Abnormal transaction processing method and device, equipment, storage medium and program product

Abstract

The invention provides an abnormal transaction processing method and device, equipment, a storage medium and a program product, and can be applied to the technical field of artificial intelligence. The method comprises the following steps: determining candidate abnormal transaction data from a plurality of transaction data; under the condition that it is determined that a first detection result of the candidate abnormal transaction data represents that the candidate transaction data has a second-level risk according to a preset anomaly detection strategy, inputting the candidate abnormal transaction data into a first anomaly detection model, and outputting a second detection result; and under the condition that the second detection result represents that the candidate abnormal transaction data has the second-level risk, outputting early warning information indicating that the candidate abnormal transaction data has the first-level risk in response to the fact that a re-checking control indicating that the candidate abnormal transaction data has the first-level risk in the re-checking interface is triggered, the first-level risk is higher than the second-level risk.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence, and more specifically to an abnormal transaction processing method, apparatus, device, storage medium, and program product. Background Technology

[0002] With the rapid development of information technology globally, the continuous development of global financial markets, and the expansion of financial transaction volume, the concealment and complexity of activities such as abnormal fund transfers that disrupt financial market order are also constantly increasing, posing a severe challenge to the compliance management of financial institutions.

[0003] Fund supervision relies on manually set rules to detect abnormal transaction data. When faced with large and complex financial transaction information, the detection efficiency is low, and it is difficult to quickly and accurately identify abnormal transaction behavior. Summary of the Invention

[0004] In view of the above problems, this application provides abnormal transaction processing methods, apparatus, equipment, media and program products to improve the efficiency of abnormal transaction detection.

[0005] According to a first aspect of this application, an abnormal transaction processing method is provided, comprising: determining candidate abnormal transaction data from multiple transaction data; if a first detection result of the candidate abnormal transaction data, determined according to a preset abnormal detection strategy, indicates that the candidate abnormal transaction data has a second level of risk, inputting the candidate abnormal transaction data into a first abnormal detection model and outputting a second detection result; if the second detection result indicates that the candidate abnormal transaction data has the second level of risk, in response to the detection that a review control in the review interface indicating that the candidate abnormal transaction data has a first level of risk is triggered, outputting a warning message indicating that the candidate abnormal transaction data has the first level of risk, wherein the first level of risk is higher than the second level of risk.

[0006] According to an embodiment of this application, the above-mentioned method of determining candidate abnormal transaction data from multiple transaction data includes: obtaining the multiple transaction data from a transaction graph database according to preset query conditions, wherein the transaction graph database includes node attribute data of multiple nodes and edge attribute data of at least one edge, the nodes represent transaction objects, the edges are used to connect two nodes with transaction behavior, and the transaction data represents transaction behavior data between transaction objects with transaction relationship; determining multiple intermediate candidate abnormal transaction data from the multiple transaction data; and determining the candidate abnormal transaction data from the multiple intermediate candidate abnormal transaction data based on a third detection result obtained by processing the multiple intermediate candidate abnormal transaction data using a second anomaly detection model.

[0007] According to an embodiment of this application, the method for determining multiple intermediate candidate abnormal transaction data from the multiple transaction data includes: dividing the multiple transaction data into multiple transaction groups using a community detection algorithm; determining at least one first intermediate candidate abnormal transaction data from the multiple transaction groups based on anomaly detection indicators; determining at least one second intermediate candidate abnormal transaction data from the multiple transaction data based on a fourth detection result obtained by processing the multiple transaction data using a third anomaly detection model; and obtaining the multiple intermediate candidate abnormal transaction data based on at least one of the at least one first intermediate candidate abnormal transaction data or the at least one second intermediate candidate abnormal transaction data.

[0008] According to an embodiment of this application, the third anomaly detection model includes multiple isolated trees, and the fourth detection result includes anomaly evaluation values ​​for each of the multiple transaction data. The step of determining at least one second intermediate candidate anomaly transaction data from the multiple transaction data based on the fourth detection result obtained by processing the multiple transaction data using the third anomaly detection model includes: determining the path length of each transaction data in each of the multiple isolated trees for any of the transaction data; obtaining anomaly evaluation values ​​based on the multiple path lengths; and determining the at least one second intermediate candidate anomaly transaction data from the multiple transaction data based on the anomaly evaluation values ​​for each of the multiple transaction data.

