device provided in an embodiment of this application;

[0043] Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0044] It should be noted that the principles of this application are illustrated by example in a suitable computing environment. The following description is based on the specific embodiments of this application that are illustrated, and should not be regarded as limiting other specific embodiments not detailed herein.

[0045] In the following description of this application, "some embodiments" are referred to, which describe a subset of all possible embodiments. However, it is understood that "some embodiments" may be the same subset or different subset of all possible embodiments, and may be combined with each other without conflict.

[0046] In the following description of this application, the terms "first, second, third" are used only to distinguish similar objects and do not represent a specific order of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0047] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0048] It's important to clarify that Artificial Intelligence (AI) is the theory, methods, technology, and application systems that utilize digital computers or computers-controlled machines to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce new intelligent machines capable of reacting in a manner similar to human intelligence. AI essentially studies the design principles and implementation methods of various intelligent machines, enabling them to possess perception, reasoning, and decision-making capabilities.

[0049] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, pre-trained model technology, operating / interactive systems, and mechatronics. Pre-trained models, also known as large models or foundational models, can be widely applied to downstream tasks across various AI fields after fine-tuning. AI software technologies primarily include machine learning (ML), with deep learning (DL) being a relatively new research direction. It has been introduced into machine learning to bring it closer to its original goal: artificial intelligence. Currently, deep learning is mainly applied in areas such as machine vision and natural language processing. Deep learning learns the inherent patterns and hierarchical representations of sample data; the information gained during this learning process greatly aids in the interpretation of data such as text, images, and sound. Using deep learning techniques and corresponding training sets, network models that achieve different functions can be trained. For example, taking generative models as an example, based on different types of training sets, generative models that can generate different types of content can be trained, such as generative models that can generate images, generative models that can generate text, and generative models that can generate speech.

[0050] To improve the accuracy of transaction behavior identification, this application provides an abnormal transaction identification method, a transaction behavior identification device, an electronic device, a computer-readable storage medium, and a computer program product. The abnormal transaction identification method can be executed by the transaction behavior identification device or by an electronic device integrating the transaction behavior identification device.

[0051] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described below are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0052] Please refer to the reference. Figure 1a This application also provides a transaction behavior identification system, which includes an electronic device 100 for executing the abnormal transaction identification method provided in this application. The electronic device 100 can be any device equipped with a processor and having processing capabilities, such as mobile devices with processors, such as smartphones, tablets, PDAs, laptops, virtual reality devices, augmented reality devices, or mixed reality devices, or fixed devices with processors, such as desktop computers, televisions, servers, and industrial equipment. The process involves several steps. First, the sequence of transaction attributes of the recipient corresponding to the transaction behavior in different dimensions is obtained, resulting in a multidimensional transaction attribute sequence of the recipient. Then, the temporal features of this multidimensional transaction attribute sequence in the time dimension are obtained, along with the spatial features in the spatial dimension. The temporal features characterize the dependency relationship between different dimensions of transaction attributes and time, while the spatial features characterize the unidirectional dependency relationship between different dimensions of transaction attributes. Next, the temporal and spatial features are fused to obtain a spatiotemporal fusion feature. Finally, based on the spatiotemporal fusion feature, the probability that the transaction behavior belongs to an abnormal transaction behavior is predicted, and the transaction behavior identification result is obtained based on the behavior probability. This transaction behavior identification result indicates whether the transaction behavior belongs to an abnormal transaction behavior.

[0053] In addition, such as Figure 1a As shown, the transaction behavior recognition system may also include a memory 200 for storing relevant data during the transaction behavior recognition process, such as raw data like multidimensional transaction attribute sequences of different dimensions of transaction attributes, intermediate data such as temporal features, spatial features, spatiotemporal fusion features and behavior probabilities during the recognition process, and final result data such as the transaction behavior recognition result.

[0054] It should be noted that the transaction behavior recognition system described above is merely an example, intended to more clearly illustrate the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of transaction behavior recognition systems and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0055] The following sections provide detailed descriptions of each example. It should be noted that the sequence numbers of the following embodiments are not intended to limit the preferred order of the embodiments.

[0056] Please refer to Figure 1b , Figure 1b This is a flowchart illustrating the abnormal transaction identification method provided in this embodiment, as follows: Figure 1b As shown, the process of this abnormal transaction identification method can be as follows:

[0057] In 110, obtain the multi-dimensional transaction attribute sequence of the recipient corresponding to the transaction behavior.

[0058] For example, transactions can be online transactions based on applications, mini-programs, quick apps, or web pages with social attributes. For instance, if user A and user B in an instant messaging application are friends, the transaction could be a money transfer or sending red envelopes between them. Or, if user C and user D in an instant messaging application are not friends, the transaction could be a QR code transaction between them.

[0059] It should be noted that, apart from the transaction examples above, any transfer of resources from at least one party to at least another can be considered a transaction. For example, a transaction can also be the transfer of virtual resources between different user objects in a game application. It should also be noted that, in this embodiment, the party transferring resources is designated as the payer, and the party receiving the resources is designated as the receiver.

[0060] The following uses transaction behavior based on instant messaging applications as an example to illustrate the abnormal transaction identification method provided in this application.

[0061] It is understood that the server providing instant messaging services for an instant messaging application and the server providing transaction services for that instant messaging application can be the same server or different servers. In this embodiment, the electronic device can identify the server providing the transaction services and execute the abnormal transaction identification method provided in this application. Specifically, the electronic device can identify the generated transaction after it occurs but before it is executed to determine whether the transaction is abnormal, thereby determining whether to execute the transaction.

[0062] When identifying transaction behavior, the electronic device first obtains a multi-dimensional transaction attribute sequence of the recipient corresponding to the transaction behavior in different dimensions. For any dimension of the transaction attribute sequence, the transaction attribute sequence is used to represent the attribute value of the transaction attribute in that dimension at different time points in a time sequence.

[0063] The choice of which dimension of transaction attributes to use can be made by those skilled in the art based on actual needs. For example, for transaction behaviors based on applications, mini-programs, quick apps, or web pages with social attributes, transaction attributes such as transaction type, transaction amount, number of transactions, number of mutual friends of the transacting parties, and duration of the friendship between the transacting parties can be used to identify transaction behaviors.

[0064] Optionally, in one embodiment, obtaining the multi-dimensional transaction attribute sequence of the recipient corresponding to the transaction includes:

[0065] Obtain the attribute values ​​of the multi-dimensional transaction attributes of the recipient corresponding to the transaction behavior within the first historical time period;

[0066] Encode the attribute value of each dimension of the transaction attribute to obtain the attribute code value of each dimension of the transaction attribute;

[0067] Based on the attribute code value of each dimension of the transaction attribute, a multidimensional transaction attribute sequence of the receiving object corresponding to the transaction behavior is obtained in chronological order.

[0068] This application embodiment further provides an optional method for obtaining a multi-dimensional transaction attribute sequence. The electronic device first obtains the attribute values ​​of the multi-dimensional transaction attributes of the recipient corresponding to the transaction behavior within a first historical time period. For example, assuming the configured multi-dimensional transaction attributes for transaction behavior identification are transaction amount, duration of the friendship between the two parties, and number of mutual friends, the electronic device obtains the following: transaction amount of the recipient of the transaction behavior at a certain point in time within the first historical time period is 25 (i.e., the attribute value of this dimension, for example, in yuan); duration of the friendship between the two parties is 5 (i.e., the attribute value of this dimension, for example, in days); and number of mutual friends is 1.

[0069] It should be noted that the length of the first historical time period can be set by those skilled in the art according to actual needs, and no specific restrictions are imposed here. For example, with days as the unit of time, the first historical time period can be configured as [t-5, t], where t represents the day on which the abnormal transaction identification method provided in this application is executed.

[0070] As described above, after obtaining the attribute values ​​of the multi-dimensional transaction attributes of the recipient corresponding to the transaction behavior within the first historical time period, the electronic device further encodes the attribute value of each dimension of the transaction attribute to facilitate subsequent transaction behavior identification. This encodes the attribute values ​​of different dimensions of the transaction attributes to the same order of magnitude, resulting in the attribute code value for each dimension of the transaction attribute. There are no restrictions on the selection of the encoding method here; the constraint is that the attribute values ​​of different dimensions of the transaction attributes are encoded to the same order of magnitude. This method can be selected by those skilled in the art according to actual needs.

[0071] Accordingly, after encoding the attribute code value of each dimension of the transaction attribute, the electronic device obtains the multidimensional transaction attribute sequence of the receiving object corresponding to the transaction behavior according to the attribute code value of each transaction attribute in a time sequence.

[0072] For example, assuming the determined multidimensional transaction attributes used for transaction behavior identification are transaction attribute A, transaction attribute B, transaction attribute C, and transaction attribute D, the resulting multidimensional transaction attribute sequence can be represented as:

[0073] Transaction attribute A: [a0, a1, a2, a3, a4, a5, a6, a7, a8, a9]

[0074] Transaction attribute B: [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9]

[0075] Transaction attribute C: [c0, c1, c2, c3, c4, c5, c6, c7, c8, c9]

[0076] Transaction attribute D: [d0, d1, d2, d3, d4, d5, d6, d7, d8, d9].

