Abnormal user type determination method and device, electronic equipment and storage medium

Abstract

The invention discloses an abnormal user type determination method and device, electronic equipment and a storage medium. The method comprises the following steps: preprocessing transaction behavior data to obtain first behavior data, and determining behavior feature information of the first behavior data on a plurality of preset feature dimensions; inputting the behavior characteristic information into an attention-enhanced long-short-term memory network for characteristic processing to obtain a predicted risk attribute of the transaction behavior data on at least one classification identifier; wherein the attention enhanced long short-term memory network at least comprises a bidirectional long short-term memory network layer and an attention mechanism layer; determining a risk threshold value corresponding to the at least one classification identifier based on the predicted risk attribute on the at least one classification identifier and an objective function; and according to the predicted risk attribute and the risk threshold value of the at least one classification identifier, determining the abnormal judgment result, thereby improving the identification accuracy of the transaction behavior, and ensuring the accuracy of the abnormal judgment result.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, apparatus, electronic device, and storage medium for determining abnormal user types. Background Technology

[0002] With economic development, abnormal transaction behaviors are becoming increasingly complex and covert. To ensure transaction security, it is necessary to identify potential users engaging in abnormal transaction behaviors.

[0003] Currently, there are two main methods for identifying potentially problematic users. One is a rule-based detection method that triggers alerts by setting static thresholds. However, while simple and direct, this method struggles to identify complex transaction behaviors and accurately pinpoint potentially problematic users. The other method uses common machine learning algorithms to analyze customers' static characteristics and simple statistics. However, this method has limitations, lacking sensitivity to abnormal transaction behavior and resulting in missed detections of abnormal transactions. Summary of the Invention

[0004] This invention provides a method, apparatus, electronic device, and storage medium for determining abnormal user types, which improves the accuracy of transaction behavior identification and ensures the accuracy of abnormal judgment results.

[0005] According to one aspect of the present invention, a method for determining abnormal user types is provided, the method comprising:

[0006] By preprocessing the acquired transaction behavior data, first behavior data to be used to determine user type is obtained, and the behavior feature information of the first behavior data in multiple preset feature dimensions is determined.

[0007] Behavioral feature information is input into a pre-trained attention-enhanced long short-term memory network for feature processing to obtain the predicted risk attribute of transaction behavior data on at least one classification label; wherein, the attention-enhanced long short-term memory network includes at least a bidirectional long short-term memory network layer and an attention mechanism layer;

[0008] Based on the predicted risk attribute and objective function of at least one classification label, determine the risk threshold corresponding to at least one classification label;

[0009] Based on the predicted risk attributes of at least one classification identifier and the corresponding risk threshold, determine the anomaly identification result corresponding to the transaction behavior data.

[0010] According to another aspect of the present invention, an abnormal user type determination apparatus is provided, the apparatus comprising:

[0011] The feature information determination module is used to preprocess the acquired transaction behavior data to obtain first behavior data to be used to determine the user type, and to determine the behavior feature information of the first behavior data in multiple preset feature dimensions.

[0012] The risk attribute determination module is used to input behavioral feature information into a pre-trained attention-enhanced long short-term memory network for feature processing to obtain the predicted risk attribute of the transaction behavior data on at least one classification label; wherein, the attention-enhanced long short-term memory network includes at least a bidirectional long short-term memory network layer and an attention mechanism layer;

[0013] The risk threshold determination module is used to determine the risk threshold corresponding to at least one classification label based on the predicted risk attribute and objective function on at least one classification label.

[0014] The discrimination result determination module is used to determine the anomaly discrimination result corresponding to the transaction behavior data based on the predicted risk attribute of at least one classification identifier and the corresponding risk threshold.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] At least one processor; and

[0017] A memory that is communicatively connected to at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by at least one processor, such that the at least one processor is able to perform the abnormal user type determination method according to any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided that stores computer instructions for causing a processor to execute an abnormal user type determination method according to any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, characterized in that the computer program, when executed by a processor, implements an abnormal user type determination method as described in any embodiment of the present invention.

[0021] The technical solution of this invention preprocesses the acquired transaction behavior data to obtain first behavior data for determining user types, ensuring the consistency and accuracy of subsequently processed data. It determines the behavioral feature information of the first behavior data across multiple preset feature dimensions, achieving multi-dimensional feature extraction and ensuring the comprehensiveness of the data processed by the attention-enhanced long short-term memory network (LSTM). The behavioral feature information is input into a pre-trained LSTM network for feature processing, obtaining the predicted risk attribute of the transaction behavior data on at least one classification label. Processing the behavioral feature information through the LSTM significantly improves the ability to identify complex transaction behaviors and enhances the accuracy of model processing. Using the predicted risk attribute on at least one classification label and the objective function, a risk threshold corresponding to at least one classification label is determined, enabling personalized threshold adjustment and effectively avoiding misjudgments of abnormal users or normal transaction behaviors. Based on the predicted risk attribute of at least one classification label and the corresponding risk threshold, an anomaly detection result corresponding to the transaction behavior data is obtained. This anomaly detection result determines the user type represented by the corresponding classification label, which is the abnormal user type. This invention solves the problems of difficulty in identifying complex transaction behaviors, difficulty in accurately locating potential users, and missed detection of abnormal transactions in the prior art. It improves the accuracy of transaction behavior identification and ensures the accuracy of anomaly detection results by using an attention-enhanced long short-term memory network that combines a bidirectional long short-term memory network layer and an attention mechanism layer to process the behavioral feature information corresponding to transaction behavior data.

[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart of a method for determining abnormal user types provided in an embodiment of the present invention;

[0025] Figure 2 This is a flowchart of a method for determining abnormal user types provided in an embodiment of the present invention;

[0026] Figure 3This is a structural example diagram of the attention-enhanced long short-term memory network provided in an embodiment of the present invention;

[0027] Figure 4 This is a flowchart illustrating a method for determining abnormal user types provided in an embodiment of the present invention;

[0028] Figure 5 This is a schematic diagram of the structure of an abnormal user type determination device provided in an embodiment of the present invention;

[0029] Figure 6 This is a schematic diagram of the structure of an electronic device that implements the abnormal user type determination method of the present invention. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] Example 1

[0033] Figure 1 This is a flowchart of an abnormal user type determination method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where abnormal user types are identified using an attention-enhanced long short-term memory network. The method can be executed by an abnormal user type determination device, which can be implemented in hardware and / or software. This device can be configured in electronic devices such as mobile phones, computers, or servers. Figure 1 As shown, the method includes:

[0034] S110. By preprocessing the acquired transaction behavior data, first behavior data to be used to determine the user type is obtained, and the behavior feature information of the first behavior data in multiple preset feature dimensions is determined.

[0035] The transaction behavior data can be data related to transaction behavior acquired within a preset time period. To ensure data consistency for subsequent input into the attention-enhanced long short-term memory network, the transaction behavior data can be preprocessed. Optionally, preprocessing can include at least one of the following: data standardization, outlier handling, and data alignment. The first behavior data can be the preprocessed transaction behavior data. The user type can be a classification of users based on the presence or absence of abnormal transaction behavior. For example, the user type can be an abnormal user or a normal user.

