Data processing method and device
By employing federated learning and multimodal feature fusion techniques, the challenge of identifying cross-domain fraud has been solved, enabling accurate identification and prevention in data silo environments. This enhances the model's generalization ability and privacy protection, making it suitable for cross-domain transaction data processing in the financial security field.
Patent Information
- Application Number
- CN202511049204.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-29
- Publication Date
- 2025-11-14
AI Technical Summary
Cross-domain fraud is difficult to accurately identify and prevent in the field of financial security. Existing security models lack strategies to deal with the phenomenon of cross-domain data silos, resulting in insufficient model generalization ability and a decline in identification accuracy.
By adopting a federated learning framework, a security model is trained collaboratively by a cloud server and multiple edge nodes. The local model is initialized using global model parameters, and privacy protection and accurate identification of cross-domain transaction data are achieved through technologies such as multimodal feature fusion and gradient pruning.
In data silo environments, the generalization ability and identification accuracy of local security assessment models have been improved, enabling accurate identification and prevention of cross-domain fraud, reducing the risk of misjudgment and missed judgment, and enhancing the security and privacy protection level of data transmission.
Smart Images
Figure CN120952104A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of financial technology, and in particular to a data processing method and apparatus. Background Technology
[0002] With the increasing frequency of cross-domain transactions, cross-domain fraud has become a major challenge in the field of financial security. Cross-domain fraud typically involves complex cross-domain networks, including but not limited to identity theft, forged transaction information, or exploiting legal differences between regions for illegal activities. However, restrictions on cross-border data flows make it difficult for financial institutions and e-commerce platforms in different regions to directly share sensitive transaction data.
[0003] However, current security models lack strategies to address the phenomenon of cross-domain data silos, making it difficult to accurately identify and prevent cross-domain fraud. For example, models trained on data from a single region struggle to capture patterns of cross-regional fraud, resulting in insufficient model generalization ability and decreased identification accuracy. Summary of the Invention
[0004] This application provides a data processing method and apparatus for accurately identifying and preventing cross-domain fraud.
[0005] In a first aspect, embodiments of this application provide a data processing method applied to a first edge node connected to a cloud server, the cloud server being used to connect multiple edge nodes, the multiple edge nodes including the first edge node, the multiple edge nodes deploying the same security model, the method comprising:
[0006] Get current cross-domain transaction data;
[0007] The trained local security model is used to process the current cross-domain transaction data to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data;
[0008] The trained local security model is a local security model trained based on training samples and global model parameters. The training samples include historical cross-domain transaction data and corresponding cross-domain transaction behavior tags. The global model parameters are model parameters sent by the cloud server, which aggregate the security models of the multiple edge nodes, and are used to initialize the local model parameters. The local model parameters indicate the model parameters of the local security model.
[0009] Optionally, the method for obtaining the trained local security model includes:
[0010] Obtain a training sample set, wherein the training sample set includes multiple training samples;
[0011] Receive the global model parameters sent by the cloud server;
[0012] Initialize the local model parameters using the global model parameters;
[0013] Using the training sample set and a preset number of training iterations, a local security model is trained, the trained local security model is obtained, and the updated local model parameters are obtained. The updated local model parameters are then sent to the cloud server.
[0014] Optionally, the updated model parameters are sent to the cloud server, including:
[0015] The difference between the updated local model parameters and the global model parameters is sent to the cloud server.
[0016] Optionally, the method further includes:
[0017] Obtain the updated global model parameters sent by the cloud server, wherein the updated global model is related to the parameter difference;
[0018] Using the updated global model parameters, the local model parameters are reinitialized, and the local security model is retrained using the training sample set and the preset number of training iterations.
[0019] Optionally, the method further includes:
[0020] A local security model is trained based on a preset loss function; wherein the preset loss function is:
[0021]
[0022] Among them, y i ∈{0,1}, is the label corresponding to the i-th training sample; where i is a positive integer, 1 indicates fraudulent behavior label, and 0 indicates normal behavior label; x i It is the feature vector corresponding to the multimodal data of the i-th training sample; Indicates the local security model of the first edge node for x i The predicted probability of fraudulent activity; h fuse Indicates the feature vector obtained through multimodal data fusion; θ k Indicates the local model parameters; N k The number of training samples is indicated; λ is the regularization coefficient, indicating the deviation between the local security model of the first edge node and the global model; θ global These are the global model parameters from the previous round.
[0023] Optionally, the model parameters can be updated in the following ways:
[0024] The model parameters are updated using a parameter update formula, which is:
[0025]
[0026] in, Indicates the updated local model parameters of the first edge node after the (t+1)th round of training; The local model parameters used by the first edge node at the start of the t-th round of training are indicated; η is the learning rate, which is a number greater than or equal to 0.001 and less than or equal to 0.01; t is the preset number of training iterations, and t is a positive integer. The first edge node is indicated by the gradient of the preset loss function with respect to the current local model parameters in the t-th training iteration; β is the global model influence coefficient, indicating the degree to which the local security model converges with the global security model.