[0077] In the transaction attribute sequence of transaction attribute A, a0-a9 represent the attribute code values ​​of transaction attribute A from time point 0 to time point 9, respectively; in the transaction attribute sequence of transaction attribute B, b0-b9 represent the attribute code values ​​of transaction attribute B from time point 0 to time point 9, respectively; in the transaction attribute sequence of transaction attribute C, c0-c9 represent the attribute code values ​​of transaction attribute C from time point 0 to time point 9, respectively; and in the transaction attribute sequence of transaction attribute D, d0-d9 represent the attribute code values ​​of transaction attribute D from time point 0 to time point 9, respectively.

[0078] Optionally, in one embodiment, the attribute value of each dimension of the transaction attribute is encoded to obtain the attribute encoding value of each dimension of the transaction attribute, including:

[0079] Based on the attribute value range in which the attribute value of each dimension of the transaction attribute is located, and the correspondence between the attribute value range associated with each dimension of the transaction attribute and the attribute code value, the attribute code value of each dimension of the transaction attribute is obtained.

[0080] In this embodiment, an interval mapping method is used to encode the attribute values ​​of transaction attributes. For each dimension of transaction attribute, a pre-set correspondence between attribute value intervals and attribute code values ​​is established. The correspondence between attribute value intervals and attribute code values ​​associated with different dimensions of transaction attributes needs to be comprehensively considered based on the original order of magnitude of the attribute values ​​for each dimension, with the constraint of mapping attribute values ​​of different orders of magnitude to the same order of magnitude.

[0081] Continuing with the example of the configured multi-dimensional transaction attributes used for transaction behavior identification, namely transaction amount, duration of the friendship between the two parties, and number of mutual friends, the transaction amount is divided into four attribute value ranges: below 50 yuan, 50 to 200 yuan, 200 to 100 yuan, and above 1000 yuan. These four attribute value ranges correspond to attribute code values ​​0, 1, 2, and 3, respectively. The duration of the friendship between the two parties is divided into five attribute value ranges: 0 days, 0 to 1 day, 1 to 7 days, 7 to 30 days, and above 30 days. These five attribute value ranges correspond to attribute code values ​​0, 1, 2, 3, and 4, respectively. The number of mutual friends between the two parties is divided into five attribute value ranges: 0, 1, 2 to 3, 4 to 6, and above 6. These five attribute value ranges correspond to attribute code values ​​0, 1, 2, 3, and 4, respectively.

[0082] For example, based on the correspondence between the attribute value range and attribute code value associated with each dimension of the transaction attribute, and according to the attribute value range in which each dimension of the transaction attribute falls, after obtaining the attribute code value of each dimension of the transaction attribute, the corresponding multidimensional transaction attribute sequence of the receiving object corresponding to the transaction behavior is obtained as follows:

[0083] Transaction amount: [0, 0, 1, 2, 2, 3, 2, 1, 1, 3]

[0084] Duration of the friendship between the transacting parties: [4, 4, 2, 3, 1, 1, 1, 2, 3, 1]

[0085] Number of mutual friends between the transacting parties: [4, 4, 2, 3, 1, 1, 1, 2, 3, 1]

[0086] In the above multidimensional transaction attribute sequence, the attribute code value of the first time point indicates that the recipient has made a transaction of less than 50 yuan, the recipient and the payer have been friends for more than 30 days, and the recipient and the payer have more than 6 mutual friends. The same applies to other time points, which will not be elaborated here.

[0087] In 120, the temporal features of the multidimensional transaction attribute sequence are obtained. The temporal features are used to characterize the dependence of different dimensions of transaction attributes on time.

[0088] Please refer to Figure 1c This application provides a transaction behavior recognition model, which consists of three parts: a temporal feature extraction network, a spatial feature extraction network, and a behavior recognition network. The temporal feature extraction network is configured to extract features of the input multidimensional transaction attribute sequence in the time dimension, used to represent the dependency relationship between different dimensions of transaction attributes and time, denoted as temporal features. The spatial feature extraction network is configured to extract features of the input multidimensional transaction attribute sequence in the spatial dimension, used to represent the unidirectional dependency relationship between different dimensions of transaction attributes, denoted as spatial features. The behavior recognition network is configured to fuse the temporal and spatial features to obtain spatiotemporal fusion features, thereby simultaneously utilizing the dependency relationship between different dimensions of transaction attributes relative to time and the unidirectional dependency relationship between different dimensions of transaction attributes to predict the probability that the transaction behavior belongs to abnormal transaction behavior. Accordingly, based on the behavior probability predicted by the transaction behavior recognition model, the transaction behavior recognition result can be obtained, indicating whether the identified transaction behavior belongs to abnormal transaction behavior.

[0089] It should be noted that, subject to the constraints of achieving their respective configurations, the network structures of the above-mentioned temporal feature extraction network, spatial feature extraction network, and behavior recognition network can be configured by those skilled in the art according to actual needs, and no restrictions are imposed here.

[0090] Accordingly, in this embodiment of the application, after the electronic device obtains the multidimensional transaction attribute sequence of the recipient corresponding to the transaction behavior to be identified, it further inputs the obtained multidimensional transaction attribute sequence into the temporal feature extraction network of the transaction behavior identification model, and extracts the features of the input multidimensional transaction attribute sequence in the time dimension through the temporal feature extraction network to obtain the temporal features of the multidimensional transaction attribute sequence.

[0091] In one embodiment, an optional method for obtaining time-series features is provided, which obtains the time-series features of a multi-dimensional transaction attribute sequence, including:

[0092] The first activation result is obtained by performing dilated convolution on the multidimensional transaction attribute sequence through the transaction behavior recognition model and then activating it with the hyperbolic tangent activation function.

[0093] By using a transaction behavior recognition model, the multidimensional transaction attribute sequence is subjected to dilated convolution and then activated by the S activation function to obtain the second activation result.

[0094] By using a transaction behavior recognition model, a cross product operation is performed on the first activation result and the second activation result to obtain the temporal features of the multidimensional transaction attribute sequence.

[0095] Please refer to Figure 1d The temporal feature extraction network of the transaction behavior recognition model consists of two dilated convolutional layers, as well as hyperbolic tangent activation function (also known as tanh activation function) layers, S activation function (also known as sigmoid activation function) layers, and cross product operation layers.

[0096] Specifically, two dilated convolutional layers are configured to perform dilated convolution processing on the input multidimensional transaction attribute sequence, respectively; a hyperbolic tangent activation function layer is configured to activate the result of the dilated convolution after processing one dilated convolutional layer; an S-activation function layer is configured to activate the result of the dilated convolution after processing another dilated convolutional layer; and a cross product operation layer is configured to perform a cross product operation on the activation results of the hyperbolic tangent activation function layer and the S-activation function layer. It should be noted that, please refer to... Figure 1e In this embodiment, the two dilated convolutional layers are configured identically, each consisting of multiple one-dimensional dilated convolutional kernels and a channel concatenation module. For any dilated convolutional layer, the one-dimensional dilated convolutional kernels are configured to perform dilated convolution processing on the multi-dimensional transaction attribute sequence to extract high-level features of the multi-dimensional transaction attribute sequence in the time dimension. The channel concatenation module is configured to concatenate the dilated convolution results of each dilated convolutional kernel according to channels to obtain the dilated convolution result of the dilated convolutional layer. The number and size of the dilated convolutional kernels in the dilated convolutional layer are not specifically limited here and can be set by those skilled in the art according to actual needs. As an example, in this embodiment, each dilated convolutional layer uses four dilated convolutional kernels with sizes of 1*2, 1*3, 1*6, and 1*7, respectively.

[0097] Accordingly, when electronic devices obtain the temporal features of multidimensional transaction attribute sequences through a transaction behavior recognition model, they input the multidimensional transaction attribute sequences into two dilated convolutional layers of the temporal feature extraction network for dilation convolution processing. The dilation convolution result of one of the dilated convolutional layers is further input into a hyperbolic tangent activation function layer for activation processing, and the activation result of the hyperbolic tangent activation function layer is recorded as the first activation result. The dilation convolution result of the other dilated convolutional layer is further input into an S activation function layer for activation processing, and the activation result of the S activation function layer is recorded as the second activation result. Finally, the first and second activation results are input into a cross product operation layer for cross product operation, and the resulting cross product is the temporal feature of the multidimensional transaction attribute sequence.

[0098] It should be noted that the hyperbolic tangent activation function layer above works as a filter, and the S activation function layer works as a gated filter, controlling the amount of information that can be passed to subsequent networks, that is, controlling the amount of information of the temporal features extracted by the temporal feature extraction network.

[0099] In 130, based on the multidimensional transaction attribute sequence, the spatial features of the multidimensional transaction attributes are obtained. The spatial features are used to characterize the unidirectional dependency relationship between transaction attributes of different dimensions.

[0100] It should be noted that in abnormal transaction behavior, the dependencies between different transaction attributes are asymmetric, that is, the influence of one transaction attribute on another is asymmetric. Therefore, in the embodiments of this application, in addition to obtaining the temporal features of the multidimensional transaction attribute sequence in the time dimension, the electronic device also obtains the spatial features of the multidimensional transaction attributes in the spatial dimension based on the multidimensional transaction attribute sequence, and uses the spatial features to characterize the unidirectional dependencies between different dimensional transaction attributes.