[0036] Optionally, the acquired transaction behavior data can be the transaction behavior data of the current user within a preset time period. By preprocessing the transaction behavior data of the current user, first behavior data that can be used to determine the user type of the current user can be obtained.

[0037] Multiple preset feature dimensions can be pre-defined dimensions for feature extraction from the first behavioral data. To improve the comprehensiveness of the input data processed by the subsequent attention-enhanced long short-term memory network, feature extraction processing can be performed on the first behavioral data to determine the user type based on the extracted behavioral feature information. Optionally, the multiple preset feature dimensions may include at least two of the following: time decay dimension, behavioral deviation dimension, and network topology feature dimension. That is, behavioral feature information can be understood as the feature data of the first behavioral data on the corresponding preset feature dimensions.

[0038] Specifically, the acquired transaction behavior data undergoes at least one preprocessing step, including data standardization, outlier handling, and data alignment, to obtain first behavior data for determining user types. Feature extraction processing is then performed on the first behavior data across multiple preset feature dimensions to obtain behavioral feature information for each preset feature dimension. This behavioral feature information is then input into a pre-trained attention-enhanced long short-term memory network to determine the user type.

[0039] In this embodiment of the invention, the preprocessing method for transaction behavior data may be as follows: acquire each transaction behavior data generated within a preset time period, and format the transaction behavior data according to the field standardization method of the field to which the transaction behavior data belongs to obtain the behavior data to be used; retain the behavior data to be used when the data value in the behavior data to be used meets the transaction amount threshold of the dimension to which the behavior data to be used belongs; for the behavior data to be used that includes time information, use spline interpolation to interpolate the behavior data to be used to obtain the first behavior data.

[0040] The preset duration can be a pre-defined period of time, such as one week. Correspondingly, each transaction data point generated within the preset duration can be multiple transaction data points generated within one week. Optionally, the fields belonging to the transaction data include: timestamp field, item acquisition cost field, transaction type field, age field, and occupation field. During data standardization, each field of the transaction data has a corresponding standardization method. The field standardization method can be understood as the standardization processing method for the transaction data corresponding to that field. Optionally, when the transaction data belongs to the timestamp field, the transaction data is standardized to ISO 8601 format. When the transaction data belongs to the item acquisition cost field, the transaction data is standardized to the baseline item acquisition cost. When the transaction data belongs to the transaction type field, the transaction data is encoded using the Society for Worldwide Interbank Financial Telecommunication (SWIFT) standard. The behavior data to be used can be the data obtained after formatting the transaction data.

[0041] The dimension to which the behavioral data belongs can be a pre-set data dimension. Optionally, since the transaction behavior data acquired within a preset time period may come from at least one user, the dimension to which the behavioral data belongs can be set as a user dimension. Correspondingly, the transaction amount threshold of the dimension to which the behavioral data belongs can be understood as a standard transaction amount value set for a single user. Optionally, an improved box plot algorithm can be used to set the transaction amount threshold for the dimension to which the behavioral data belongs, so as to retain the behavioral data to be used that meets the transaction amount threshold. Optionally, if the transaction amount threshold is a standard transaction amount value set for a single user, the transaction amount threshold (μ±σ) can be determined based on the mean and standard deviation data determined from multiple historical transaction amount data of that user, where μ represents the mean data and σ represents the standard deviation data. By setting a transaction amount threshold, retaining the behavioral data to be used that meets the transaction amount threshold of the dimension to which the behavioral data belongs can avoid the appearance of outliers in the behavioral data, making the retained behavioral data to be used consistent with actual needs.

[0042] The transaction behavior data includes data values ​​under the timestamp field, and correspondingly, the usage behavior data also includes the corresponding time information. Spline interpolation is a numerical method that constructs smooth curves or surfaces using piecewise low-order polynomials. In this embodiment of the invention, using spline interpolation to interpolate the usage behavior data ensures that each equally spaced data point has corresponding data, thus ensuring the consistency of the input data dimension of the attention-enhanced long short-term memory network. Optionally, for the usage behavior data including time information, cubic spline interpolation can be used to generate the first behavior data under equally spaced data points (default 30 minutes as a time step).

[0043] The first row of data can be the data obtained after data interpolation. Optionally, the first row of data can include 15 basic fields and 3 derived fields. For example, the basic fields can be an age field and an occupation field. The derived fields can be a timestamp field, an item acquisition cost field, and a transaction type field.

[0044] It should be noted that after preprocessing the transaction behavior data, the resulting first-order data can be stored in a distributed columnar database for retrieval when needed. Alternatively, feature extraction can be performed directly on the first-order data, using the behavioral feature information across multiple preset feature dimensions as input data for an attention-enhanced long short-term memory network.

[0045] Specifically, each transaction data point generated within a preset time period is acquired. Since this data may originate from different channels, it can be formatted using field standardization to unify the data format across different channels, resulting in the data to be used. An improved boxplot algorithm is used to determine the corresponding transaction amount threshold for each dimension of the data to be used. Data points meeting the transaction amount threshold for their respective dimensions are retained, while those exceeding the threshold are removed and submitted for manual review. Because the time information in the data to be used may be irregular, cubic spline interpolation is used to interpolate the data, yielding the first set of data. This ensures the consistency of the input data dimensions for the attention-enhanced long short-term memory network.

[0046] In this embodiment of the invention, the method for determining the behavioral feature information of the first behavioral data in multiple preset feature dimensions may be as follows: processing the first behavioral data using a time decay algorithm to obtain behavioral feature information in the time decay dimension; processing the first behavioral data using a behavioral deviation algorithm to obtain behavioral feature information in the behavioral deviation dimension; determining the network topology features corresponding to the first behavioral data and using the network topology features as behavioral feature information; performing principal component analysis on the behavioral feature information to obtain behavioral feature information to be input into the attention-enhanced long short-term memory network.

[0047] The time decay algorithm is used to extract features along the time decay dimension from the first row of data to emphasize the importance of recent transactions. Optionally, the time decay algorithm can be characterized by the following function.

[0048]

[0049] Among them, w(t) k ) represents the exponential decay coefficient value of the k-th transaction, which can be determined using the exponential decay function, v k Let S represent the amount of the k-th transaction, n represent the number of transactions, and S represent the total amount of the transaction. t This represents the weighted total transaction amount at time t, corresponding to the behavioral characteristics information in the time decay dimension mentioned above.

[0050] The exponential decay function can be expressed as follows:

[0051]

[0052] Where λ represents the decay coefficient, and the decay function, determined through grid search, can be 0.05 (corresponding to a half-life of 14 days), t current This indicates the end time of the transaction in the time information of the first row of data, such as the current time, t. transaction This indicates the starting transaction time corresponding to the time information in the first row of data.

[0053] It should be noted that processing behavioral characteristic information in the time decay dimension can effectively capture the "test-breakout" trading pattern.

[0054] The behavioral deviation algorithm can be used to calculate the Mahalanobis distance between a user's initial behavioral data and the historical baseline. Optionally, the behavioral deviation algorithm can be characterized by the following function.

[0055]

[0056] Among them, D MThis represents behavioral characteristic information based on behavioral deviation, where X represents the first behavioral data, μ represents the historical baseline (e.g., μ could represent the mean of the first behavioral data for the same period over the past 90 days), and ∑ represents the covariance matrix. It should be noted that behavioral characteristic information based on behavioral deviation can be sensitive to abnormal transaction behaviors such as account takeover of the user account corresponding to the first behavioral data.

