A network transaction illegal behavior prediction method, an electronic device, and a storage medium

Abstract

The present application relates to the technical field of data processing, more particularly, to a network transaction illegal behavior prediction method, an electronic device and a storage medium. The method fuses a multi-scale time convolution network (TCN), a multi-head uncertainty perception differential attention mechanism (MUDA) and a deep time sequence modeling framework of an inverted Transformer structure (iTransformer), realizes unified modeling of local and global information, and significantly improves the perception and prediction stability of periodic fluctuations and sudden behaviors. The method faces the multivariate non-stationary sequence modeling task of transaction data in an e-commerce platform, extracts local and global features in combination, maintains high precision, and improves the perception and generalization ability of the model to abnormal behaviors.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and more specifically, to a method for predicting illegal online transaction activities, an electronic device, and a storage medium. Background Technology

[0002] With the rapid development of e-commerce platforms, the number of online transactions has exploded, user behavior patterns have become increasingly complex and varied, and various illegal activities have become more covert, intelligent, and frequent. These illegal activities not only seriously affect the fairness of transactions on the platform and user trust, but also place higher demands on the platform's risk control system for real-time early warning and accurate identification.

[0003] Most existing methods rely on rule matching, statistical modeling, or traditional machine learning models such as logistic regression, decision trees, and support vector machines for risk identification and illegal behavior prediction. However, traditional models have significant limitations when dealing with high-dimensional, time-dependent, and non-stationary data environments. For example, most methods struggle to model long-term dependencies and sudden behavioral characteristics, failing to effectively capture complex behavioral change patterns across time periods, especially exhibiting lag and high false positive rates when facing highly reactive, sudden transaction anomalies. Furthermore, transaction behavior is often dynamically driven by multiple factors such as user attributes, transaction time, transaction device, and product characteristics, making it difficult for traditional models to effectively model the complex high-order interactions between these variables. In addition, because e-commerce transaction data generally exhibits non-stationary characteristics such as periodicity, seasonality, and abrupt changes, and contains heterogeneous variable distributions, conventional models have poor adaptability to this type of data, are easily affected by noise, and result in insufficient stability and generalization ability of the prediction results.

[0004] Chinese patent document CN118469715A discloses a risk management method and system for cross-border e-commerce transactions, including: collecting users' historical transaction data and cleaning the historical transaction data; building a multi-agent framework of Large Language Model (LLM) and designing agents corresponding to different sub-tasks for different risk types in cross-border e-commerce; collecting and preprocessing transaction data in real time through a stream processing framework to form feature vectors; and inputting the feature vectors into the agents of the different sub-tasks to obtain real-time risk prediction. However, it lacks deep modeling of time-series data, especially when dealing with the high dimensionality and time-series dependence of transaction data, and may not be able to capture the changes and complexities of transaction patterns over long periods.

[0005] Chinese patent document CN118967135A discloses a method, apparatus, storage medium, and electronic device for identifying abnormal accounts. The method includes: acquiring target interaction data of a target account within a historical period from a network interaction platform; constructing a sequence of interaction operation feature vectors of the target account within the historical period based on the target interaction data; obtaining N fused operation feature vectors based on N interaction operation feature vectors and N location-encoded feature vectors; and obtaining a risk prediction probability by inputting the N fused operation feature vectors into a target identification model, and identifying the target account as an abnormal account if the risk prediction probability is greater than or equal to a preset threshold. However, this method relies solely on the fusion of historical interaction data and location-encoded features, failing to effectively capture the nonlinear dynamic interaction relationships between variables, and exhibiting weak modeling capabilities for complex transaction behavior patterns and multivariate non-stationary sequences.

[0006] Therefore, there is an urgent need for a new modeling method that combines strong time series modeling capabilities, sudden event perception capabilities, and multivariate dynamic interaction modeling capabilities to meet the high accuracy and robustness requirements of e-commerce platforms in predicting illegal transaction behavior. Summary of the Invention

[0007] This invention aims to address the shortcomings of existing methods for predicting illegal online transaction behavior in terms of temporal modeling capabilities, variable interaction modeling capabilities, and response capabilities to sudden abnormal behaviors. It provides a new method for predicting illegal online transaction behavior. This method integrates a deep temporal modeling framework that combines a multi-scale temporal convolutional network (TCN), a multi-head uncertainty-aware differential attention mechanism (MUDA), and an inverted Transformer structure (iTransformer). This method is designed for modeling multivariate non-stationary sequences of transaction data in e-commerce platforms. By combining local and global feature extraction mechanisms, it improves the model's ability to perceive and generalize abnormal behaviors while maintaining high accuracy.

[0008] The present invention also discloses an electronic device for implementing the above method.

[0009] The present invention also discloses a machine-readable storage medium for implementing the above method.

[0010] To achieve the above objectives, the technical solution of the present invention is as follows:

[0011] A method for predicting illegal online transaction activities, the method comprising:

[0012] S1. Transaction data acquisition and preprocessing: Preprocess the raw transaction data to generate multivariate time series and input matrix X composed of multivariate time series, training set, validation set and test set;

[0013] S2. Construct the TCN-MUDA-iTransformer model:

[0014] S21. Construct a TCN module based on a multi-layer dilated causal convolutional structure and residual connections to extract local features from the input matrix X generated in step S1 and output a high-dimensional tensor. Where R represents the set of real numbers, T is the time step, and H is the number of features learned at each time step;

[0015] S22. Apply the inverted input strategy (treating variables as tokens) and embedding mapping to the input matrix X generated in step S1, and introduce a multi-head differential attention mechanism to construct the MUDA-iTransformer module for global feature extraction of the input matrix X generated in step S1, outputting features. Where D is the characteristic number, It is the dimension of the embedded space;

[0016] S23. High-dimensional tensors output by the TCN module Features output by the MUDA-iTransformer module Feature fusion is performed to obtain a fusion vector, which is then input into the regression predictor to output the model's prediction results.

[0017] S3. Train the TCN-MUDA-iTransformer model constructed in step S2 using the training set generated in step S1, and evaluate the model performance using the validation set generated in step S1.

[0018] S4. Using the test set generated in step S1, select multiple prediction time points to predict and evaluate the model evaluated by the validation set in step S3.

[0019] Preferably, step S1 specifically includes:

[0020] S11. Extract structured transaction data from the historical log database as raw transaction data;

[0021] S12. Unify the time granularity of the raw transaction data extracted in step S11, and generate a multivariate time series and an input matrix X composed of the multivariate time series;

[0022] S13. For the multivariate time series generated in step S12, use feature engineering to filter variables related to illegal behavior, and then standardize the filtered variables.

[0023] S14. Slice the variables after standardization in step S13 to generate multiple consecutive sample pairs as a complete training dataset.

[0024] S15. Split the complete training dataset obtained in step S14 into training set, validation set and test set in chronological order.

