Anti-fraud detection method and device, equipment and storage medium

Abstract

The invention discloses an anti-fraud detection method and device, equipment and a storage medium. The method comprises the following steps: acquiring to-be-detected data; performing anti-fraud detection on the to-be-detected data based on the anti-fraud detection model to obtain a detection result; the anti-fraud detection model comprises an interactive attention module, at least one feature extraction module and a result judgment module; the interactive attention module processes the to-be-detected data to obtain context information; the feature extraction module comprises a self-adaptive frequency filtering unit, an MOE hybrid expert unit and a frequency domain self-correlation unit; the context information is sequentially processed by an adaptive frequency filtering unit, an MOE hybrid expert unit and a frequency domain self-correlation unit in the feature extraction module to obtain at least two target features; the result determination module determines the detection result based on the at least two target features, the anti-fraud detection model in the scheme can extract the key features in the to-be-detected data, and the efficiency and accuracy of anti-fraud detection can be improved.

Description

Technical Field

[0001] This invention relates to the field of financial technology, and in particular to an anti-fraud detection method, apparatus, device, and storage medium. Background Technology

[0002] The integration of digital technology with the financial industry has given rise to new digital financial business models, including third-party payment, online insurance, online lending, supply chain finance, and consumer finance. At the same time, the risks and hidden dangers exposed by digital finance are also increasing daily, with financial fraud risks escalating and the anti-fraud situation becoming increasingly severe.

[0003] Traditional fraud detection methods primarily rely on rule engines and machine learning models. Rule engines depend on manually written and maintained rule sets, which suffer from scalability issues when processing large amounts of transaction data, leading to reduced detection performance and response latency. Machine learning models perform fraud detection by learning features from transaction data; however, because they cannot capture long-term dependencies and trends in transaction data, their accuracy in fraud detection is low. Summary of the Invention

[0004] This invention provides an anti-fraud detection method, apparatus, device, and storage medium to achieve anti-fraud detection and improve the efficiency and accuracy of anti-fraud detection.

[0005] According to one aspect of the present invention, an anti-fraud detection method is provided, the method comprising:

[0006] Obtain the data to be detected; the data to be detected includes at least one of the following: quantitative transaction data and transaction description text;

[0007] The anti-fraud detection model is used to perform anti-fraud detection on the data to be detected, and the detection results are obtained.

[0008] The anti-fraud detection model includes an interactive attention module, at least one feature extraction module, and a result determination module.

[0009] The interactive attention module processes the quantitative data and descriptive text of transactions to obtain contextual information;

[0010] The feature extraction module includes an adaptive frequency filtering unit, an MOE hybrid expert unit, and a frequency domain autocorrelation unit;

[0011] The adaptive frequency filtering unit performs adaptive filtering on the context information to obtain the filtered context information.

[0012] MOE hybrid expert unit includes at least two MOE expert units; the at least two MOE expert units respectively extract features from the filtered context information under different duration modes to obtain feature information of at least two duration modes;

[0013] The frequency domain autocorrelation unit performs autocorrelation processing on the feature information of at least two duration modes to obtain at least two target features;

[0014] The result determination module determines the detection result based on at least two target features; correspondingly, the detection result includes the detection result corresponding to at least two duration modes.

[0015] According to another aspect of the present invention, an anti-fraud detection device is provided, the device comprising:

[0016] The data to be detected module is used to acquire the data to be detected; the data to be detected includes at least one of the following: quantitative transaction data and transaction description text.

[0017] The detection result determination module is used to perform anti-fraud detection on the data to be detected based on the anti-fraud detection model and obtain the detection result. The anti-fraud detection model includes an interactive attention module, at least one feature extraction module, and a result determination module. The interactive attention module processes the quantitative transaction data and transaction description text to obtain contextual information. The feature extraction module includes an adaptive frequency filtering unit, a MOE hybrid expert unit, and a frequency domain autocorrelation unit. The adaptive frequency filtering unit performs adaptive filtering on the contextual information to obtain filtered contextual information. The MOE hybrid expert unit includes at least two MOE expert units. The at least two MOE expert units respectively extract features from the filtered contextual information under different duration modes to obtain feature information for at least two duration modes. The frequency domain autocorrelation unit performs autocorrelation processing on the feature information for at least two duration modes to obtain at least two target features. The result determination module determines the detection result based on the at least two target features. Correspondingly, the detection result includes the detection results corresponding to at least two duration modes.

[0018] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0019] At least one processor; and

[0020] A memory that is communicatively connected to at least one processor; wherein,

[0021] The memory stores a computer program that can be executed by at least one processor, such that the at least one processor is able to perform the anti-fraud detection method of any embodiment of the present invention.

[0022] According to another aspect of the present invention, a computer-readable storage medium is provided, which stores computer instructions for causing a processor to execute and implement the anti-fraud detection method of any embodiment of the present invention.