[0057] Network topology features can be extracted from the topology graph formed by the first behavioral data of users and their corresponding accounts. Optionally, network topology features can include: first-degree neighbor entropy, betweenness centrality, and dynamic community change features. First-degree neighbor entropy measures the dispersion of counterparties in a transaction. Betweenness centrality identifies key nodes in the resource value transfer process within the first behavioral data. Dynamic community change features characterize resource value aggregation behavior. Principal component analysis (PCA) is used to reduce the dimensionality of the behavioral feature information across multiple preset feature dimensions. For example, if the final behavioral feature information has a feature vector dimension of 28, after PCA dimensionality reduction, 15 principal components (cumulative variance contribution rate > 95%) can be retained. This yields the behavioral feature information to be input into the attention-enhanced long short-term memory network.

[0058] Specifically, a time decay algorithm can be used to extract time decay features from the first set of data to emphasize the importance of recent transactions, thus obtaining behavioral feature information in the time decay dimension. A behavioral deviation algorithm can then be used to extract behavioral deviation features from the first set of data, yielding behavioral feature information in the behavioral deviation dimension. A topology graph is constructed based on at least one user corresponding to the first set of data and the first sub-behavior data corresponding to each user's account. Feature extraction is then performed on the topology graph in at least one of the following dimensions: first-degree neighbor entropy, betweenness centrality, and dynamic community change characteristics, resulting in network topology graph features. These network topology features are then used as behavioral feature information in the network topology feature dimension. Principal component analysis is then performed on the behavioral feature information in the time decay dimension, the behavioral feature information in the behavioral deviation dimension, and the behavioral feature information in the network topology feature dimension to obtain the behavioral feature information to be input into the attention-enhanced long short-term memory network.

[0059] S120. Input the behavioral feature information into a pre-trained attention-enhanced long short-term memory network for feature processing to obtain the predicted risk attribute of the transaction behavior data on at least one classification label; wherein, the attention-enhanced long short-term memory network includes at least a bidirectional long short-term memory network layer and an attention mechanism layer.

[0060] The attention-enhanced long short-term memory (LSTM) network is used to perform risk assessment on behavioral feature information to determine the predicted risk attribute of at least one classification label. It should be noted that the classification label corresponds to user type. Different classification labels represent different user types. The predicted risk attribute can be used to characterize the probability of risk existing under each classification label. Optionally, the predicted risk attribute can be characterized by a probability value. A bidirectional LSM network layer can be used to capture the long-term dependencies of the time series corresponding to the behavioral feature information. The attention mechanism layer can be used to dynamically allocate weights to focus on key information, enhancing the interpretability of the attention-enhanced LSM network.

[0061] Specifically, behavioral feature information is input into a pre-trained attention-enhanced long short-term memory network (LSTM). The behavioral feature information is then processed through the bidirectional LSTM network layer and the attention mechanism layer of the attention-enhanced LSTM network to obtain the predicted risk attribute of the transaction behavior data on at least one classification label. Based on the predicted risk attribute, the user type of at least one user corresponding to the transaction behavior data is determined, thereby identifying potential users with abnormal transaction behavior.

[0062] Optionally, the attention-enhanced long short-term memory network may include at least two bidirectional long short-term memory network layers and an attention mechanism layer. Described from an input-output perspective, the attention-enhanced long short-term memory network includes: a bidirectional long short-term memory network layer, an attention mechanism layer, and a bidirectional long short-term memory network layer.

[0063] By sequentially processing the bidirectional long short-term memory network layer, the attention mechanism layer, and the bidirectional long short-term memory network layer of the attention-enhanced long short-term memory network, the predictive risk attribute of the transaction behavior data on at least one classification label is obtained.

[0064] It should be noted that before processing behavioral feature information based on a pre-trained Attention-Enhanced Long Short-Term Memory (ALS) network, an ALS network can be trained first. Optionally, multiple training samples can be obtained, each including sample behavioral feature information and the theoretical risk attribute of the corresponding classification label. The multiple training samples are divided into training, validation, and test sets in a 7:2:1 ratio. It should be noted that the proportion of sample behavioral feature information corresponding to different classification labels can be set. For example, if there are two classification labels, abnormal users and normal users, the ratio of training samples for abnormal users to those for normal users is set to 10:1. The ALS network is then trained using multiple training samples and a preset loss function to obtain a trained ALS network. The preset loss function can be a weighted cross-entropy loss function, as shown below:

[0065]

[0066] Among them, y i This represents the pre-defined theoretical risk attribute of attention-enhanced long short-term memory networks, i.e., the true label. i It can be 0 or 1. p i This represents the model prediction probability of the attention-enhanced long short-term memory network, where N represents the number of training samples, η represents the weight of positive samples (default 5.0), and L... reg This indicates the attention to the distributed constraint terms.

[0067] It should be noted that when adjusting the model parameters of the attention-enhanced long short-term memory network to be trained based on the preset loss function, the Nadam optimizer (initial learning rate 0.001, learning rate decays by 50% every 20 epochs), the Dropout regularization rate is set to 0.3, and the early stopping mechanism is enabled (the training of the attention-enhanced long short-term memory network to be trained is terminated when the validation set AUC does not improve for 10 consecutive epochs).

[0068] S130. Based on the predicted risk attribute and objective function of at least one classification identifier, determine the risk threshold corresponding to at least one classification identifier.

[0069] The objective function can be a function used to determine the risk threshold. The risk threshold can be understood as the standard risk attribute corresponding to the classification label.

[0070] Specifically, in order to improve the accuracy of anomaly detection results, for at least one classification label, a risk threshold corresponding to each classification label can be determined based on the predicted risk attribute and objective function of each classification label, combined with the historical risk attributes of the same classification label within a historical period, so as to determine whether the corresponding predicted risk attribute meets the conditions through the risk threshold.

[0071] S140. Based on the predicted risk attribute of at least one classification identifier and the corresponding risk threshold, determine the anomaly identification result corresponding to the transaction behavior data.

[0072] Among them, the anomaly detection results can be used to characterize abnormal users who have transaction risks or abnormal transaction behaviors.

[0073] Specifically, for at least one classification identifier, if the predicted risk attribute of the current classification identifier exceeds the risk threshold corresponding to the same classification identifier, and the current classification identifier corresponds to an anomaly category, then the anomaly judgment result corresponding to the transaction behavior data can be obtained. Here, the anomaly category can be the user type corresponding to the abnormal user.

[0074] It should be noted that the data flow in S110 to S140 above can be achieved through standardized interfaces. This embodiment of the invention supports both real-time data processing and batch data processing.