[0009] According to an embodiment of this application, the third anomaly detection model includes an encoder and a decoder, and the fourth detection result includes reconstruction error values ​​for each of the plurality of transaction data. The step of determining at least one second intermediate candidate anomalous transaction data from the plurality of transaction data based on the fourth detection result obtained by processing the plurality of transaction data using the third anomaly detection model includes: inputting the plurality of transaction data into the encoder and outputting coded transaction feature data for each of the plurality of transaction data; inputting the coded transaction feature data for each of the plurality of transaction data into the decoder and outputting reconstructed transaction data for each of the plurality of transaction data; determining a reconstruction error value between the transaction data and the reconstructed transaction data for any one of the transaction data; and determining at least one second intermediate candidate anomalous transaction data from the plurality of transaction data based on the reconstruction error values ​​for each of the plurality of transaction data.

[0010] According to embodiments of this application, the second anomaly detection model includes at least one of the following: a local neural network model, a temporal neural network model, or a graph neural network model; wherein, the method further includes: inputting the plurality of intermediate candidate anomaly transaction data into the feature extraction layer of the local neural network model, and outputting local transaction feature data of each of the plurality of intermediate candidate anomaly transaction data; inputting the local transaction feature data of each of the plurality of intermediate candidate anomaly transaction data into the classification layer of the local neural network model, and obtaining a first classification result of each of the plurality of intermediate candidate anomaly transaction data; inputting the plurality of intermediate candidate anomaly transaction data into the temporal neural network model, and outputting a second classification result of each of the plurality of intermediate candidate anomaly transaction data; inputting the plurality of intermediate candidate anomaly transaction data into the graph neural network model, and outputting a third classification result of each of the plurality of intermediate candidate anomaly transaction data; and obtaining the third detection result based on at least one of the first classification result, the second classification result, or the third classification result of each of the plurality of intermediate candidate transaction data.

[0011] According to an embodiment of this application, the second anomaly detection model is trained using multiple sample transaction data, which are obtained by processing multiple original sample transaction data using a sample balancing strategy.

[0012] According to an embodiment of this application, the method further includes: if the candidate abnormal transaction data has the aforementioned first-level risk, performing a freezing operation on the transaction account associated with the candidate abnormal transaction data.

[0013] According to an embodiment of this application, it further includes: storing the operations performed to obtain at least one of the first detection result, the second detection result, or the warning information to an operation log.

[0014] According to an embodiment of this application, the method further includes: cleaning the original transaction data to obtain cleaned transaction data; extracting key information from the cleaned transaction data to obtain key transaction data; and performing semantic parsing on the key transaction data to obtain the transaction data.

[0015] According to an embodiment of this application, the method further includes: obtaining source transaction data from a data warehouse; and converting the source transaction data to obtain the original transaction data.

[0016] A second aspect of this application provides an abnormal transaction processing apparatus, comprising: a data determination module for determining candidate abnormal transaction data from multiple transaction data; a result output module for inputting the candidate abnormal transaction data into a first anomaly detection model and outputting a second detection result when a first detection result of the candidate abnormal transaction data, determined according to a preset anomaly detection strategy, indicates that the candidate abnormal transaction data has a second level of risk; and a risk warning module for outputting a warning message indicating that the candidate abnormal transaction data has the first level of risk, in response to the detection that a review control in the review interface indicating that the candidate abnormal transaction data has a first level of risk is triggered, when the second detection result indicates that the candidate abnormal transaction data has the second level of risk, wherein the first level of risk is higher than the second level of risk.