[0027] Optionally, after obtaining the current cross-domain transaction data, the method further includes:
[0028] Obtain the multimodal features of the current cross-domain transaction data;
[0029] The multimodal features are fused together;
[0030] The step of processing the current cross-domain transaction data using the trained local security model to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data includes:
[0031] The trained local security model is used to process the fused multimodal features to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data.
[0032] Optionally, the current cross-domain transaction data includes current transaction data, current user behavior data, device information, and geographic location information, and the multimodal features include temporal modality, spatial modality, and biological modality;
[0033] The acquisition of multimodal features of the current cross-domain transaction data includes:
[0034] The temporal modality of the current cross-domain transaction data is obtained based on a bidirectional long short-term memory network encoder (BILSTM encoder).
[0035] A geographic location relationship model constructed based on a graph convolutional neural network is used to obtain the spatial mode of the temporal mode of the current cross-domain transaction data.
[0036] Based on the residual network, the biological modality of the time-series modality of the current cross-domain transaction data is obtained.
[0037] Optionally, the step of processing the current transaction data using the trained local security model to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data includes:
[0038] Using the trained local security model, the current cross-domain transaction data is processed to obtain the fraud probability of the current cross-domain transaction data;
[0039] If the fraud probability is greater than or equal to a preset probability threshold, the cross-domain transaction is determined to be a fraudulent transaction; if the fraud probability is less than the preset probability threshold, the cross-domain transaction is determined to be a normal transaction.
[0040] Secondly, embodiments of this application also provide a data processing apparatus applied to a first edge node connected to a cloud server, the cloud server being used to connect multiple edge nodes, the multiple edge nodes including the first edge node, the multiple edge nodes deploying the same security model, the apparatus comprising:
[0041] The acquisition unit is used to acquire current cross-domain transaction data;
[0042] The determining unit is used to process the current cross-domain transaction data using the trained local security model to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data.
[0043] The trained local security model is a local security model trained based on training samples and global model parameters. The training samples include historical cross-domain transaction data and corresponding cross-domain transaction behavior tags. The global model parameters are model parameters sent by the cloud server, which aggregate the security models of the multiple edge nodes, and are used to initialize the local model parameters. The local model parameters indicate the model parameters of the local security model.
[0044] Thirdly, embodiments of this application provide a computer program product, the computer program product comprising: a computer program (also referred to as code or instructions), which, when the computer program is run, causes the computer to perform the method in any of the possible implementations of any of the above aspects.
[0045] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program (also referred to as code or instructions) that, when run on a computer, causes the computer to perform the method in any of the possible implementations of the second aspect described above.
[0046] Fifthly, embodiments of this application provide a chip system including one or more processors for calling and executing instructions stored in memory, causing the methods in any of the above aspects or possible implementations to be executed. The chip system may be composed of chips or may include chips and other discrete devices.
[0047] This application provides a data processing method and apparatus. The method is applied to a first edge node connected to a cloud server. The cloud server connects multiple edge nodes, including the first edge node, and all edge nodes deploy the same security model. Specifically, the first edge node acquires current cross-domain transaction data; it then processes the current cross-domain transaction data using a trained local security model to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data. The trained local security model is a local security model trained based on training samples and global model parameters. The training samples include historical cross-domain transaction data and corresponding cross-domain transaction behavior labels. The global model parameters are model parameters sent by the cloud server, aggregating the security models of multiple edge nodes, and used to initialize the local model parameters. The local model parameters indicate the model parameters of the local security model. Using the global model parameters sent by the cloud server to initialize the local model parameters of the local security assessment model allows the current edge node to benefit from the global intelligence under the federated learning framework. Even in a data silo environment, it ensures that the local security assessment model learns the performance of other models, thus improving the generalization ability of the local security assessment model and achieving accurate identification and prevention of cross-domain fraud. Furthermore, by adjusting the model parameters of the local security assessment model using historical multimodal data, the model parameters can be made closer to the characteristics of the local data, thereby further improving the recognition accuracy. Attached Figure Description
[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0049] Figure 1 This is a schematic diagram of a cross-regional scene structure provided in an embodiment of this application;
[0050] Figure 2 A flowchart of a data processing method provided in an embodiment of this application;
[0051] Figure 3 A flowchart illustrating a local model training method for a first edge node provided in an embodiment of this application;
[0052] Figure 4 A flowchart of another data processing method provided in this application embodiment;
[0053] Figure 5 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application. Detailed Implementation
[0054] To enable those skilled in the art to better understand the present application, the technical solutions in this embodiment will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0055] First, let's introduce the technical terms used in the embodiments of this application:
[0056] Federated learning: Federated learning is a distributed machine learning technique that allows multiple participants to collaboratively train a model without sharing the original data. This technique can fully leverage and utilize geographically dispersed data resources while protecting data privacy, ultimately building high-performance machine learning models.