[0025] Preferably, the TCN module described in step S21 uses dilated causal convolution and residual connections to extract local temporal features, and achieves exponential expansion of the receptive field by increasing the dilation rate layer by layer:

[0026] The calculation formula for each convolutional layer is:

[0027] (1)

[0028] in, Indicates the first Layer in time step The output, The width of the convolution kernel. For expansion rate, For the first The k-th convolution parameter of the layer, This represents the activation function. It refers to the first The bias term of each convolutional layer, where X is the input matrix;

[0029] Each layer's output is connected to LayerNorm, residual connections, and Dropout;

[0030] Finally, the TCN module outputs a high-dimensional tensor: , representing local temporal features at different scales, where T is the time step, H is the number of features learned at each time step, and R represents the set of real numbers.

[0031] Preferably, step S22 specifically includes:

[0032] S221. Perform the inverted input strategy and embedding mapping, treating variables as tokens, on the input matrix X generated in step S1:

[0033] Perform an axis transpose operation on the input matrix X to obtain the transposed matrix. The shape changes from (B,T,D) to (B,D,T); The structure becomes: each variable is an independent token, and each token contains all the values ​​of that variable at each time step;

[0034] Where B represents the batch size, T is the time step (i.e., the sequence length), and D is the number of variables;

[0035] Transposed matrix After a linear transformation, an embedding matrix E is generated with shape (B,D, ), It is the dimension of the embedding space, and the calculation process of the embedding matrix E is as follows:

[0036] (2)

[0037] in, For the first The embedding vector of each variable, containing all The embedding matrix E obtained by stacking on the variable dimension, This indicates an embedded mapping function. It is the first The time series corresponding to each variable.

[0038] S222. Input the embedding vector of the embedding matrix E obtained in step S221 into a Transformer encoder consisting of N layers. After stacking N Transformer encoder layers, the output features are... ;

[0039] The Transformer encoder consists of N layers, each of which contains two main sub-layers: a first sub-layer with a multi-head differential attention mechanism and a second sub-layer with a feedforward neural network, and each sub-layer has residual connections and Dropout operations.

[0040] More preferably, step S222 specifically involves: the multi-head differential attention mechanism constructs two independent attention paths and calculates their difference to generate a differential attention matrix; the differential attention matrix is ​​residually connected to the embedding matrix E, and a Dropout operation is performed to obtain the output Z; the output Z is processed by a feedforward neural network to obtain the output F; the output F is residually connected to the output Z, and a Dropout operation is performed to obtain the output... Calculate the values ​​for each layer As input to the next layer, after passing through N layers of stacked Transformer encoders, the output features are... .

[0041] Preferably, the multi-head differential attention mechanism generates a differential attention matrix by constructing two independent attention paths and calculating their difference. The differential attention matrix is ​​then residually concatenated with the embedding matrix E, and the output Z is obtained through a Dropout operation. Specifically:

[0042] In the first sub-layer of the Transformer encoder, the embedding matrix E generated in step S221 is first input into the multi-head attention mechanism. Through three different linear layers, the input matrix E is mapped into a query, key, and value matrix:

[0043] ; ; (3)

[0044] Where Q is the query matrix, K is the key matrix, and V is the value matrix. , , These are the projection matrices of the query, key, and value, respectively, with the shape ( , );

[0045] The standard attention weights are calculated as follows:

[0046] ， ； (4)

[0047] in , , respectively representing the first Query and key matrix for path attention. This represents the dimension of the key vector. It is the first Attention weights calculated from each path ( ) is the activation function. Indicates transpose;

[0048] By calculating the difference between the two attention distributions, the differential attention tensor is obtained:

[0049] (5)

[0050] in, For differential attention tensors, , which is a learnable scaling factor that controls the intensity of attentional differences. , The first The attention weights calculated for the first path and the first path Attention weights calculated for each path;

[0051] The final differential attention matrix, i.e., the attention output, is:

[0052] (6)

[0053] in, For the final attention output, Represents the value matrix. Indicates the dimension of the value vector;

[0054] Finally, after multi-head attention computation, the attention output is residually concatenated with the embedding matrix E, and the output Z is obtained through a Dropout operation:

[0055] (7)

[0056] This represents the output after differential modulation.

[0057] The output Z is processed by a feedforward neural network to obtain output F. Output F and output Z are then residually concatenated, and a Dropout operation is performed to obtain the output... Calculate the values ​​for each layer As input to the next layer, after passing through N layers of stacked Transformer encoders, the output features are... Specifically:

[0058] The embedding vector of the embedding matrix E is processed by the multi-head differential attention mechanism in the first sub-layer to output Z, and then processed by the feedforward neural network in the second sub-layer. The calculation process is as follows:

[0059] (8)

[0060] Where F is the output of the feedforward neural network, and Z is the output representation after differential modulation. , It is the weight matrix of the linear layer. , It is a bias term. It is a non-linear activation function;

[0061] After processing by the feedforward network, the output F is added to the input Z, a residual connection is formed, and then regularization is performed using the Dropout operation to obtain the output. :

[0062] (9)

[0063] Where Z is the output representation after differential modulation. It is a regularization operation, where F is the output of the feedforward network. It is the recursive intermediate quantity of the single-layer output of the Transformer;

[0064] Calculate the values ​​of each layer As input to the next layer, this process is recursively repeated until the Nth and final layer. It means output to the outside world. The shape is (B, D, It contains D variables for each sample, and each variable has The dimensional representation, in the variable dimension, arranges the D variables according to their order. The feature is obtained by concatenating the first and last small vectors of the same dimension into a long vector. It is used as a global variable interaction representation.

[0065] Preferably, step S23 specifically includes:

[0066] First, the high-dimensional tensor output by the TCN module Perform pooling operations along the time dimension to extract the overall time trend:

[0067] (10)

[0068] in, It is the output feature sequence of the TCN module. This refers to average pooling along the time dimension, which means averaging the values ​​across all time steps for each channel. This represents the overall trend vector after time pooling, which will be used for feature fusion with the global variable representation of iTransformer for prediction.

[0069] Meanwhile, the output of the MUDA-iTransformer module is pooled or flattened along the variable dimension to obtain a global variable interaction representation:

[0070] (11)

[0071] in, For global variable interaction representation, Flatten indicates that each variable is represented along the variable dimension. The dimensions are concatenated into a single vector, which is used for interactive representation of global variables; These are the characteristics of the output;

[0072] The two feature sets are mapped to a unified dimension and then concatenated to form a fused representation:

[0073] (12)

[0074] Among them, Concat( The two aligned vectors are concatenated along their feature dimensions to form a fused representation. FC( This is a fully connected mapping, which first maps the two feature sets to a unified dimension. This indicates the dimension of the fused vector obtained after concatenation;

[0075] The fusion vector is input into the regression predictor, which outputs the prediction results of illegal online transaction behavior.

[0076] Further optimized, the fused vector is input into the regression predictor MLP, which outputs the number of illegal transactions within the future prediction time window:

[0077] (13)

[0078] in, , indicating the predicted time point The predicted number of illegal transactions can be set with multiple step sizes τ=3h, 6h, 12h, etc.

