A Machine Learning-Based Real-Time Identification and Handling Method and System for Payment Fraud

Abstract

This invention provides a machine learning-based method and system for real-time identification and handling of payment fraud, relating to the field of computer technology. The method includes constructing a transaction relationship graph, using graph attention networks to identify abnormal transaction patterns, and calculating transaction suspiciousness scores. When a preset threshold is exceeded, an adaptive verification strategy based on knowledge graphs and reinforcement learning is triggered to execute corresponding verification measures and process the transaction results. This invention enables accurate identification and efficient handling of fraudulent transactions, improves payment security, reduces false interception rates, and optimizes user experience.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and in particular to a payment fraud real-time identification and disposal method and system based on machine learning. BACKGROUND

[0002] With the popularity of electronic payment, payment fraud activities are increasingly rampant, posing a serious threat to financial security. Traditional payment fraud detection methods mainly rely on rule engines and simple statistical models, which cannot effectively cope with the rapid evolution of fraud methods. In recent years, machine learning technology has been widely applied in fraud detection, analyzing multi-dimensional data such as user behavior characteristics, transaction patterns, and device information, improving the accuracy of fraud identification. The current mainstream fraud detection system usually uses traditional machine learning algorithms such as decision trees, random forests, and support vector machines or deep learning models, combined with risk control rules for risk assessment. After detecting suspicious transactions, the corresponding verification process will be triggered, such as SMS verification, biometric authentication, or telephone confirmation, to confirm the authenticity of the transaction.

[0003] However, the existing payment fraud detection technology has the following shortcomings:

[0004] Firstly, the existing technology generally uses isolated feature analysis methods, which cannot effectively model the complex relationship network between transaction participants, resulting in limited ability to identify gang fraud and complex associated transaction patterns. Due to the failure to fully utilize the rich relationship information contained in the graph structure data, it is difficult to discover hidden fraud patterns and abnormal transaction paths.

[0005] Secondly, the existing fraud transaction verification strategy is usually preset and fixed, lacking flexibility and adaptability, and cannot dynamically adjust the verification means according to different transaction scenarios and risk levels. This one-size-fits-all verification mechanism will not only lead to insufficient verification of high-risk transactions, but also cause excessive verification of low-risk transactions, affecting user experience and increasing operating costs.

[0006] Finally, the selection of traditional verification means lacks a systematic optimization method, and various verification means cannot comprehensively consider factors such as cost, effect, and user experience, making it difficult to achieve the best balance between security and convenience. The combination strategy between verification means also lacks scientific basis, and cannot adjust the verification strategy in real time according to the dynamic changes of fraud risk, resulting in low prevention and control efficiency. SUMMARY

[0007] The embodiments of the present application provide a payment fraud real-time identification and disposal method and system based on machine learning, which can solve the problems in the prior art.

[0008] In a first aspect of the embodiments of the present application, a payment fraud real-time identification and disposal method based on machine learning is provided, comprising:

[0009] obtaining a user identifier, extracting historical payment device records and historical payee information of the user from a user historical behavior database based on the user identifier;

[0010] constructing the user identifier, the payment device and the payee as nodes, and constructing the payment behavior as edges to generate a transaction relationship graph, performing feature embedding on the nodes in the transaction relationship graph, modeling the association strength between the nodes by using a graph attention network, identifying an abnormal transaction association mode, and calculating a transaction suspiciousness score based on the node embedding features and the association strength;

[0011] comparing the transaction suspiciousness score with a preset suspiciousness threshold, and triggering a transaction verification process when the preset suspiciousness threshold is exceeded;

[0012] taking the transaction features as an environmental state, constructing a hierarchical verification means action space based on a knowledge graph, constructing a relationship edge set by calculating similarity measurement values and dependency relationship values between verification means nodes, realizing adaptive division of security levels according to dynamic security scores of the verification means nodes, calculating a comprehensive utility value of a verification combination by a node unit cost and an associated conflict cost, constructing a reinforcement learning-based adaptive verification strategy generator, executing a verification combination output by the adaptive verification strategy generator, and obtaining a verification result;

[0013] when the verification is passed, releasing the transaction, and when the verification is not passed, rejecting the transaction and pushing a risk reminder to the user.

[0014] constructing the user identifier, the payment device and the payee as nodes, and constructing the payment behavior as edges to generate a transaction relationship graph includes:

[0015] constructing the user identifier information as a first type of node, constructing the payment device information as a second type of node, and constructing the payee information as a third type of node;

[0016] using transaction time, transaction amount and transaction type as payment behavior information, and constructing a directed edge between the first type of node or the second type of node and the third type of node according to the payment behavior information, wherein the starting point of the directed edge is the node initiating the payment, the end point of the directed edge is the node receiving the payment, and the corresponding payment behavior information is labeled on the directed edge;

[0017] A node adjacency matrix is constructed to represent the connection relationship between the first type of nodes, the second type of nodes and the third type of nodes, the rows and columns of the node adjacency matrix correspond to different types of nodes respectively, and the matrix elements represent whether there is a directed edge connection between nodes; an edge attribute matrix is constructed to store the payment behavior information on the directed edge, the edge attribute matrix has the same dimension as the node adjacency matrix, and the matrix elements record the transaction time, transaction amount and transaction type of the corresponding directed edge; and a topology structure of a transaction relationship graph is generated based on the node adjacency matrix and the edge attribute matrix.

[0018] The association strength between nodes is modeled using a graph attention network, and an abnormal transaction association pattern is identified. The transaction suspiciousness score is calculated based on the node embedding features and the association strength, including:

[0019] An initial feature vector is configured for a node in the transaction relationship graph, and the initial feature vector is input into a feature transformation matrix to obtain a transformed feature. The transformed features corresponding to adjacent nodes are spliced and input into an attention vector to generate an attention coefficient between the node pair. The attention coefficient is normalized to obtain an attention weight. The node features are aggregated and updated based on the attention weight to obtain an attention feature of the node.

[0020] The attention feature sequence of the user's historical transactions is extracted. The attention coefficient between the user-device node and the negative exponential decay value of the transaction time interval are multiplied and summed to obtain the user-device association strength. The attention coefficient between the user-collecting party node and the logarithmic normalized value of the transaction amount are weighted and summed to obtain the user-collecting party association strength. The cosine similarity of the attention features between the device-collecting party node and the attention coefficient are multiplied to obtain the device-collecting party association strength. The three kinds of association strength are spliced and input into a fully connected layer to obtain a multi-dimensional fusion feature vector.

[0021] The difference between the current transaction association strength and the average of the user historical transaction association strength is calculated, and the difference is divided by the standard deviation to obtain a time series anomaly score. The probability distribution information entropy of the three kinds of association strength is calculated to obtain a structural anomaly score. The time series anomaly score, the structural anomaly score and the multi-dimensional fusion feature vector are spliced and input into a three-layer fully connected network to obtain a transaction suspiciousness score through a Sigmoid function mapping.

[0022] The transaction features are taken as the environmental state, a hierarchical verification means action space is constructed based on a knowledge graph, a relationship edge set is constructed by calculating the similarity measurement value and the dependency relationship value between the verification means nodes, the adaptive division of the security level is realized according to the dynamic security score of the verification means nodes, and the comprehensive utility value of the verification combination is calculated by the node unit cost and the associated conflict cost, including:

[0023] Construct a knowledge graph of verification methods, wherein the knowledge graph of verification methods includes a set of verification method nodes and a set of relation edges;

[0024] Based on the feature vectors of the verification method nodes, a similarity measure between nodes is obtained by weighting the cosine similarity of the feature vectors with the overlap of the applicable scenario set. At the same time, a dependency value is calculated based on the number of co-occurrences of the verification method nodes based on historical verification data. The similarity measure and the dependency value are used as the weights of the relation edge set.