[0057] Edge computing: Edge computing is a distributed computing model that moves data processing, storage, and analysis capabilities from traditional centralized cloud architectures to first-edge nodes closer to the data source. This computing model effectively shortens data transmission distances by deploying computing resources close to the data source at the first-edge node, thus significantly improving system real-time performance, privacy, and bandwidth utilization efficiency. It is suitable for scenarios with high real-time requirements, strict data privacy protection, and limited network bandwidth.
[0058] Multimodal feature fusion: Multimodal features refer to the extraction and integration of different types of data sources (also known as modalities) into a unified representation. These features can capture complementary information between different modalities, thereby enhancing the model's ability to understand complex scenarios and enabling the model to make decisions by comprehensively utilizing multidimensional information.
[0059] Privacy noise: Privacy noise is an artificial interference mechanism introduced during data circulation and processing to protect sensitive information. Its core is to block the risk of privacy leakage through controllable random perturbations, while maintaining data utility.
[0060] Federated aggregation: Federated aggregation is a core mechanism in federated learning, used to aggregate local model parameters or gradients trained by distributed clients into a global model while protecting data privacy. Its core logic lies in realizing a collaborative paradigm of "data remains stationary while the model moves." In the embodiments of this application, federated aggregation is used to aggregate local model parameters or gradients trained by edge nodes into a global model.
[0061] The application scenarios of the embodiments of this application are described below.
[0062] For example, Appendix Figure 1 The diagram shown is a schematic representation of a cross-regional scenario structure provided in an embodiment of this application. The cross-regional scenario includes edge nodes 101 and a cloud server 102. The number of edge nodes 101 is N, where N is an integer greater than 1.
[0063] Edge node 101 refers to a computing device located near the data source that is directly connected to the transaction systems of various participants in cross-domain transactions, such as financial institutions, e-commerce platforms, and payment service providers.
[0064] In this embodiment, the same security model is deployed in all N edge nodes to determine cross-domain transaction behavior of cross-domain transaction data. All N edge nodes are communicatively connected to the cloud server 102. They receive global model parameters from the cloud server 102 and send their own security model parameters to the cloud server 102.
[0065] The cloud server 102 includes a global model. The global model refers to the machine learning model constructed from the contributions of all edge nodes connected to the cloud server. In this embodiment, the global model is used to aggregate the model parameters of all edge nodes to obtain a single global model parameter.
[0066] In this embodiment, the cloud server 102 can distribute global model parameters to N edge nodes, enabling each edge node to train a local security assessment model based on these global model parameters and a preset training sample set. Each edge node can upload its updated local model parameters to the cloud server to update the global model parameters.
[0067] Understandably, this approach enables cross-domain transaction data sharing between different edge nodes, solving the data silo problem while protecting data privacy.
[0068] It should be noted that the above application scenarios are for illustrative purposes only and can be adjusted as needed in actual use. For example, edge node 101 also includes a federated training module and a real-time fraud determination module. The federated training module performs federated training by combining with a cloud server. The real-time fraud determination module is used to acquire cross-domain transaction data in real time, call the trained security model, determine the fraud probability, and thus determine whether fraudulent behavior exists in the cross-domain transaction data.
[0069] The data processing method provided in the embodiments of this application is described below. For ease of explanation, one edge node (referred to as the first edge node) among multiple edge nodes connected to a cloud server will be used as an example.
[0070] Appendix Figure 2 A flowchart of a data processing method provided in this application embodiment is shown. The method is applied to a first edge node and includes the following:
[0071] S210, the first edge node obtains the current cross-domain transaction data.
[0072] In this embodiment, the current cross-domain transaction data is multi-source heterogeneous data, including but not limited to: transaction data, user behavior data, device information, and geographic location information. Transaction data includes, but is not limited to: order amount, payment method, transaction time, and transaction location. User behavior data includes, but is not limited to: login frequency, browsing history, operation path, and click behavior. Device information includes, but is not limited to: device model, system version, network environment, and IP address. Geographic location information includes, but is not limited to: the transaction location and the user's permanent residence.
[0073] S220: The first edge node uses the trained local security model to process the current cross-domain transaction data and obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data.
[0074] Cross-domain transactions include both fraudulent and legitimate transactions. Fraudulent transactions must be intercepted. Legitimate transactions can be shared with other edge nodes.
[0075] The first edge node uses the trained local security model to process the current cross-domain transaction data and obtain the corresponding cross-domain transaction behavior. The trained local security model is based on training samples and global model parameters. The training samples include historical cross-domain transaction data and corresponding cross-domain transaction behavior labels; the global model parameters are model parameters sent by the cloud server, aggregating the security models of multiple edge nodes, used to initialize the local model parameters, which indicate the model parameters of the local security model.
[0076] The embodiments of this application do not specifically limit the security model. For example, the security model can be a deep learning network model or other models set as needed.
[0077] In a specific implementation, such as Figure 3 The diagram shown is a flowchart of a local model training method for a first edge node provided in an embodiment of this application. The method includes the following:
[0078] S31. Obtain the training sample set.
[0079] The training sample set includes multiple training samples.
[0080] S32, Receive global model parameters sent by the cloud server.