[0101] Among them, electronic devices can input the acquired multidimensional transaction attribute sequence into the spatial feature extraction network of the transaction behavior recognition model, and extract the spatial features of the multidimensional transaction attributes in the spatial dimension through the spatial feature extraction network.

[0102] It should be noted that the one-way dependency between different dimensions of transaction attributes can be understood as the difference in the amount of information transmitted between the different dimensions of transaction attributes. For example, the one-way dependency between transaction attribute A and transaction attribute B is the difference between the amount of information transmitted from transaction attribute A to transaction attribute B and the amount of information transmitted from transaction attribute B to transaction attribute B. The larger this difference, the stronger the one-way dependency between transaction attribute A and transaction attribute B. For instance, if the amount of information transmitted from transaction attribute A to transaction attribute B is 10, and the amount of information transmitted from transaction attribute B to transaction attribute A is 8, this application only considers the one-way dependency between transaction attribute A and transaction attribute B, assuming that the amount of information transmitted from transaction attribute A to transaction attribute B is 2, while the amount of information transmitted from transaction attribute B to transaction attribute A is 0.

[0103] Furthermore, it should be noted that the execution order of the steps for obtaining spatial features and the steps for obtaining temporal features is not affected by the number. It can be that 120 is executed before 130, or 130 is executed before 120, or 120 and 130 are executed simultaneously.

[0104] For example, electronic devices can synchronously input the acquired multidimensional transaction attribute sequence into the temporal feature extraction network and spatial feature extraction network of the transaction behavior recognition model, and synchronously extract the temporal features of the multidimensional transaction attribute sequence and the spatial features of the multidimensional transaction attributes.

[0105] Optionally, in one embodiment, obtaining the spatial features of the multidimensional transaction attributes based on the multidimensional transaction attribute sequence includes:

[0106] Based on the multidimensional transaction attribute sequence, the adjacency matrix corresponding to the multidimensional transaction attributes is obtained through the transaction behavior recognition model;

[0107] By using a transaction behavior recognition model, graph convolution processing is performed on the adjacency matrix to obtain spatial features of multi-dimensional transaction attributes.

[0108] Adjacency matrices are a graph representation method that displays the graph structure in matrix form, representing the dependencies between nodes in the graph using a two-dimensional matrix. However, for multiple transaction attributes with different dimensions, the dependencies between these attributes cannot be determined. In this embodiment, it is necessary to learn the dependencies between transaction attributes with different dimensions from the data.

[0109] Please refer to Figure 1f In this embodiment of the application, the spatial feature extraction network may include a graph representation learning layer and a graph convolutional layer, wherein the graph representation learning layer is configured to adaptively learn the adjacency matrix corresponding to the multidimensional transaction attributes based on the input multidimensional transaction attribute sequence, and the graph convolutional layer is configured to perform graph convolution processing on the input adjacency matrix to obtain the spatial features of the multidimensional transaction attributes.

[0110] Correspondingly, when electronic devices obtain the spatial features of multi-dimensional transaction attributes through the transaction behavior recognition model, they first input the multi-dimensional transaction attribute sequence into the graph representation learning layer of the spatial feature extraction network. The graph representation learning layer adaptively learns the adjacency matrix corresponding to the multi-dimensional transaction attributes. Then, the adjacency matrix is ​​input into the graph convolution layer, and the graph convolution layer performs graph convolution processing on the adjacency matrix to obtain the spatial features of the multi-dimensional transaction attributes.

[0111] It should be noted that the method of graph convolution processing in the embodiments of this application is not specifically limited, and can be selected by those skilled in the art according to actual needs. As an example, this application uses GraphSage to perform graph convolution processing.

[0112] Please refer to Figure 1g The diagram illustrates a graph represented by an adjacency matrix, where nodes represent transaction attributes. For a given transaction attribute, the neighboring transaction attributes are first sampled according to the adjacency matrix; then, the information of the neighboring transaction attributes is aggregated through two layers of aggregation functions; finally, the aggregated information is used to predict the label vector of the transaction attribute; thus, the label vectors of each transaction attribute can be obtained, and the spatial features of the multidimensional transaction attributes can be obtained by combining these label vectors of different transaction attributes.

[0113] Optionally, in one embodiment, based on the multi-dimensional transaction attribute sequence, the adjacency matrix corresponding to the multi-dimensional transaction attributes is obtained through a transaction behavior recognition model, including:

[0114] Based on the multidimensional transaction attribute sequence, an adaptive embedding vector for each dimension of the transaction attribute is obtained through a transaction behavior recognition model;

[0115] By using a transaction behavior recognition model, one-way cross-similarity calculation is performed on the adaptive embedding vectors of different transaction attributes to obtain the adjacency matrix corresponding to the multi-dimensional transaction attributes.

[0116] In this embodiment of the application, when the electronic device adaptively learns the adjacency matrix corresponding to the multi-dimensional transaction attribute through the graph representation learning layer, the electronic device first obtains the initial embedding vector of the transaction attribute for each transaction attribute sequence in the multi-dimensional transaction attribute sequence, and then adaptively learns the adaptive embedding vector of the transaction attribute for each dimension based on the initial embedding vector of each transaction attribute through the graph representation learning layer.

[0117] As shown above, after learning the adaptive embedding vector of each dimension of transaction attribute, the electronic device further performs unidirectional cross-similarity calculation on the adaptive embedding vectors of different transaction attributes through the graph representation learning layer to obtain the adjacency matrix corresponding to the multidimensional transaction attributes.

[0118] The process of obtaining the adjacency matrix described above can be represented as follows:

[0119] M1 = tanh(αE1Θ1);

[0120] M2 = tanh(αE2Θ2);

[0121]

[0122] Where tanh() represents the hyperbolic tangent activation function, ReLU() represents the linear rectified activation function, α represents the hyperparameter controlling the saturation of the hyperbolic tangent activation function and the linear rectified activation function, Θ1 and Θ2 are the model parameters of the graph representation learning layer, E1 represents the initial embedding vector of one transaction attribute, E2 represents the initial embedding vector of another transaction attribute, and A represents the adjacency matrix.

[0123] Optionally, in one embodiment, before performing graph convolution processing on the adjacency matrix using a transaction behavior recognition model to obtain the spatial features of multi-dimensional transaction attributes, the method further includes:

[0124] By using a transaction behavior recognition model, the k smallest matrix elements in each row of the adjacency matrix are set to zero to obtain a sparse adjacency matrix.

[0125] By using a transaction behavior recognition model, graph convolution processing is performed on the adjacency matrix to obtain spatial features of multi-dimensional transaction attributes, including:

[0126] By using a transaction behavior recognition model, graph convolution is performed on the sparse adjacency matrix to obtain the spatial features of multi-dimensional transaction attributes.

[0127] To reduce the computational load of subsequent graph convolution processing, the original adjacency matrix is ​​also subjected to sparse processing in this embodiment.

[0128] In this process, after obtaining the adjacency matrix corresponding to the multi-dimensional transaction attributes through the graph learning layer, the electronic device uses the graph learning representation layer to set the k smallest matrix elements in each row of the adjacency matrix to zero. That is, for each transaction attribute, the k farthest transaction attributes are no longer considered as its neighbors, resulting in a sparse adjacency matrix. Here, k is a positive integer greater than 0, which can be selected by those skilled in the art according to actual needs.

[0129] Correspondingly, electronic devices use the graph convolutional layer of the spatial feature extraction network to perform graph convolution processing on the sparse adjacency matrix to obtain the spatial features of multi-dimensional transaction attributes.

[0130] In 140, temporal and spatial features are fused to obtain spatiotemporal fusion features.

[0131] As described above, after obtaining the temporal and spatial features of the multidimensional transaction attribute sequence, the obtained temporal and spatial features are further fused, and the fused feature is denoted as the spatiotemporal fusion feature. Thus, this spatiotemporal fusion feature integrates the temporal and spatial features of the multidimensional transaction attribute sequence, and can not only utilize the dependency relationship between transaction attributes and time, but also the unidirectional dependency relationship between different transaction attributes to predict the probability that the transaction behavior belongs to abnormal transaction behavior.

[0132] The temporal and spatial features obtained above can be input into the behavior recognition network of the transaction behavior recognition model. The temporal and spatial features are then fused through the behavior recognition network to obtain spatiotemporal fusion features.

[0133] It should be noted that the embodiments of this application do not impose specific limitations on the fusion method of temporal and spatial features, and can be selected by those skilled in the art according to actual needs.

[0134] As an example, in order to better preserve the features of the time dimension and the spatial dimension, in this embodiment of the application, the electronic device can use the behavior recognition network of the transaction behavior recognition model to splice the temporal features and spatial features in the channel dimension, thereby obtaining the fused features of the temporal features and spatial features, also known as the spatiotemporal fused features.

[0135] For example, if the temporal feature has 'a' channels and the spatial feature has 'b' channels, then by concatenating the temporal and spatial features along the channel dimension, the resulting spatiotemporal fusion feature has a+b channels.

[0136] In 150, based on the spatiotemporal fusion characteristics, the probability of a transaction behavior belonging to abnormal transaction behavior is predicted, and the transaction behavior identification result of the transaction behavior is obtained based on the behavior probability. The transaction behavior identification result is used to indicate whether the transaction behavior belongs to abnormal transaction behavior.