[0025] Based on the basic security score of the verification method node and the weight information of the relation edge set, combined with the historical performance score and adaptability score of the verification method in different scenarios, the dynamic security score of the verification method node is calculated, and the verification method node is dynamically divided into different security levels based on the dynamic security score.

[0026] A cost budget constraint model is established for verification method nodes with different security levels. The unit cost is calculated based on the resource consumption cost of the verification method nodes. At the same time, the conflict cost is calculated through the conflict information between nodes obtained by the relation edge set. The unit cost and conflict cost are integrated and the combined utility value is obtained under the condition of satisfying the budget constraint.

[0027] A cost budget constraint model is established for verification method nodes with different security levels. The unit cost is calculated based on the resource consumption cost of the verification method nodes. Simultaneously, the conflict cost is calculated using the inter-node conflict information obtained from the relational edge set. The unit cost and conflict cost are integrated, and a combined utility value is obtained under the condition of satisfying budget constraints, including:

[0028] The computational resource consumption, memory resource consumption, and time consumption of the verification method node are assigned corresponding weights and the weighted sum is calculated to obtain the unit resource cost. The security level cost coefficient is calculated according to the security level to which the verification method node belongs. The unit resource cost is multiplied by the security level cost coefficient to obtain the node base cost of each verification method node.

[0029] The computational resources, memory resources, and time resources used by the verification method nodes are statistically analyzed. The proportion of shared resources to the total resources of the nodes is calculated to obtain the resource overlap. The resource overlap is multiplied by a preset conflict weight to obtain the conflict intensity between the nodes. The conflict intensity is calculated for each selected verification method node and the cumulative conflict cost is obtained.

[0030] Set a global budget cap and tiered budget caps for each security level as budget constraints, and determine whether the sum of the basic costs of the nodes and the sum of the cumulative conflict costs satisfy the budget constraints.

[0031] For verification method nodes that meet the budget constraints, calculate their security score, performance score, and user experience score respectively. Assign corresponding weights to the security score, performance score, and user experience score respectively and calculate the weighted sum to obtain the node utility value. Subtract the accumulated conflict cost from the node utility value to obtain the combined utility value of the verification combination.

[0032] Construct an adaptive verification policy generator based on reinforcement learning, execute the verification combination output by the adaptive verification policy generator, and obtain the verification results, including:

[0033] The transaction feature vector, user profile feature vector, and scene context feature vector are acquired and concatenated to form an environment state representation vector. The environment state representation vector is then linearly transformed through an encoding weight matrix and processed by an activation function to obtain a state code.

[0034] The verification method sets for multiple security levels are divided according to the state code. The selection state of each verification method is composed into an action vector. The overall selection quantity constraint and the selection quantity constraint within different security levels are set for the action vector to generate a set of candidate verification method combinations that meet the constraints.

[0035] The state code is simultaneously input into the Actor network and the Critic network. The Actor network extracts features from the state code using a multilayer perceptron structure to generate the selection probability distribution of each combination in the candidate verification method combination set. The Critic network adopts a two-layer neural network structure. The first layer performs dimensionality reduction mapping on the state code, and the second layer outputs the state value evaluation score to obtain the value score corresponding to the current state code.

[0036] The candidate verification method combination set is sorted according to the selection probability distribution, and the verification method combination with the highest value score is selected as the optimal verification strategy output to obtain the verification result.

[0037] A second aspect of the present invention provides a real-time payment fraud identification and handling system based on machine learning, comprising:

[0038] The first unit is used to obtain a user identifier and, based on the user identifier, extract the user's historical payment device records and historical payee information from the user's historical behavior database.

[0039] The second unit is used to construct user identifiers, payment devices, and payees as nodes, and payment behaviors as edges to generate a transaction relationship graph; to embed features into the nodes in the transaction relationship graph; to model the correlation strength between nodes using a graph attention network, to identify abnormal transaction correlation patterns, and to calculate the transaction suspicion score based on node embedding features and correlation strength.

[0040] The third unit is used to compare the transaction suspicion score with a preset suspicion threshold. When the score exceeds the preset suspicion threshold, the transaction verification process is triggered.

[0041] The fourth unit is used to treat transaction features as environmental states, construct a hierarchical verification action space based on a knowledge graph, build a set of relational edges by calculating similarity and dependency values ​​between verification method nodes, achieve adaptive classification of security levels based on the dynamic security scores of verification method nodes, calculate the comprehensive utility value of verification combinations by node unit cost and association conflict cost, construct an adaptive verification strategy generator based on reinforcement learning, execute the verification combinations output by the adaptive verification strategy generator, and obtain verification results.

[0042] The fifth unit is used to allow transactions when verification is successful, and to reject transactions and send risk warnings to users when verification fails.

[0043] A third aspect of the embodiments of the present invention,

[0044] An electronic device is provided, comprising:

[0045] processor;

[0046] Memory used to store processor-executable instructions;

[0047] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0048] Fourth aspect of the present invention,

[0049] A computer-readable storage medium is provided, having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0050] The beneficial effects of this application are as follows:

[0051] This invention constructs a transaction relationship graph and utilizes graph attention networks for feature embedding and association strength modeling, which can effectively identify abnormal transaction patterns, improve the accuracy of fraud identification, reduce the false judgment rate, and provide more precise technical protection for financial security.

[0052] This invention constructs a hierarchical verification action space based on knowledge graphs. By calculating node similarity and dependencies, it achieves adaptive partitioning of verification methods, making risk control measures more flexible and efficient. It can intelligently select the most suitable verification combination according to different risk levels, thus optimizing the user experience.

[0053] This invention employs reinforcement learning to construct an adaptive verification strategy generator. By calculating the comprehensive utility value of verification combinations, it reduces verification costs while ensuring security, improves system processing efficiency, and achieves an optimal balance between fraud risk and user experience, providing financial institutions with a more efficient risk management solution. Attached Figure Description

[0054] Figure 1 This is a flowchart illustrating the real-time identification and handling method for payment fraud based on machine learning, as described in an embodiment of the present invention.

[0055] Figure 2 A diagram illustrating the performance comparison of different technical solutions;

[0056] Figure 3 A diagram illustrating the comparison of utility values ​​of verification combinations under different budget constraints. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0058] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0059] Figure 1 This is a flowchart illustrating the real-time identification and handling method for payment fraud based on machine learning, as described in an embodiment of the present invention. Figure 1 As shown, the method includes:

[0060] Obtain the user identifier, and based on the user identifier, extract the user's historical payment device records and historical payee information from the user's historical behavior database;

[0061] User identifiers, payment devices, and payees are constructed as nodes, and payment behaviors are constructed as edges to generate a transaction relationship graph; feature embedding is performed on the nodes in the transaction relationship graph; the association strength between nodes is modeled using a graph attention network to identify abnormal transaction association patterns, and transaction suspicion scores are calculated based on node embedding features and association strength.

[0062] The transaction suspicion score is compared with a preset suspicion threshold. When the score exceeds the preset suspicion threshold, the transaction verification process is triggered.