[0081] S33. Initialize local model parameters using global model parameters.
[0082] S34. Iteratively train the local security model t times using the training sample set to obtain the trained local security model and the updated local model parameters.
[0083] Where t is a positive integer, representing the preset number of training iterations as required by those skilled in the art.
[0084] S35. Send the updated local model parameters to the cloud server.
[0085] S36. The cloud server updates the global model parameters based on the updated local model parameters, and sends the updated global model parameters as the new global model parameters to the first edge node, and then re-executes S33.
[0086] Furthermore, the first edge node can upload the parameter difference of the security assessment model to the cloud server instead of directly transmitting the updated local model parameters. This method can protect privacy during the model update process. The parameter difference is the difference between the updated local model parameters and the global model parameters.
[0087] This method of continuously updating global model parameters to train the local security model helps to further improve the accuracy of the trained security model.
[0088] In summary, this application provides a data processing method applied to a first edge node connected to a cloud server. The cloud server connects multiple edge nodes, including the first edge node, which deploys the same security model. Specifically, the first edge node acquires current cross-domain transaction data; it then processes the current cross-domain transaction data using a trained local security model to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data. The trained local security model is a local security model trained based on training samples and global model parameters. The training samples include historical cross-domain transaction data and corresponding cross-domain transaction behavior labels. The global model parameters are model parameters sent by the cloud server, aggregating the security models of multiple edge nodes, and used to initialize the local model parameters, which indicate the model parameters of the local security model. Using the global model parameters sent by the cloud server to initialize the local model parameters of the local security assessment model allows the current edge node to benefit from global intelligence under a federated learning framework. Even in a data silo environment, this ensures that the local security assessment model learns the performance of other models, thus improving the generalization ability of the local security assessment model and enabling accurate identification and prevention of cross-domain fraud. Furthermore, by adjusting the model parameters of the local security assessment model using historical multimodal data, the model parameters can be made closer to the characteristics of the local data, thereby further improving the recognition accuracy.
[0089] The following section introduces another data processing method with practical application. This method extracts multimodal features from the current cross-domain transaction data, performs feature fusion, and then inputs the fused features into a pre-trained security model to obtain the fraud probability. Based on the fraud probability, cross-domain transaction behavior is determined.
[0090] Appendix Figure 4 This is a flowchart of another data processing method provided in an embodiment of the present application. After S210, the method further includes the following:
[0091] S420: The first edge node extracts the multimodal features corresponding to the current cross-domain transaction data.
[0092] The first edge node extracts multimodal features from the current cross-domain transaction data. These multimodal features include temporal modalities, spatial modalities, and / or biometric modalities. Temporal modalities focus on the time-series characteristics of transaction behavior, used to effectively identify abrupt patterns in transaction behavior, including but not limited to: transaction frequency, transaction time, and amount sequences. Biometric modalities indicate biometric features associated with the transaction actors, used to identify the authenticity of the transaction actors, including but not limited to: facial feature vectors and voiceprint spectra. Spatial modalities indicate features related to the transaction's geographical location, used to identify abnormal geographical locations, including but not limited to: IP geographical location, cross-border routing paths, and user's permanent residence.
[0093] It should be noted that, in order to improve processing accuracy, transaction data can be preprocessed such as data cleaning, standardization and normalization. Then, the first edge node processes the preprocessed data to extract multimodal features.
[0094] In one specific implementation, the first edge node can employ a Bidirectional Long Short-Term Memory (BILSTM) encoder to extract temporal modalities from the multimodal transaction data. Here, the current cross-domain transaction data set M = {m1, m2, ..., m} k}, where k is an integer greater than 1. The timing modes can be obtained using formula (1):
[0095]
[0096] in:
[0097] For sequential modes, R d The feature dimension of the time series mode is a d-dimensional real space. X represents the time series input matrix. That is, it includes the time feature dimension T and the input feature dimension d. in For example, the total dimension after concatenating features such as transaction amount and frequency. This determines the model's ability to capture periodic patterns; m i Temporal modality identifiers distinguish time-series data from different sources, such as payment records and server logs.
[0098] The first edge node can also use a geographic location relationship model constructed by a graph convolutional neural network, such as an IP address cross-domain routing adjacency matrix, to extract spatial modalities from multimodal data. Specifically, the first edge node uses formula (2) to obtain spatial modalities.
[0099]
[0100] in:
[0101] For spatial modes, A∈{0,1} N×N X is the adjacency matrix for spatial modal data, describing the topological relationships between spatial nodes. X is the node feature matrix for graph structure data, describing the attribute information of each node. Each row of the matrix corresponds to a node, and each column represents a feature dimension.
[0102] N represents the number of nodes, such as the total number of IP address nodes in a cross-border transaction routing; N is a positive integer. nodeThis refers to the node feature dimension, such as the encoded vector dimension of geographical features, device type, etc.; m j Spatial mode identifier.