[0137] As described above, after fusing temporal and spatial features to obtain spatiotemporal fusion features, the probability that a transaction behavior belongs to an abnormal transaction behavior is predicted using the transaction behavior recognition model provided in this application based on these spatiotemporal fusion features. This probability is denoted as the behavior probability. Accordingly, the transaction behavior recognition result can be obtained based on this behavior probability, and the transaction behavior recognition result can be used to indicate whether the transaction behavior belongs to an abnormal transaction behavior. Abnormal transaction behavior can be defined by those skilled in the art according to actual needs. For example, abnormal transaction behavior can be fraudulent, involuntary, or other such behavior.

[0138] As an example, based on spatiotemporal fusion features, the behavior recognition network of the transaction behavior recognition model can predict the probability that a transaction behavior belongs to abnormal behavior, and obtain the transaction behavior recognition result based on this probability. Specifically, when the probability that a transaction behavior belongs to abnormal behavior reaches a probability threshold, a transaction behavior recognition result indicating that the transaction behavior belongs to abnormal behavior is obtained; when the probability that a transaction behavior belongs to abnormal behavior is less than the probability threshold, a transaction behavior recognition result indicating that the transaction behavior does not belong to abnormal behavior, or a transaction behavior recognition result indicating that the transaction behavior belongs to normal behavior, is obtained.

[0139] Optionally, in one embodiment, predicting the probability that a transaction behavior belongs to an abnormal transaction behavior based on spatiotemporal fusion characteristics includes:

[0140] By using a transaction behavior recognition model, spatiotemporal fusion features are processed using a fully connected method to obtain a fully connected result.

[0141] By using a transaction behavior identification model, the results of the fully connected component are normalized to an exponential value to obtain the probability that the transaction behavior belongs to abnormal transaction behavior.

[0142] Please refer to Figure 1h In this embodiment, the behavior recognition network can consist of a feature fusion layer, a fully connected layer, and a normalized exponential function (also known as Softmax) layer. The feature fusion layer is configured to concatenate temporal features and spatiotemporal features in the channel dimension to obtain spatiotemporal fusion features. The fully connected layer is configured to perform fully connected processing on the spatiotemporal fusion features to obtain a fully connected result. The normalized exponential function layer is configured to perform normalized exponential processing on the fully connected result, thereby mapping the fully connected result to a two-dimensional vector (a, b), where a and b both take values ​​between 0 and 1, and a + b = 1. a represents the probability that the transaction behavior is not an abnormal transaction behavior (that is, the probability that it is a normal transaction behavior), and b represents the probability that the transaction behavior is an abnormal transaction behavior.

[0143] Correspondingly, the electronic device concatenates temporal and spatial features along the channel dimension through a feature fusion layer to obtain a spatiotemporal fusion feature. Then, a fully connected layer processes the spatiotemporal fusion feature to obtain a fully connected result. This fully connected result is then input into a normalized exponential function layer for normalization, resulting in a two-dimensional vector (a, b) representing the probability of whether a transaction is an abnormal transaction. For example, assuming a probability threshold of 60%, when the output of the normalized exponential function layer is (0.6, 0.4), the probability of the transaction being an abnormal transaction is 40%, which does not reach the 60% probability threshold. In this case, the transaction behavior identification result indicating that the transaction is not an abnormal transaction is obtained. Conversely, when the output of the normalized exponential function layer is (0.4, 0.6), the probability of the transaction being an abnormal transaction is 60%, which reaches the 60% probability threshold. In this case, the transaction behavior identification result indicating that the transaction is an abnormal transaction is obtained.

[0144] Optionally, in one embodiment, after obtaining the transaction behavior identification result based on the behavior probability, the method further includes:

[0145] If the transaction behavior identification result indicates that the transaction behavior is abnormal, then the transaction behavior will be blocked.

[0146] It is understandable that when a transaction is considered abnormal, its execution may result in a loss for the recipient. Therefore, to avoid such losses, in this embodiment, if the transaction identification result indicates that the transaction is abnormal, the electronic device intercepts the transaction and suspends its execution.

[0147] In other embodiments, the electronic device may also send a transaction notification message to the payment recipient, which indicates that the transaction is an abnormal transaction and has been blocked.

[0148] In one embodiment, an optional training scheme for a transaction behavior recognition model is also provided, which, before obtaining the multi-dimensional transaction attribute sequence of the recipient corresponding to the transaction behavior, further includes:

[0149] Obtain the first historical multidimensional transaction attribute sequence of the first historical recipient corresponding to the known first historical abnormal transaction behavior, and use the first historical multidimensional transaction attribute sequence as a positive sample;

[0150] Obtain the second historical multidimensional transaction attribute sequence of the second historical recipient corresponding to the known first historical normal transaction behavior, and use the second historical multidimensional transaction attribute sequence as a negative sample;

[0151] The transaction behavior recognition model is trained based on positive and negative samples until the first preset stopping condition is met.

[0152] In this embodiment, to enable the transaction behavior recognition model to accurately predict the probability of whether a transaction behavior belongs to an abnormal transaction behavior, positive and negative samples are used to train the transaction behavior recognition model. For distinction, known historical abnormal transaction behaviors are recorded as first historical abnormal transaction behaviors, the historical recipients corresponding to the first historical abnormal transaction behaviors are recorded as first historical recipients, known historical normal transaction behaviors are recorded as first historical normal transaction behaviors, and the historical recipients corresponding to the first historical normal transaction behaviors are recorded as second historical recipients. Based on this, for a known first historical abnormal transaction behavior, the electronic device obtains the historical multidimensional transaction attribute sequence of the first historical recipient corresponding to the first historical abnormal transaction behavior, which is recorded as the first historical multidimensional transaction attribute sequence. The method of obtaining the first historical multidimensional transaction attribute sequence is not described in detail here, but can be obtained by referring to the method of obtaining the multidimensional transaction attribute sequence of the recipient corresponding to the transaction behavior in the above embodiments. Furthermore, for a known first historical normal transaction behavior, the electronic device obtains the historical multidimensional transaction attribute sequence of the second historical recipient corresponding to the first historical normal transaction behavior, which is denoted as the second historical multidimensional transaction attribute sequence. The method of obtaining the second historical multidimensional transaction attribute sequence will not be elaborated here, but can be obtained by referring to the method of obtaining the multidimensional transaction attribute sequence of the recipient corresponding to the transaction behavior in the above embodiments.

[0153] As described above, for each known first historical abnormal transaction behavior, a corresponding first historical multidimensional transaction attribute sequence can be obtained; for each known first historical normal transaction behavior, a corresponding second historical multidimensional transaction attribute sequence can be obtained. In this embodiment, the obtained first historical multidimensional transaction attribute sequence is used as a positive sample, and the obtained second historical multidimensional attribute sequence is used as a negative sample.

[0154] It should be noted that the embodiments of this application do not impose specific restrictions on the ratio of positive samples to negative samples obtained, and can be configured by those skilled in the art according to actual needs.

[0155] As an example, an electronic device can determine the degree of anomalousness of a transaction based on the sample sampling ratio of the first historical normal transaction behavior and the first historical abnormal transaction behavior within a third historical time period (the value can be chosen by the designer in the art according to actual needs, and is not limited here). (The degree of anomalousness is negatively correlated with the ratio of normal transaction behavior to the first historical abnormal transaction behavior; that is, the larger the ratio of the first historical normal transaction behavior to the first historical abnormal transaction behavior, the lower the degree of anomalousness of the transaction behavior.) Then, based on the preset correspondence between the degree of anomalousness and the sample sampling ratio, the sample sampling ratio of positive samples and negative samples is determined. For example, assuming that the determined degree of anomalousness is low, and the sample sampling ratio determined based on this degree of anomalousness is 1:50, then when acquiring positive samples and negative samples, they are acquired accordingly according to this sample sampling ratio, that is, the final ratio of the number of positive samples and negative samples is 1:50.

[0156] As mentioned above, after obtaining positive and negative samples, the transaction behavior recognition model is trained based on the obtained positive and negative samples until the first preset stopping condition is met. There are no restrictions on the setting of the first preset stopping condition. It can be set by those skilled in the art according to actual needs. For example, the first preset stopping condition can be configured to update the model parameters of the transaction behavior recognition model to a first preset number of times, or it can be configured to the transaction behavior recognition model converge.

[0157] In this process, the electronic device inputs a batch of samples (including positive and negative samples) into the transaction behavior recognition model for prediction, and obtains the prediction results (a) corresponding to each sample in that batch. i b i Then, based on the prediction results corresponding to each batch of samples (a) i b i ), i∈(1,n), n represents the number of samples in the batch, and the expected prediction result (0,1) for positive samples and the expected prediction result (1,0) for negative samples, to obtain the loss of the batch; based on the loss of the batch, the model parameters of the transaction behavior recognition model are updated by gradient descent; this is repeated until the first preset stopping condition is met.

[0158] It should be noted that the embodiments of this application do not limit the type of loss to be used, and those skilled in the art can select it according to actual needs. As an example, the embodiments of this application use mean square error loss.

[0159] Optionally, in one embodiment, training the transaction behavior recognition model based on positive and negative samples until a first preset stopping condition is met further includes:

[0160] The positive samples are split into m sub-positive samples in chronological order, and the negative samples are split into m sub-negative samples.