[0063] By treating transaction features as environmental states, a hierarchical verification action space is constructed based on a knowledge graph. A set of relational edges is built by calculating the similarity and dependency values ​​between verification method nodes. An adaptive classification of security levels is achieved based on the dynamic security scores of verification method nodes. The comprehensive utility value of the verification combination is calculated by the unit cost of nodes and the cost of association conflicts. An adaptive verification strategy generator based on reinforcement learning is constructed, and the verification combination output by the adaptive verification strategy generator is executed to obtain the verification result.

[0064] The transaction is allowed when the verification is successful, and the transaction is rejected and a risk warning is sent to the user when the verification fails.

[0065] In one optional implementation, user identifiers, payment devices, and payees are constructed as nodes, and payment actions are constructed as edges, generating a transaction relationship graph including:

[0066] User identification information is constructed as the first type of node, payment device information is constructed as the second type of node, and payee information is constructed as the third type of node;

[0067] Using transaction time, transaction amount, and transaction type as payment behavior information, directed edges are constructed between the first type of node or the second type of node and the third type of node based on the payment behavior information. The starting point of the directed edge is the node that initiates the payment, and the ending point of the directed edge is the node that receives the payment. The corresponding payment behavior information is marked on the directed edge.

[0068] A node adjacency matrix is ​​constructed to represent the connection relationships between the first type of nodes, the second type of nodes, and the third type of nodes. The rows and columns of the node adjacency matrix correspond to different types of nodes, and the matrix elements indicate whether there are directed edges connecting the nodes. An edge attribute matrix is ​​constructed to store payment behavior information on the directed edges. The edge attribute matrix has the same dimension as the node adjacency matrix, and the matrix elements record the transaction time, transaction amount, and transaction type of the corresponding directed edge. A topological structure of the transaction relationship graph is generated based on the node adjacency matrix and the edge attribute matrix.

[0069] This invention provides a method for constructing a transaction relationship graph. By constructing user identifiers, payment devices, and payees as nodes and payment behaviors as edges, a transaction relationship graph is generated to facilitate transaction data analysis and risk monitoring.

[0070] In this embodiment, the transaction data is first preprocessed to extract user identification information, payment device information, and payee information. User identification information may include user ID, user name, ID card number, etc.; payment device information may include device ID, device type, device MAC address, etc.; payee information may include merchant ID, merchant name, merchant category, etc.

[0071] When constructing the transaction relationship graph, user identification information is constructed as the first type of node, with one node corresponding to each user. Node attributes include user ID, user name, and other information. For example, the node attributes for user Zhang are {User ID: "U001", User Name: "Zhang"}. Payment device information is constructed as the second type of node, with one node corresponding to each payment device. Node attributes include device ID, device type, and other information. For example, the node attributes for Zhang's mobile device are {D001, Device Type: "Smartphone", MAC Address: "00:11:22:33:44:55"}. Recipient information is constructed as the third type of node, with one node corresponding to each recipient. Node attributes include merchant ID, merchant name, and other information. For example, the node attributes for a supermarket are {Merchant ID: "M001", Merchant Name: "Supermarket", Merchant Category: "Retail"}.

[0072] For each transaction, the transaction time, transaction amount, and transaction type are extracted as payment behavior information. A directed edge is constructed between the first-type node or the second-type node and the third-type node. The starting point of the directed edge is the node that initiated the payment, and the ending point is the node that received the payment. The corresponding payment behavior information is labeled on the directed edge. For example, if Mr. Zhang used his mobile phone to pay 100 yuan for daily necessities at a supermarket at 10:30 on July 10, 2023, a directed edge can be constructed between the user node "U001" or device node "D001" and the merchant node "M001". The edge attributes are {Transaction Time: "2023-07-10 10:30:00", Transaction Amount: "100", Transaction Type: "Purchase of Daily Necessities"}.

[0073] To efficiently store and process the transaction relationship graph, a node adjacency matrix is ​​constructed to represent the connections between nodes of different types (first, second, and third). The rows and columns of the node adjacency matrix correspond to different node types, and the matrix elements indicate whether there are directed edges connecting the nodes. Assuming there are 3 user nodes (U001, U002, U003), 2 device nodes (D001, D002), and 4 merchant nodes (M001, M002, M003, M004), a 9×9 node adjacency matrix can be constructed. In this matrix, if a transaction relationship exists between user U001 and merchant M001, the corresponding element has a value of 1; otherwise, it has a value of 0.

[0074] Simultaneously, an edge attribute matrix is ​​constructed to store payment behavior information on directed edges. The edge attribute matrix has the same dimension as the node adjacency matrix, and the matrix elements record the transaction time, transaction amount, and transaction type for the corresponding directed edge. In the above 9×9 matrix, if there is a transaction between user U001 and merchant M001, the element value at the corresponding position in the matrix is ​​the attribute information of that transaction, for example, {Transaction Time: "2023-07-10 10:30:00", Transaction Amount: "100", Transaction Type: "Daily Necessities Purchase"}.

[0075] When multiple transactions exist between the same pair of nodes, a transaction list can be stored in the corresponding element of the edge attribute matrix. Each transaction record contains the transaction time, transaction amount, and transaction type. For example, if user U001 makes multiple purchases at supermarket M001 at different times, the corresponding edge attribute would be a list of transaction records: [{Transaction Time: "2023-07-10 10:30:00", Transaction Amount: "100", Transaction Type: "Daily Necessities Purchase"}, {Transaction Time: "2023-07-15 16:45:00", Transaction Amount: "150", Transaction Type: "Food Purchase"}].

[0076] Based on the node adjacency matrix and edge attribute matrix, the topology of the transaction relationship graph can be generated. By traversing the node adjacency matrix, the connection relationships between nodes are determined; by using the edge attribute matrix, the transaction information on each edge is obtained. For example, the node adjacency matrix indicates that there is a transaction relationship between user U001 and merchants M001 and M002, while the edge attribute matrix provides detailed information about these transactions, including transaction time, amount, and type.

[0077] To enhance the expressive power of transaction relationship graphs, nodes and edges can be visualized. For example, different types of nodes can be represented by different shapes or colors: user nodes are represented by blue circles, device nodes by green squares, and merchant nodes by red triangles. The thickness of the edges can represent the transaction amount, and the color of the edges can represent different transaction types. Through this visualization method, the structure and characteristics of the transaction network can be intuitively displayed.

[0078] By constructing transaction relationship graphs, we can uncover user consumption patterns, device usage habits, and relationships between merchants. For example, if multiple users frequently use the same device to make payments to the same merchant within the same time period, it indicates a connection between these users or that the device is shared by multiple people. This information is of significant value for risk control, marketing promotion, and user profiling.

[0079] In one optional implementation, a graph attention network is used to model the association strength between nodes, identify abnormal transaction association patterns, and calculate the transaction suspicion score based on node embedding features and association strength, including:

[0080] An initial feature vector is configured for each node in the transaction relationship graph. The initial feature vector is input into a feature transformation matrix to obtain transformed features. The transformed features corresponding to adjacent nodes are concatenated and input into an attention vector to generate attention coefficients between node pairs. The attention coefficients are normalized to obtain attention weights. The node features are aggregated and updated based on the attention weights to obtain the attention features of the nodes.

[0081] The attention feature sequence of user's historical transactions is extracted. The user-device association strength is obtained by multiplying the attention coefficient between user-device nodes by the negative exponential decay value of the transaction time interval and summing the results. The user-payee association strength is obtained by weighted summing the attention coefficient between user-payee nodes by the log normalized value of the transaction amount. The device-payee association strength is obtained by multiplying the cosine similarity of the attention features between device-payee nodes by the attention coefficient. The three association strengths are concatenated and input into a fully connected layer to obtain a multidimensional fusion feature vector.