[0023] The technical solution of this invention involves acquiring data to be detected, including at least one of quantitative transaction data and transaction description text; performing fraud detection on the data to be detected based on an anti-fraud detection model to obtain detection results; wherein, the anti-fraud detection model includes an interactive attention module, at least one feature extraction module, and a result determination module; the interactive attention module processes the quantitative transaction data and transaction description text to obtain context information; the feature extraction module includes an adaptive frequency filtering unit, a MOE hybrid expert unit, and a frequency domain autocorrelation unit; the adaptive frequency filtering unit performs adaptive filtering on the context information to obtain filtered context information; the MOE hybrid expert unit includes at least two MOE expert units; the at least two MOE expert units respectively extract features from the filtered context information under different duration modes to obtain feature information under at least two duration modes; the frequency domain autocorrelation unit performs autocorrelation processing on the feature information under at least two duration modes to obtain at least two target features; the result determination module determines the detection results based on the at least two target features; correspondingly, the detection results include detection results corresponding to at least two duration modes, thereby achieving anti-fraud detection, solving the problems of low efficiency and low accuracy in existing anti-fraud detection technologies, and improving the efficiency and accuracy of anti-fraud detection.

[0024] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart of an anti-fraud detection method provided in Embodiment 1 of the present invention;

[0027] Figure 2 This is a schematic diagram of the structure of an anti-fraud detection model provided in an embodiment of the present invention;

[0028] Figure 3 This is a schematic diagram of the structure of an anti-fraud detection model provided in an embodiment of the present invention;

[0029] Figure 4 This is a schematic diagram of the structure of an anti-fraud detection device provided in Embodiment 3 of the present invention;

[0030] Figure 5 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] Example 1

[0034] Figure 1 This is a flowchart of an anti-fraud detection method provided in Embodiment 1 of the present invention. This embodiment is applicable to anti-fraud detection in the financial field. The method can be executed by an anti-fraud detection device, which can be implemented in hardware and / or software. The anti-fraud detection device can be configured in the electronic device provided in this embodiment of the invention. The electronic device can be a server, computer, or mobile terminal, such as a mobile phone or tablet computer. Figure 1 As shown, the method includes:

[0035] S110. Obtain the data to be detected; the data to be detected includes at least one of the following: transaction quantitative data and transaction description text.

[0036] The data to be detected refers to the data required for anti-fraud detection. This data can be read from the trading system via an Application Programming Interface (API). The data to be detected may include quantitative transaction data, transaction description text, or both, depending on the requirements. Quantitative transaction data refers to a quantifiable transaction indicator within the data to be detected. Quantitative transaction data includes, but is not limited to, transaction amount, transaction time, and transaction frequency. Transaction description text is unstructured text information used to supplement the transaction context. For example, transaction description text includes, but is not limited to, textual descriptions corresponding to the purpose of the transaction. Obtaining the data to be detected provides data support for subsequent analysis, ensuring that various tasks are executed efficiently and accurately.

[0037] Optionally, after S110, the method further includes: performing sliding sampling processing on the transaction quantitative data based on a sliding window of a preset size to obtain multiple sliding window subsequences; wherein, the multiple sliding window subsequences have the same sequence length.

[0038] The preset size is the length of the sliding window set before sampling. The preset size can be set according to actual needs and is not limited here. The sliding window subsequence is a continuous segment extracted from the quantitative transaction data through the sliding window.

[0039] Specifically, a preset size for the sliding window is set in advance. The sliding window of the preset size moves on the quantitative transaction data. After each movement, a new sliding window subsequence is extracted until the sliding sampling ends, resulting in multiple sliding window subsequences. This ensures that the lengths of the multiple sliding window subsequences are consistent, providing standardized input for subsequent task processing.

[0040] For example, a set of quantitative trading data is X = {x1, x2, ..., x...} N}; where x N This represents the quantitative data of transactions with a sampling time of N. The preset size of the sliding window is set to L, and the set corresponding to the subsequences of the resulting sliding window is... Sliding sampling of transaction quantitative data was implemented, ensuring that the lengths of multiple sliding window subsequences were consistent, thus providing standardized input for subsequent tasks.

[0041] S120. Based on the anti-fraud detection model, perform anti-fraud detection on the data to be detected and obtain the detection results.

[0042] The anti-fraud detection model includes an interactive attention module, at least one feature extraction module, and a result determination module. The interactive attention module processes the quantitative transaction data and transaction description text to obtain contextual information. The feature extraction module includes an adaptive frequency filtering unit, a MOE hybrid expert unit, and a frequency domain autocorrelation unit. The adaptive frequency filtering unit performs adaptive filtering on the contextual information to obtain filtered contextual information. The MOE hybrid expert unit includes at least two MOE expert units. The at least two MOE expert units respectively extract features from the filtered contextual information under different duration modes to obtain feature information for at least two duration modes. The frequency domain autocorrelation unit performs autocorrelation processing on the feature information for at least two duration modes to obtain at least two target features. The result determination module determines the detection result based on at least two target features. Correspondingly, the detection result includes the detection results corresponding to at least two duration modes.