[0161] The transaction behavior recognition model is trained based on the positive and negative sub-samples until the second preset stopping condition is met.

[0162] In this embodiment, to enable the transaction behavior recognition model to achieve stronger generalization ability and faster training efficiency, it is not directly trained using complete positive and negative samples. Instead, before training the model using complete positive and negative samples, each positive sample is first split into m sub-positive samples and each negative sample is split into m sub-negative samples in a temporal sequence, where m is a positive integer greater than 1, and can be selected by those skilled in the art according to actual needs. The method of splitting positive and negative samples is not limited here; those skilled in the art can select a suitable splitting method according to actual needs. As an example, this embodiment uses random splitting to split positive and negative samples.

[0163] As shown above, after splitting the positive and negative samples, the transaction behavior recognition model is further trained based on the sub-positive and sub-negative samples obtained from the split.

[0164] In this process, the electronic device inputs a batch of sub-samples (including positive and negative sub-samples) into the transaction behavior recognition model for prediction, and obtains the prediction results (a) corresponding to each sub-sample in that batch. j b j ), j∈(1,m), where m represents the number of samples in the batch; then, based on the prediction results (a) corresponding to each subsample in the batch. j b j The mean squared error loss for this batch is obtained by taking the expected prediction result (0, 1) for positive samples and (1, 0) for negative samples. Based on this mean squared error loss, the model parameters of the transaction behavior recognition model are updated using gradient descent. This process is repeated until a second preset stopping condition is met. The setting of the second preset stopping condition is not limited here and can be set by those skilled in the art according to actual needs. For example, the second preset stopping condition can be configured to update the model parameters of the transaction behavior recognition model a second preset number of times.

[0165] As mentioned above, after training the transaction behavior recognition model using shorter sub-positive / negative samples from more complete positive / negative samples, the model is then trained again using complete positive / negative samples. This approach of learning from short samples first and then from long samples improves the training efficiency of the transaction behavior recognition model. Furthermore, by adding sub-positive / negative samples to the training of the transaction behavior recognition model based on the original positive / negative samples, the generalization ability of the transaction behavior recognition model can be improved.

[0166] Optionally, in one embodiment, after obtaining the transaction behavior identification result based on the behavior probability, the process includes:

[0167] If the transaction behavior identification result indicates that the transaction behavior is an abnormal transaction behavior, then the historical payment object of the recipient's historical transaction behavior in the second historical time period is determined.

[0168] Send an abnormal transaction behavior coordination request to the historical payment object, instructing the historical payment object to cooperate in confirming whether the historical transaction behavior is abnormal;

[0169] Based on the coordinated response to abnormal transaction behavior of historical payment recipients, historical transaction behavior is divided into second historical abnormal transaction behavior and second historical normal transaction behavior.

[0170] Obtain the third historical multidimensional transaction attribute sequence corresponding to the second historical abnormal transaction behavior, and use the third historical multidimensional transaction attribute sequence as the update positive sample;

[0171] Obtain the fourth historical multidimensional transaction attribute sequence corresponding to the second historical normal transaction behavior, and use the fourth historical multidimensional transaction attribute sequence as the update negative sample;

[0172] Update the model parameters of the transaction behavior recognition model based on the updated positive and negative samples.

[0173] If the transaction behavior identification result obtained based on the behavior probability indicates that the transaction behavior is an abnormal transaction behavior, the electronic device further determines the historical payment object of the historical transaction behavior of the recipient of the transaction behavior within the configured second historical time period. The length of the second historical time period is not limited here and can be set by those skilled in the art according to actual needs. After determining the historical payment object, an abnormal transaction behavior coordination request is sent to the historical payment object according to a pre-agreed message format, instructing the historical payment object to coordinate and confirm whether the historical transaction behavior is an abnormal transaction behavior. The electronic device receives the abnormal transaction behavior coordination response returned by the historical payment object based on the abnormal transaction behavior coordination request. This response indicates whether the historical payment object agrees that the historical transaction behavior is an abnormal transaction behavior. Accordingly, based on the historical payment object's abnormal transaction behavior coordination response, the historical transaction behavior is divided into two parts, one of which is an abnormal transaction behavior. The historical transaction behaviors are recorded as the second historical abnormal transaction behaviors, and the other part of the historical transaction behaviors that are normal transactions are recorded as the second historical normal transaction behaviors. According to the acquisition method of the multi-dimensional transaction attribute sequence of the recipient corresponding to the transaction behavior in the above embodiment, the third historical multi-dimensional transaction attribute sequence corresponding to the second historical abnormal transaction behavior and the fourth historical multi-dimensional transaction attribute sequence corresponding to the second historical normal transaction behavior are acquired accordingly. The third historical multi-dimensional transaction attribute sequence is used as the positive update sample, and the fourth historical multi-dimensional transaction attribute sequence is used as the negative update sample. When the number of accumulated positive update samples and negative update samples reaches the preset number, and the ratio of positive update samples to negative update samples reaches the sample sampling ratio, the target positive update sample and target negative update sample are selected according to the sample sampling ratio to update the model parameters of the transaction behavior recognition model, and the model parameters of the transaction behavior recognition model are updated according to the target positive update sample and target negative update sample.

[0174] As for how to use the target to update positive samples and target to update negative samples to update the model parameters of the transaction behavior recognition model, the same method of training the transaction behavior recognition model based on positive samples and negative samples in the above embodiments can be used, and will not be repeated here.

[0175] Optionally, in one embodiment, for the recipient, the transaction function is further controlled based on the abnormality of their transaction behavior. After coordinating responses based on the abnormal transaction behavior of historical payment recipients and dividing historical transaction behavior into second historical abnormal transaction behavior and second historical normal transaction behavior, the method further includes:

[0176] The level of abnormality of the recipient is determined based on the number of transactions in the second historical abnormal transaction behavior;

[0177] Based on the level of abnormality, the transaction function corresponding to the abnormality level of the receiving object will be suspended.

[0178] In this embodiment, after dividing the recipient's historical transaction behavior within a second historical time period into second historical abnormal transaction behavior and second historical normal transaction behavior, the recipient's abnormality level is determined based on the number of transactions in the second historical abnormal transaction behavior and the preset correspondence between transaction frequency ranges and abnormality levels. The correspondence between transaction frequency ranges and abnormality levels can be set by those skilled in the art according to actual needs, and is not specifically limited here.

[0179] Furthermore, this application embodiment also pre-defines the correspondence between anomaly levels and transaction functions that need to be suspended. As an example, there are three anomaly levels: low anomaly level, medium anomaly level, and high anomaly level. The transaction function that needs to be suspended for the low anomaly level is the withdrawal function, the transaction function that needs to be suspended for the medium anomaly level is the withdrawal function and the transfer function, and the transaction function that needs to be suspended for the high anomaly level is all transaction functions, including withdrawal function, transfer function, QR code transaction function, and red envelope function.

[0180] As described above, after determining the abnormality level of the recipient, the system further suspends the transaction functions corresponding to the recipient's abnormality level based on the preset correspondence between abnormality levels and transaction functions that need to be suspended. For example, if the recipient's abnormality level is determined to be low, then the recipient's withdrawal function is suspended.

[0181] As can be seen from the above, the transaction behavior identification scheme provided in this application does not adopt a method based on predefined rules to identify abnormal transaction behavior. Instead, it obtains a sequence of transaction attributes of the recipient corresponding to the transaction behavior across multiple dimensions, resulting in a multidimensional transaction attribute sequence. Then, it obtains the temporal features of the multidimensional transaction attribute sequence in the time dimension, and the spatial features of the multidimensional transaction attributes in the spatial dimension based on this sequence. The temporal and spatial features are then fused to obtain a spatiotemporal fusion feature. Finally, based on this spatiotemporal fusion feature, the probability that the transaction behavior is abnormal is predicted, and the transaction behavior identification result indicating whether the transaction behavior is abnormal is obtained accordingly. Compared to identification methods based on predefined rules, this application not only utilizes the dependency relationship between different dimensions of transaction attributes and time, but also the unidirectional dependency relationship between different dimensions of transaction attributes. That is, it fully utilizes the features of different dimensions of transaction attributes in the time and spatial dimensions, providing more information for predicting abnormal transaction behavior, increasing the difficulty of being circumvented by probing, and thus improving the accuracy of transaction behavior identification.

[0182] Please refer to Figure 2a and Figure 2b The following describes the abnormal transaction identification method provided in this application, using electronic devices as the executing entity. Figure 2a As shown, the transaction behavior recognition model includes a temporal feature extraction network, a spatial feature extraction network, and a behavior recognition network. The temporal feature extraction network includes two dilated convolutional layers, as well as a hyperbolic tangent activation function layer, an S-activation function layer, and a cross product operation layer. The spatial feature extraction network includes a graph representation learning layer and a graph convolutional layer. The behavior recognition network includes a feature fusion layer, a fully connected layer, and a normalized exponential function layer.

[0183] The temporal feature extraction network is configured to extract the features of the input multidimensional transaction attribute sequence in the time dimension, which are used to characterize the dependence of different dimensions of transaction attributes on time, and are referred to as temporal features.