[0082] The difference between the correlation strength of the current transaction and the average correlation strength of the user's historical transactions is calculated. The difference is divided by the standard deviation to obtain the temporal anomaly score. The information entropy of the probability distribution of the three correlation strengths is calculated to obtain the structural anomaly score. The temporal anomaly score, structural anomaly score and multidimensional fusion feature vector are concatenated and input into a three-layer fully connected network. The transaction suspicion score is obtained by mapping through the Sigmoid function.

[0083] This embodiment provides an abnormal transaction identification method based on graph attention network. By modeling the correlation strength between nodes in the transaction relationship graph, it identifies abnormal transaction association patterns and calculates transaction suspicion scores.

[0084] In practical applications, a transaction relationship graph is first constructed, which includes user nodes, device nodes, and payee nodes. An initial feature vector is configured for each node in the transaction relationship graph. The initial features of user nodes may include user age, registration duration, and transaction frequency; the initial features of device nodes may include device type, operating system version, and number of installed applications; and the initial features of payee nodes may include merchant category, registered capital, and operating duration. Taking a user node as an example, its initial feature vector can be represented as a 64-dimensional vector, where the first 10 dimensions represent basic user attributes, and the last 54 dimensions represent user behavioral characteristics.

[0085] The initial feature vectors are input into a feature transformation matrix for linear transformation to obtain the transformed features. The feature transformation matrix has a dimension of 64×32, which maps the initial features from 64-dimensional to 32-dimensional space. For adjacent node pairs, their transformed features are concatenated to form a 64-dimensional vector, which is then input into the attention vector to generate attention coefficients between node pairs. The attention vector has a dimension of 64, and by calculating the inner product of the concatenated features and the attention vector, a scalar value representing the importance of the association between the two nodes can be obtained.

[0086] Attention coefficients are normalized by using a softmax function to convert the attention coefficients from the same source node to each target node into attention weights that sum to 1. Then, node features are weighted and aggregated based on these attention weights, and processed by a non-linear activation function (such as ReLU) to obtain the node's attention features. Through iteration of a multi-layer graph attention network, a node embedding representation incorporating local structural information is finally obtained.

[0087] In the transaction relationship graph, the attention feature sequence formed by the user's historical transactions is extracted. For user A's 10 historical transactions, a 32-dimensional attention feature vector is generated for each transaction, forming a 10×32 feature matrix. When calculating the association strength between user and device nodes, the attention coefficient between user and device nodes is multiplied by the negative exponential decay value of the transaction time interval and then summed. For example, the attention coefficients of the three most recent transactions between user A and device D1 are 0.8, 0.75, and 0.7, respectively, with corresponding transaction time intervals of 1 day, 5 days, and 10 days. The time decay values ​​are 0.905, 0.607, and 0.368, respectively, and the calculated association strength is 0.8×0.905+0.75×0.607+0.7×0.368=1.272.

[0088] When calculating the association strength between user-payer nodes, the attention coefficient between user-payer nodes is weighted and summed with the log-normalized value of the transaction amount. Assuming the attention coefficients of the three most recent transactions between user A and merchant M1 are 0.6, 0.65, and 0.55, respectively, with corresponding transaction amounts of 100 yuan, 200 yuan, and 500 yuan, and log-normalized values ​​of 0.2, 0.3, and 0.5, then the association strength is 0.6 × 0.2 + 0.65 × 0.3 + 0.55 × 0.5 = 0.5175.

[0089] When calculating the association strength between device and payee nodes, the cosine similarity of the attention features between the device and payee nodes is multiplied by the attention coefficient. For example, if the cosine similarity of the attention features between device D1 and merchant M1 is 0.85 and the attention coefficient is 0.7, then the association strength is 0.85 × 0.7 = 0.595.

[0090] The three correlation strengths are concatenated into a vector [1.272, 0.5175, 0.595], which is then input into a fully connected layer with an input dimension of 3 and an output dimension of 8, resulting in a multidimensional fused feature vector.

[0091] The time-series anomaly score is obtained by calculating the difference between the correlation strength of the current transaction and the mean correlation strength of the user's historical transactions, and then dividing the difference by the standard deviation. For example, if the mean user-device correlation strength of user A's historical transactions is 1.25 and the standard deviation is 0.15, and the correlation strength of the current transaction is 0.9, then the time-series anomaly score is (0.9-1.25) / 0.15=-2.33, indicating that the current transaction deviates significantly from the user's historical device usage patterns.

[0092] The structural anomaly score is obtained by calculating the information entropy of the probability distributions of the three association strengths. For user A's transaction network, if the entropy value of the user-device association strength is 0.8, the entropy value of the user-payee association strength is 0.65, and the entropy value of the device-payee association strength is 0.75, then the structural anomaly score is (0.8+0.65+0.75) / 3=0.73. A higher entropy value indicates a complex transaction relationship structure and the presence of anomalies.

[0093] The temporal anomaly score, structural anomaly score, and multi-dimensional fusion feature vector are concatenated to form a 10-dimensional vector, which is then input into a three-layer fully connected network. The first layer has an input dimension of 10 and an output dimension of 16; the second layer has an input dimension of 16 and an output dimension of 8; and the third layer has an input dimension of 8 and an output dimension of 1. Finally, the output is mapped to a value between 0 and 1 using the Sigmoid function to obtain a score representing the degree of suspiciousness of the transaction. If this score exceeds a preset threshold of 0.7, the transaction is judged as suspicious, triggering further risk review procedures.

[0094] Figure 2 A diagram illustrating the performance comparison of different technical solutions:

[0095] As shown in the figure, in terms of accuracy, this invention achieves a high-precision recognition capability of 95.3%, significantly outperforming the 85.7% of the traditional fixed-configuration method and the 75.4% of the simple greedy algorithm, demonstrating the algorithm's superior performance in recognizing complex patterns. In the detection speed test, this invention also performs excellently, achieving a high efficiency of 86.2%, leading the traditional fixed-configuration method (68.5%) and the simple greedy algorithm (62.7%), proving that the optimized computing framework effectively reduces processing latency. The most significant advantage lies in resource utilization; this invention requires only 35.6% of system resources, far lower than the 67.3% of the traditional fixed-configuration method and the 72.8% of the simple greedy algorithm. In real-world deployment environments, it can handle larger-scale data loads while reducing hardware costs.

[0096] In one optional implementation, transaction features are used as the environmental state. A hierarchical verification action space is constructed based on a knowledge graph. A set of relational edges is constructed by calculating the similarity and dependency values ​​between verification method nodes. The security level is adaptively divided based on the dynamic security scores of the verification method nodes. The comprehensive utility value of the verification combination is calculated through the unit cost of nodes and the cost of association conflicts, including:

[0097] Construct a knowledge graph of verification methods, wherein the knowledge graph of verification methods includes a set of verification method nodes and a set of relation edges;

[0098] Based on the feature vectors of the verification method nodes, a similarity measure between nodes is obtained by weighting the cosine similarity of the feature vectors with the overlap of the applicable scenario set. At the same time, a dependency value is calculated based on the number of co-occurrences of the verification method nodes based on historical verification data. The similarity measure and the dependency value are used as the weights of the relation edge set.