[0103] The first edge node can also use a residual network to identify biological modalities, such as extracting facial or voiceprint feature vectors. Furthermore, the first edge node can also use a normalization layer to compress the feature dimension and verify the authenticity of the operator's biological features. For specific acquisition methods, please refer to formula (3):
[0104]
[0105] in: For biological feature vectors, The input image for the k-th biological modality; m k Biological modality identifiers; i,j,k This represents different data instances or processing levels under the same modality, where i=1 represents the first time-series input sequence.
[0106] This application's embodiments utilize a BILSTM encoder, a graph convolutional neural network, and a residual network to encode transaction time series, geographic location relationships, and biometric features, effectively capturing the temporal dependence, spatial correlation, and biometric authenticity of transaction behavior. This multimodal feature extraction enhances the model's ability to identify complex fraudulent activities and reduces the model's false positive rate.
[0107] It should be noted that the embodiments of this application can also extract multimodal features in other ways, and the embodiments of this application are not specifically limited.
[0108] S430, the first edge node fuses multimodal features.
[0109] The first edge node can fuse multimodal features to obtain a multimodal feature vector in the following way. See formula (4) for the specific fusion method:
[0110]
[0111] Among them, a m Let a be the attention weight for the m-th modality. m Obtained through formula (5):
[0112]
[0113] m is the index of the target modality whose weights are currently being calculated; m is an integer greater than or equal to 1 and less than or equal to k; j is the loop variable in the denominator that iterates through all modalities and is used for normalization calculations; h fuse The weighted sum of the features of each modality represents the fused multimodal feature vector; hm The feature vector of the m-th mode.
[0114] S440, the first edge node, uses the trained local security model to process the fused features and obtain the fraud probability of cross-domain transaction behavior.
[0115] The following describes a training method for a security model of edge nodes. This training method specifically involves N edge nodes, namely, the security model training for edge nodes 1 to N.
[0116] Specifically, the cloud server obtains the global model parameters and then... The task is distributed to N edge nodes. Each of the N edge nodes is used to execute:
[0117] Step 1: Receive global model parameters sent by the cloud server
[0118] Step 2: Initialize the local model parameters θ of the local security model using the global model parameters. k .
[0119] The local model parameters θ k Adjust to global model parameters
[0120] Step 3: Obtain a training sample set based on local historical multimodal data, and train the local security model according to the preset training number t to obtain the trained local security model.
[0121] Edge nodes acquire training sample sets based on local historical multimodal data. After training the local security model for t rounds using a preset training sequence t, the local model parameters θ are updated. k Edge nodes can upload updated local model parameters to the cloud server.
[0122] In one example, gradient clipping is performed on edge nodes, adjusting the gradient... Norm truncation is performed to prevent gradient explosion. Then, the edge nodes calculate the parameter differences between the local and global model parameters. Uploading to a cloud server, rather than directly transmitting the original parameters, can protect privacy during model updates.
[0123] In another example, edge nodes employ a protection mechanism of gradient clipping and noise injection. Only the parameter differences are uploaded in each training round to protect the privacy of the uploaded parameters. Gradient clipping reduces the influence of a single sample on the model update by limiting the magnitude of parameter updates, while noise injection increases the difficulty of inferring the updated parameter model from the parameter differences by adding random noise to the gradient. The privacy protection formula is shown in formula (6):
[0124]
[0125] Where, Δθ k The difference in parameters uploaded to the cloud server; Let N(0,σ) be the gradient clipping function, and restrict the gradient norm to not exceed C; 2 I) Added Gaussian noise with a mean of 0 and a variance of σ. 2 .
[0126] In this embodiment, the edge nodes can train the local security model based on a preset loss function. The preset loss function is specifically shown in formula (7):
[0127]
[0128] Among them, y i ∈{0,1}, is the label corresponding to the i-th training sample; where i is a positive integer, 1 indicates fraudulent behavior label, and 0 indicates normal behavior label; x i It is the feature vector corresponding to the multimodal data of the i-th training sample; Instruct the local security model on x i The predicted probability of fraudulent activity; h fuse Indicates the feature vector obtained through multimodal data fusion; θ k Indicates local model parameters; N k The number of training samples is indicated; λ is the regularization coefficient, indicating the deviation between the local security model and the global model; θ global These are the global model parameters from the previous round.
[0129] In another example, this application embodiment also provides a local model parameter update method, specifically the parameter update formula (8):
[0130]
[0131] in, Indicates the updated local model parameters after the (t+1)th training round; Indicates the local model parameters used at the start of the t-th training round; η is the learning rate, which is a number greater than or equal to 0.001 and less than or equal to 0.01, and is used to control the parameter update step size; t is the preset number of training iterations, and t is a positive integer; The first edge node is indicated by the gradient of the preset loss function with respect to the current local model parameters in the t-th training iteration; β is the global model influence coefficient, indicating the degree to which the local security model converges with the global security model.
[0132] Step 4: The global model on the cloud server adopts a weighted average aggregation strategy to aggregate the parameter differences of N edge nodes and realize the global model parameter update.