[0184] In this network, two dilated convolutional layers are configured to perform dilated convolution on the input multidimensional transaction attribute sequence, respectively; a hyperbolic tangent activation function layer is configured to activate the result of the dilated convolution after performing dilated convolution on one layer; an S-activation function layer is configured to activate the result of the dilated convolution after performing dilated convolution on another layer; and a cross product layer is configured to perform a cross product operation on the activation results of the hyperbolic tangent activation function layer and the S-activation function layer, and the resulting cross product is the time-series feature.

[0185] The spatial feature extraction network is configured to extract features in the spatial dimension of the input multidimensional transaction attribute sequence, which are used to characterize the unidirectional dependencies between transaction attributes in different dimensions, and are denoted as spatial features.

[0186] In this system, the graph representation learning layer of the spatial feature extraction network is configured to adaptively learn the adjacency matrix corresponding to the multidimensional transaction attributes based on the input multidimensional transaction attribute sequence, and the graph convolution layer is configured to perform graph convolution processing on the input adjacency matrix to obtain the spatial features of the multidimensional transaction attributes.

[0187] The behavior recognition network is configured to fuse temporal and spatial features to obtain spatiotemporal fusion features. It then utilizes the time-dependent relationships between different dimensions of transaction attributes and the unidirectional dependencies between different dimensions of transaction attributes to identify transaction behaviors and output transaction behavior recognition results. These results indicate whether the identified transaction behavior is abnormal.

[0188] Specifically, the feature fusion layer of the behavior recognition network is configured to concatenate temporal and spatiotemporal features along the channel dimension to obtain spatiotemporal fusion features; the fully connected layer is configured to perform fully connected processing on the spatiotemporal fusion features to obtain the fully connected result; the normalized exponential function layer is configured to perform normalized exponential processing on the fully connected result, thereby mapping the fully connected result into a two-dimensional vector (a, b), where a and b both take values ​​between 0 and 1, and a + b = 1, a represents the probability that the transaction behavior is not an abnormal transaction behavior (that is, the probability that it is a normal transaction behavior), and b represents the probability that the transaction behavior is an abnormal transaction behavior.

[0189] like Figure 2b As shown, the process of this abnormal transaction identification method can also be as follows:

[0190] In 210, the electronic device acquires the multidimensional transaction attribute sequence of the recipient corresponding to the transaction behavior.

[0191] The electronic device first obtains a multidimensional transaction attribute sequence of the recipient corresponding to the transaction behavior in different dimensions. For any dimension of the transaction attribute sequence, the transaction attribute sequence is used to represent the attribute value of the transaction attribute in that dimension at different time points in a time sequence.

[0192] The choice of which dimension of transaction attributes to use can be made by those skilled in the art based on actual needs. For example, for transaction behaviors based on applications, mini-programs, quick apps, or web pages with social attributes, transaction attributes such as transaction type, transaction amount, number of transactions, number of mutual friends of the transacting parties, and duration of the friendship between the transacting parties can be used to identify transaction behaviors.

[0193] In 220, the electronic device performs dilated convolution processing on the multidimensional transaction attribute sequence through a dilated convolution layer and then activates it using the hyperbolic tangent activation function to obtain the first activation result.

[0194] In 230, the electronic device performs dilated convolution processing on the multidimensional transaction attribute sequence through another dilated convolution layer and then activates it with the S activation function to obtain the second activation result.

[0195] In this embodiment, the two dilated convolutional layers are configured identically, each consisting of multiple one-dimensional dilated convolutional kernels and a channel concatenation module. For any dilated convolutional layer, the one-dimensional dilated convolutional kernels are configured to perform dilated convolution processing on the multi-dimensional transaction attribute sequence to extract high-level features of the multi-dimensional transaction attribute sequence in the time dimension. The channel concatenation module is configured to concatenate the dilated convolution results of each dilated convolutional kernel according to channels to obtain the dilated convolution result of the dilated convolutional layer. The number and size of the dilated convolutional kernels in the dilated convolutional layer are not specifically limited here and can be set by those skilled in the art according to actual needs. As an example, in this embodiment, each dilated convolutional layer uses four dilated convolutional kernels with sizes of 1*2, 1*3, 1*6, and 1*7, respectively.

[0196] As shown above, after obtaining the multidimensional transaction attribute sequence, the electronic device inputs the multidimensional transaction attribute sequence into two dilated convolutional layers of the temporal feature extraction network for dilation convolution processing. The dilation convolution result of one of the dilated convolutional layers is further input into the hyperbolic tangent activation function layer for activation processing, and the activation result of the hyperbolic tangent activation function layer is recorded as the first activation result. The dilation convolution result of the other dilated convolutional layer is further input into the S activation function layer for activation processing, and the activation result of the S activation function layer is recorded as the second activation result.

[0197] In 240, the electronic device performs a cross-product operation on the first activation result and the second activation result through a cross-product operation layer to obtain the temporal characteristics of the multidimensional transaction attribute sequence.

[0198] As shown above, after obtaining the first activation result and the second activation result, the electronic device inputs the first activation result and the second activation result into the cross-product operation layer. Through the cross-product operation layer, the first activation result and the second activation result are cross-producted, and the resulting cross-product result is the time-series feature of the multidimensional transaction attribute sequence.

[0199] It should be noted that the hyperbolic tangent activation function layer above works as a filter, and the S activation function layer works as a gated filter, controlling the amount of information that can be passed to subsequent networks, that is, controlling the amount of information of the temporal features extracted by the temporal feature extraction network.

[0200] In 250, the electronic device obtains the adjacency matrix corresponding to the multidimensional transaction attribute through a graph representation learning layer based on the multidimensional transaction attribute sequence.

[0201] Adjacency matrices are a graph representation method that displays the graph structure in matrix form, representing the dependencies between nodes in the graph using a two-dimensional matrix. However, for multiple transaction attributes with different dimensions, the dependencies between these attributes cannot be determined. In this embodiment, it is necessary to learn the dependencies between transaction attributes with different dimensions from the data.

[0202] In this process, the electronic device inputs the multidimensional transaction attribute sequence into the graph representation learning layer of the spatial feature extraction network, through which the graph representation learning layer adaptively learns the adjacency matrix corresponding to the multidimensional transaction attributes.

[0203] In 260, electronic devices use graph convolution layers to process the adjacency matrix, thereby obtaining the spatial features of multidimensional transaction attributes.

[0204] As shown above, after learning the adjacency matrix corresponding to the multidimensional transaction attributes, the electronic device further inputs the learned adjacency matrix into the graph convolutional layer of the spatial feature extraction network. The learned adjacency matrix is ​​processed by graph convolution through the graph convolutional layer, and the resulting graph convolution result is denoted as the spatial feature of the multidimensional transaction attributes.

[0205] In 270, the electronic device fuses the temporal features and the spatial features through a feature fusion layer to obtain spatiotemporal fused features.

[0206] As shown above, after obtaining the temporal features of the multidimensional transaction attribute sequence and the spatial features of the multidimensional transaction attributes, the electronic device further inputs the obtained temporal and spatial features into the feature fusion layer of the behavior recognition network. The feature fusion layer splices the temporal and spatial features in the channel dimension to obtain the spatiotemporal fusion features of the two.

[0207] For example, if the temporal feature has 'a' channels and the spatial feature has 'b' channels, by using a feature fusion layer to splice the temporal and spatial features along the channel dimension, the resulting spatiotemporal fusion feature has a+b channels.

[0208] In 280, the electronic device performs fully connected processing on the spatiotemporal fusion features through a fully connected layer to obtain a fully connected result.

[0209] In this embodiment of the application, after obtaining the spatiotemporal fusion features, the electronic device further inputs the spatiotemporal fusion features into the fully connected layer of the behavior recognition network, and performs fully connected processing on the spatiotemporal fusion features through the fully connected layer to obtain the fully connected result.

[0210] In 290, the electronic device performs normalized exponential processing on the fully connected result through a normalized exponential function layer to obtain the probability that the transaction behavior belongs to abnormal transaction behavior, and obtains the transaction behavior identification result based on the behavior probability.

[0211] As shown above, after obtaining the fully connected result of the spatiotemporal fusion features, the electronic device inputs the fully connected result into the normalized exponential function layer of the behavior recognition network. The normalized exponential function layer performs normalized exponential processing on the fully connected result, thereby mapping the fully connected result to a two-dimensional vector (a, b), where both a and b take values ​​between 0 and 1, and a + b = 1. a represents the probability that the transaction behavior is not an abnormal transaction behavior (that is, the probability that it is a normal transaction behavior), and b represents the probability that the transaction behavior is an abnormal transaction behavior.

[0212] Specifically, when the probability of a transaction being an abnormal transaction reaches a probability threshold, a transaction behavior identification result indicating that the transaction is an abnormal transaction is obtained. When the probability of a transaction being an abnormal transaction is less than the probability threshold, a transaction behavior identification result indicating that the transaction is not an abnormal transaction is obtained, or a transaction behavior identification result indicating that the transaction is a normal transaction is obtained. For example, assuming the probability threshold is configured to 60%, when the output result of the normalized exponential function layer is (0.6, 0.4), the probability of the transaction being an abnormal transaction is 40%, which does not reach the probability threshold of 60%, and a transaction behavior identification result indicating that the transaction is not an abnormal transaction is obtained. When the output result of the normalized exponential function layer is (0.4, 0.6), the probability of the transaction being an abnormal transaction is 60%, which reaches the probability threshold of 60%, and a transaction behavior identification result indicating that the transaction is an abnormal transaction is obtained.