[0099] Based on the basic security score of the verification method node and the weight information of the relation edge set, combined with the historical performance score and adaptability score of the verification method in different scenarios, the dynamic security score of the verification method node is calculated, and the verification method node is dynamically divided into different security levels based on the dynamic security score.

[0100] A cost budget constraint model is established for verification method nodes with different security levels. The unit cost is calculated based on the resource consumption cost of the verification method nodes. At the same time, the conflict cost is calculated through the conflict information between nodes obtained by the relation edge set. The unit cost and conflict cost are integrated and the combined utility value is obtained under the condition of satisfying the budget constraint.

[0101] In this embodiment, an adaptive verification strategy for transaction security is implemented by constructing a hierarchical verification action space based on a knowledge graph. This method treats transaction features as environmental states, constructs a set of relational edges by calculating similarity metrics and dependency values ​​between verification method nodes, and adaptively classifies security levels based on the dynamic security scores of the verification method nodes. Finally, it calculates the comprehensive utility value of the verification combination through node unit cost and association conflict cost.

[0102] When constructing a knowledge graph of verification methods, it is necessary to define a set of verification method nodes and a set of relation edges. The set of verification method nodes includes various verification methods, such as ID card OCR verification, facial recognition, bank card four-factor authentication, and mobile phone number three-factor authentication. Each verification method node includes attributes such as node ID, name, type, set of applicable scenarios, basic security score, and resource consumption cost. For example, the attributes of a facial recognition node include: node ID is "KYC002", name is "facial recognition", type is "identity verification", set of applicable scenarios is ["account opening verification", "large amount transfer", "sensitive operation confirmation"], basic security score is 85 points, and resource consumption cost is 0.5 yuan per instance.

[0103] To calculate the similarity metric between verification method nodes, the feature vector of each node is first extracted. The feature vector consists of multi-dimensional features such as the technology type, verification dimension, and implementation method of the verification method. Taking ID card OCR verification and face recognition as examples, their feature vectors are extracted respectively. The ID card OCR verification feature vector can be represented as identity verification type, image recognition technology, and static feature extraction; the face recognition feature vector can be represented as identity verification type, biometric technology, and dynamic feature extraction. By calculating the cosine similarity of these two feature vectors, the technology similarity is found to be 0.6. Simultaneously, the overlap of their applicable scenario sets is calculated; for example, both are applicable to the "account opening verification" scenario, resulting in a scenario overlap of 0.4. The technology similarity and scenario overlap are weighted and averaged at a 6:4 ratio, ultimately yielding a node similarity metric of 0.52.

[0104] The dependency value is calculated based on the co-occurrence frequency of verification method nodes in historical verification data. For example, in 10,000 recorded transaction verifications, ID card OCR verification and facial recognition co-occurred 7,000 times, resulting in a co-occurrence frequency of 0.7. Further analysis reveals that among these 7,000 co-occurrences, ID card OCR verification was performed first, followed by facial recognition, accounting for 90% of the total co-occurrences. Therefore, the dependency value from ID card OCR verification to facial recognition is 0.63 (i.e., 0.7 × 0.9). Using the similarity metric and dependency value as weights for the set of relationship edges, a complete knowledge graph of verification methods is constructed.

[0105] The dynamic security score is calculated by comprehensively considering the basic security score of the verification method node, the weight information of the relational edge set, the historical performance score, and the adaptability score. The historical performance score is calculated based on indicators such as the accuracy, coverage, and fraud interception rate of the verification method over a past period. Taking facial recognition as an example, assuming that its accuracy recognition rate is 98% and its fraud interception rate is 95% in the last 10,000 uses, its historical performance score is calculated to be 96.5. The adaptability score measures the degree to which the verification method is adapted to the current transaction scenario. For example, for high-frequency, small-amount transfer scenarios where it is not the first login, the adaptability score of facial recognition is 75. Combining the basic security score of 85 for facial recognition and the relational edge weight information of other related verification methods, the dynamic security score of the facial recognition node is calculated to be 82.3.

[0106] Based on dynamic security scoring, verification method nodes are divided into different security levels. Assume the security level classification thresholds are: 90 points and above is Level A (high security), 80-90 points is Level B (medium-high security), 70-80 points is Level C (medium security), 60-70 points is Level D (basic security), and below 60 points is Level E (low security). Based on the dynamic security score of 82.3 for the facial recognition system, it is classified as Level B.

[0107] A cost budget constraint model is established for verification method nodes with different security levels. First, the unit cost of each verification method node is calculated, including technical resource consumption, time cost, and user experience impact. Taking facial recognition as an example, its resource consumption cost is 0.5 yuan per instance, the average time is 5 seconds, and the user experience impact score is medium (equivalent to a value of 0.3). The overall calculated unit cost is 0.65 yuan.

[0108] The conflict cost is calculated based on the conflict information between nodes obtained from the relation edge set. For example, if both facial recognition and voiceprint recognition biometric verification methods are selected simultaneously, it increases the user's operational burden and degrades the user experience. Based on the conflict level of 0.4 between these two nodes recorded in the relation edge set, the conflict cost of using these two verification methods in combination is calculated to be 0.26.

[0109] When integrating unit costs and conflict costs, budget constraints must be met. Assume the current transaction risk score is 75, and the budgeted verification cost for this risk level is 1.5 yuan. For a feasible verification combination scheme: ID card OCR verification (unit cost 0.3) + facial recognition (unit cost 0.65) + SMS verification code (unit cost 0.2), the total unit cost is 1.15 yuan, satisfying the budget constraint. Considering the total conflict cost among these three verification methods is 0.15, the final comprehensive utility value of this verification combination is 1.3 (i.e., 1.15 + 0.15), which is lower than the budget limit of 1.5 yuan. Therefore, this verification combination scheme can be adopted.

[0110] Through the detailed implementation steps above, the action space of hierarchical verification methods based on knowledge graphs was constructed, and the optimal verification combination can be adaptively selected according to transaction characteristics, which not only ensures transaction security but also controls verification costs.

[0111] In one optional implementation, a cost budget constraint model is established for verification method nodes of different security levels. The unit cost is calculated based on the resource consumption cost of the verification method nodes. Simultaneously, the conflict cost is calculated using the inter-node conflict information obtained from the relational edge set. The unit cost and conflict cost are integrated, and a combined utility value is obtained under the condition of satisfying budget constraints, including:

[0112] The computational resource consumption, memory resource consumption, and time consumption of the verification method node are assigned corresponding weights and the weighted sum is calculated to obtain the unit resource cost. The security level cost coefficient is calculated according to the security level to which the verification method node belongs. The unit resource cost is multiplied by the security level cost coefficient to obtain the node base cost of each verification method node.

[0113] The computational resources, memory resources, and time resources used by the verification method nodes are statistically analyzed. The proportion of shared resources to the total resources of the nodes is calculated to obtain the resource overlap. The resource overlap is multiplied by a preset conflict weight to obtain the conflict intensity between the nodes. The conflict intensity is calculated for each selected verification method node and the cumulative conflict cost is obtained.

[0114] Set a global budget cap and tiered budget caps for each security level as budget constraints, and determine whether the sum of the basic costs of the nodes and the sum of the cumulative conflict costs satisfy the budget constraints.

[0115] For verification method nodes that meet the budget constraints, calculate their security score, performance score, and user experience score respectively. Assign corresponding weights to the security score, performance score, and user experience score respectively and calculate the weighted sum to obtain the node utility value. Subtract the accumulated conflict cost from the node utility value to obtain the combined utility value of the verification combination.