[0133] Under the federated learning framework, the global model adopts a weighted average aggregation strategy, which integrates the local model parameters of each edge node to update the global model parameters. The weight allocation is based on the proportion of data volume in each node, ensuring that the model can adapt to different data distribution characteristics. The aggregation formula for the federated learning global model is shown in formula (9):
[0134]
[0135] in, N k The local data volume of the k-th edge node; N is the total data volume of all nodes. K represents the number of edge nodes participating in federated learning (e.g., transaction servers in different regions); Represents the global model parameters updated in round t+1; The local model parameters of the k-th edge node after the t-th round of training.
[0136] The cloud server aggregates the parameter updates from all edge nodes using a weighted average to generate new global model parameters. The weights are allocated based on the proportion of data volume at each edge node, ensuring that data-rich nodes have a greater impact on the global model, while nodes with less data can still participate in the learning process, reflecting the imbalance in real-world data distribution. This weighted aggregation strategy ensures that the global model can better adapt to the data distribution of all participating nodes, improving the model's generalization ability and robustness.
[0137] Step 5: The cloud server distributes the updated global model parameters to N edge nodes and repeats step 2.
[0138] This process involves multiple iterations, with the first edge node continuously uploading parameter updates and the cloud server continuously aggregating and optimizing global model parameters. As the iterations deepen, the global model gradually converges, and the learned parameters become increasingly closer to the optimal solution. This allows the local security model to achieve higher accuracy and stability more quickly in subsequent training iterations (t+1).
[0139] With the updated local security model described above, any edge node can determine the probability of fraud corresponding to the current cross-domain transaction data based on the current cross-domain transaction data on its local side.
[0140] S450: The first edge node determines whether fraudulent activity exists based on the fraud probability. If fraudulent activity is determined to exist, proceed to S460. If fraudulent activity is determined not to exist, proceed to S470.
[0141] Specifically, if the probability of fraud is greater than or equal to a preset probability threshold, then fraudulent cross-domain transaction behavior is determined to exist. Otherwise, it is determined that no fraudulent cross-domain transaction behavior exists.
[0142] It should be noted that the preset probability threshold is a value set by those skilled in the art as needed. The preset probability threshold is a number greater than 0 and less than 1, for example, the preset probability threshold is 0.6.
[0143] S460, the first edge node intercepts transactions.
[0144] S470, the first edge node shares cross-domain transaction data with the second edge node connected to the cloud server.
[0145] The second edge node is any of the N edge nodes connected to the cloud server, excluding the first edge node.
[0146] In summary, this application's embodiments, by fusing multimodal data—that is, by fusing multiple data types (such as text, images, audio, and video)—to obtain fused features, and processing based on these fused features, can provide a more comprehensive and accurate fraud detection capability. This effectively compensates for the limitations of a single data source, improves the robustness and generalization ability of the model, and thus more accurately identifies complex fraudulent behaviors, reducing the risk of false positives and false negatives, and providing more reliable protection for financial security and user asset protection. Furthermore, this application employs a mechanism of uploading local parameter updates from edge nodes to the cloud, avoiding direct data interaction. Simultaneously, gradient pruning and the addition of Gaussian noise further enhance data privacy, thereby significantly improving the security and privacy protection level of data transmission while ensuring model update efficiency.
[0147] In addition, this application also provides a data processing apparatus.
[0148] Appendix Figure 5 This is a schematic diagram of a data processing apparatus provided in an embodiment of this application. The apparatus 500 is applied to a first edge node connected to a cloud server. The cloud server is used to connect multiple edge nodes, including the first edge node. The multiple edge nodes deploy the same security model. The apparatus 500 includes:
[0149] Acquisition unit 501 is used to acquire current cross-domain transaction data;
[0150] The determining unit 502 is used to process the current cross-domain transaction data using the trained local security model to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data.
[0151] The trained local security model is a local security model trained based on training samples and global model parameters. The training samples include historical cross-domain transaction data and corresponding cross-domain transaction behavior tags. The global model parameters are model parameters sent by the cloud server, which aggregate the security models of the multiple edge nodes, and are used to initialize the local model parameters. The local model parameters indicate the model parameters of the local security model.
[0152] Optionally, the device 500 further includes a training unit, which is used to: acquire a training sample set, the training sample set including a plurality of the training samples;
[0153] Receive the global model parameters sent by the cloud server;
[0154] Initialize the local model parameters using the global model parameters;
[0155] Using the training sample set and a preset number of training iterations, a local security model is trained, the trained local security model is obtained, and the updated local model parameters are obtained. The updated local model parameters are then sent to the cloud server.
[0156] Optionally, the updated model parameters are sent to the cloud server, including:
[0157] The difference between the updated local model parameters and the global model parameters is sent to the cloud server.
[0158] Specifically, the updated global model parameters sent by the cloud server are obtained, and the updated global model is related to the parameter difference.
[0159] Using the updated global model parameters, the local model parameters are reinitialized, and the local security model is retrained using the training sample set and the preset number of training iterations.