[0079] Preferably, in step S3, when training the TCN-MUDA-iTransformer model constructed in step S2, a multi-task loss function is used to simultaneously optimize the trend prediction and recurrence probability prediction of illegal behavior: the trend prediction uses mean squared error (MSE) loss, the recurrence probability prediction of illegal behavior uses binary cross-entropy (BCE) loss, and Focal Loss is used to enhance the focus on minority illegal behaviors. The parameters are updated through the Adam optimizer, and learning rate scheduling and early stopping strategies are used to prevent overfitting. After training, the model performance is evaluated through the validation set, and the model parameters are adjusted according to the evaluation metrics.

[0080] This invention also provides an application of the above-mentioned method for predicting illegal online transactions, used for early warning and response in risk control systems.

[0081] In another aspect of the invention, an electronic device is also provided, comprising:

[0082] At least one processor; and

[0083] The memory stores instructions that, when executed by the at least one processor, cause the at least one processor to perform the online transaction violation prediction method as described above.

[0084] In another aspect of the invention, a machine-readable storage medium is also provided, which stores executable instructions that, when executed, cause the machine to perform the online transaction violation prediction method as described above.

[0085] Compared with the prior art, the present invention has the following beneficial effects:

[0086] (1) In terms of model structure, this invention breaks the traditional single temporal modeling path and achieves effective integration of local and global modeling through parallel convolutional branches and attention branches, thereby improving the ability to perceive periodic fluctuations and abnormal behaviors. The MUDA mechanism can effectively identify the differences in importance between variables, improve the model's noise resistance and prediction accuracy for sudden events. The inverted Transformer structure strengthens the ability to model high-order asymmetric interactions between variables, making up for the problem of ambiguous expression of dependencies between variables in the traditional Transformer.

[0087] (2) Compared to existing dependency rule or traditional machine learning schemes, which struggle to simultaneously characterize strong temporal dependencies, high-order variable interactions, and sudden anomalies such as response lag and high false alarm rates, this invention achieves unified modeling of local and global information through the parallel and fusion of "convolutional branch TCN + differential attention branch MUDA-iTransformer," significantly improving the perception and prediction stability of periodic fluctuations and sudden behaviors. Experimental results show that it achieves optimal performance across multiple prediction windows; for example, in short-term prediction (t+6), compared to the representative strong baseline DLinear, MAE is reduced by approximately 3.9%, RMSE by approximately 1.2%, and R... 2 The improvement of over 3% validates the effectiveness and generalization ability of the collaborative framework.

[0088] (3) TCN uses stacked dilated causal convolutions in combination with residuals and normalization, and the receptive field expands exponentially. It can capture local time-series patterns at multiple scales from hourly to daily, and is more sensitive to local dynamics such as short-term mutations and periodic fluctuations. This directly alleviates the peak-valley response lag and overfitting problems caused by the insufficient characterization of short-term and multi-scale patterns by traditional methods, and provides a stable and generalizable local feature base for subsequent fusion.

[0089] (4) MUDA highlights the differences in the importance of variables and the mutation pattern by differentiating two independent attention paths and introducing learnable strength as a bias. While suppressing redundancy and noise, it improves the sensitivity and positioning accuracy of abnormal trading behavior. This overcomes the defects of standard self-attention in the expression of sudden events, such as "averaging" and "dilution", thereby improving the noise resistance robustness and the prediction accuracy of abnormal segments.

[0090] (5) By adopting the inverted input strategy of "variable as token" (D×T), iTransformer models the global dependencies between variables and can capture complex, asymmetric high-order interactions. This makes up for the shortcomings of traditional Transformer in expressing variable dependencies in a vague way, and makes the model more comprehensive, interpretable and stable for anomalous behaviors driven by cross-variable coupling. Its encoder stacked output directly provides the global expression of each variable, providing a solid global feature representation for subsequent fusion and prediction.

[0091] (6) This invention provides a prediction method for e-commerce transaction data that is structurally scalable, highly expressive, and has a keen ability to detect sudden illegal behaviors. It has good application prospects and can be widely used in intelligent risk control systems in e-commerce, finance, social and other scenarios. At the same time, the method of this invention is also applicable to modeling and analyzing user transaction behavior in e-commerce platforms. It is especially suitable for short-term trend prediction and intelligent early warning of abnormal behaviors such as illegal transactions and fraud. It belongs to the application technology of artificial intelligence in e-commerce behavior analysis. Attached Figure Description

[0092] Figure 1 This is a flowchart of the method for predicting illegal online transaction behavior as described in Embodiment 1 of the present invention;

[0093] Figure 2 This is a structural diagram of the TCN-MUDA-iTransformer model constructed in Embodiment 1 of the present invention;

[0094] Figure 3 This is a graph showing the experimental results of Embodiment 1 of the present invention on a network transaction dataset. Detailed Implementation

[0095] The proposed method for predicting illegal online transaction behaviors is based on the TCN-MUDA-iTransformer model framework. It can perform deep modeling on the input online transaction behavior sequence and output the frequency prediction value of abnormal illegal behaviors such as order brushing in the future time period.

[0096] First, the raw transaction data is preprocessed, aggregating event data including transaction time, amount, user information, and transaction type into a multivariate time series. Second, a temporal convolutional network is used to extract multi-scale local temporal features, enhancing the model's ability to model short-term dynamics and periodic structures. Subsequently, a multi-head differential attention mechanism (MUDA) is introduced into the Transformer architecture to identify the dependencies between variables in dynamic changes, suppress redundant information, and strengthen the response to abrupt change patterns. In addition, an "inverted input" strategy that treats variables as tokens is adopted to model the global interaction relationships between variables, further improving the ability to model complex variable coupling behavior. Finally, the model outputs predictions of illegal online transaction behaviors within several future time steps, which are used for early warning and response in the risk control system.

[0097] Example 1

[0098] This embodiment provides a method for predicting illegal online transaction activities, such as... Figure 1 As shown, the method includes:

[0099] S1. Transaction data acquisition and preprocessing: Preprocess the raw transaction data to generate multivariate time series and input matrix X composed of multivariate time series, training set, validation set and test set;

[0100] First, transaction data containing fields such as transaction time, amount, user ID, device information, and IP address is collected from e-commerce platforms, and fraudulent transactions are flagged using the platform's anti-fraud system or rule engine. Then, the data is aggregated hourly to generate multivariate time series data, including features such as the number of fraudulent transactions, abnormal transaction amounts, and device switching frequency. Next, feature engineering is used to select key variables related to fraudulent behavior, such as high-frequency transaction identifiers and repeated order placement behavior, and the data is standardized. A sliding window method is used to generate samples, using data from a certain past time period as input to predict fraudulent behavior in future time periods. Finally, the dataset is divided into training, validation, and test sets to ensure the integrity of the time series data and the accuracy of model training.