[0017] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0018] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0019] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0020] According to the embodiments of this application, when the first detection result of the candidate abnormal transaction data detected by the application of the preset anomaly detection strategy indicates that the candidate transaction data has a second level of risk, the first anomaly detection model is applied to further detect the candidate abnormal transaction data and output a second detection result. When the second detection result indicates that the candidate abnormal transaction data has a second level of risk, the candidate abnormal transaction data is reviewed. When the review result indicates that the candidate abnormal transaction data has a first level of risk, a warning message indicating that the candidate abnormal transaction data has the first level of risk is output, thereby realizing the automated detection of abnormal transaction data and improving the regulatory efficiency of abnormal transactions. Since the detection of candidate abnormal transaction data is comprehensively evaluated by the application of the preset anomaly detection strategy, the first anomaly detection model, and the review method, the accuracy of identifying abnormal transaction behavior is improved and the false alarm rate is reduced. Attached Figure Description

[0021] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0022] Figure 1 The illustration shows an application scenario diagram of the abnormal transaction processing method, apparatus, device, medium, and program product according to embodiments of this application;

[0023] Figure 2 A flowchart illustrating an abnormal transaction processing method according to an embodiment of this application is shown schematically.

[0024] Figure 3 A flowchart illustrating an abnormal transaction processing method according to another embodiment of this application is shown schematically;

[0025] Figure 4 This illustration schematically shows a data acquisition architecture diagram according to an embodiment of this application;

[0026] Figure 5 A flowchart illustrating a data import method according to an embodiment of this application is shown schematically;

[0027] Figure 6 A flowchart illustrating data acquisition and data preprocessing according to an embodiment of this application is shown schematically;

[0028] Figure 7 A flowchart illustrating data preprocessing according to an embodiment of this application is shown schematically;

[0029] Figure 8 A flowchart illustrating transaction monitoring according to an embodiment of this application is shown schematically;

[0030] Figure 9 A flowchart illustrating the warning and response process according to an embodiment of this application is shown schematically;

[0031] Figure 10 A schematic diagram illustrating the structure of an abnormal transaction processing apparatus according to an embodiment of this application is shown; and

[0032] Figure 11 A block diagram schematically illustrates an electronic device suitable for implementing an abnormal transaction processing method according to an embodiment of this application. Detailed Implementation

[0033] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0034] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0035] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0036] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0037] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0038] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this application all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0039] With the booming development of financial markets and the widespread application of information technology, various transaction activities are becoming increasingly frequent and complex, covering multiple areas such as bank transfers, securities trading, and e-commerce payments. However, while the scale of transactions continues to expand, abnormal transaction behaviors are also on the rise.

[0040] In related technologies, anomaly detection methods often rely on manually formulated rules. This involves domain experts setting a series of judgment criteria based on experience; transactions meeting these criteria are then deemed anomaly. For example, a threshold for the amount of a single transaction is set, and an alert is issued when the transaction amount exceeds this threshold. However, this method has limitations: firstly, the financial market environment and trading patterns are constantly changing, with anomaly patterns emerging frequently. Manual rules often struggle to adapt quickly to these changes, leading to missed detections; secondly, with the explosive growth of transaction data, the cost of manually formulating and maintaining rules is extremely high, and it is difficult to handle complex transaction relationships, potentially resulting in numerous false alarms and impacting detection efficiency.

[0041] The embodiments of this application provide an abnormal transaction processing method. When a first detection result from a preset anomaly detection strategy indicates that the candidate abnormal transaction data has a second-level risk, a first anomaly detection model is applied to further detect the candidate abnormal transaction data, outputting a second detection result. If the second detection result indicates that the candidate abnormal transaction data has a second-level risk, the candidate abnormal transaction data is reviewed. When the review result indicates that the candidate abnormal transaction data has a first-level risk, a warning message indicating that the candidate abnormal transaction data has a first-level risk is output. This achieves automated detection of abnormal transaction data, improving the efficiency of abnormal transaction supervision. Because a preset anomaly detection strategy, a first anomaly detection model, and review are used to comprehensively evaluate the detection of candidate abnormal transaction data, the accuracy of identifying abnormal transaction behavior is improved, and the false alarm rate is reduced.

[0042] Figure 1 The diagram illustrates an application scenario of the abnormal transaction processing method according to an embodiment of this application.

[0043] like Figure 1 As shown, the application scenario according to this embodiment may include a data source 110, a data warehouse 120, and a data processing platform 130. The data source may include multiple terminal devices and servers; the data warehouse 120 may be a server; and the data processing platform 130 may be at least one of terminal devices, servers, or a server cluster. The data source 110, data warehouse 120, and data processing platform 130 can be connected via a network. The network may include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0044] Raw data is obtained from data source 110 and transferred to data warehouse 120. Data warehouse 120 stores the raw data to obtain source transaction data. Data warehouse 120 then transfers the source transaction data to data processing platform 130, which obtains the raw transaction data. Data processing platform 130 uses the raw transaction data as a basis to process abnormal transactions.