[0213] To facilitate better implementation of the above abnormal transaction identification method, this application also provides a corresponding transaction behavior identification device. The meanings of the terms used are the same as in the above abnormal transaction identification method; for specific implementation details, please refer to the descriptions in the above method embodiments.

[0214] Please refer to Figure 3 , Figure 3 This is a schematic diagram of the transaction behavior recognition device provided in the embodiments of this application. The transaction behavior recognition device may include a sequence acquisition module 310, a temporal feature extraction module 320, a spatial feature extraction module 330, a feature fusion module 340, and a behavior recognition module 350, wherein...

[0215] Sequence acquisition module 310 is used to acquire the multi-dimensional transaction attribute sequence of the receiving object corresponding to the transaction behavior;

[0216] The temporal feature extraction module 320 is used to obtain the temporal features of the multidimensional transaction attribute sequence. The temporal features are used to characterize the dependence of different dimensions of transaction attributes on time.

[0217] The spatial feature extraction module 330 is used to obtain the spatial features of multidimensional transaction attributes based on the multidimensional transaction attribute sequence. The spatial features are used to characterize the unidirectional dependency relationship between transaction attributes of different dimensions.

[0218] The feature fusion module 340 is used to fuse temporal features and spatial features to obtain spatiotemporal fused features;

[0219] The behavior recognition module 350 is used to predict the probability that a transaction behavior belongs to an abnormal transaction behavior based on spatiotemporal fusion features, and to obtain the transaction behavior recognition result of the transaction behavior based on the behavior probability. The transaction behavior recognition result is used to indicate whether the transaction behavior belongs to an abnormal transaction behavior.

[0220] Optionally, in one embodiment, the sequence acquisition module 310 is used to acquire the attribute values ​​of the multidimensional transaction attributes of the receiving object corresponding to the transaction behavior within a first historical time period; encode the attribute value of each dimension of the transaction attribute to obtain the attribute encoding value of each dimension of the transaction attribute; and obtain the multidimensional transaction attribute sequence of the receiving object corresponding to the transaction behavior in chronological order based on the attribute encoding value of each dimension of the transaction attribute.

[0221] Optionally, in one embodiment, the sequence acquisition module 310 is used to obtain the attribute code value of each dimension transaction attribute based on the attribute value range in which the attribute value of each dimension transaction attribute is located, and the correspondence between the attribute value range and the attribute code value associated with each dimension transaction attribute.

[0222] Optionally, in one embodiment, the temporal feature extraction module 320 is used to perform dilated convolution processing on the multidimensional transaction attribute sequence through the transaction behavior recognition model and then activate it with the hyperbolic tangent activation function to obtain a first activation result; perform dilated convolution processing on the multidimensional transaction attribute sequence through the transaction behavior recognition model and then activate it with the S activation function to obtain a second activation result; and perform a cross product operation on the first activation result and the second activation result through the transaction behavior recognition model to obtain the temporal features of the multidimensional transaction attribute sequence.

[0223] Optionally, in one embodiment, the spatial feature extraction module 330 is used to obtain the adjacency matrix corresponding to the multidimensional transaction attributes through a transaction behavior recognition model based on the multidimensional transaction attribute sequence; and to perform graph convolution processing on the adjacency matrix through the transaction behavior recognition model to obtain the spatial features of the multidimensional transaction attributes.

[0224] Optionally, in one embodiment, the spatial feature extraction module 330 is used to obtain the adaptive embedding vector of each dimension of the transaction attribute according to the multidimensional transaction attribute sequence through the transaction behavior recognition model; and to perform unidirectional cross-similarity calculation on the adaptive embedding vectors of different transaction attributes through the transaction behavior recognition model to obtain the adjacency matrix corresponding to the multidimensional transaction attributes.

[0225] Optionally, in one embodiment, the spatial feature extraction module 330 is used to set the k smallest matrix elements in each row of the adjacency matrix to zero through the transaction behavior recognition model to obtain a sparse adjacency matrix; and to perform graph convolution processing on the sparse adjacency matrix through the transaction behavior recognition model to obtain the spatial features of multi-dimensional transaction attributes.

[0226] Optionally, in one embodiment, the transaction behavior recognition device provided in this application further includes a model training module, configured to acquire a first historical multidimensional transaction attribute sequence of a first historical recipient corresponding to a known first historical abnormal transaction behavior, and use the first historical multidimensional transaction attribute sequence as a positive sample; acquire a second historical multidimensional transaction attribute sequence of a second historical recipient corresponding to a known first historical normal transaction behavior, and use the second historical multidimensional transaction attribute sequence as a negative sample; and train the transaction behavior recognition model based on the positive and negative samples until a first preset stopping condition is met.

[0227] Optionally, in one embodiment, the model training module is further configured to split positive samples into m sub-positive samples and negative samples into m sub-negative samples in a time sequence; and to train the transaction behavior recognition model based on the sub-positive samples and sub-negative samples until a second preset stopping condition is met.

[0228] Optionally, in one embodiment, the transaction behavior identification device provided in this application further includes a model update module, configured to: if the transaction behavior identification result indicates that the transaction behavior belongs to abnormal transaction behavior, determine the historical payment object of the recipient's historical transaction behavior within a second historical time period; send an abnormal transaction behavior collaboration request to the historical payment object, instructing the historical payment object to collaboratively confirm whether the historical transaction behavior belongs to abnormal transaction behavior; divide the historical transaction behavior into a second historical abnormal transaction behavior and a second historical normal transaction behavior according to the historical payment object's abnormal transaction behavior collaboration response; obtain a third historical multidimensional transaction attribute sequence corresponding to the second historical abnormal transaction behavior, and use the third historical multidimensional transaction attribute sequence as an update positive sample; obtain a fourth historical multidimensional transaction attribute sequence corresponding to the second historical normal transaction behavior, and use the fourth historical multidimensional transaction attribute sequence as an update negative sample; and update the model parameters of the transaction behavior identification model according to the update positive sample and update negative sample.

[0229] Optionally, in one embodiment, the transaction behavior identification device provided in this application further includes a transaction control module, used to determine the abnormality level of the recipient based on the number of transactions of the second historical abnormal transaction behavior; and to suspend the transaction function corresponding to the abnormality level of the recipient based on the abnormality level.

[0230] Optionally, in one embodiment, the behavior recognition module 350 is used to perform full-connection processing on the spatiotemporal fusion features through the transaction behavior recognition model to obtain a full-connection result; and to perform normalized exponential processing on the full-connection result through the transaction behavior recognition model to obtain the probability that the transaction behavior belongs to abnormal transaction behavior.

[0231] For details on the implementation of each of the above modules, please refer to the previous examples, which will not be repeated here.

[0232] This application also provides an electronic device, including a memory and a processor, wherein the processor executes the steps in the abnormal transaction identification method provided in the above embodiments by calling a computer program stored in the memory.

[0233] Please refer to Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0234] The electronic device may include components such as a processor 101 with one or more processing cores, a memory 102 with one or more computer-readable storage media, a power supply 103, and an input unit 104. Those skilled in the art will understand that... Figure 4 The electronic device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein:

[0235] The processor 101 is the control center of the electronic device, connecting various parts of the device via various interfaces and lines. It executes software programs and / or modules stored in the memory 102, and calls data stored in the memory 102, to perform various functions and process data. Optionally, the processor 101 may include one or more processing cores; alternatively, the processor 101 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 101.

[0236] The memory 102 can be used to store software programs and modules. The processor 101 executes various functional applications and data processing by running the software programs and modules stored in the memory 102. The memory 102 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 102 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 102 may also include a memory controller to provide the processor 101 with access to the memory 102.

[0237] The electronic device also includes a power supply 103 that supplies power to the various components. Optionally, the power supply 103 can be logically connected to the processor 101 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 103 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0238] The electronic device may also include an input unit 104, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0239] Although not shown, the electronic device may also include a display unit, an image acquisition component, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 101 loads one or more executable codes corresponding to computer programs into the memory 102, and the processor 101 executes the steps in the abnormal transaction identification method provided in this application, such as:

[0240] Obtain the multidimensional transaction attribute sequence of the recipient corresponding to the transaction behavior;

[0241] Obtain the temporal features of the multidimensional transaction attribute sequence. The temporal features are used to characterize the dependence of different dimensions of transaction attributes on time.

[0242] Based on the multidimensional transaction attribute sequence, the spatial features of the multidimensional transaction attributes are obtained. The spatial features are used to characterize the unidirectional dependency relationship between transaction attributes of different dimensions.

[0243] By integrating temporal and spatial features, spatiotemporal fusion features are obtained;

[0244] Based on the spatiotemporal fusion characteristics, the probability of a transaction behavior belonging to abnormal transaction behavior is predicted, and the transaction behavior identification result is obtained based on the behavior probability. The transaction behavior identification result is used to indicate whether the transaction behavior belongs to abnormal transaction behavior.

[0245] It should be noted that the electronic device provided in this application embodiment and the abnormal transaction identification method in the above embodiment belong to the same concept. The specific implementation process can be found in the above related embodiments, and will not be repeated here.