[0075] The technical solution of this embodiment preprocesses the acquired transaction behavior data to obtain first behavior data for determining user types, ensuring the consistency and accuracy of subsequent data processing. It determines the behavioral feature information of the first behavior data across multiple preset feature dimensions, achieving multi-dimensional feature extraction and ensuring the comprehensiveness of the data processed by the attention-enhanced long short-term memory network (LSTM). The behavioral feature information is input into a pre-trained LSTM network for feature processing, obtaining the predicted risk attribute of the transaction behavior data on at least one classification label. Processing the behavioral feature information through the LSTM significantly improves the ability to identify complex transaction behaviors and enhances the accuracy of model processing. Using the predicted risk attribute on at least one classification label and the objective function, a risk threshold corresponding to at least one classification label is determined, enabling personalized threshold adjustment and effectively avoiding misjudgments of abnormal users or normal transaction behaviors. Based on the predicted risk attribute of at least one classification label and the corresponding risk threshold, an anomaly detection result corresponding to the transaction behavior data is obtained. This anomaly detection result determines the user type represented by the corresponding classification label, which is the abnormal user type. This invention solves the problems of difficulty in identifying complex transaction behaviors, difficulty in accurately locating potential users, and missed detection of abnormal transactions in the prior art. It improves the accuracy of transaction behavior identification and ensures the accuracy of anomaly detection results by using an attention-enhanced long short-term memory network that combines a bidirectional long short-term memory network layer and an attention mechanism layer to process the behavioral feature information corresponding to transaction behavior data.

[0076] Example 2

[0077] Figure 2 This is a flowchart of a method for determining abnormal user types according to Embodiment 2 of the present invention. This embodiment is a preferred embodiment of the above embodiments. For specific implementation details, please refer to the technical solution of this embodiment. Technical terms that are the same as or corresponding to those in the above embodiments will not be repeated here. Figure 2 As shown, the method includes:

[0078] S210. By preprocessing the acquired transaction behavior data, first behavior data to be used to determine the user type is obtained, and the behavior feature information of the first behavior data in multiple preset feature dimensions is determined.

[0079] S220. Based on the bidirectional long short-term memory network layer in the attention-enhanced long short-term memory network, the behavioral feature information is analyzed and processed to determine the feature vector corresponding to the behavioral feature information; wherein, the feature vector includes the feature value corresponding to each field.

[0080] The bidirectional long short-term memory network layer can include 128 hidden units for processing behavioral feature information. The feature vector includes the feature value corresponding to each field in the transaction behavior data.

[0081] Specifically, behavioral feature information is processed by forward and backward propagation through the bidirectional long short-term memory network layer in the attention-enhanced long short-term memory network to obtain the feature vector corresponding to the behavioral feature information.

[0082] An exemplary structural diagram of an attention-enhanced long short-term memory network can be shown as follows: Figure 3 As shown. The behavioral characteristic information x t The input is fed into the bidirectional long short-term memory network layer in the attention-enhanced long short-term memory network, so that the behavioral feature information x can be processed through the 128 hidden units of the bidirectional long short-term memory network layer. t Forward and backward propagation processes are performed. Forward propagation can be represented by the following function:

[0083]

[0084] Where, x t Represents behavioral characteristic information. This represents the hidden state of the forward propagation layer of a bidirectional long short-term memory network at time t-1. This represents the hidden state of the forward propagation layer of a bidirectional long short-term memory network at time t.

[0085] Backpropagation can be represented by the following function:

[0086]

[0087] Where, x t Represents behavioral characteristic information. This represents the hidden state of the backpropagation layer of a bidirectional long short-term memory network at time t+1. This represents the hidden state of the backpropagation layer of a bidirectional long short-term memory network at time t.

[0088] By combining the results obtained from forward propagation and backward propagation, the feature value of each field corresponding to the behavioral feature information is determined, which can be represented by the following function:

[0089]

[0090] Among them, h t The eigenvalues ​​represent the hidden states of the bidirectional Long Short-Term Memory (LSTM) network layer at time t, i.e., the aforementioned eigenvalues, which are obtained by bidirectionally concatenating the forward and backward propagation results. This represents the hidden state of the forward propagation layer of a bidirectional long short-term memory network at time t. This represents the hidden state of the backpropagation layer of a bidirectional long short-term memory network at time t.

[0091] S230. Based on the attention mechanism layer in the attention-enhanced long short-term memory network, determine the original attention attribute corresponding to the feature value of each field in the feature vector.

[0092] The raw attention attribute can be used to characterize the attention attribute corresponding to the feature value of each field. Optionally, the raw attention attribute can be characterized by the raw attention score.

[0093] Specifically, the attention mechanism layer in the attention-enhanced long short-term memory network performs a linear transformation on the feature values ​​of each field in the feature vector to obtain the original attention attribute corresponding to the feature value of each field.

[0094] For example, in conjunction with the above examples, see Figure 3 The attention mechanism layer includes a fully connected (FC) sublayer, which performs a linear transformation on the feature values ​​of each field in the feature vector. The process of processing the feature values ​​of each field in the feature vector through the fully connected sublayer in the attention mechanism layer can be represented by the following function:

[0095] e t =v T tanh(W h h t +b)

[0096] Among them, e t The original attention attribute corresponding to the feature value of the field, v T W represents the preset weight matrix. h H represents the trainable weight matrix. t represents the hidden state of the bidirectional long short-term memory network layer at time t, i.e., the feature value mentioned above, and b represents the attention parameter vector.

[0097] S240. Based on the original attention attribute and the applied dispersion constraint attribute corresponding to the feature value of each field, determine the weighted attention value of the field.

[0098] The dispersion constraint attribute is used to reduce redundancy among eigenvalues. Optionally, the dispersion constraint attribute for each field can be determined using the constraint attribute determination function described below.

[0099]

[0100] Among them, Lreg This indicates the application of dispersion constraints, where α represents the regularization strength (default is 0.3), T represents the time upper limit, and w t This represents the attention weight corresponding to time t.

[0101] The weighted attention value can be the attention weight obtained by adjusting the original attention attribute by applying a dispersion constraint attribute. Optionally, the weighted attention value can be obtained by the following function.

[0102]

[0103] Among them, w t This represents the attention weight at time t obtained after adjusting for the dispersion constraint attribute, i.e., the weighted attention value mentioned above, e. t This represents the raw attention attribute of the field, where T represents the time range. risk This indicates a high-risk period (e.g., 0:00 to 4:00 AM), β represents a business adjustment parameter (default is 0.1), and I represents an indicator function, in the case of t∈T. risk In the case of I = 1.

[0104] Specifically, the original attention attribute of each field is subjected to dispersion constraint by applying dispersion constraint attribute to obtain the weighted attention value corresponding to each field.

[0105] For example, in conjunction with the above examples, see Figure 3 , Figure 3 S in the diagram represents the weighted attention value determination module, which determines the attention value based on the original attention attribute e corresponding to the feature value of each field. t and apply dispersion constraint property L reg Determine the weighted attention value w corresponding to each field. t .

[0106] S250. Based on the weighted attention value of the field and the corresponding feature value, determine the predictive risk attribute of the transaction behavior data on at least one classification label.

[0107] Specifically, the weighted attention weight determined for each field is multiplied by the corresponding feature value of that field to determine the processing result for each field. Based on the processing result for each field, the predicted risk attribute of the transaction behavior data on at least one classification label is determined, and the anomaly detection result is determined based on the predicted risk attribute.