[0116] In a multi-security-level verification method combination optimization system, the method for establishing a cost budget constraint model for verification method nodes of different security levels and calculating the combination utility value based on this model can be described in detail as follows:

[0117] First, we receive verification graph data containing multiple verification method nodes and their relational edges. Each verification method node has attribute parameters such as computational resource consumption, memory resource consumption, and time consumption. For each verification method node, we calculate the unit cost based on its resource consumption and calculate the conflict cost by obtaining conflict information through the relational edges between nodes. Under the condition of satisfying budget constraints, we find the optimal combination.

[0118] For calculating the unit resource cost of verification method nodes, the weights for computational resource consumption and memory resource consumption are set at 0.4, 0.3, and 0.3 respectively. Taking a facial recognition verification method as an example, its computational resource consumption is 500 CPU units, memory resource consumption is 200MB, and time consumption is 300ms. The calculated weighted unit resource cost is: 500×0.4 + 200×0.3 + 300×0.3 = 350 units. Based on the security level of the verification method, its security level cost coefficient is determined. If the verification method belongs to the high security level, the security level cost coefficient is set to 1.5; for the medium security level, it is set to 1.2; and for the low security level, it is set to 1.0. Assuming that the facial recognition belongs to the medium security level, its basic node cost is: 350×1.2 = 420 units.

[0119] The conflict between verification method nodes is evaluated. Taking facial recognition and fingerprint recognition as examples, if both use an image processing unit and share 100 units of computing resources (total computing resources are 600 units), share 50MB of memory resources (total memory resources are 300MB), and share 80ms of time resources (total time resources are 500ms), the calculated overlap of computing resources is 100 / 600 = 0.167, memory resources is 50 / 300 = 0.167, and time resources is 80 / 500 = 0.16. Setting the conflict weights for computing resources, memory resources, and time resources to 0.5, and 0.3 and 0.2 respectively, the conflict strength between these two nodes is: 0.167 × 0.5 + 0.167 × 0.3 + 0.16 × 0.2 = 0.1655. If five verification nodes have been selected, then the conflict intensity between each pair of these five nodes needs to be calculated. Assume that the calculated cumulative conflict cost is 5.8 units.

[0120] The global budget cap is set at 2000 units, the high security level budget cap at 1000 units, the medium security level budget cap at 700 units, and the low security level budget cap at 300 units. Assume the sum of the basic node costs of the currently selected verification method nodes is 1500 units, the sum of the accumulated conflict costs is 200 units, and the total cost is 1700 units. The total cost is less than the global budget cap of 2000 units, and the costs for each security level are: 800 units for high security level, 600 units for medium security level, and 100 units for low security level, all of which do not exceed the corresponding level's budget cap. Therefore, the budget constraint condition is met.

[0121] For verification method combinations that meet budget constraints, their utility values ​​are further evaluated. Taking a fingerprint recognition verification method as an example, its security score is evaluated as 85 points (out of 100), its performance score as 75 points, and its user experience score as 70 points. Setting a security weight of 0.5, a performance weight of 0.3, and a user experience weight of 0.2, the calculated node utility value is: 85 × 0.5 + 75 × 0.3 + 70 × 0.2 = 79 points. Assuming the cumulative conflict cost between this fingerprint recognition method and other selected verification methods is 2.5 points, its combined utility value is: 79 - 2.5 = 76.5 points.

[0122] Calculate the combined utility value for all verification method combinations that meet the budget constraint, and select the combination with the highest combined utility value as the optimal verification combination. For example, combination A includes three verification methods: facial recognition, fingerprint recognition, and password verification, with a combined utility value of 210 points; combination B includes three verification methods: facial recognition, voiceprint recognition, and SMS verification, with a combined utility value of 195 points; combination C includes three verification methods: iris recognition, fingerprint recognition, and dynamic password verification, with a combined utility value of 225 points. After comparison, combination C is selected as the optimal verification combination.

[0123] By implementing the above technologies, it is possible to comprehensively consider the resource consumption, security, performance, and user experience of verification methods while meeting the budget constraints of different security levels, and also take into account the conflict effects between verification methods, to obtain the optimal combination of verification methods, thereby improving security and user experience.

[0124] Figure 3 A diagram illustrating the comparison of utility values ​​of verification portfolios under different budget constraints:

[0125] This graph visually illustrates the utility performance of three different combinations of verification methods under various budget constraints. The horizontal axis represents budget constraints from 500 to 2600 cost units, and the vertical axis represents the combined utility value (0-350). The graph uses different shapes to represent the three methods: a circle represents the current solution (cost budget constraint model), a square represents the fixed combination solution, and a triangle represents the greedy choice solution. The trend shows that all methods exhibit diminishing marginal utility as the budget increases. The current solution consistently maintains a significant lead, achieving a utility value of 305 at a budget of 1700 units, representing increases of 74.3% and 35.6% compared to the fixed combination solution's 175 and the greedy choice solution's 225, respectively. Notably, when the budget exceeds 2000 units, the utility value growth of the three methods tends to plateau, indicating that the combination of verification methods has reached saturation. The advantage of this solution stems from its innovative establishment of a cost budget constraint model for multi-security-level verification methods. This model comprehensively considers unit resource costs, security-level cost coefficients, conflict costs arising from resource overlap, and the security, performance, and user experience scores of each verification method. This holistic optimization approach maximizes the overall utility of the verification combination within a limited budget, providing a more efficient verification strategy selection solution for practical application scenarios.

[0126] In one optional implementation, an adaptive verification policy generator based on reinforcement learning is constructed, and the verification combination output by the adaptive verification policy generator is executed to obtain the verification result, including:

[0127] The transaction feature vector, user profile feature vector, and scene context feature vector are acquired and concatenated to form an environment state representation vector. The environment state representation vector is then linearly transformed through an encoding weight matrix and processed by an activation function to obtain a state code.

[0128] The verification method sets for multiple security levels are divided according to the state code. The selection state of each verification method is composed into an action vector. The overall selection quantity constraint and the selection quantity constraint within different security levels are set for the action vector to generate a set of candidate verification method combinations that meet the constraints.

[0129] The state code is simultaneously input into the Actor network and the Critic network. The Actor network extracts features from the state code using a multilayer perceptron structure to generate the selection probability distribution of each combination in the candidate verification method combination set. The Critic network adopts a two-layer neural network structure. The first layer performs dimensionality reduction mapping on the state code, and the second layer outputs the state value evaluation score to obtain the value score corresponding to the current state code.

[0130] The candidate verification method combination set is sorted according to the selection probability distribution, and the verification method combination with the highest value score is selected as the optimal verification strategy output to obtain the verification result.

[0131] This embodiment provides an adaptive verification strategy generation method based on reinforcement learning. This method constructs an adaptive verification strategy generator to dynamically generate the optimal verification strategy according to different states of the transaction environment, thereby improving transaction security while optimizing user experience.

[0132] In practical applications, the first step is to obtain the current transaction environment status information, including transaction feature vectors, user profile feature vectors, and scenario context feature vectors. The transaction feature vectors contain information such as transaction amount, transaction time, and transaction type; the user profile feature vectors contain information such as user historical behavior, credit score, and transaction frequency; and the scenario context feature vectors contain information such as device information, IP address, and geographical location. For example, for a cross-regional transfer transaction of 5,000 yuan, the following features are obtained: transaction feature vector [5000,1,3] (representing amount, type code, and time period code), user profile feature vector [85,120,4] (representing credit score, monthly transaction frequency, and user level), and scenario context feature vector [2,0,1] (representing device type, IP risk level, and abnormal geographical location marker).