[0101] Specifically, S11 extracts structured transaction data from the historical log database of the e-commerce platform as raw transaction data.

[0102] The extracted data includes fields such as the precise time of the transaction, the transaction amount, a unique identifier related to the user, device identification information, network IP address, transaction status code, transaction type code, and the code and category information of the goods involved. Furthermore, to clearly identify fraudulent transactions, this invention combines the platform's existing anti-fraud engine or rule-based detection system to mark transactions in historical data that are determined by the system to be fraudulent transactions with a "fraudulent transaction" label, thereby constructing the target labels required for the supervised learning model.

[0103] S12. Process the original transaction data at a uniform time granularity to generate a multivariate time series and an input matrix X composed of the multivariate time series.

[0104] This embodiment selects the hourly level as the aggregation unit, statistically aggregating the original transaction records hourly to transform them into time-series structured data. To enhance the model's ability to detect fraudulent transactions, statistical features highly correlated with such behavior are extracted during the aggregation process, mainly including the following aspects:

[0105] Number of fraudulent transactions per unit of time: the total number of transactions marked as fraudulent by the platform during that time period;

[0106] Abnormal transaction quantity: refers to the number of transactions with consecutive identical amounts or obviously abnormal amount structures, such as fixed integer values ​​or amounts below the lower limit of the platform's reasonable range, within the specified time period;

[0107] User device switching frequency: This counts the total number of device change behaviors for the same user account in adjacent transactions, based on whether the device identifier used by the user account changes.

[0108] Total high-frequency trading activity: Identify multiple order behaviors initiated by the same user and the same device within a short time interval, and count the number of such high-frequency operations;

[0109] Number of suspicious transaction events: This counts the number of records where the time interval between a transaction and a refund is extremely short within the specified period, reflecting the characteristics of fraudulent order-brushing behavior that maliciously simulates real transaction processes.

[0110] S13. For the multivariate time series generated in step S12, use feature engineering to filter variables related to illegal behavior, and then standardize the filtered variables.

[0111] After constructing the aforementioned statistical variables, this invention implements a feature engineering step to screen the features for relevance. Variables that significantly contribute to the identification of fraudulent order behavior are selected to form the input feature set required for subsequent modeling. To ensure that all feature dimensions are within the same scale range and to prevent differences in the distribution of dependent variables from affecting model convergence and prediction stability, all feature variables are uniformly standardized. Standardization methods include max-min scaling and zero-mean unit variance normalization to ensure the consistency of the numerical range of the data during the modeling process.

[0112] S14. Slice the variables after standardization in step S13 to generate multiple consecutive sample pairs as a complete training dataset.

[0113] To construct data samples suitable for time series prediction tasks, this invention employs a sliding window strategy to slice the processed time series data. Each input sample has a fixed time span, and consecutive time periods within this span are systematically extracted as the model input. The target output corresponds to the statistical value of the number of fraudulent transactions within a certain number of hours following the input sequence. By continuously sliding the window, multiple consecutive sample pairs are generated, forming the complete training dataset required for training the deep learning model.

[0114] S15. Split the complete training dataset obtained in step S14 into training set, validation set and test set in chronological order.

[0115] After constructing the sample set, the dataset is split chronologically. Data from the earliest time period is used as the training set for fitting model parameters; data from the middle period is used as the validation set to monitor the model's generalization ability during training; and data from the most recent period is used as the test set to independently evaluate model performance. This splitting process strictly maintains chronological order to ensure that the model learns and predicts based solely on past information, preventing information leakage.

[0116] Through the above data collection and preprocessing process, a multivariate time series dataset with complete structure, accurate labeling, and strong variable correlation was constructed, providing a solid foundation for the training and deployment of subsequent order-brushing behavior prediction models.

[0117] S2. Construct the TCN-MUDA-iTransformer model:

[0118] The constructed TCN-MUDA-iTransformer model combines the parallel structure of the TCN module and the MUDA-iTransformer module, focusing on effectively extracting temporal features and complex interaction relationships from network transaction data.

[0119] S21. Construct a TCN module based on a multi-layer dilated causal convolutional structure and residual connections to extract local features from the input matrix X generated in step S1 and output a high-dimensional tensor. Where R represents the set of real numbers, T is the time step, and H is the number of features learned at each time step:

[0120] The TCN module is used to model local time dependencies in the input sequence, effectively identifying short-term abrupt changes, volatility patterns, and cyclical trends in trading behavior. The model employs a multi-layer dilated causal convolutional structure, achieving exponential expansion of the receptive field by progressively increasing the dilation rate layer by layer.

[0121] The calculation formula for each convolutional layer is:

[0122] (1)

[0123] in, The width of the convolution kernel. For expansion rate, For the first The k-th convolution parameter of the layer, Represents the activation function (ReLU). It refers to the first The bias term of the convolutional layer, Indicates the first Layer in time step The output is X, which is the input matrix. By stacking multiple layers of convolutions with different dilation rates, the model can simultaneously capture multi-level temporal features, such as hourly and daily time series. To enhance training stability, each layer's output is connected to LayerNorm, residual connections, and Dropout. Finally, the TCN module outputs a high-dimensional tensor. , representing local temporal features at different scales, serving as one of the basic inputs to subsequent models, where T is the time step, H is the number of features learned at each time step, and R represents the set of real numbers.

[0124] In the TCN module, dilated causal convolution and residual connections are used to extract local temporal features. Dilated causal convolution expands the receptive field, capturing both short-term and long-term temporal dependencies, while residual connections effectively avoid the vanishing gradient problem, ensuring the stability of model training. This module is responsible for extracting multi-scale local temporal features from transaction data, providing input for subsequent modules.

[0125] S22. Global Variable Dependency Modeling: The input matrix X generated in step S1 is subjected to an inverted input strategy that treats variables as tokens. A multi-head differential attention mechanism is introduced, and a MUDA-iTransformer module is constructed to extract global features from the input matrix X generated in step S1, outputting the features. Where D is the characteristic number, It is the dimension of the embedded space;

[0126] Specifically, the MUDA-iTransformer module replaces the traditional multi-head self-attention mechanism in the Transformer with the MUDA module. The MUDA module generates a differential attention matrix by constructing two independent attention paths and calculating their difference. After adjusting the difference strength, this differential attention is used as a bias term in the standard multi-head attention mechanism. The MUDA module enhances the model's sensitivity to abnormal transaction behaviors such as fraud and frequent login attempts, effectively suppresses noise interference, and improves the accuracy of anomaly detection.

[0127] The iTransformer module employs an inverted input strategy, using variables as tokens and time as the feature dimension, transposing the input data to [D × T]. Through the stacking of multiple Transformer encoder layers, the iTransformer module can model global interactive dependencies between variables. Because the MUDA module replaces the traditional self-attention mechanism, it enhances the model's focus on key variables and enables the model to better identify sudden behaviors.