[0160] The training unit is also used to: train a local security model based on a preset loss function; wherein the preset loss function is:
[0161]
[0162] Among them, y i ∈{0,1}, is the label corresponding to the i-th training sample; where i is a positive integer, 1 indicates fraudulent behavior label, and 0 indicates normal behavior label; x i It is the feature vector corresponding to the multimodal data of the i-th training sample; Indicates the local security model of the first edge node for x i The predicted probability of fraudulent activity; h fuseIndicates the feature vector obtained through multimodal data fusion; θ k Indicates the local model parameters; N k The number of training samples is indicated; λ is the regularization coefficient, indicating the deviation between the local security model of the first edge node and the global model; θ global These are the global model parameters from the previous round.
[0163] Optionally, the model parameters can be updated in the following ways:
[0164] The model parameters are updated using a parameter update formula. The parameter update formula is:
[0165]
[0166] in, Indicates the updated local model parameters of the first edge node after the (t+1)th round of training; The local model parameters used by the first edge node at the start of the t-th round of training are indicated; η is the learning rate, which is a number greater than or equal to 0.001 and less than or equal to 0.01; t is the preset number of training iterations, and t is a positive integer. The first edge node is indicated by the gradient of the preset loss function with respect to the current local model parameters in the t-th training iteration; β is the global model influence coefficient, indicating the degree to which the local security model converges with the global security model.
[0167] In addition, the device 500 also includes: a fusion unit, used to acquire the multimodal features of the current cross-domain transaction data;
[0168] The multimodal features are fused together;
[0169] At this point, the determining unit 502 is specifically used to: process the fused multimodal features using the trained local security model to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data.
[0170] Optionally, the current cross-domain transaction data includes current transaction data, current user behavior data, device information, and geographic location information, and the multimodal features include temporal modality, spatial modality, and biological modality; the acquisition unit 501 is specifically used to: acquire the temporal modality of the current cross-domain transaction data based on a bidirectional long short-term memory network encoder (BILSTM encoder);
[0171] A geographic location relationship model constructed based on a graph convolutional neural network is used to obtain the spatial mode of the temporal mode of the current cross-domain transaction data.
[0172] Based on the residual network, the biological modality of the time-series modality of the current cross-domain transaction data is obtained.
[0173] Optionally, the determining unit 502 is also used for:
[0174] Using the trained local security model, the current cross-domain transaction data is processed to obtain the fraud probability of the current cross-domain transaction data;
[0175] If the fraud probability is greater than or equal to a preset probability threshold, the cross-domain transaction is determined to be a fraudulent transaction; if the fraud probability is less than the preset probability threshold, the cross-domain transaction is determined to be a normal transaction.
[0176] This application provides a data processing device applied to a first edge node connected to a cloud server. The cloud server connects multiple edge nodes, including the first edge node, and all edge nodes deploy the same security model. The device acquires current cross-domain transaction data and processes this data using a trained local security model to obtain the corresponding cross-domain transaction behavior. The trained local security model is based on training samples and global model parameters. The training samples include historical cross-domain transaction data and corresponding cross-domain transaction behavior labels. The global model parameters are model parameters sent by the cloud server, aggregating the security models of multiple edge nodes, and used to initialize the local model parameters. These local model parameters indicate the model parameters of the local security model. Initializing the local model parameters of the local security assessment model using the global model parameters sent by the cloud server allows the current edge node to benefit from global intelligence under a federated learning framework. Even in a data silo environment, this ensures that the local security assessment model learns the performance of other models, thus improving the generalization ability of the local security assessment model and enabling accurate identification and prevention of cross-domain fraud. Furthermore, by adjusting the model parameters of the local security assessment model using historical multimodal data, the model parameters can be made closer to the characteristics of the local data, thereby further improving the recognition accuracy.
[0177] According to the method provided in the embodiments of this application, this application also provides a chip system, which includes one or more processors for calling and executing instructions stored in memory, thereby causing the method described in the embodiments of this application to be executed. The chip system may be composed of chips or may include chips and other discrete devices.
[0178] The chip system may include input circuits or interfaces for transmitting information or data, and output circuits or interfaces for receiving information or data.
[0179] According to the method provided in the embodiments of this application, this application also provides a computer program product, which includes: computer program code, which, when run on a computer, causes the computer to execute the various steps or processes executed by the network device or terminal device in any of the foregoing method embodiments.
[0180] According to the method provided in the embodiments of this application, this application also provides a computer-readable storage medium storing program code, which, when run on a computer, causes the computer to execute the various steps or processes executed by the network device or terminal device in any of the foregoing method embodiments.
[0181] The computer-readable storage medium may be the aforementioned volatile memory or non-volatile memory, or it may include both volatile memory and non-volatile memory.
[0182] In the embodiments of this application, the terms and English abbreviations are exemplary examples given for ease of description and should not be construed as limiting the application in any way. This application does not preclude the possibility of defining other terms that can achieve the same or similar functions in existing or future agreements.
[0183] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When these computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated.
[0184] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.