[0045] Terminal devices can be various electronic devices with a display screen and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0046] It should be noted that the abnormal transaction processing method provided in this application embodiment can generally be executed by the data processing platform 130. Accordingly, the abnormal transaction processing device provided in this application embodiment can generally be set in the data processing platform 130.

[0047] The following will be based on Figure 1 The described scene, through Figures 2-9 The abnormal transaction processing method according to the embodiments of this application will be described in detail.

[0048] Figure 2 A flowchart illustrating an abnormal transaction processing method according to an embodiment of this application is shown.

[0049] like Figure 2 As shown, the abnormal transaction processing method of this embodiment includes operations S210 to S230, and the transaction processing method can be executed by a server or a terminal device.

[0050] In operation S210, candidate abnormal transaction data is identified from multiple transaction data.

[0051] According to embodiments of this application, multiple transaction data can be a collection of transaction records from different channels, scenarios, types, or systems. They can be divided by transaction channel, such as bank counter transaction data, ATM transaction data, or third-party payment platform data, or by transaction type, such as recorded transfer transaction data or consumption transaction data, or by data source subject, such as internal corporate fund transaction data or transaction data from different payment institutions.

[0052] For example, candidate abnormal transaction data can be transaction records that have potential risks or do not conform to normal transaction characteristics. The operation of identifying candidate abnormal transaction data from multiple transaction data can be based on rule-based screening methods or anomaly detection methods based on machine learning.

[0053] In operation S220, if the first detection result of the candidate abnormal transaction data is determined to indicate that the candidate transaction data has a second level of risk according to the preset anomaly detection strategy, the candidate abnormal transaction data is input into the first anomaly detection model and the second detection result is output.

[0054] In some embodiments, based on the comparison between the risk score corresponding to the first detection result and the first preset risk level threshold, the risk level of the candidate transaction data is divided into low-risk, medium-risk, and high-risk levels, wherein the second-level risk corresponds to the medium-risk level. The risk score corresponding to the first detection result can be used to assess the degree of anomaly and potential risk level of the transaction through quantitative indicators. For example, by decomposing the abnormal features of the transaction, setting weights and scoring standards for each feature, and summarizing them to obtain a comprehensive risk score.

[0055] In some embodiments, the first anomaly detection model can be a machine learning model. The machine learning model is trained using historical labeled data and directly outputs the second detection result. When the machine learning model selects a logistic regression model, the second detection result represents the risk probability of the transaction.

[0056] In operation S230, if the second detection result indicates that the candidate abnormal transaction data has a second level of risk, in response to the detection that the review control in the review interface indicating that the candidate abnormal transaction data has a first level of risk is triggered, a warning message indicating that the candidate abnormal transaction data has a first level of risk is output, wherein the first level of risk is higher than the second level of risk.

[0057] For example, based on the comparison between the risk score corresponding to the second detection result and the second preset risk level threshold, the risk level of candidate transaction data with second-level risk is divided into low-risk level, medium-risk level and high-risk level, with the second-level risk corresponding to the medium-risk level.

[0058] For example, based on the second detection result, candidate abnormal transaction data with a risk level of level two is determined from the candidate abnormal transaction data input to the first abnormality detection model. When the review interface indicates that there is candidate abnormal transaction data with a risk level of level one among the candidate abnormal transaction data with a risk level of level two, a warning message is output, and candidate abnormal transaction data with a risk level of level one is output.

[0059] According to the embodiments of this application, when the first detection result of the candidate abnormal transaction data detected by the application of the preset anomaly detection strategy indicates that the candidate transaction data has a second level of risk, the first anomaly detection model is applied to further detect the candidate abnormal transaction data and output a second detection result. When the second detection result indicates that the candidate abnormal transaction data has a second level of risk, the candidate abnormal transaction data is reviewed. When the review result indicates that the candidate abnormal transaction data has a first level of risk, a warning message indicating that the candidate abnormal transaction data has the first level of risk is output, thereby realizing the automated detection of abnormal transaction data and improving the regulatory efficiency of abnormal transactions. Since the detection of candidate abnormal transaction data is comprehensively evaluated by the application of the preset anomaly detection strategy, the first anomaly detection model, and the review method, the accuracy of identifying abnormal transaction behavior is improved and the false alarm rate is reduced.