[0128] Through this parallel design, the TCN module focuses on extracting multi-scale local temporal features, while the MUDA-iTransformer module enhances the ability to identify sudden trading behaviors by replacing the self-attention mechanism with the MUDA module, and models the interactions between global variables in the iTransformer. Ultimately, these two modules work together to improve the model's ability to detect abnormal behavior and its predictive performance.

[0129] S221. Perform the inverted input strategy and embedding mapping, treating variables as tokens, on the input matrix X generated in step S1:

[0130] Apply the inverted input strategy of treating variables as tokens to the input matrix X generated in step S1:

[0131] The input matrix X has the shape (B, T, D), where B represents the batch size, T is the time step (sequence length), and D is the number of features (variables). To treat the overall time series of each variable as a token, the input matrix X is first transposed to generate the transposed matrix. The shape of X is transformed from (B,T,D) to (B,D,T). At this point, the data structure becomes: each sample has D tokens, that is, each variable is an independent token, and each token contains all the values ​​of that variable at time step T.

[0132] Embedding Mapping: Transposed Matrix The shape is (B, D, T). The time series of each variable, i.e., each token, will then be transformed through an embedding mapping function. This mapping function is typically a simple linear layer that maps the time series of each variable to a higher-dimensional space for processing by the subsequent Transformer model. In this step, the transposed matrix... A new embedding representation E is obtained through a linear transformation, with shape (B,D, ),in This is the dimension of the embedding space. This process can be implemented using matrix multiplication; specifically, it involves using a weight matrix to weight the time series data. Mapping to the new representation space generates the final embedding matrix E. The calculation process for the embedding matrix E is as follows:

[0133] (2)

[0134] in, For the first The embedding vector of each variable, containing all The embedding matrix E obtained by stacking on the variable dimension, This indicates an embedded mapping function. It is the first The time series corresponding to each variable.

[0135] The shape of the embedding matrix E is (B, D, That is, the time series of each variable has been transformed into a... A dimensional embedding vector. Next, all these embedding vectors will be fed into a stack of N Transformer encoder layers.

[0136] S222, Transformer Encoder Stacking: The embedding vectors of the embedding matrix E obtained in step S221 are input into a Transformer encoder consisting of N layers. After stacking N Transformer encoder layers, the output features are... ;

[0137] The Transformer encoder consists of N layers, each of which contains two main sub-layers: a first sub-layer with a multi-head differential attention mechanism and a second sub-layer with a feedforward neural network, and each sub-layer has residual connections and Dropout operations.

[0138] Step S222 specifically involves: the multi-head differential attention mechanism constructs two independent attention paths and calculates their difference to generate a differential attention matrix. The differential attention matrix is ​​then residually concatenated with the embedding matrix E, and a Dropout operation is performed to obtain the output Z. Output Z is then processed by a feedforward neural network to obtain output F. Output F is residually concatenated with output Z, and a Dropout operation is performed to obtain the output... Calculate the values ​​for each layer As input to the next layer, after passing through N layers of stacked Transformer encoders, the output features are... .

[0139] Specifically, multi-head differential attention constructs two independent attention paths and calculates their difference to generate a differential attention matrix. This differential attention matrix is ​​then residually concatenated with the embedding matrix E, and the output Z is obtained through a Dropout operation.

[0140] In the first sub-layer of the Transformer encoder, the embedding matrix E generated in step S221 is first input into the multi-head attention mechanism. The input is mapped to a query, key, and value matrix through three different linear layers:

[0141] ; ; (3)

[0142] Where Q is the query matrix, K is the key matrix, and V is the value matrix. , , These are the projection matrices of the query, key, and value, respectively, with the shape ( , These matrices will be used to calculate attention scores.

[0143] The standard method for calculating attention weights is as follows:

[0144] , (4)

[0145] in , , respectively representing the first Query and key matrix for path attention. This represents the dimension of the key vector. It is the first Attention weights calculated from each path ( ) is the activation function. Indicates transpose;

[0146] By calculating the difference between the two attention distributions, the differential attention tensor is obtained:

[0147] (5)

[0148] in For differential attention tensors, , which is a learnable scaling factor that controls the intensity of attentional differences. , The first The attention weights calculated for the first path and the first path Attention weights are calculated for each path.

[0149] The final attention output is:

[0150] (6)

[0151] in, For the final attention output, Represents the value matrix. Indicates the dimension of the value vector.

[0152] Finally, after multi-head attention computation, the attention output is residually concatenated with the embedding matrix E, and the output Z is obtained through a Dropout operation:

[0153] (7)

[0154] in, This represents the output after differential modulation.

[0155] The second sub-layer of the Transformer encoder is a feedforward neural network (FFN). The embedding vectors of the embedding matrix E, after passing through the multi-head differential attention mechanism of the first sub-layer to output Z, then pass through the second sub-layer feedforward neural network. In this sub-layer, the input data Z passes through a two-layer feedforward network, where each layer typically includes a linear transformation and a non-linear activation function, ReLU. The purpose of the feedforward network is to perform a non-linear transformation on the representation of each variable, enhancing the model's expressive power.

[0156] The output Z is processed by a feedforward neural network to obtain the output F. The output F is then residually connected to the output Z, and the result is obtained through a Dropout operation. Calculate the values ​​for each layer As input to the next layer, after passing through N layers of stacked Transformer encoders, the output features are... Specifically:

[0157] The calculation process of the feedforward network is as follows:

[0158] (8)

[0159] Where F is the output of the feedforward network, and Z is the output representation after differential modulation. , It is the weight matrix of the linear layer. , It is a bias term. It is a non-linear activation function.

[0160] After processing by the feedforward network, the output F is added to the input Z, a residual connection is formed, and then regularization is performed using the Dropout operation to obtain the output. :

[0161] (9)

[0162] Where F is the output of the feedforward network, and Z is the output representation after differential modulation. It is a regularization operation. It is the recursive intermediate quantity of the single-layer output of the Transformer;

[0163] As described above, the Transformer encoder comprises multiple stacked layers. At each layer, the data is first processed through a multi-head attention mechanism, and then further transformed by a feedforward network. These processing steps maintain model stability and prevent overfitting through residual connections and Dropout. Through this multi-layer stacking, iTransformer is able to progressively learn and capture complex global dependencies between variables. The output of each layer serves as the input to the next layer, until the output of the last layer is reached.

[0164] Calculate the values ​​of each layer As the input to the next layer, the output matrix is ​​obtained after passing through N layers of stacked Transformer encoders. The shape is (B, D, It contains D variables for each sample, and each variable has Dimensional representation. On the variable dimension, arrange these D variables in order. The smaller vectors are concatenated end-to-end to form a longer vector. This process is performed on each sample in the batch. This longer vector is... Used as a global variable interaction representation, subsequently with Each component is mapped using a fully connected layer and then concatenated before being fed into the predictor.

[0165] This matrix contains the global dependencies between each variable, representing the global representation vector of each variable in the current window.