[0043] The anti-fraud detection model is a model used to detect fraud in the data to be detected, determining whether the data contains fraudulent elements. Anti-fraud detection models include, but are not limited to, deep learning models, and can be selected according to user needs; no limitation is made here. The detection result is data characterizing whether the data to be detected contains fraudulent elements. Optionally, the detection result includes whether the data contains fraudulent elements and the corresponding probability value.

[0044] The interactive attention module, within the anti-fraud detection model, handles the relationship between quantitative transaction data and descriptive transaction text. It processes this data to obtain contextual information. The feature extraction module, on the other hand, extracts features from this contextual information. The anti-fraud detection model can include one or more feature extraction modules, the number of which is determined by requirements and is not limited here. When multiple feature extraction modules are included, each module can have the same or different structures, also depending on the needs of the model.

[0045] The result determination module is the structure in the anti-fraud detection model used to determine the detection results. The result determination module processes at least two target features to obtain the detection results, which include detection results corresponding to at least two duration modes.

[0046] Each feature extraction module includes an adaptive frequency filtering unit, an MOE hybrid expert unit, and a frequency domain autocorrelation unit. The adaptive frequency filtering unit performs adaptive frequency filtering on the context information input to the feature extraction module, obtaining filtered context information. By automatically learning the importance of different frequency components in the context information, the adaptive frequency filtering unit retains frequency features relevant to fraud risk while filtering out noise and irrelevant frequency components.

[0047] A Mixture of Experts (MOE) unit comprises at least two MOE units. Each MOE unit extracts features from the filtered context information within its corresponding duration mode, thus obtaining feature information. A Mixture of Experts (MOE) unit can include two, three, or five MOE units, depending on requirements; the number of MOE units is not limited here. Different MOE units correspond to different duration modes. Optionally, the duration mode for each MOE unit can be determined based on a pre-set feature extraction period. Different duration modes correspond to different feature extraction periods. Feature extraction periods include, but are not limited to, hours, days, weeks, months, quarters, and years, and can be set according to requirements. Alternatively, the duration mode corresponding to a MOE unit can be determined based on a pre-set feature extraction period, which is then used as the duration mode for the MOE unit. For example, if a Mixture of Experts (MOE) unit comprises three MOE units, and the pre-set feature extraction periods include days, months, and quarters, then the duration modes corresponding to the three MOE units are days, months, and quarters, respectively. By using different MOE expert units to extract features from the filtered context information under different duration modes, feature information of different duration modes is obtained, realizing comprehensive feature extraction and providing comprehensive data support for subsequent analysis.

[0048] The frequency domain autocorrelation unit (FTU) is a structure in the feature extraction module that performs autocorrelation processing on feature information of different duration modes. By performing autocorrelation processing on feature information of different duration modes using the FTU, the time-dimensional features of feature information of different duration modes are extracted, resulting in target features corresponding to feature information of different duration modes. These target features are used to determine whether the data to be detected is fraudulent.

[0049] For example, see Figure 2 , Figure 2This is a schematic diagram of the structure of an anti-fraud detection model provided in an embodiment of the present invention. The anti-fraud detection model includes an interactive attention module, a feature extraction module, and a result determination module. The feature extraction module includes an adaptive frequency filtering unit, a MOE hybrid expert unit, and a frequency domain autocorrelation unit. The MOE hybrid expert unit includes three MOE expert units with different feature extraction periods. The MOE expert units with different feature extraction periods perform feature extraction on the filtered context information under different duration modes. The processing procedure of the anti-fraud detection model is as follows: The data to be detected is input into the anti-fraud detection model. The interactive attention module processes the quantitative transaction data and transaction description text to obtain context information. The adaptive frequency filtering unit performs adaptive filtering on the context information to obtain filtered context information. The filtered context information is then processed by the first, second, and third MOE expert units for feature extraction under the three duration modes to obtain feature information for the three duration modes. The feature information for the three duration modes is then processed by the frequency domain autocorrelation unit to obtain three target features. The three target features are then processed by the result determination module to obtain the detection result, which includes the detection results corresponding to the three duration modes.

[0050] Optionally, the method further includes: determining a risk control strategy based on the detection results; the risk control strategy includes at least one of an interception strategy and an audit strategy.

[0051] Risk control strategies are the rules and measures for handling risks based on the test results, used to prevent, control, or mitigate the risk of fraud in the test results. Risk control strategies may include interception strategies, audit strategies, or both.

[0052] Specifically, based on a pre-set mapping table between detection results and risk control strategies, the system matches the detection results and uses the matched risk control strategy as the final risk control strategy. This helps prevent fraud and reduce user losses.