[0060] Figure 3 A flowchart illustrating an abnormal transaction processing method according to another embodiment of this application is shown schematically. Figure 3 As shown, the abnormal transaction processing method of this embodiment includes operations S310 to S340. This transaction processing method can be executed by the server and adopts a distributed computing framework, which allows data to be distributed on multiple nodes for parallel processing, thereby accelerating the data processing speed.

[0061] Data acquisition is performed while operating the S310.

[0062] In the embodiments of this application, raw data such as transaction records, account information, and fund flows within a preset time period are obtained through various methods. The following examples illustrate this. Figure 4 Taking this as an example, we will further explain the architecture of data acquisition.

[0063] like Figure 4 As shown, the data acquisition module 400 includes data source classification 410, acquisition method 420, and data transmission module 430. Data source classification 410 includes financial institution data 411, third-party payment data 412, cross-border transaction data 413, and public network data 414. Financial institution data 411 includes business data from financial institutions such as banks and securities firms, such as transaction records and account information. Third-party payment data 412 includes payment data from multiple platforms, such as payment amount and transaction time. Cross-border transaction data 413 includes transaction data related to international business, such as foreign exchange settlement and cross-border e-commerce orders. Public network data 414 includes publicly available information on the internet, such as industry reports, news, and social media. By establishing communication protocols with the data sources, raw data such as transaction flow, account information, and fund flows are obtained.

[0064] After identifying the data source, various methods can be used to collect data from it. For example, collection method 420 may include API (Application Programming Interface) collection 421, direct database connection 422, file / log parsing 423, and web crawling 424. Specifically, API collection 421 refers to pulling data via an API, such as an interface provided by a financial institution; direct database connection 422 refers to directly connecting to the database where the data source resides and reading data, provided the database has the appropriate permissions; file / log parsing 423 refers to parsing local files or system logs to extract data; and web crawling 424 refers to legally crawling data from publicly available web pages.

[0065] After acquiring data from the data source, the data is stored in the data warehouse via message queue 431 and / or encrypted transmission channel 432 to obtain the source transaction data. Message queue 431 transmits data asynchronously, which can smooth out peak traffic and alleviate data flow pressure; encrypted transmission channel 432 encrypts the data to ensure transmission security and prevent data leakage. Message queue 431 and encrypted transmission channel 432 can be used in combination or separately to achieve data transmission.

[0066] According to an embodiment of this application, the abnormal transaction processing method further includes: obtaining source transaction data from a data warehouse; and converting the format of the source transaction data to obtain the original transaction data.

[0067] In the embodiments of this application, the source transaction data is the raw data stored in the data warehouse. The raw data in the data warehouse is imported into the data processing platform through various methods, and the format of the source transaction data is converted during the import process. Figure 5 The flowchart shown below illustrates the data import method in further detail.

[0068] like Figure 5 As shown, the data import method includes operations S510~S560.

[0069] When operating S510, configure the verification data table structure and data file address.

[0070] In the embodiments of this application, configuring and validating the data table structure allows for checking whether the database table design meets requirements through preset rules, ensuring the standardization and consistency of the data table structure, and preventing data storage and business logic errors due to structural issues. For example, the data file address can be the path to the data source, such as a file storage location or a data warehouse connection address.

[0071] Create this data table in the S520 operation.

[0072] In the embodiments of this application, the data table is created according to the data table structure and the data file address.

[0073] When operating the S530, an executable file is generated.

[0074] In the embodiments of this application, a task configuration file for the executable file is configured, which specifies data source information, table and field information, data processing rules, etc. The data source information details the source and destination of the data. The table and field information specifies the tables to be synchronized and their corresponding fields, allowing for precise synchronization of only certain specific fields rather than all fields; for example, synchronizing only the "name" and "age" fields in the user table. The data processing rules can set data filtering conditions, field mapping relationships, etc.

[0075] When operating the S540, execute the executable file.