[0166] S23. Feature Fusion: High-dimensional tensors output by the TCN module Features output by the MUDA-iTransformer module Feature fusion is performed to obtain a fusion vector, which is then input into the regression predictor to output the model's prediction results.

[0167] After completing multi-scale time modeling and global dependency modeling of transaction data, the model obtains structured feature representations from the TCN module and the iTransformer module, respectively. The TCN module extracts short-term and long-term local trend information through dilated convolutions and outputs features. This represents the local temporal state at each time step; the iTransformer module models the global interaction between variables through a differential attention mechanism, outputting features. .

[0168] To achieve accurate prediction of the future number of fraudulent orders, the system is designed with a multi-source feature fusion mechanism.

[0169] First, the high-dimensional tensor output by the TCN module Perform pooling operations along the time dimension, such as average pooling, to extract the overall trend over time.

[0170] (10)

[0171] in, It is the output feature sequence of TCN. This refers to average pooling along the time dimension, which means averaging the values ​​across all time steps for each channel. This represents the overall trend vector after time pooling, which will be used for feature fusion with the global variable representation of iTransformer for prediction.

[0172] Meanwhile, the output of the MUDA-iTransformer module is pooled or flattened along the variable dimension to obtain a global variable interaction representation:

[0173] (11)

[0174] in, For global variable interaction representation, Flatten indicates that each variable is represented along the variable dimension. The dimensions are concatenated into a single vector, which is used for interactive representation of global variables; These are the characteristics of the output;

[0175] The two feature sets are mapped to a unified dimension and then concatenated to form a fused representation:

[0176] (12)

[0177] Among them, Concat( The two aligned vectors are concatenated along their feature dimensions to form a fused representation. FC( This is a fully connected mapping, which first maps the two feature sets to a unified dimension. This indicates the dimension of the fused vector obtained after concatenation;

[0178] This fusion vector comprehensively reflects the evolutionary trend and complex dependencies between features of the transaction sequence within the current window, providing information support for predicting the frequency of scalping behavior. Subsequently, the fusion vector is input into a regression predictor such as an MLP, which outputs the number of scalped transactions in future prediction time windows, such as the next 3, 6, or 12 hours.

[0179] (13)

[0180] in, , indicating the predicted time point The predicted quantity of illegal transactions can be set with multiple step lengths τ=3h, 6h, 12h, etc., forming a multi-step prediction structure for trend analysis and risk warning.

[0181] S3. Model Training: Train the TCN-MUDA-iTransformer model constructed in step S2 using the training set generated in step S1, and evaluate the model performance using the validation set generated in step S1.

[0182] During training, a multi-task loss function is employed to simultaneously optimize trend prediction and recurrence probability prediction of fraudulent order behavior. The mean squared error (MSE) loss is used for trend prediction, while the binary cross-entropy (BCE) loss is used for recurrence probability prediction. To address class imbalance in the fraudulent order behavior data, Focal Loss is used to enhance attention to minority classes of fraudulent order behavior. Parameter updates are performed using the Adam optimizer, and learning rate scheduling and early stopping strategies are employed to prevent overfitting. After training, model performance is evaluated using a validation set, and model parameters are adjusted based on evaluation metrics such as MAE, RMSE, and R² to ensure accuracy and stability in predicting future illegal activities.

[0183] S4. Prediction and Evaluation: Using the test set generated in step S1, select multiple prediction time points to predict and evaluate the model evaluated by the validation set in step S3.

[0184] After thorough training, the model will be used to predict future illegal trading activities. We select multiple prediction time points, such as t+3h, t+6h, t+12h, etc., and output the predicted frequency of future illegal trading activities at each time point. For model evaluation, we use three metrics to measure the model's predictive performance: Mean Absolute Error (MAE), Root Mean Square Error (RMSE), and Coefficient of Determination (R²), as shown in the following formulas:

[0185] (14)

[0186] (15)

[0187] (16)

[0188] Where n is the number of samples. This is the actual value. It is a predicted value. It is the average of the actual values.

[0189] These evaluation metrics can comprehensively assess the model's performance, ensuring that it can effectively predict potential illegal activities in future transactions in practical applications.

[0190] After training and evaluation, the trained model will be deployed to the online risk control system. The deployed model can monitor the transaction flow of the e-commerce platform in real time and provide real-time risk warnings. When the system detects abnormal transactions or potential illegal activities, it can promptly trigger alarms, providing valuable information to the risk control team.

[0191] To ensure the system can handle high-concurrency transaction data, the deployed model supports both batch prediction and streaming inference. Batch prediction can process all transactions within a given time window, while streaming inference supports real-time prediction of transaction data, ensuring the risk control system can react immediately upon a transaction. Furthermore, the deployed model will be integrated as a microservice into the platform's risk control system, enabling low-latency, high-concurrency risk monitoring and early warning.

[0192] After training and parameter optimization are completed, the model's prediction process is performed according to the following steps:

[0193] Regarding the experimental configuration and the experimental results of this invention, the following content is included:

[0194] A. Dataset and Model Setup

[0195] This invention selects a transaction dataset generated by a real online trading platform as the experimental object. The data includes features such as user ID, transaction amount, transaction timestamp, IP address, device information, transaction behavior type, and suspicious behavior identifiers marked by the platform. This data covers multiple high-frequency transaction behavior time periods and has obvious periodicity, suddenness, and non-linearity characteristics, making it suitable for modeling and predicting trends in fraudulent transactions.

[0196] This invention employs TCN-MUDA-iTransformer as the main model structure. The TCN module contains two layers of dilated causal convolutions to extract the local temporal dependencies of transaction behavior; the MUDA module enhances the response to sudden events through a differential mechanism; and the iTransformer uses an inverted embedding method where variables are used as tokens to achieve global modeling of multi-variable interactions, such as... Figure 2 As shown.

[0197] At the start of the prediction phase, the system receives a continuous time series of online transactions as input. The input data consists of several key variables, such as: frequency of fraudulent transactions, abnormal amount ratio, device switching frequency, number of repeated order placements, and high-frequency login events.

[0198] Let the input time window length be T and the variable dimension be D, then the original input data shape is T × D. The system first performs a structural transformation on this data to adapt it to the modeling requirements of the TCN module and the iTransformer module respectively:

[0199] The TCN module receives data in T × D format, keeping the original structure unchanged;

[0200] The iTransformer module receives data in D × T format, therefore it performs matrix transpose on the input data.

[0201] The specific structure of the model includes: two TCN convolutional layers with 64 and 128 filters respectively, kernel sizes of 3 and 5, and ReLU activation function; three stacked iTransformer encoder layers, each using an 8-head attention mechanism, a feedforward network intermediate layer dimension of 1024, and an output layer that predicts the number of fake orders through a fully connected structure.

[0202] B. Training Setup

[0203] The training process of this invention uses a sliding window to generate training samples, with each input window having a length of 48. The prediction target is the frequency of order brushing within the next 6 or 12 time steps. To maintain the integrity of the time series, the samples are strictly divided into training set, validation set, and test set according to the time sequence.