[0053] The technical solution of this embodiment acquires data to be detected, which includes at least one of quantitative transaction data and transaction description text, providing data support for subsequent analysis and ensuring that various tasks are executed efficiently and accurately. Based on an anti-fraud detection model, anti-fraud detection is performed on the data to be detected to obtain detection results, achieving accurate anti-fraud detection. The anti-fraud detection model includes an interactive attention module, at least one feature extraction module, and a result determination module. The interactive attention module processes the quantitative transaction data and transaction description text to obtain contextual information. The feature extraction module includes an adaptive frequency filtering unit, a MOE hybrid expert unit, and a frequency domain autocorrelation unit. The adaptive frequency filtering unit performs adaptive filtering on the contextual information to obtain filtered contextual information, filtering out noise and irrelevant data. In the frequency component, frequency features related to fraud risk are retained. The MOE hybrid expert unit includes at least two MOE expert units. Each of the at least two MOE expert units extracts features from the filtered context information under different duration modes, obtaining feature information for at least two duration modes. This achieves comprehensive feature extraction and provides comprehensive data support for subsequent analysis. The frequency domain autocorrelation unit performs autocorrelation processing on the feature information for at least two duration modes, obtaining at least two target features. The result determination module determines the detection results based on at least two target features. Correspondingly, the detection results include detection results corresponding to at least two duration modes, realizing anti-fraud detection and solving the problems of low efficiency and low accuracy in existing anti-fraud detection technologies, thereby improving the efficiency and accuracy of anti-fraud detection.

[0054] Example 2

[0055] Embodiment 2 of the present invention provides an anti-fraud detection method. This embodiment is a refinement of the above embodiments, and based on the foregoing embodiments, the processing procedure of the interactive attention module is explained in detail. For specific implementation details, please refer to the technical solution of this embodiment. Technical terms that are the same as or corresponding to those in the above embodiments will not be repeated here. The method includes:

[0056] S110. Obtain the data to be detected; the data to be detected includes at least one of the following: transaction quantitative data and transaction description text.

[0057] S120. Based on the anti-fraud detection model, perform anti-fraud detection on the data to be detected and obtain the detection results.

[0058] The anti-fraud detection model includes an interactive attention module, at least one feature extraction module, and a result determination module. The interactive attention module determines the correlation between the quantitative transaction data and the transaction description text; it determines the attention weight corresponding to the quantitative transaction data based on the correlation; and it determines the context information based on the attention weight and the quantitative transaction data. The feature extraction module includes an adaptive frequency filtering unit, a MOE hybrid expert unit, and a frequency domain autocorrelation unit. The adaptive frequency filtering unit performs adaptive filtering on the context information to obtain filtered context information. The MOE hybrid expert unit includes at least two MOE expert units. The at least two MOE expert units respectively extract features from the filtered context information under different duration modes to obtain feature information under at least two duration modes. The frequency domain autocorrelation unit performs autocorrelation processing on the feature information under at least two duration modes to obtain at least two target features. The result determination module determines the detection result based on at least two target features. Correspondingly, the detection result includes detection results corresponding to at least two duration modes.

[0059] Correlation is used to characterize the degree of association between quantitative transaction data and transaction description text. For example, the quantitative transaction data and transaction description text can be converted into corresponding vector forms, and the correlation can be calculated based on the corresponding vector forms of the quantitative transaction data and transaction description text. Attention weights are the importance coefficients of different dimensions of data in the quantitative transaction data. Attention weights can be determined based on the correlation between the quantitative transaction data and the transaction description text. For example, the correlation between the quantitative transaction data and the transaction description text can be determined and input into a Softmax layer for normalization to obtain the attention weights corresponding to the quantitative transaction data. Intersecting data is weighted according to the attention weights to obtain contextual information, achieving accurate determination of contextual information and providing accurate data support for subsequent analysis and processing.

[0060] For example, see Figure 3 , Figure 3 This is a schematic diagram of the structure of an anti-fraud detection model provided in an embodiment of the present invention. The anti-fraud detection model sequentially includes a cross-attention layer, an adaptive frequency filter layer, a normalization layer, an MOE layer, a feedforward network layer, a normalization layer, an adaptive frequency filter layer, a normalization layer, and a linear layer. The adaptive frequency filter layer, normalization layer, MOE layer, feedforward network layer, normalization layer, adaptive frequency filter layer, and normalization layer form a feature extraction layer, where N represents the number of feature extraction layers, and N is greater than or equal to 1. The number of feature extraction layers can be one or three, depending on the requirements, and is not limited here.