[0076] In the embodiments of this application, the process of executing an executable file includes launching the executable file, task parsing, data extraction, data transformation and processing, etc.; launching the executable file can be achieved through command line. After launching the executable file, the task configuration file is read through the task parsing operation, and the various configurations in it are parsed. The parser will convert the contents of the configuration file into a recognizable data structure. Data extraction is based on the data source information and table and field information specified in the configuration file, and data is extracted from the data source through the corresponding reading plugin. Data transformation and processing is performed after the data is extracted, according to the data processing rules set in the configuration file, such as converting a date field from one format to another, or filtering and calculating the data according to preset conditions.

[0077] When operating the S550, data is inserted into the database.

[0078] In the embodiments of this application, a writing plugin is used to write the transformed and processed data obtained from executing executable file operations into a target data source at a specified path according to a specified format, thereby storing the data in a database, and the data in the database is referred to as the original transaction data. During the writing process, some optimization operations can also be performed according to the characteristics of the target data source. For example, for databases that support batch writing, a batch insert method can be used to improve writing efficiency.

[0079] According to the embodiments of this application, by converting source transaction data into a predetermined format, and converting data of a preset type or format into their respective specified formats, the data standards of some data in the source transaction data are unified, which can eliminate the format barriers between some source transaction data and lay the foundation for subsequent data processing.

[0080] When operating S560, some data cannot be imported to generate log files.

[0081] In the embodiments of this application, during the execution of operations S530~S540, the execution status of the task is monitored in real time, including information such as the amount of data extracted, the amount of data written, and the task execution time. The results of the task execution (success, failure, and reasons for failure, etc.) can also be fed back to facilitate users and technicians to understand the task execution status. If the task execution fails, users or technicians can check the task configuration file or the connection status of the data source based on the feedback information so as to make corresponding adjustments and re-execute the task.

[0082] According to embodiments of this application, before importing source transaction data from the data warehouse into the data processing platform through various methods, the source transaction data in the data warehouse can be pre-processed. The following examples illustrate this. Figure 6 Taking this as an example, we will further explain the prior processing of source transaction data in the data warehouse.

[0083] Figure 6 A flowchart illustrating data acquisition and data preprocessing according to an embodiment of this application is shown schematically.

[0084] like Figure 6 The data acquisition and preprocessing operation S610 is shown below. In operation S610, raw data acquisition S611 is used to collect source transaction data from the data warehouse and determine the data type of the source transaction data in the data warehouse. It determines whether the data type is structured data S612. If the data type is structured data, then the raw data of structured data is cleaned using structured data cleaning S614. Structured data cleaning S614 is used to clean the source transaction data of structured data, for example, by deduplication and filling in missing data, to obtain cleaned structured data. If the data type is unstructured data, then the raw data of unstructured data is parsed using unstructured data parsing S613. This parsing process can be used to parse unstructured data, such as text and images, using natural language processing techniques to obtain parsed unstructured data. Unified data storage S615 stores the cleaned structured data and the parsed unstructured data into the target data source specified by the data processing platform. Unified data storage S615 executes the following steps: Figure 5 Operations S510 to S560 in the data import method shown.

[0085] In operation of S320, data preprocessing.

[0086] According to an embodiment of this application, the abnormal transaction processing method further includes: cleaning the original transaction data to obtain cleaned transaction data; extracting key information from the cleaned transaction data to obtain key transaction data; and performing semantic parsing on the key transaction data to obtain transaction data.

[0087] In the embodiments of this application, such as Figure 6 According to operation S620 in the data acquisition and data preprocessing of the embodiment of this application, the data preprocessing operation is completed by data preprocessing S621. In data preprocessing S621, the source transaction data in the database is first checked by data quality verification S6211, for example, the integrity and accuracy of the data in the target data source are checked; if the verification result is qualified, the qualified data is subjected to feature extraction S622; if the verification result is unqualified, the unqualified data is subjected to data cleaning S6213, and the data output by data cleaning S6213 is subjected to feature extraction S622; the data output by feature extraction S622 is subjected to standardized data output S623.

[0088] Figure 7 The flowchart illustrating data preprocessing according to an embodiment of this application is shown schematically; the data cleaning process S6213 is as follows: Figure 7 The data cleaning process is shown in the figure.