[0133] The three types of feature vectors are concatenated to form an environment state representation vector, for example, [5000, 1, 3, 85, 120, 4, 2, 0, 1]. This vector undergoes a linear transformation using a preset encoding weight matrix. If the environment state representation vector has a dimension of 9, and the encoded state has a dimension of 64, then the encoding weight matrix has a dimension of 9×64. The result of the linear transformation is then processed by the ReLU activation function to obtain the state encoding. For example, the initial environment state representation vector, after processing with the encoding weight matrix and activation function, yields a 64-dimensional state encoding vector.

[0134] Based on the state coding vector, a set of verification methods is divided into multiple security levels. In this embodiment, the verification methods are divided into three security levels: low-level security verification (such as SMS verification code, fingerprint recognition), medium-level security verification (such as face recognition, security questions), and high-level security verification (such as video liveness detection, contact confirmation). Each security level contains multiple verification methods; for example, low-level security verification contains 3 methods, medium-level security verification contains 4 methods, and high-level security verification contains 3 methods, for a total of 10 verification methods. The selection state of each verification method (0 indicates no selection, 1 indicates selection) is used to form an action vector. For example, [0,1,0,1,0,0,0,0,1,0] indicates that the 2nd, 4th, and 9th verification methods have been selected.

[0135] The action vector is subject to overall selection quantity constraints and selection quantity constraints within different security levels. For example, the overall selection quantity constraint is 2 to 4 verification methods, with at least 1 low-level security verification selected, a maximum of 2 medium-level security verifications selected, and a maximum of 1 high-level security verification selected. Based on these constraints, a set of candidate verification method combinations that meet the conditions is generated. For the above 10 verification methods and constraints, the generated candidate combinations include: [1,0,0,1,0,0,0,0,0,0], [1,0,0,0,1,0,0,0,1,0], [0,1,0,1,0,1,0,0,0,0], etc.

[0136] The state code is simultaneously input into both the Actor network and the Critic network. The Actor network employs a multilayer perceptron structure, comprising an input layer, two hidden layers, and an output layer. The input layer receives a 64-dimensional state code; the first hidden layer contains 128 neurons using the ReLU activation function; the second hidden layer contains 64 neurons using the ReLU activation function; the output layer's dimension equals the number of candidate verification method combinations, and uses the Softmax activation function to generate the selection probability distribution for each combination. For example, if there are 20 candidate combinations, the output layer is a 20-dimensional vector representing the probability of selecting each combination.

[0137] The Critic network employs a two-layer neural network structure. The first layer performs a dimensionality reduction mapping on the 64-dimensional state encoding, containing 32 neurons and using the ReLU activation function. The second layer is a single-neuron output layer that directly outputs the state value assessment score, representing the value score of the current state. For example, for a given state encoding, the Critic network outputs a value score of 7.5.

[0138] Based on the selection probability distribution output by the Actor network, the combinations of candidate verification methods are ranked. For example, if the selection probability of combination A is 0.3, the selection probability of combination B is 0.25, and the selection probability of combination C is 0.2, then the ranking result is A>B>C. The verification method combination with the highest selection probability is selected as the optimal verification strategy output. In actual deployment, an exploration strategy is combined, randomly selecting combinations with a certain probability to enhance exploration capabilities.

[0139] The selected optimal verification strategy is executed, presenting the user with a combination of verification methods, such as "Please complete SMS verification code verification and facial recognition." After the user completes the verification, the verification result is obtained, including whether the verification passed or failed, the user's response time, and the operation trajectory. These results will serve as reward signals for reinforcement learning, used to update the Actor network and Critic network, continuously optimizing the verification strategy generation capability.

[0140] The above methods can dynamically generate optimal verification strategies based on the risk characteristics of different transaction scenarios, ensuring transaction security while minimizing the user's operational burden and improving the overall user experience.

[0141] This invention relates to a machine learning-based real-time payment fraud identification and handling system, the system comprising:

[0142] The first unit is used to obtain a user identifier and, based on the user identifier, extract the user's historical payment device records and historical payee information from the user's historical behavior database.

[0143] The second unit is used to construct user identifiers, payment devices, and payees as nodes, and payment behaviors as edges to generate a transaction relationship graph; to embed features into the nodes in the transaction relationship graph; to model the correlation strength between nodes using a graph attention network, to identify abnormal transaction correlation patterns, and to calculate the transaction suspicion score based on node embedding features and correlation strength.

[0144] The third unit is used to compare the transaction suspicion score with a preset suspicion threshold. When the score exceeds the preset suspicion threshold, the transaction verification process is triggered.

[0145] The fourth unit is used to treat transaction features as environmental states, construct a hierarchical verification action space based on a knowledge graph, build a set of relational edges by calculating similarity and dependency values ​​between verification method nodes, achieve adaptive classification of security levels based on the dynamic security scores of verification method nodes, calculate the comprehensive utility value of verification combinations by node unit cost and association conflict cost, construct an adaptive verification strategy generator based on reinforcement learning, execute the verification combinations output by the adaptive verification strategy generator, and obtain verification results.

[0146] The fifth unit is used to allow transactions when verification is successful, and to reject transactions and send risk warnings to users when verification fails.

[0147] A third aspect of the present invention provides an electronic device, comprising:

[0148] processor;

[0149] Memory used to store processor-executable instructions;

[0150] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0151] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0152] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0153] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for real-time identification and handling of payment fraud based on machine learning, characterized in that, The method comprises the following steps: obtaining a user identifier, extracting historical payment device records and historical payee information of the user from a user historical behavior database based on the user identifier; constructing the user identifier, payment device and payee as nodes, constructing payment behavior as edges, generating a transaction relationship graph, performing feature embedding on the nodes in the transaction relationship graph, modeling the association strength between nodes using a graph attention network, identifying abnormal transaction association patterns, calculating a transaction suspiciousness score based on node embedding features and association strength, including: configuring an initial feature vector for the nodes in the transaction relationship graph, inputting the initial feature vector into a feature transformation matrix to obtain transformed features, concatenating the transformed features corresponding to adjacent nodes and inputting them into an attention vector to generate attention coefficients between node pairs, normalizing the attention coefficients to obtain attention weights, aggregating and updating the node features based on the attention weights to obtain attention features of the nodes; extracting the attention feature sequence of the user's historical transactions, multiplying the attention coefficients between the user-device nodes by the negative exponential decay value of the transaction time interval to obtain the user-device association strength; weighting and summing the attention coefficients between the user-payee nodes and the logarithmic normalized value of the transaction amount to obtain the user-payee association strength; multiplying the cosine similarity of the attention features between the device-payee nodes by the attention coefficients to obtain the device-payee association strength; concatenating the three kinds of association strengths and inputting them into a fully connected layer to obtain a multi-dimensional fusion feature vector; calculating the difference between the association strength of the current transaction and the average association strength of the user's historical transactions, and dividing the difference by the standard deviation to obtain a time series anomaly score; calculating the probability distribution information entropy of the three kinds of association strengths to obtain a structural anomaly score; concatenating the time series anomaly score, the structural anomaly score and the multi-dimensional fusion feature vector and inputting them into a three-layer fully connected network to obtain a transaction suspiciousness score through a Sigmoid function mapping; comparing the transaction suspiciousness score with a preset suspiciousness threshold, and triggering a transaction verification process when the transaction suspiciousness score exceeds the preset suspiciousness threshold; taking transaction features as environmental states, constructing a hierarchical verification means action space based on a knowledge graph, constructing a relationship edge set by calculating similarity measurement values and dependency relationship values between verification means nodes, realizing adaptive division of security levels according to dynamic security scores of the verification means nodes, and calculating comprehensive utility values of verification combinations by node unit cost and associated conflict cost; constructing a reinforcement learning-based adaptive verification strategy generator, executing a verification combination output by the adaptive verification strategy generator, and obtaining a verification result; when the verification is passed, releasing the transaction, and when the verification is not passed, rejecting the transaction and pushing a risk reminder to the user.