[0204] The model was trained using the Adam optimizer with an initial learning rate of 0.001 and a maximum of 100 training epochs. The mini-batch size was 32. During training, to prevent overfitting, Dropout (with a dropout rate of 0.1) and LayerNorm were implemented in each submodule.

[0205] Furthermore, to simulate the differences in transaction behavior among different accounts in real-world business scenarios, a Dirichlet distribution was used to partition the user samples, thereby establishing heterogeneity among the samples. By adjusting parameters, the skewness of the transaction data distribution was controlled to test the model's generalization ability under heterogeneous data.

[0206] C. Comparison of baseline and experimental results

[0207] Baseline

[0208] To comprehensively evaluate the performance of the TCN-MUDA-iTransformer model proposed in this invention in the task of predicting fraudulent order behavior trends, this embodiment selects several representative advanced models in the current time series prediction field as comparison baselines, including:

[0209] Pathformer: A sequence prediction model based on graph path modeling, which excels at processing structured sequence information;

[0210] FITS: A high-performance prediction model that combines adaptive attention mechanism with dynamic temporal embedding;

[0211] TimeMixer: A novel architecture for efficient sequence modeling through a hybrid gating mechanism;

[0212] Crossformer: A Transformer architecture focused on modeling across time steps;

[0213] DLinear: A lightweight forecasting model based on a decomposition strategy that excels in long-term trend modeling.

[0214] All comparison methods were tested on the same dataset, with the same training configuration (learning rate, optimizer, number of epochs, etc.), and the same training / test split to ensure fairness and comparability in the evaluation. Experimental results are as follows: Figure 3 As shown.

[0215] Based on the experimental results in Figure 3, the mean absolute error (MAE), root mean square error (RMSE), and coefficient of determination (R²) of each model were calculated at time points t+6 (3h), t+12 (6h), and t+24 (12h). The data results are shown in Table 1.

[0216] Table 1. Data Comparison of Each Model on the Online Transaction Dataset

[0217]

[0218] Experimental results show that the proposed TCN-MUDA-iTransformer model exhibits the best performance across all prediction time windows. It also demonstrates superior performance in terms of mean absolute error (MAE), root mean square error (RMSE), and coefficient of determination (R²). 2 In all three metrics, the model outperformed the comparison method and maintained a stable advantage across different prediction ranges.

[0219] Specifically, in short-term forecasting (t+6), the model significantly reduced the error value, with a MAE reduction of approximately 3.9% and an RMSE reduction of approximately 1.2% compared to the higher-performing DLinear method. 2 The improvement exceeds 3%. In medium- and long-term prediction tasks (such as t+12 and t+24), the model still maintains a strong fitting ability. Especially in periods of drastic trend changes and frequent abnormal fluctuations, the TCN-MUDA-iTransformer responds more accurately to peaks and troughs, and the predicted curves almost completely overlap with the real data.

[0220] Example 2

[0221] This embodiment also provides an electronic device, including:

[0222] At least one processor; and

[0223] The memory stores instructions that, when executed by the at least one processor, cause the at least one processor to perform the online transaction violation prediction method as described above.

[0224] In this embodiment, the electronic device may include, but is not limited to: personal computer, server computer, workstation, desktop computer, laptop computer, notebook computer, mobile computing device, smartphone, tablet computer, cellular phone, personal digital assistant (PDA), handheld device, messaging device, wearable computing device, consumer electronic device, etc.

[0225] Example 3

[0226] This embodiment also provides a machine-readable storage medium storing executable instructions that, when executed, cause the machine to perform the online transaction illegality prediction method as described above.

[0227] Specifically, a system or apparatus equipped with a readable storage medium may be provided, on which software program code implementing the functions of any of the embodiments described above is stored, and the computer or processor of the system or apparatus can read and execute the instructions stored in the readable storage medium.

[0228] In this case, the program code read from the readable medium itself can perform the functions of any of the above embodiments, and therefore the machine-readable code and the readable storage medium storing the machine-readable code constitute a part of this specification.

[0229] Examples of readable storage media include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD-RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, program code can be downloaded from a server computer or the cloud via a communication network.

[0230] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the technical solutions of the present invention, and are not intended to limit the specific implementation of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention should be included within the protection scope of the claims of the present invention.

Claims

1. A method for predicting illegal online transaction activities, characterized in that, The method includes: S1. Transaction data acquisition and preprocessing: Preprocess the raw transaction data to generate multivariate time series and input matrix X composed of multivariate time series, training set, validation set and test set; Transaction data, including transaction time, amount, user ID, device information, and IP address, is collected from e-commerce platforms. Transaction data related to illegal activities is then flagged using the e-commerce platforms' anti-fraud systems or rule engines. This flagged data is aggregated hourly to generate multivariate time series, including the number of fraudulent transactions, abnormal transaction amounts, and device switching frequency. Feature engineering is then used to filter key variables related to illegal transactions, including high-frequency transaction identifiers and repetitive transaction behaviors. These variables are then standardized. A sliding window method is used to generate multiple consecutive sample pairs from the standardized variables. These sample pairs from a past time period are used as input to predict illegal transactions in the future. Finally, the dataset consisting of multiple consecutive sample pairs is divided into training, validation, and test sets. S2. Construct the TCN-MUDA-iTransformer model: S21. Construct a TCN module based on a multi-layer dilated causal convolutional structure and residual connections to extract local features from the input matrix X generated in step S1 and output a high-dimensional tensor. Where R represents the set of real numbers, T is the time step, and H is the number of features learned at each time step; S22. Apply the inverted input strategy of treating variables as tokens and embedding mapping to the input matrix X generated in step S1, and introduce a multi-head differential attention mechanism to construct the MUDA-iTransformer module, a multi-head uncertainty-aware differential attention mechanism, to perform global feature extraction on the input matrix X generated in step S1 and output features. Where D is the characteristic number, It is the dimension of the embedded space; S23. High-dimensional tensors output by the TCN module Features output by the MUDA-iTransformer module Feature fusion is performed to obtain a fusion vector, which is then input into the regression predictor to output the model's prediction results. S3. Train the TCN-MUDA-iTransformer model constructed in step S2 using the training set generated in step S1, and evaluate the model performance using the validation set generated in step S1. S4. Using the test set generated in step S1, select multiple prediction time points to predict and evaluate the model evaluated by the validation set in step S3.

2. The prediction method according to claim 1, characterized in that, Step S1 is as follows: S11. Extract structured transaction data from the historical log database as raw transaction data; S12. Unify the time granularity of the raw transaction data extracted in step S11, and generate a multivariate time series and an input matrix X composed of the multivariate time series; S13. For the multivariate time series generated in step S12, use feature engineering to filter variables related to illegal behavior, and then standardize the filtered variables. S14. Slice the variables after standardization in step S13 to generate multiple consecutive sample pairs as a complete training dataset. S15. Split the complete training dataset obtained in step S14 into training set, validation set and test set in chronological order.