[0061] For example, the interactive attention module processes the quantitative transaction data and the transaction description text as follows: First, it calculates the correlation between the quantitative transaction data and the transaction description text. The correlation calculation formula is as follows:

[0062]

[0063] Where S represents the correlation between the quantitative transaction data and the transaction description text; Q represents the transaction description text in vector form; K represents the quantitative transaction data in vector form; d k This represents the dimension of K. Next, the attention weights corresponding to the quantitative transaction data are calculated based on correlation. The formula for calculating the attention weights is as follows:

[0064]

[0065] Where A represents the attention weight corresponding to the quantitative transaction data; softmax() represents the softmax function; N Q N represents the number of transaction description texts in vector form; K This represents the quantity of quantitative transaction data in vector form. Finally, contextual information is determined based on attention weights and the quantitative transaction data; the formula for calculating contextual information is as follows:

[0066] O = AV;

[0067] Where O represents contextual information; A represents the attention weights corresponding to the quantitative transaction data; and V represents the quantitative transaction data in vector form.

[0068] Optionally, the adaptive frequency filtering unit is specifically used to: perform Fourier transform processing on the context information to obtain the context information in the frequency domain; perform filtering processing on the context information in the frequency domain based on a first preset filtering threshold to obtain first filtered data; perform frequency domain regularization processing on the first filtered data to obtain second filtered data; and perform inverse Fourier transform processing on the second filtered data to obtain filtered context information.

[0069] The first preset filtering threshold is used to filter the context information in the frequency domain, determining whether the context information needs to be retained. Based on the first preset filtering threshold, the context information in the frequency domain is filtered, retaining the necessary context information and removing irrelevant context information, resulting in the first filtered data. The first filtered data is frequency domain data obtained by converting the context information to the frequency domain via Fourier transform and then filtering it using the first preset filtering threshold. For example, by performing a Fourier transform on the context information to obtain the frequency domain context information, determining the first preset filtering threshold, retaining the context information in the frequency domain that is greater than or equal to the first preset filtering threshold, and removing the context information in the frequency domain that is less than the first preset filtering threshold, the first filtered data is obtained. This achieves preliminary filtering of the context information in the frequency domain, which helps reduce noise interference. The second filtered data is frequency domain data obtained after performing frequency domain regularization on the first filtered data. By performing frequency domain regularization on the first filtered data, high-frequency data in the first filtered data is filtered out, resulting in the second filtered data. This reduces the influence of high-frequency data in the first filtered data, thereby improving the accuracy of anti-fraud detection.

[0070] For example, the adaptive frequency filtering unit performs adaptive filtering on the context information to obtain the filtered context information as follows: First, a Fourier transform is performed on the context information to convert the time-domain context information into frequency-domain context information. The calculation formula for the Fourier transform of the context information is as follows:

[0071]

[0072] Among them, X k Represents context information in the frequency domain; N k This represents the quantity of quantitative transaction data in vector form. Then, a first preset filtering threshold is set, and the context information in the frequency domain is filtered according to this threshold to obtain the first filtered data. The specific calculation formula is as follows:

[0073] Xk=X k ·1(|X k |>T k );

[0074] T k =σ(θ) k )∈[0,1];

[0075] Where, X′ k Represents the first filtered data; θ k T represents the first preset filtering threshold; k This represents the first preset filtering threshold after processing by the Sigmoid activation function. When |X k | Greater than Tk When |X k | Less than or equal to T k At this time, the context information in the frequency domain corresponding to the first frequency is filtered out. Secondly, frequency domain regularization is performed on the first filtered data; the specific calculation formula is as follows:

[0076] X″ k =X′ k +R;

[0077]

[0078] Where, X″ k Represents the second filtered data; R represents the regularization term; λ k X represents the regularization strength, used to filter out high-frequency data in the first filtered data; k This represents the context information in the frequency domain. Finally, an inverse Fourier transform is performed on the second filtered data to obtain the filtered context information, which is time-domain data. The specific calculation formula is as follows:

[0079]

[0080] Among them, O n ′ represents the filtered context information.

[0081] Optionally, the frequency domain autocorrelation unit is specifically used to: perform Fourier transform processing on the feature information of at least two duration modes respectively to obtain the feature information of at least two duration modes in the frequency domain; and perform autocorrelation calculation on the feature information of at least two duration modes in the frequency domain to obtain at least two target features.

[0082] Specifically, by performing Fourier transform on the feature information of at least two duration modes respectively, feature information of at least two duration modes in the frequency domain is obtained. By performing autocorrelation calculation on the feature information of at least two duration modes in the frequency domain, at least two target features are obtained, thus achieving accurate determination of target features and improving the accuracy of anti-fraud detection.

[0083] For example, the autocorrelation of the characteristic information of the duration pattern in the frequency domain is calculated using the following formula:

[0084] C k =H k ·H′ k ;

[0085] Among them, C k Represents target features; H k H′ represents characteristic information of a duration pattern in the frequency domain. kThe conjugate complex number represents the feature information of a duration pattern in the frequency domain. Based on the above formula, the target features corresponding to the feature information of the duration patterns in the remaining frequency domains are calculated to obtain at least two target features.