[0108] For example, in conjunction with the above example, in determining the weighted attention value w for each field t Then, based on the feature value h corresponding to each field t And the weighted attention value w for each field tFeature concatenation is performed to obtain the processing result c. t Based on the processing result c t Determine the predicted risk attribute. Taking the predicted risk attribute as a risk score as an example, the function for determining the predicted risk attribute can be expressed as follows:

[0109]

[0110] Among them, W c Let b represent the trainable weight matrix. c w represents the preset bias term. t h represents the attention weight corresponding to time t, i.e., the weighted attention value of the field. t This represents the hidden state of the bidirectional long short-term memory network layer at time t, i.e., the eigenvalue mentioned above, where T represents the time range, and c... t This represents the context vector, which is the processing result mentioned above.

[0111] It should be noted that, see Figure 3 After obtaining the processing result c t Afterwards, the processing result c can be... t Input into a bidirectional long short-term memory network layer to obtain a predicted risk attribute under at least one classification label.

[0112] S260. Based on the historical risk attributes corresponding to at least one category identifier of the user to which the transaction behavior data belongs within the historical time period, determine the risk mean and risk standard deviation corresponding to at least one category identifier.

[0113] The historical duration can be a pre-set historical period. For example, the historical duration could be the past 180 days ending at the current time. Historical risk attributes can be the historical probability of risk existing under each classification identifier. Optionally, risk attributes can be represented by risk scores; that is, historical risk attributes can be the historical risk scores corresponding to each classification identifier. The risk mean can be the average of historical risk attributes. The risk standard deviation can be the standard deviation of historical risk attributes.

[0114] Specifically, the historical risk attributes corresponding to at least one category identifier for the user to whom the transaction behavior data belongs within at least one preset time period are obtained. For each category identifier, the mean risk for each category identifier is determined based on the number of historical risk attributes and the at least one historical risk attribute corresponding to each category identifier. The standard deviation of the risk is determined based on the mean risk and the at least one historical risk attribute corresponding to each category identifier.

[0115] S270. Substitute the risk mean, risk standard deviation and predicted risk attribute corresponding to at least one classification identifier into the objective function to determine the risk threshold corresponding to at least one classification identifier.

[0116] The objective function can be a function used to calculate the risk threshold. Optionally, the objective function can be expressed as follows:

[0117]

[0118] Where, θ dynamic θ represents the risk threshold. base The baseline threshold is determined based on the risk standard deviation and risk mean. γ represents the adjustment factor, which can be selected according to actual needs, typically ranging from 0.3 to 0.7. recent μ represents the predicted risk attribute corresponding to the same classification identifier. history σ represents the mean risk corresponding to the same classification identifier. history This represents the standard deviation of risk corresponding to the same classification identifier.

[0119] Wherein, the reference threshold θ base The following function can be used to determine this.

[0120] θ base =μ history +k·σ history

[0121] Where, μ history This represents the average risk corresponding to the classification identifier, and k represents the sensitivity coefficient, which is usually set to 2.5 but can be adjusted according to actual business needs. σ history θ represents the standard deviation of risk corresponding to the same classification label. base This represents the baseline threshold corresponding to the same category identifier.

[0122] Specifically, for at least one classification identifier, a baseline threshold is determined for each classification identifier based on its risk mean and risk standard deviation. The baseline threshold, the risk mean and risk standard deviation for each classification identifier, and the predicted risk attribute are then substituted into the objective function to obtain the risk threshold corresponding to the same classification identifier.

[0123] S280. For at least one classification identifier, when the predicted risk attribute corresponding to the classification identifier is greater than the corresponding risk threshold, and the classification identifier corresponds to the abnormal category, the abnormality judgment result of the transaction behavior data is determined.

[0124] Among them, the anomaly category can be understood as the category corresponding to abnormal users who pose a risk.

[0125] Specifically, for at least one classification identifier, if the predicted risk attribute under the current classification identifier corresponding to the transaction behavior data is greater than the risk threshold corresponding to the same classification identifier, and the current classification identifier corresponds to an abnormal category, then it is indicated that the current classification identifier is the classification identifier corresponding to the abnormal user, and the abnormality judgment result is determined, that is, the user to whom the transaction behavior data belongs is determined to be an abnormal user.

[0126] Optionally, the device further includes: generating a time-axis overlay heatmap based on the user's anomaly detection results and corresponding time information within a preset time period, wherein the time-axis overlay heatmap is used to reflect the anomaly category corresponding to the user within a historical time range; determining the contribution degree corresponding to each field by performing feature analysis processing on at least one user, and generating a contribution degree heatmap based on the contribution degree; acquiring user information whose anomaly detection results are preset classification identifiers within a target time period, and aggregating the geographical areas in the user information to obtain a risk customer geographical distribution heatmap.

[0127] The timeline overlay heatmap is used to reflect the anomaly categories corresponding to users within a historical time range. The historical time range can be a pre-set duration. Optionally, the historical time range can include a preset duration. By using a timeline overlay heatmap reflecting the anomaly categories corresponding to users within a historical time range, universally applicable statistical results can be obtained. The contribution degree corresponding to a field can be used to characterize the degree of influence of that field on the output of the Attention-Enhanced Long Short-Term Memory (ALS) network. The contribution degree heatmap is used to reflect the contribution of each field of at least one user to the output of the ALS network. The preset classification label can be a classification label corresponding to the anomaly category.

[0128] The target duration can be a pre-set timeframe. It's worth noting that to ensure the risk customer geographic distribution heatmap has universal applicability, the target duration can be set to a relatively long period. For example, the target duration could be one year. The user information with pre-defined classification labels can be understood as information about abnormal or potentially problematic users. The geographic region can be the user's location as represented in the user information. The risk customer geographic distribution heatmap can be used to reflect the geographic regions to which abnormal or potentially problematic users reside. By using the risk customer geographic distribution heatmap, the geographic regions where potentially problematic or abnormal users typically reside can be identified, facilitating subsequent focused monitoring of users belonging to those geographic regions.

[0129] Specifically, based on the anomaly detection results and corresponding time information of users within a preset time period, a time-axis overlay heatmap reflecting the anomaly categories corresponding to users within a historical time range is generated. The characteristics of each field for at least one user are analyzed to determine the contribution of each field to the output of the Attention-Enhanced Long Short-Term Memory (LSTM) network. A contribution heatmap is generated based on the contribution of each field, and the network parameters of the LSTM are adaptively adjusted according to the contribution heatmap. User information with anomaly detection results of preset classification labels within the target time period is obtained. Geographical regions in the user information are aggregated, and a risk customer geographic distribution heatmap is generated based on the aggregation results. The geographic regions to which abnormal or potentially problematic users belong are determined based on the risk customer geographic distribution heatmap.

[0130] Based on the above, by determining the time axis overlay heatmap, contribution heatmap, and risk customer geographical distribution heatmap, the decision-making process becomes transparent, thereby meeting the requirements for the interpretability of the risk model.