3. The prediction method according to claim 1, characterized in that, The TCN module described in step S21 uses dilated causal convolution and residual connections to extract local temporal features, and achieves exponential expansion of the receptive field by increasing the dilation rate layer by layer. The calculation formula for each convolutional layer is: （1） in, Indicates the first Layer in time step The output, The width of the convolution kernel. For expansion rate, For the first The k-th convolution parameter of the layer, This represents the activation function. It refers to the first The bias term of each convolutional layer, where X is the input matrix; Each layer's output is connected to LayerNorm, residual connections, and Dropout; Finally, the TCN module outputs a high-dimensional tensor: , representing local temporal features at different scales, where T is the time step, H is the number of features learned at each time step, and R represents the set of real numbers.

4. The prediction method according to claim 1, characterized in that, Step S22 is as follows: S221. Perform the inverted input strategy and embedding mapping, treating variables as tokens, on the input matrix X generated in step S1: Perform an axis transpose operation on the input matrix X to obtain the transposed matrix. The shape is transformed from (B,T,D) to (B,D,T); where B represents the batch size, T is the time step or sequence length, and D is the number of variables. Transposed matrix After a linear transformation, an embedding matrix E is generated with shape (B,D, ), It is the dimension of the embedding space, and the calculation process of the embedding matrix E is as follows: （2） in, For the first The embedding vector of each variable, containing all The embedding matrix E obtained by stacking on the variable dimension, This indicates an embedded mapping function. It is the first Time series corresponding to each variable; S222. Input the embedding vector of the embedding matrix E obtained in step S221 into a Transformer encoder consisting of N layers. After stacking N Transformer encoder layers, the output features are... ; The Transformer encoder consists of N layers, each of which contains two main sub-layers: a first sub-layer with a multi-head differential attention mechanism and a second sub-layer with a feedforward neural network, and each sub-layer has residual connections and Dropout operations.

5. The prediction method according to claim 4, characterized in that, Step S222 specifically involves: The multi-head differential attention mechanism generates a differential attention matrix by constructing two independent attention paths and calculating their difference. This differential attention matrix is ​​then residually concatenated with the embedding matrix E, and a Dropout operation is performed to obtain the output Z. Output Z is then passed through a feedforward neural network to obtain output F. Output F is residually concatenated with output Z, and a Dropout operation is performed to obtain the output... Calculate the values ​​for each layer As input to the next layer, after passing through N layers of stacked Transformer encoders, the output features are... .

6. The prediction method according to claim 5, characterized in that, The multi-head differential attention constructs two independent attention paths and calculates their difference to generate a differential attention matrix. This differential attention matrix is ​​then residually concatenated with the embedding matrix E, and the output Z is obtained through a Dropout operation. Specifically: In the first sub-layer of the Transformer encoder, the embedding matrix E generated in step S221 is first input into the multi-head attention mechanism. Through three different linear layers, the input matrix E is mapped into a query, key, and value matrix: ； ； （3） Where Q is the query matrix, K is the key matrix, and V is the value matrix. , , These are the projection matrices of the query, key, and value, respectively, with the shape ( , ); The standard attention weights are calculated as follows: ， ； （4） in, , , respectively representing the first Query and key matrix for path attention. The dimension of the key vector. It is the first Attention weights calculated from each path ( ) is the activation function. Indicates transpose; By calculating the difference between the two attention distributions, the differential attention tensor is obtained: （5） in, For differential attention tensors, , which is a learnable scaling factor that controls the intensity of attentional differences. , The first The attention weights calculated for the first path and the first path Attention weights calculated for each path; The final differential attention matrix, i.e., the attention output, is: （6） in, For the final attention output, Represents the value matrix. Indicates the dimension of the value vector; Finally, after multi-head attention computation, the attention output is residually concatenated with the embedding matrix E, and the output Z is obtained through a Dropout operation: （7） This represents the output after differential modulation. The output Z is processed by a feedforward neural network to obtain output F. Output F and output Z are then residually concatenated, and a Dropout operation is performed to obtain the output... Calculate the values ​​for each layer As input to the next layer, after passing through N layers of stacked Transformer encoders, the output features are... Specifically: The embedding vector of the embedding matrix E is processed by the multi-head differential attention mechanism in the first sub-layer to output Z, and then processed by the feedforward neural network in the second sub-layer. The calculation process is as follows: （8） Where F is the output of the feedforward neural network, and Z is the output representation after differential modulation. , It is the weight matrix of the linear layer. , It is a bias term. It is a non-linear activation function; After processing by the feedforward network, the output F is added to the input Z, a residual connection is formed, and then regularization is performed using the Dropout operation to obtain the output. : （9） Where Z is the output representation after differential modulation. It is a regularization operation, where F is the output of the feedforward network. It is the recursive intermediate quantity of the single-layer output of the Transformer; Calculate the values ​​of each layer As input to the next layer, this process is recursively repeated until the Nth and final layer. It means output to the outside world. The shape is (B, D, It contains D variables for each sample, and each variable has The dimensional representation, in the variable dimension, arranges the D variables according to their order. The feature is obtained by concatenating the first and last small vectors of the same dimension into a long vector. It is used as a global variable interaction representation.

7. The prediction method according to claim 1, characterized in that, Step S23 is as follows: First, the high-dimensional tensor output by the TCN module Perform pooling operations along the time dimension to extract the overall time trend: （10） in, It is the output feature sequence of the TCN module. This refers to average pooling along the time dimension, which means averaging the values ​​across all time steps for each channel. This represents the overall trend vector after time pooling, which will be used for feature fusion with the global variable representation of iTransformer for prediction. Meanwhile, the output of the MUDA-iTransformer module is pooled or flattened along the variable dimension to obtain a global variable interaction representation: （11） in, For global variable interaction representation, Flatten indicates that each variable is represented along the variable dimension. The dimensions are concatenated into a single vector, which is used for interactive representation of global variables; These are the characteristics of the output; The two feature sets are mapped to a unified dimension and then concatenated to form a fused representation: （12） Among them, Concat( The two aligned vectors are concatenated along their feature dimensions to form a fused representation. FC( This is a fully connected mapping, which first maps the two feature sets to a unified dimension. This indicates the dimension of the fused vector obtained after concatenation; The fusion vector is input into the regression predictor, which outputs the prediction results of illegal online transaction behavior.

8. The application of the method for predicting illegal online transaction activities as described in any one of claims 1 to 7, characterized in that, Used for early warning and response in risk control systems.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory that stores instructions, which, when executed by the at least one processor, cause the at least one processor to perform the method for predicting illegal online transactions as described in any one of claims 1 to 7.

10. A machine-readable storage medium storing executable instructions, characterized in that, When the instruction is executed, it causes the machine to perform the method for predicting illegal online transactions as described in any one of claims 1 to 7.

Images