[0086] In some embodiments of the present invention, the method further includes training an anti-fraud detection model, the specific training process of which is as follows:

[0087] (1) Obtain one year's worth of sample data from the trading system. The sample data includes quantitative data of sample transactions and descriptive text of sample transactions. Among them, the proportion of sample data with fraud risk is 10%. Each sample data includes a label, which includes a normal label and an abnormal label. A normal label indicates that the sample data is not fraudulent, and an abnormal label indicates that the sample data is fraudulent.

[0088] (2) Construct training, validation, and test sets in a ratio of 7:2:1. For the sample data in the training, validation, and test sets, use a sliding window of a preset size to perform sliding sampling to obtain multiple sliding sample sequences.

[0089] (3) Construct an untrained anti-fraud detection model by inputting multiple sliding sample sequences and sample transaction description texts from the training set into the untrained anti-fraud detection model for training.

[0090] (4) Set evaluation metrics for the anti-fraud detection model. Precision, recall, F1 score, and area under the precision-recall curve can be set as evaluation metrics for the anti-fraud detection model.

[0091] The formula for calculating accuracy is as follows:

[0092]

[0093] Precision represents the accuracy rate; TP represents the number of sample data points where the anti-fraud detection model predicts fraud and the corresponding label is abnormal; FP represents the number of sample data points where the anti-fraud detection model predicts fraud and the corresponding label is normal.

[0094] Recall is used to characterize the proportion of samples with normal labels that are correctly predicted as fraud-free. The formula for calculating recall is as follows:

[0095]

[0096] Recall represents the recall rate; TP represents the number of samples predicted as fraudulent by the anti-fraud detection model and labeled as anomalous; FN represents the number of samples predicted as non-fraudulent by the anti-fraud detection model and labeled as anomalous.

[0097] The F1 score is the harmonic mean of precision and recall, used to balance these two metrics. The formula for calculating the F1 score is as follows:

[0098]

[0099] F1 represents the F1 score; Precision represents the precision rate; Recall represents the recall rate.

[0100] The area under the precision-recall curve (PR-AUC) is an evaluation metric for the predictive performance of anti-fraud detection models. A higher PR-AUC value indicates better predictive performance, while a lower PR-AUC value indicates worse predictive performance.

[0101] If at least one of the precision, recall, F1 score, and area under the precision-recall curve fails to meet the corresponding preset threshold, adjust the model parameters of the anti-fraud detection model until all of these parameters meet the corresponding preset threshold. Then, stop adjusting the model parameters of the anti-fraud detection model and obtain the trained anti-fraud detection model.

[0102] The technical solution of this embodiment acquires data to be detected, including at least one of quantitative transaction data and transaction description text, providing data support for subsequent analysis and ensuring that various tasks are executed efficiently and accurately. Based on an anti-fraud detection model, anti-fraud detection is performed on the data to be detected to obtain detection results, achieving accurate anti-fraud detection. The anti-fraud detection model includes an interactive attention module, at least one feature extraction module, and a result determination module. The interactive attention module determines the correlation between the quantitative transaction data and the transaction description text; it determines the attention weight corresponding to the quantitative transaction data based on the correlation; and it determines the context information based on the attention weight and the quantitative transaction data, achieving accurate determination of context information and providing accurate data support for subsequent analysis and processing. The feature extraction module includes an adaptive frequency filtering unit, an MOE hybrid expert unit, and a frequency domain autocorrelation unit. An adaptive frequency filtering unit performs adaptive filtering on the context information to obtain filtered context information, filtering out noise and irrelevant frequency components while retaining frequency features related to fraud risk. The MOE hybrid expert unit includes at least two MOE expert units. These at least two MOE expert units extract features from the filtered context information under different duration modes, obtaining feature information for at least two duration modes, achieving comprehensive feature extraction and providing comprehensive data support for subsequent analysis. A frequency domain autocorrelation unit performs autocorrelation processing on the feature information for at least two duration modes, obtaining at least two target features. The result determination module determines the detection result based on at least two target features. Correspondingly, the detection result includes detection results corresponding to at least two duration modes, realizing anti-fraud detection and solving the problems of low efficiency and low accuracy in existing anti-fraud detection technologies, thus improving the efficiency and accuracy of anti-fraud detection.

[0103] Example 3

[0104] Figure 4 This is a schematic diagram of the structure of an anti-fraud detection device provided in Embodiment 3 of the present invention. Figure 4 As shown, the device includes:

[0105] The data acquisition module 210 is used to acquire the data to be detected; the data to be detected includes at least one of the following: transaction quantitative data and transaction description text.