[0131] The technical solution of this embodiment preprocesses the acquired transaction behavior data to obtain first behavior data for determining user type, ensuring the consistency and accuracy of subsequent data processing. It determines the behavioral feature information of the first behavior data across multiple preset feature dimensions, achieving multi-dimensional feature extraction and ensuring the comprehensiveness of the data processed by the attention-enhanced long short-term memory network. By processing the behavioral feature information through the bidirectional long short-term memory network layer and attention mechanism layer of the pre-trained attention-enhanced long short-term memory network, the recognition ability of complex transaction behaviors can be significantly improved, increasing the model's recognition accuracy to 0.93 and reducing the model's false positive rate to 12.4%. By using the historical risk attributes corresponding to at least one classification identifier of the user to which the transaction behavior data belongs within the historical timeframe, the predicted risk attributes on at least one classification identifier, and the objective function, a risk threshold corresponding to at least one classification identifier is determined, achieving personalized threshold adjustment and effectively avoiding misjudgment of abnormal users or normal transaction behaviors. Based on the predicted risk attributes of at least one classification identifier and the corresponding risk threshold of the classification identifier, the anomaly discrimination result corresponding to the transaction behavior data is obtained. This invention addresses the problems of difficulty in identifying complex transaction behaviors, accurately locating potentially problematic users, and missing abnormal transactions in existing technologies. It utilizes an attention-enhanced long short-term memory (LSTM) network, combining a bidirectional LSM network layer and an attention mechanism layer, to process the behavioral feature information corresponding to transaction behavior data. This improves the accuracy of transaction behavior identification, accurately identifying behaviors such as "dispersed inflows and concentrated outflows" and "high-frequency, small-amount test transactions," ensuring the accuracy of anomaly detection results. Simultaneously, by controlling the prediction latency of the attention-enhanced LSM network to within 50 milliseconds, it meets the business needs of practical applications and enhances the real-time processing capability of transaction behavior data.

[0132] Example 3

[0133] Figure 4 This is a flowchart illustrating a method for determining abnormal user types according to an embodiment of the present invention. This embodiment is an example of the above embodiments. For specific implementation details, please refer to the technical solution of this embodiment. Technical terms that are the same as or corresponding to those in the above embodiments will not be repeated here.

[0134] like Figure 4 As shown, the method includes:

[0135] S310. Perform data standardization, outlier handling, and data alignment on the acquired transaction behavior data to obtain the first behavior data to be used to determine the user type.

[0136] The data standardization, outlier handling, and data alignment of the transaction behavior data correspond to the preprocessing of the transaction behavior data in the above embodiment S110.

[0137] In this embodiment of the invention, the transaction behavior data of the target user is used as an example for explanation. The target user can be the user whose user type needs to be determined, that is, the user whose potential risks or abnormality needs to be determined.

[0138] Specifically, the transaction behavior data of the target users is acquired and standardized to unify data from different sources, resulting in the behavior data to be used. Based on an improved boxplot algorithm, a transaction amount threshold for the target users is set. If the transaction amount data in the behavior data to be used does not exceed the threshold, the transaction amount data is retained. Cubic spline interpolation is used to align the behavior data, including time information, to generate the first behavior data with equally spaced data points.

[0139] Optionally, the first row of data can be stored in a distributed columnar database for retrieval when needed. The first row of data includes 15 basic fields and 3 derived fields.

[0140] S320. Perform time-series feature extraction processing on the first row of data to obtain the time decay feature, behavior deviation feature and network topology feature corresponding to the first row of data.

[0141] Among them, the time decay feature corresponds to the behavioral feature information in the time decay dimension mentioned in the above embodiments, and the behavioral deviation feature corresponds to the behavioral feature information in the behavioral deviation dimension mentioned in the above embodiments.

[0142] Specifically, the first row of data is processed using an exponential decay function to emphasize the importance of recent trading behavior, yielding a processing result. This result is then further processed using the function corresponding to the time decay algorithm to obtain the time decay feature. It should be noted that the functions corresponding to the exponential decay function and the time decay algorithm have been mentioned in the above embodiments and will not be repeated here.

[0143] The Mahalanobis distance between the target user's transaction behavior data and the historical baseline is calculated, and this distance is used as a feature of behavioral deviation. The historical baseline can be the mean of the target user's first behavioral data within the same time period over the past 90 days.

[0144] Based on the data in the first row, a transaction network topology graph of the target user and the accounts to which the target user belongs is constructed. The first-degree neighbor entropy, betweenness centrality, and dynamic community change characteristics are extracted from the transaction network topology graph to obtain the network topology features.

[0145] The time decay characteristics, behavioral deviation characteristics, and network topology characteristics corresponding to the first set of data are used as behavioral feature information. Principal Component Analysis (PCA) is used to reduce the dimensionality of the behavioral feature information to obtain behavioral feature information that retains the principal components.

[0146] It should be noted that when performing PCA dimensionality reduction, when the cumulative variance contribution rate is greater than 95%, the 28-dimensional behavioral feature information can be reduced to the dimensionality-reduced behavioral feature information corresponding to 15 principal components.

[0147] S330. The time decay feature, behavior deviation feature and network topology feature corresponding to the first behavior data are used as behavior feature information and input into a pre-trained attention-enhanced long short-term memory network for processing to obtain the predicted risk attribute of the transaction behavior data on at least one classification label.

[0148] In an embodiment of the present invention, see Figure 3 From an input-output perspective, an attention-enhanced long short-term memory (LSSM) network can be described as consisting of a bidirectional LSSM layer, an attention mechanism layer, and another bidirectional LSSM layer. The bidirectional LSSM layer can contain 128 hidden units, used for forward and backward propagation processing of behavioral feature information.

[0149] Specifically, the behavioral feature information is processed through forward propagation, backward propagation, and bidirectional concatenation in the bidirectional long short-term memory network layer of the attention-enhanced long short-term memory network to determine the feature value corresponding to each field. The feature value corresponding to each field is then input into the attention mechanism layer to calculate the original attention score, which is the original attention attribute corresponding to the feature value of each field mentioned in the above embodiments. Furthermore, a dispersion constraint is applied to determine the attention weight corresponding to each field. The application of the dispersion constraint corresponds to the application of the dispersion constraint attribute mentioned in the above embodiments. The attention weight corresponds to the weighted attention value of the field mentioned in the above embodiments.

[0150] Based on the attention weight and corresponding feature value of each field, the processing result to be input into the next bidirectional long short-term memory network layer is determined. The processing result is then processed by the next bidirectional long short-term memory network layer to obtain the predicted risk attribute of the target user under at least one classification label.

[0151] S340. Based on the predicted risk attribute on at least one classification identifier and the historical risk attribute corresponding to at least one classification identifier of the user to which the transaction behavior data belongs within the historical time period, determine the risk threshold corresponding to at least one classification identifier.

[0152] The user to whom the transaction occurred corresponds to the target user mentioned above.

[0153] Specifically, the system obtains the historical risk attributes corresponding to at least one category identifier for the target user within at least one preset time period. For each category identifier, based on the number of historical risk attributes and at least one historical risk attribute, the system determines the risk mean and risk standard deviation corresponding to each category identifier. Substituting the risk mean and risk standard deviation corresponding to each category identifier, along with the predicted risk attributes for that category identifier, into the objective function yields the risk threshold corresponding to each category identifier.

[0154] S350. For at least one classification label, if the predicted risk attribute corresponding to the classification label is greater than the risk threshold corresponding to the same classification label, and the classification label corresponds to an anomaly category, then the anomaly judgment result of the transaction behavior data is determined.

[0155] Among them, the abnormal category is the user type corresponding to abnormal users or users with potential risks.

[0156] Specifically, if the predicted risk attribute corresponding to the current classification identifier is greater than the risk threshold corresponding to the same classification identifier, and the current classification identifier corresponds to an abnormal category, then the target user corresponding to the transaction behavior data is determined to be an abnormal user or a user with potential risks, thus determining the abnormality judgment result.