[0246] This application also provides a computer-readable storage medium storing a computer program thereon. When the computer program stored thereon is executed on the processor of the electronic device provided in the embodiments of this application, the processor of the electronic device implements the steps in the abnormal transaction identification method provided in this application. The storage medium may be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0247] This application also provides a computer program product, which includes a computer program that, when executed on the processor of the electronic device provided in the embodiments of this application, causes the processor of the electronic device to implement the steps in the abnormal transaction identification method provided in this application.

[0248] The above provides a detailed description of the abnormal transaction identification method, transaction behavior identification device, electronic device, computer-readable storage medium, and computer program product provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, those skilled in the art will recognize that there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

[0249] It should be noted that when the above embodiments of this application are applied to specific products or technologies, and user-related data is involved, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

Claims

1. A method for identifying abnormal transactions, characterized in that, include: Obtain the multidimensional transaction attribute sequence of the recipient corresponding to the transaction behavior; Obtain the temporal features of the multidimensional transaction attribute sequence, wherein the temporal features are used to characterize the dependence of different dimensions of transaction attributes on time; Based on the multidimensional transaction attribute sequence, spatial features of the multidimensional transaction attributes are obtained, and the spatial features are used to characterize the unidirectional dependency relationship between transaction attributes of different dimensions. By fusing the temporal features and the spatial features, a spatiotemporal fusion feature is obtained; Based on the spatiotemporal fusion features, the probability that the transaction behavior belongs to abnormal transaction behavior is predicted, and the transaction behavior identification result of the transaction behavior is obtained based on the behavior probability. The transaction behavior identification result is used to indicate whether the transaction behavior belongs to abnormal transaction behavior.

2. The abnormal transaction identification method according to claim 1, characterized in that, The acquisition of the temporal features of the multidimensional transaction attribute sequence includes: The multidimensional transaction attribute sequence is processed by dilated convolution using a transaction behavior recognition model and then activated by a hyperbolic tangent activation function to obtain the first activation result. The transaction behavior recognition model is used to perform dilated convolution on the multidimensional transaction attribute sequence and then activate it with the S activation function to obtain a second activation result. The transaction behavior recognition model is used to perform a cross product operation on the first activation result and the second activation result to obtain the temporal features of the multidimensional transaction attribute sequence.

3. The abnormal transaction identification method according to claim 2, characterized in that, The step of obtaining the spatial features of the multidimensional transaction attributes based on the multidimensional transaction attribute sequence includes: Based on the multidimensional transaction attribute sequence, the adjacency matrix corresponding to the multidimensional transaction attributes is obtained through the transaction behavior recognition model; The adjacency matrix is ​​processed by graph convolution using the transaction behavior recognition model to obtain the spatial features of the multidimensional transaction attributes.

4. The abnormal transaction identification method according to claim 3, characterized in that, The step of obtaining the adjacency matrix corresponding to the multi-dimensional transaction attributes through the transaction behavior recognition model based on the multi-dimensional transaction attribute sequence includes: Based on the multidimensional transaction attribute sequence, the adaptive embedding vector of each dimension of the transaction attribute is obtained through the transaction behavior recognition model; The transaction behavior recognition model is used to perform unidirectional mutual similarity calculation on the adaptive embedding vectors of different transaction attributes to obtain the adjacency matrix corresponding to the multidimensional transaction attributes.

5. The abnormal transaction identification method according to claim 3, characterized in that, Before performing graph convolution processing on the adjacency matrix using the transaction behavior recognition model to obtain the spatial features of the multidimensional transaction attributes, the method further includes: By using the transaction behavior recognition model, the k smallest matrix elements in each row of the adjacency matrix are set to zero to obtain a sparse adjacency matrix. The step of performing graph convolution processing on the adjacency matrix through the transaction behavior recognition model to obtain the spatial features of the multidimensional transaction attributes includes: The spatial features of the multidimensional transaction attributes are obtained by performing graph convolution on the sparse adjacency matrix using the transaction behavior recognition model.

6. The abnormal transaction identification method according to claim 2, characterized in that, The step of predicting the probability that the transaction behavior belongs to abnormal transaction behavior based on the spatiotemporal fusion features includes: The spatiotemporal fusion features are processed using the transaction behavior recognition model to obtain a fully connected result. By using the transaction behavior identification model, the fully connected result is normalized exponentially to obtain the probability that the transaction behavior belongs to abnormal transaction behavior.

7. The abnormal transaction identification method according to any one of claims 2-6, characterized in that, Before obtaining the multi-dimensional transaction attribute sequence of the recipient corresponding to the transaction behavior, the method further includes: Obtain the first historical multidimensional transaction attribute sequence of the first historical recipient corresponding to the known first historical abnormal transaction behavior, and use the first historical multidimensional transaction attribute sequence as a positive sample; Obtain the second historical multidimensional transaction attribute sequence of the second historical recipient corresponding to the known first historical normal transaction behavior, and use the second historical multidimensional transaction attribute sequence as a negative sample; The transaction behavior recognition model is trained based on the positive and negative samples until a first preset stopping condition is met.

8. The abnormal transaction identification method according to claim 7, characterized in that, The step of training the transaction behavior recognition model based on the positive samples and the negative samples until a first preset stopping condition is met further includes: The positive samples are split into m sub-positive samples in chronological order, and the negative samples are split into m sub-negative samples. The transaction behavior recognition model is trained based on the sub-positive samples and the sub-negative samples until the second preset stopping condition is met.

9. The abnormal transaction identification method according to any one of claims 2-6, characterized in that, After obtaining the transaction behavior identification result based on the behavior probability, the method further includes: If the transaction behavior identification result indicates that the transaction behavior is an abnormal transaction behavior, then the historical payment object of the recipient's historical transaction behavior in the second historical time period is determined; Send an abnormal transaction behavior collaboration request to the historical payment object, instructing the historical payment object to collaborate in confirming whether the historical transaction behavior is an abnormal transaction behavior; Based on the collaborative response to the abnormal transaction behavior of the historical payment object, the historical transaction behavior is divided into second historical abnormal transaction behavior and second historical normal transaction behavior; Obtain the third historical multidimensional transaction attribute sequence corresponding to the second historical abnormal transaction behavior, and use the third historical multidimensional transaction attribute sequence as an update positive sample; Obtain the fourth historical multidimensional transaction attribute sequence corresponding to the second historical normal transaction behavior, and use the fourth historical multidimensional transaction attribute sequence as an update negative sample; The model parameters of the transaction behavior recognition model are updated based on the updated positive samples and the updated negative samples.

10. The abnormal transaction identification method according to claim 9, characterized in that, After the collaborative response based on the abnormal transaction behavior of the historical payment object, which divides the historical transaction behavior into second historical abnormal transaction behavior and second historical normal transaction behavior, it also includes: The abnormality level of the recipient is determined based on the number of transactions in the second historical abnormal transaction behavior. Based on the level of abnormality, the transaction function corresponding to that level of abnormality for the recipient is suspended.

11. The abnormal transaction identification method according to claim 1, characterized in that, The acquisition of the multi-dimensional transaction attribute sequence of the recipient corresponding to the transaction behavior includes: Obtain the attribute values ​​of the multi-dimensional transaction attributes of the recipient corresponding to the transaction behavior within the first historical time period; Encode the attribute value of each dimension of the transaction attribute to obtain the attribute code value of each dimension of the transaction attribute; Based on the attribute code value of each dimension of the transaction attribute, a multidimensional transaction attribute sequence of the receiving object corresponding to the transaction behavior is obtained in chronological order.

12. The abnormal transaction identification method according to claim 2, characterized in that, The process of encoding the attribute value of each dimension of a transaction attribute to obtain the attribute encoding value of each dimension of the transaction attribute includes: Based on the attribute value range in which the attribute value of each dimension of the transaction attribute is located, and the correspondence between the attribute value range associated with each dimension of the transaction attribute and the attribute code value, the attribute code value of each dimension of the transaction attribute is obtained.

13. A transaction behavior identification device, characterized in that, include: The sequence acquisition module is used to acquire the multi-dimensional transaction attribute sequence of the recipient corresponding to the transaction behavior; The temporal feature extraction module is used to obtain the temporal features of the multidimensional transaction attribute sequence, wherein the temporal features are used to characterize the dependence of different dimensions of transaction attributes on time. The spatial feature extraction module is used to obtain the spatial features of the multidimensional transaction attributes based on the multidimensional transaction attribute sequence. The spatial features are used to characterize the unidirectional dependency relationship between transaction attributes of different dimensions. The feature fusion module is used to fuse the temporal features and the spatial features to obtain spatiotemporal fused features; The behavior recognition module is used to predict the probability that the transaction behavior belongs to abnormal transaction behavior based on the spatiotemporal fusion features, and to obtain the transaction behavior recognition result of the transaction behavior based on the behavior probability. The transaction behavior recognition result is used to indicate whether the transaction behavior belongs to abnormal transaction behavior.

14. An electronic device, characterized in that, The method includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program in the memory to implement the steps of the abnormal transaction identification method according to any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted for execution by a processor to implement the steps of the abnormal transaction identification method according to any one of claims 1 to 12.

16. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the abnormal transaction identification method according to any one of claims 1 to 12.

Images