[0106] The detection result determination module 220 is used to perform anti-fraud detection on the data to be detected based on the anti-fraud detection model and obtain the detection result. The anti-fraud detection model includes an interactive attention module, at least one feature extraction module, and a result determination module. The interactive attention module processes the quantitative transaction data and transaction description text to obtain context information. The feature extraction module includes an adaptive frequency filtering unit, a MOE hybrid expert unit, and a frequency domain autocorrelation unit. The adaptive frequency filtering unit performs adaptive filtering on the context information to obtain filtered context information. The MOE hybrid expert unit includes at least two MOE expert units. The at least two MOE expert units respectively extract features from the filtered context information under different duration modes to obtain feature information under at least two duration modes. The frequency domain autocorrelation unit performs autocorrelation processing on the feature information under at least two duration modes to obtain at least two target features. The result determination module determines the detection result based on the at least two target features. Correspondingly, the detection result includes the detection results corresponding to at least two duration modes.

[0107] The technical solution of this embodiment involves acquiring data to be detected, including at least one of quantitative transaction data and transaction description text; performing anti-fraud detection on the data to be detected based on an anti-fraud detection model to obtain detection results; wherein, the anti-fraud detection model includes an interactive attention module, at least one feature extraction module, and a result determination module; the interactive attention module processes the quantitative transaction data and transaction description text to obtain context information; the feature extraction module includes an adaptive frequency filtering unit, a MOE hybrid expert unit, and a frequency domain autocorrelation unit; the adaptive frequency filtering unit performs adaptive filtering on the context information to obtain filtered context information; the MOE hybrid expert unit includes at least two MOE expert units; the at least two MOE expert units respectively extract features from the filtered context information under different duration modes to obtain feature information under at least two duration modes; the frequency domain autocorrelation unit performs autocorrelation processing on the feature information under at least two duration modes to obtain at least two target features; the result determination module determines the detection results based on the at least two target features; correspondingly, the detection results include detection results corresponding to at least two duration modes, thereby achieving anti-fraud detection, solving the problems of low efficiency and low accuracy in existing anti-fraud detection technologies, and improving the efficiency and accuracy of anti-fraud detection.

[0108] Based on the above embodiments, optionally, the interactive attention module is specifically used to: determine the correlation between the transaction quantitative data and the transaction description text based on the transaction quantitative data and the transaction description text; determine the attention weight corresponding to the transaction quantitative data based on the correlation; and determine the context information based on the attention weight and the transaction quantitative data.

[0109] Optionally, the adaptive frequency filtering unit is specifically used to: perform Fourier transform processing on the context information to obtain the context information in the frequency domain; perform filtering processing on the context information in the frequency domain based on a first preset filtering threshold to obtain first filtered data; perform frequency domain regularization processing on the first filtered data to obtain second filtered data; and perform inverse Fourier transform processing on the second filtered data to obtain filtered context information.

[0110] Optionally, the frequency domain autocorrelation unit is specifically used to: perform Fourier transform processing on the feature information of at least two duration modes respectively to obtain the feature information of at least two duration modes in the frequency domain; and perform autocorrelation calculation on the feature information of at least two duration modes in the frequency domain to obtain at least two target features.

[0111] Optionally, the device further includes a sliding window subsequence determination module, used to: after acquiring the user's data to be detected, perform sliding sampling processing on the quantitative transaction data based on a sliding window of a preset size to obtain multiple sliding window subsequences; wherein, the multiple sliding window subsequences have the same sequence length.

[0112] Optionally, the device further includes a risk control strategy determination module, used to: determine a risk control strategy based on the detection results; the risk control strategy includes at least one of an interception strategy and an audit strategy.

[0113] Optionally, the device further includes a duration mode determination module, used to: determine the duration mode corresponding to each MOE expert unit based on a pre-set feature extraction period, wherein different duration modes correspond to different feature extraction periods.

[0114] The anti-fraud detection device provided in the embodiments of the present invention can execute the anti-fraud detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0115] Example 4

[0116] Figure 5 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0117] like Figure 5As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0118] Multiple components in electronic device 10 are connected to input / output (I / O) interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of monitors, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0119] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as anti-fraud detection methods.

[0120] In some embodiments, the anti-fraud detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via read-only memory (ROM) 12 and / or communication unit 19. When the computer program is loaded into random access memory (RAM) 13 and executed by processor 11, one or more steps of the anti-fraud detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the anti-fraud detection method by any other suitable means (e.g., by means of firmware).