[0157] In this embodiment of the invention, by performing data standardization, outlier handling, and data alignment on the acquired transaction behavior data, first behavior data for determining user type is obtained, ensuring the consistency and accuracy of subsequent data processing. Temporal feature extraction processing is performed on the first behavior data to obtain time decay features, behavior deviation features, and network topology features corresponding to the first behavior data, achieving multi-dimensional feature extraction and ensuring the comprehensiveness of the data processed by the attention-enhanced long short-term memory network. The time decay features, behavior deviation features, and network topology features corresponding to the first behavior data are used as behavioral feature information and input into a pre-trained attention-enhanced long short-term memory network for processing, obtaining the predicted risk attribute of the transaction behavior data on at least one classification label. By processing the behavioral feature information through the bidirectional long short-term memory network layer and attention mechanism layer of the pre-trained attention-enhanced long short-term memory network, the recognition ability of complex transaction behaviors can be significantly improved, the model recognition accuracy can be increased, and the model false alarm rate can be reduced. Based on the predicted risk attribute of at least one classification identifier and the historical risk attribute corresponding to at least one classification identifier of the user to which the transaction behavior data belongs within a historical period, a risk threshold corresponding to at least one classification identifier is determined. This enables personalized threshold adjustment and effectively avoids misjudgment of abnormal users or normal transaction behavior. The anomaly judgment result of the transaction behavior data is determined when the predicted risk attribute corresponding to the classification identifier is greater than the risk threshold corresponding to the same classification identifier, and the classification identifier corresponds to an abnormal category. This invention solves the problems of difficulty in identifying complex transaction behavior, difficulty in accurately locating potentially problematic users, and missed detection of abnormal transactions in existing technologies. It improves the accuracy of transaction behavior identification and ensures the accuracy of anomaly judgment results by processing the behavioral feature information corresponding to the transaction behavior data through an attention-enhanced long short-term memory network that combines a bidirectional long short-term memory network layer and an attention mechanism layer.

[0158] Example 4

[0159] Figure 5 This is a schematic diagram of the structure of an abnormal user type determination device provided in Embodiment 4 of the present invention. Figure 5 As shown, the device includes: a feature information determination module 410, a risk attribute determination module 420, a risk threshold determination module 430, and a discrimination result determination module 440.

[0160] The feature information determination module 410 is used to preprocess the acquired transaction behavior data to obtain first behavior data to be used to determine the user type, and to determine the behavior feature information of the first behavior data in multiple preset feature dimensions; the risk attribute determination module 420 is used to input the behavior feature information into a pre-trained attention-enhanced long short-term memory network for feature processing to obtain the predicted risk attribute of the transaction behavior data on at least one classification label; wherein, the attention-enhanced long short-term memory network includes at least a bidirectional long short-term memory network layer and an attention mechanism layer; the risk threshold determination module 430 is used to determine the risk threshold corresponding to at least one classification label based on the predicted risk attribute on at least one classification label and the objective function; the discrimination result determination module 440 is used to determine the anomaly discrimination result corresponding to the transaction behavior data according to the predicted risk attribute of at least one classification label and the corresponding risk threshold.

[0161] The technical solution of this embodiment preprocesses the acquired transaction behavior data to obtain first behavior data for determining user types, ensuring the consistency and accuracy of subsequent data processing. It determines the behavioral feature information of the first behavior data across multiple preset feature dimensions, achieving multi-dimensional feature extraction and ensuring the comprehensiveness of the data processed by the attention-enhanced long short-term memory network (LSTM). The behavioral feature information is input into a pre-trained LSTM network for feature processing, obtaining the predicted risk attribute of the transaction behavior data on at least one classification label. Processing the behavioral feature information through the LSTM significantly improves the ability to identify complex transaction behaviors and enhances the accuracy of model processing. Using the predicted risk attribute on at least one classification label and the objective function, a risk threshold corresponding to at least one classification label is determined, enabling personalized threshold adjustment and effectively avoiding misjudgments of abnormal users or normal transaction behaviors. Based on the predicted risk attribute of at least one classification label and the corresponding risk threshold, an anomaly detection result corresponding to the transaction behavior data is obtained. This anomaly detection result determines the user type represented by the corresponding classification label, which is the abnormal user type. This invention solves the problems of difficulty in identifying complex transaction behaviors, difficulty in accurately locating potential users, and missed detection of abnormal transactions in the prior art. It improves the accuracy of transaction behavior identification and ensures the accuracy of anomaly detection results by using an attention-enhanced long short-term memory network that combines a bidirectional long short-term memory network layer and an attention mechanism layer to process the behavioral feature information corresponding to transaction behavior data.

[0162] Based on the above embodiments, optionally, the feature information determination module includes: a data preprocessing unit, which is used to acquire each transaction behavior data generated within a preset time period, and format the transaction behavior data according to the field standardization method of the field to which the transaction behavior data belongs, to obtain the behavior data to be used; when the data value in the behavior data to be used meets the transaction amount threshold of the dimension to which the behavior data to be used belongs, the behavior data to be used is retained; for the behavior data to be used that includes time information, spline interpolation is used to interpolate the behavior data to be used to obtain the first behavior data.

[0163] Optionally, the feature information determination module includes: a behavior feature information determination unit, which is used to process the first behavior data using a time decay algorithm to obtain behavior feature information in the time decay dimension; to process the first behavior data using a behavior deviation algorithm to obtain behavior feature information in the behavior deviation dimension; to determine the network topology features corresponding to the first behavior data and use the network topology features as behavior feature information; and to perform principal component analysis on the behavior feature information to obtain the behavior feature information to be input into the attention-enhanced long short-term memory network.

[0164] Optionally, a risk attribute determination module is used to analyze and process behavioral feature information based on the bidirectional long short-term memory network layer in an attention-enhanced long short-term memory network to determine the feature vector corresponding to the behavioral feature information; wherein, the feature vector includes the feature value corresponding to each field; the original attention attribute corresponding to the feature value of each field in the feature vector is determined based on the attention mechanism layer in the attention-enhanced long short-term memory network; the weighted attention value of the field is determined based on the original attention attribute corresponding to the feature value of each field and the applied dispersion constraint attribute; and the predicted risk attribute of the transaction behavior data on at least one classification label is determined based on the weighted attention value of the field and the corresponding feature value.

[0165] Optionally, the risk threshold determination module is used to determine the risk mean and risk standard deviation corresponding to at least one classification identifier based on the historical risk attributes corresponding to at least one classification identifier of the user to which the transaction behavior data belongs within the historical time period; and to substitute the risk mean, risk standard deviation and predicted risk attributes corresponding to at least one classification identifier into the objective function to determine the risk threshold corresponding to at least one classification identifier.

[0166] Optionally, the discrimination result determination module is used to determine the anomaly discrimination result of the transaction behavior data when, for at least one classification identifier, the predicted risk attribute corresponding to the classification identifier is greater than the corresponding risk threshold, and the classification identifier corresponds to the anomaly category.