2. The method of claim 1, wherein, The method comprises the following steps: constructing user identifier information as a first type of node, constructing payment device information as a second type of node, and constructing payee information as a third type of node; The transaction time, the transaction amount and the transaction type are used as the payment behavior information, and a directed edge is constructed between the first type of node or the second type of node and the third type of node according to the payment behavior information, wherein the starting point of the directed edge is a node initiating payment, the ending point of the directed edge is a node receiving payment, and the corresponding payment behavior information is marked on the directed edge; A node adjacency matrix is constructed to represent the connection relationship between the first type of node, the second type of node and the third type of node, the rows and columns of the node adjacency matrix correspond to different types of nodes respectively, and the matrix elements represent whether there is a directed edge connection between nodes; an edge attribute matrix is constructed to store the payment behavior information on the directed edge, the edge attribute matrix has the same dimension as the node adjacency matrix, and the matrix elements record the transaction time, the transaction amount and the transaction type of the corresponding directed edge; and a topology structure of a transaction relationship graph is generated based on the node adjacency matrix and the edge attribute matrix.

3. The method of claim 1, wherein, The transaction features are taken as the environment state, a hierarchical verification means action space is constructed based on a knowledge graph, a relationship edge set is constructed by calculating the similarity measurement value and the dependency relationship value between the verification means nodes, the adaptive division of the security level is realized according to the dynamic security score of the verification means node, and the comprehensive utility value of the verification combination is calculated by the node unit cost and the associated conflict cost, including: A verification means knowledge graph is constructed, and the verification means knowledge graph includes a verification means node set and a relationship edge set; Based on the feature vector of the verification means node, the similarity measurement value between the nodes is obtained by weighting the cosine similarity of the feature vector and the overlap degree of the applicable scene set, and the dependency relationship value is calculated based on the co-occurrence number of the verification means node in the historical verification data, and the similarity measurement value and the dependency relationship value are taken as the weight of the relationship edge set; The dynamic security score of the verification means node is calculated according to the basic security score of the verification means node and the weight information of the relationship edge set, combined with the historical performance score and the adaptability score of the verification means in different scenes, and the verification means node is dynamically divided into different security levels based on the dynamic security score; A cost budget constraint model is established for the verification means nodes of different security levels, the unit cost is calculated based on the resource consumption cost of the verification means node, the conflict cost is calculated through the conflict information between the nodes obtained by the relationship edge set, and the combination utility value is obtained by integrating the unit cost and the conflict cost under the condition of meeting the budget constraint.

4. The method of claim 3, wherein, A cost budget constraint model is established for the verification means nodes of different security levels, the unit cost is calculated based on the resource consumption cost of the verification means node, the conflict cost is calculated through the conflict information between the nodes obtained by the relationship edge set, and the combination utility value is obtained by integrating the unit cost and the conflict cost under the condition of meeting the budget constraint. A corresponding weight is given to the computing resource consumption, memory resource consumption and time consumption of the verification means node, and a weighted sum is calculated to obtain a unit resource cost. According to the security level to which the verification means node belongs, a security level cost coefficient is calculated, and the unit resource cost is multiplied by the security level cost coefficient to obtain the node basic cost of each verification means node; The computing resource, memory resource and time resource commonly used between the verification means nodes are counted, the proportion of the commonly used resource to the total amount of node resource is calculated to obtain the resource overlap degree, the resource overlap degree is multiplied by the preset conflict weight to obtain the conflict intensity between the nodes, and the conflict intensity of the selected verification means nodes is calculated and accumulated to obtain the cumulative conflict cost; The global budget upper limit and the hierarchical budget upper limit of each security level are set as the budget constraint condition, and it is judged whether the sum of the node basic costs and the sum of the cumulative conflict costs meet the budget constraint condition; The security score, performance score and user experience score of the verification means node meeting the budget constraint condition are calculated respectively, the security score, performance score and user experience score are given a corresponding weight and a weighted sum is calculated to obtain a node utility value, and the combination utility value of the verification combination is obtained based on the node utility value minus the cumulative conflict cost.

5. The method of claim 1, wherein, An adaptive verification strategy generator based on reinforcement learning is constructed, and the verification combination output by the adaptive verification strategy generator is executed to obtain a verification result, including: A transaction feature vector, a user portrait feature vector and a scene context feature vector are obtained and spliced to form an environment state representation vector, the environment state representation vector is linearly transformed through an encoding weight matrix and processed through an activation function to obtain a state code; According to the state code, a verification means set of multiple security levels is divided, and the selection state of each verification means is composed into an action vector. The action vector is set with a total selection quantity constraint and a selection quantity constraint in different security levels, and a candidate verification means combination set meeting the constraint condition is generated; The state code is input into an Actor network and a Critic network at the same time. The Actor network extracts features of the state code through a multi-layer perception structure to generate a selection probability distribution of each combination of the candidate verification means combination set. The Critic network adopts a double-layer neural network structure, the first layer performs dimension reduction mapping on the state code, and the second layer outputs a state value evaluation score to obtain a value score corresponding to the current state code; According to the selection probability distribution, each combination of the candidate verification means combination set is sorted, and the verification means combination with the highest value score is selected as the optimal verification strategy output to obtain a verification result.

6. A machine learning based payment fraud real-time identification and handling system for implementing the method of any one of claims 1-5, characterized in that, It includes: The first unit is used for obtaining a user identifier, and extracting historical payment device records and historical payee information of the user from a user historical behavior database based on the user identifier; The second unit is configured to construct a user identifier, a payment device, and a payee as nodes, construct a payment behavior as an edge, and generate a transaction relationship graph; perform feature embedding on the nodes in the transaction relationship graph; model the association strength between the nodes by using a graph attention network, identify an abnormal transaction association mode, and calculate a transaction suspiciousness score based on the node embedding features and the association strength; The third unit is configured to compare the transaction suspiciousness score with a preset suspiciousness threshold, and trigger a transaction verification process when the preset suspiciousness threshold is exceeded. The fourth unit is configured to take transaction features as an environmental state, construct a hierarchical verification means action space based on a knowledge graph, construct a relationship edge set by calculating similarity measurement values and dependency relationship values between verification means nodes, realize adaptive division of security levels according to dynamic security scores of the verification means nodes, calculate a comprehensive utility value of a verification combination by using a node unit cost and an associated conflict cost, construct a reinforcement learning-based adaptive verification strategy generator, execute a verification combination output by the adaptive verification strategy generator, and obtain a verification result. The fifth unit is configured to release the transaction when the verification is passed, and reject the transaction and push a risk reminder to the user when the verification is not passed.

7. An electronic device, comprising: The computer program instructions are executed by the processor to implement the method in any one of claims 1 to 5. The computer program instructions are executed by the processor to implement the method in any one of claims 1 to 5. ​ ​ 8. A computer-readable storage medium having stored thereon computer program instructions, wherein, ​

Images