[0121] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0122] Computer programs used to implement the anti-fraud detection method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0123] Example 5

[0124] Embodiment 5 of the present invention also provides a computer-readable storage medium storing computer instructions for causing a processor to execute an anti-fraud detection method, the method comprising:

[0125] The process involves acquiring data to be detected, including at least one of quantitative transaction data and transaction description text. Anti-fraud detection is then performed on the data based on an anti-fraud detection model to obtain detection results. The anti-fraud detection model includes an interactive attention module, at least one feature extraction module, and a result determination module. The interactive attention module processes the quantitative transaction data and transaction description text to obtain contextual information. The feature extraction module includes an adaptive frequency filtering unit, a MOE hybrid expert unit, and a frequency domain autocorrelation unit. The adaptive frequency filtering unit performs adaptive filtering on the contextual information to obtain filtered contextual information. The MOE hybrid expert unit includes at least two MOE expert units. The at least two MOE expert units extract features from the filtered contextual information under different duration modes to obtain feature information for at least two duration modes. The frequency domain autocorrelation unit performs autocorrelation processing on the feature information for at least two duration modes to obtain at least two target features. The result determination module determines the detection results based on the at least two target features. Correspondingly, the detection results include detection results corresponding to at least two duration modes.

[0126] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0127] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0128] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0129] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0130] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0131] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for anti-fraud detection, characterized in that, include: Acquire the data to be detected; the data to be detected includes at least one of quantitative transaction data and transaction description text; The anti-fraud detection model is used to perform anti-fraud detection on the data to be detected, and the detection results are obtained. The anti-fraud detection model includes an interactive attention module, at least one feature extraction module, and a result determination module. The interactive attention module processes the quantitative transaction data and the transaction description text to obtain contextual information; The feature extraction module includes an adaptive frequency filtering unit, an MOE hybrid expert unit, and a frequency domain autocorrelation unit; The adaptive frequency filtering unit performs adaptive filtering on the context information to obtain filtered context information. The MOE hybrid expert unit includes at least two MOE expert units; the at least two MOE expert units respectively perform feature extraction on the filtered context information under different duration modes to obtain feature information of at least two duration modes; The frequency domain autocorrelation unit performs autocorrelation processing on the feature information of the at least two duration modes respectively to obtain at least two target features; The result determination module determines the detection result based on the at least two target features; correspondingly, the detection result includes the detection result corresponding to at least two duration modes.

2. The method according to claim 1, characterized in that, The interactive attention module is specifically used for: The correlation between the quantitative transaction data and the transaction description text is determined based on the quantitative transaction data and the transaction description text. The attention weights corresponding to the quantitative transaction data are determined based on the correlation. The context information is determined based on the attention weights and the quantitative transaction data.

3. The method according to claim 2, characterized in that, The adaptive frequency filtering unit is specifically used for: The context information is subjected to Fourier transform processing to obtain the frequency domain context information; The frequency domain context information is filtered based on a first preset filtering threshold to obtain first filtered data; The first filtered data is subjected to frequency domain regularization to obtain the second filtered data. The second filtered data is subjected to inverse Fourier transform to obtain the filtered context information.

4. The method according to claim 3, characterized in that, The frequency domain autocorrelation unit is specifically used for: The feature information of the at least two duration modes is subjected to Fourier transform processing to obtain the feature information of the at least two duration modes in the frequency domain. Autocorrelation calculation is performed on the feature information of at least two duration modes in the frequency domain to obtain the at least two target features.

5. The method according to claim 1, characterized in that, After obtaining the user's data to be detected, the process also includes: The transaction quantitative data is subjected to sliding sampling based on a sliding window of a preset size to obtain multiple sliding window subsequences; The multiple sliding window subsequences have the same sequence length.

6. The method according to claim 1, characterized in that, The method further includes: Risk control strategies are determined based on the detection results; the risk control strategies include at least one of interception strategies and auditing strategies.

7. The method according to claim 1, characterized in that, The method further includes: The duration mode corresponding to each MOE expert unit is determined based on a pre-set feature extraction period, and the feature extraction period is different for each duration mode.

8. An anti-fraud detection device, characterized in that, include: The data to be detected module is used to acquire the data to be detected; the data to be detected includes at least one of quantitative transaction data and transaction description text; The detection result determination module is used to perform anti-fraud detection on the data to be detected based on the anti-fraud detection model and obtain the detection result. The anti-fraud detection model includes an interactive attention module, at least one feature extraction module, and a result determination module. The interactive attention module processes the quantitative transaction data and the transaction description text to obtain contextual information; The feature extraction module includes an adaptive frequency filtering unit, an MOE hybrid expert unit, and a frequency domain autocorrelation unit; The adaptive frequency filtering unit performs adaptive filtering on the context information to obtain filtered context information. The MOE hybrid expert unit includes at least two MOE expert units; the at least two MOE expert units respectively perform feature extraction on the filtered context information under different duration modes to obtain feature information of at least two duration modes; The frequency domain autocorrelation unit performs autocorrelation processing on the feature information of the at least two duration modes respectively to obtain at least two target features; The result determination module determines the detection result based on the at least two target features; correspondingly, the detection result includes the detection result corresponding to at least two duration modes.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the anti-fraud detection method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the anti-fraud detection method according to any one of claims 1-7.

Images