[0167] Optionally, the device further includes: a data visualization module, used to generate a time-axis overlay heatmap based on the user's anomaly detection results and corresponding time information within a preset time period, wherein the time-axis overlay heatmap is used to reflect the anomaly category corresponding to the user within a historical time range; by performing feature analysis and processing on each field of at least one user, the contribution degree corresponding to each field is determined, so as to generate a contribution degree heatmap based on the contribution degree; user information whose anomaly detection results are preset classification identifiers within a target time period is obtained, and the geographical areas in the user information are aggregated and processed to obtain a risk customer geographical distribution heatmap.

[0168] The abnormal user type determination device provided in the embodiments of the present invention can execute the abnormal user type determination method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0169] Example 5

[0170] Figure 6 This is a schematic diagram of the structure of an electronic device provided in Embodiment 5 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0171] like Figure 6 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0172] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0173] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the abnormal user type determination method.

[0174] In some embodiments, the abnormal user type determination method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the abnormal user type determination method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the abnormal user type determination method by any other suitable means (e.g., by means of firmware).

[0175] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0176] Computer programs used to implement the abnormal user type determination method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0177] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication unit 19, or installed from storage unit 18, or installed from ROM 12. When the computer program is executed by processor 11, it performs the functions defined in the methods of the embodiments of the present invention.

[0178] Example 6

[0179] Embodiment 6 of the present invention also provides a computer-readable storage medium storing computer instructions for causing a processor to execute an abnormal user type determination method, the method comprising:

[0180] By preprocessing the acquired transaction behavior data, first behavior data is obtained to determine the user type, and the behavior feature information of the first behavior data in multiple preset feature dimensions is determined. The behavior feature information is input into a pre-trained attention-enhanced long short-term memory network for feature processing to obtain the predicted risk attribute of the transaction behavior data on at least one classification label. The attention-enhanced long short-term memory network includes at least a bidirectional long short-term memory network layer and an attention mechanism layer. Based on the predicted risk attribute on at least one classification label and the objective function, the risk threshold corresponding to at least one classification label is determined. According to the predicted risk attribute of at least one classification label and the corresponding risk threshold, the anomaly discrimination result corresponding to the transaction behavior data is determined.

[0181] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0182] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0183] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0184] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0185] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0186] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for determining abnormal user types, characterized in that, include: By preprocessing the acquired transaction behavior data, first behavior data to be used to determine user type is obtained, and the behavior feature information of the first behavior data in multiple preset feature dimensions is determined. The behavioral feature information is input into a pre-trained attention-enhanced long short-term memory network for feature processing to obtain the predicted risk attribute of the transaction behavior data on at least one classification label; wherein, the attention-enhanced long short-term memory network includes at least a bidirectional long short-term memory network layer and an attention mechanism layer; Based on the predicted risk attribute and objective function of the at least one classification identifier, determine the risk threshold corresponding to the at least one classification identifier; Based on the predicted risk attributes and corresponding risk thresholds of the at least one classification identifier, the anomaly detection result corresponding to the transaction behavior data is determined.

2. The method according to claim 1, characterized in that, The process of preprocessing the acquired transaction behavior data to obtain first behavior data for determining user type includes: Acquire each transaction behavior data generated within a preset time period, and format the transaction behavior data according to the field standardization method of the field to which the transaction behavior data belongs, to obtain the behavior data to be used; When the data value in the data to be used meets the transaction amount threshold of the dimension to which the data to be used belongs, the data to be used is retained; For the behavior data to be used, which includes time information, spline interpolation is used to interpolate the behavior data to obtain the first behavior data.

3. The method according to claim 1, characterized in that, The step of determining the behavioral feature information of the first behavioral data across multiple preset feature dimensions includes: The first behavioral data is processed using a time decay algorithm to obtain behavioral feature information in the time decay dimension; The first behavioral data is processed using a behavioral deviation algorithm to obtain behavioral feature information based on behavioral deviation. Determine the network topology features corresponding to the first behavioral data, and use the network topology features as behavioral feature information; Principal component analysis is performed on the behavioral feature information to obtain the behavioral feature information to be input into the attention-enhanced long short-term memory network.

4. The method according to claim 1, characterized in that, The step of inputting the behavioral feature information into a pre-trained attention-enhanced long short-term memory network for feature processing to obtain the predicted risk attribute of the transaction behavior data on at least one classification label includes: The behavioral feature information is analyzed and processed based on the bidirectional long short-term memory network layer in the attention-enhanced long short-term memory network to determine the feature vector corresponding to the behavioral feature information; wherein, the feature vector includes the feature value corresponding to each field; The original attention attribute corresponding to the feature value of each field in the feature vector is determined based on the attention mechanism layer in the attention-enhanced long short-term memory network. Based on the original attention attribute and the applied dispersion constraint attribute corresponding to the feature value of each field, the weighted attention value of the field is determined; Based on the weighted attention value and corresponding feature value of the field, the predictive risk attribute of the transaction behavior data on the at least one classification identifier is determined.

5. The method according to claim 1, characterized in that, The step of determining the risk threshold corresponding to the at least one classification identifier based on the predicted risk attribute and objective function on the at least one classification identifier includes: Based on the historical risk attributes corresponding to at least one classification identifier of the user to which the transaction behavior data belongs within the historical time period, determine the risk mean and risk standard deviation corresponding to the at least one classification identifier; The risk mean, risk standard deviation, and predicted risk attribute corresponding to the at least one classification identifier are substituted into the objective function to determine the risk threshold corresponding to the at least one classification identifier.

6. The method according to claim 1, characterized in that, The step of determining the anomaly detection result corresponding to the transaction behavior data based on the predicted risk attribute and corresponding risk threshold of the at least one classification identifier includes: For the at least one classification identifier, when the predicted risk attribute corresponding to the classification identifier is greater than the corresponding risk threshold, and the classification identifier corresponds to the anomaly category, the anomaly judgment result of the transaction behavior data is determined.

7. The method according to claim 1, characterized in that, The method further includes: Based on the user's anomaly detection results and corresponding time information within a preset time period, a time axis overlay heat map is generated, wherein the time axis overlay heat map is used to reflect the anomaly category corresponding to the user within a historical time range; By performing feature analysis on each field of at least one user, the contribution level corresponding to each field is determined, and a contribution heatmap is generated based on the contribution level. The system acquires user information whose anomaly identification results are preset category identifiers within a target time period, and aggregates the geographical regions in the user information to obtain a heat map of the geographical distribution of risky customers.

8. An abnormal user type determination device, characterized in that, include: The feature information determination module is used to preprocess the acquired transaction behavior data to obtain first behavior data to be used to determine the user type, and to determine the behavior feature information of the first behavior data in multiple preset feature dimensions. The risk attribute determination module is used to input the behavioral feature information into a pre-trained attention-enhanced long short-term memory network for feature processing to obtain the predicted risk attribute of the transaction behavior data on at least one classification label; wherein, the attention-enhanced long short-term memory network includes at least a bidirectional long short-term memory network layer and an attention mechanism layer; The risk threshold determination module is used to determine the risk threshold corresponding to the at least one classification identifier based on the predicted risk attribute and objective function on the at least one classification identifier; The discrimination result determination module is used to determine the anomaly discrimination result corresponding to the transaction behavior data based on the predicted risk attribute and corresponding risk threshold of the at least one classification identifier.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the abnormal user type determination method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the abnormal user type determination method according to any one of claims 1-7.

Images