Claims
1. A data processing method, characterized in that, The method is applied to a first edge node connected to a cloud server, the cloud server being used to connect multiple edge nodes, including the first edge node, the multiple edge nodes deploying the same security model, the method comprising: Get current cross-domain transaction data; The trained local security model is used to process the current cross-domain transaction data to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data; The trained local security model is a local security model trained based on training samples and global model parameters. The training samples include historical cross-domain transaction data and corresponding cross-domain transaction behavior tags. The global model parameters are model parameters sent by the cloud server, which aggregate the security models of the multiple edge nodes, and are used to initialize the local model parameters. The local model parameters indicate the model parameters of the local security model.
2. The processing method according to claim 1, characterized in that, The method for obtaining the trained local security model includes: Obtain a training sample set, wherein the training sample set includes multiple training samples; Receive the global model parameters sent by the cloud server; Initialize the local model parameters using the global model parameters; Using the training sample set and a preset number of training iterations, a local security model is trained, the trained local security model is obtained, and the updated local model parameters are obtained. The updated local model parameters are then sent to the cloud server.
3. The processing method according to claim 2, characterized in that, The updated model parameters are sent to the cloud server, including: The difference between the updated local model parameters and the global model parameters is sent to the cloud server.
4. The processing method according to claim 3, characterized in that, The method further includes: Obtain the updated global model parameters sent by the cloud server, wherein the updated global model is related to the parameter difference; Using the updated global model parameters, the local model parameters are reinitialized, and the local security model is retrained using the training sample set and the preset number of training iterations.
5. The processing method according to claim 2, characterized in that, The method further includes: A local security model is trained based on a preset loss function; wherein the preset loss function is: Among them, y i ∈{0,1}, is the label corresponding to the i-th training sample; where i is a positive integer, 1 indicates fraudulent behavior label, and 0 indicates normal behavior label; x i It is the feature vector corresponding to the multimodal data of the i-th training sample; Indicates the local security model of the first edge node for x i The predicted probability of fraudulent activity; h fuse Indicates the feature vector obtained through multimodal data fusion; θ k Indicates the local model parameters; N k The number of training samples is indicated; λ is the regularization coefficient, indicating the deviation between the local security model of the first edge node and the global model; θ global These are the global model parameters from the previous round.
6. The processing method according to claim 5, characterized in that, The methods for updating the model parameters include: The model parameters are updated using a parameter update formula, which is: in, Indicates the updated local model parameters of the first edge node after the (t+1)th round of training; The local model parameters used by the first edge node at the start of the t-th round of training are indicated; η is the learning rate, which is a number greater than or equal to 0.001 and less than or equal to 0.01; t is the preset number of training iterations, and t is a positive integer. The first edge node is indicated by the gradient of the preset loss function with respect to the current local model parameters in the t-th training iteration; β is the global model influence coefficient, indicating the degree to which the local security model converges with the global security model.
7. The processing method according to claim 1, characterized in that, After obtaining the current cross-domain transaction data, the method further includes: Obtain the multimodal features of the current cross-domain transaction data; The multimodal features are fused together; The step of processing the current cross-domain transaction data using the trained local security model to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data includes: The trained local security model is used to process the fused multimodal features to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data.
8. The processing method according to claim 7, characterized in that, The current cross-domain transaction data includes current transaction data, current user behavior data, device information, and geographic location information; the multimodal features include temporal modality, spatial modality, and biological modality. The acquisition of multimodal features of the current cross-domain transaction data includes: The temporal modality of the current cross-domain transaction data is obtained based on a bidirectional long short-term memory network encoder (BILSTM encoder). A geographic location relationship model constructed based on a graph convolutional neural network is used to obtain the spatial mode of the temporal mode of the current cross-domain transaction data. Based on the residual network, the biological modality of the time-series modality of the current cross-domain transaction data is obtained.
9. The processing method according to claim 1, characterized in that, The step of processing the current transaction data using the trained local security model to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data includes: Using the trained local security model, the current cross-domain transaction data is processed to obtain the fraud probability of the current cross-domain transaction data; If the fraud probability is greater than or equal to a preset probability threshold, the cross-domain transaction is determined to be a fraudulent transaction; if the fraud probability is less than the preset probability threshold, the cross-domain transaction is determined to be a normal transaction.
10. A data processing apparatus, characterized in that, An apparatus for use with a first edge node connected to a cloud server, the cloud server for connecting multiple edge nodes, the multiple edge nodes including the first edge node, the multiple edge nodes deploying the same security model, the apparatus comprising: The acquisition unit is used to acquire current cross-domain transaction data; The determining unit is used to process the current cross-domain transaction data using the trained local security model to obtain the cross-domain transaction behavior corresponding to the current cross-domain transaction data. The trained local security model is a local security model trained based on training samples and global model parameters. The training samples include historical cross-domain transaction data and corresponding cross-domain transaction behavior tags. The global model parameters are model parameters sent by the cloud server, which aggregate the security models of the multiple edge nodes, and are used to initialize the local model parameters. The local model parameters indicate the model parameters of the local security model.