[0089] The process begins with inputting raw data and then cleaning it. Data that fails validation is used as the original data. Data cleaning includes at least the following: non-null checks, primary key duplicate checks, illegal code removal, illegal value removal, data format checks, record count checks, null value checks, duplicate data removal, outlier checks, data format standardization, data type conversion, and logical consistency checks. The order in which these operations are performed is not specified.

[0090] For example, the NOT NULL check checks if a field is empty. For fields that are not allowed to be empty, appropriate processing methods are set, such as auto-completion based on field type (e.g., text, numeric) and business rules. The primary key duplicate check checks if the primary key field contains duplicate values ​​and handles duplicate records, such as keeping one record and deleting the rest, or merging duplicate records. Illegal code cleaning checks if the values ​​in a field belong to the valid value range and replaces illegal values ​​with valid or missing values. Illegal value cleaning checks if the values ​​in a field exceed a reasonable range and deletes or corrects unreasonable values.

[0091] For example, data format checks ensure that all fields are formatted correctly, such as using consistent date and number formats. Record count checks verify that the number of records in the dataset matches expectations. If the number is mismatched, the cause needs to be investigated. Null value checks detect missing values ​​in fields. Missing values ​​are filled using statistical methods (such as mean, median, and mode). Records containing missing values ​​are deleted. Missing values ​​are estimated using predictive models, such as regression analysis.

[0092] For example, deduplication is used to detect and remove duplicate records. Duplicates can be determined based on one or more fields. Outlier detection uses statistical methods (such as standard deviation) to identify outliers. Outliers are then corrected or deleted. Data formatting standardizes the case of text fields. Unnecessary spaces or special characters are removed. Date and time formats are adjusted. Data type conversion ensures that the data type of each field matches its purpose. For example, converting text-based numbers to numeric types. Logical consistency checks verify the logical relationships between fields. For example, age cannot be greater than the age calculated from the date of birth.

[0093] According to embodiments of this application, a rule engine can be constructed to define and execute data cleaning rules. The rule engine can automatically select and apply corresponding cleaning strategies based on preset conditions, and automatically optimize the rules based on the results of historical data cleaning. For example, first, a rule and strategy library is constructed, with preset rule conditions and strategy logic. A preset rule template might be, for instance, a field equal to a phone number with a length not equal to 11. The corresponding strategy logic is to trigger an application format modification strategy, which could involve replacing illegal characters or filling in default values. Real-time calculation of input data field characteristics, such as null value rate and format matching degree, is performed, automatically matching them with preset rule conditions to trigger the corresponding strategy logic. Logs are recorded for each cleaning cycle, including the original value, processed value, strategy identifier, and execution time. Historical logs are periodically analyzed to calculate the problem resolution rate of each strategy. Rules with low problem resolution rates are adjusted or replaced to optimize the rules.

[0094] According to embodiments of this application, by performing consistency checks on the data, logical consistency is ensured before and after cleaning, avoiding the introduction of new errors during the cleaning process. Statistical methods and machine learning techniques are used to identify outliers, and decisions are made based on predefined rules to determine whether to retain, correct, or delete these outliers. Integrity verification ensures that necessary information is retained after cleaning, preventing the loss of important data due to over-cleaning.

[0095] The working process of feature extraction S622 is as follows: Figure 7 The feature extraction is shown in the figure.

[0096] Feature extraction involves extracting key information from cleaned data. The operations for key information extraction may include, but are not limited to, basic feature generation, temporal feature calculation, statistical feature aggregation, and network feature construction. The execution order of these processes is not limited. The cleaned data undergoes basic feature generation to obtain the first feature; temporal feature calculation is performed to obtain the second feature; statistical feature aggregation is performed to obtain the third feature; and network feature construction is performed to obtain the fourth feature. These first, second, third, and fourth features are then used as key transaction data to obtain the data features.

[0097] For example, basic feature generation can include direct extraction of original fields, data type conversion features, simple statistical features, and logical judgment features. Direct extraction of original fields can involve directly using existing basic fields in the data, such as age from a user table. Data type conversion features can involve converting the type of original fields according to business requirements, such as converting a string-type registration time to an integer-type registration year. Simple statistical features can involve calculating basic statistical values ​​for numeric fields, such as a user's total spending in the past 30 days. Logical judgment features can generate Boolean or flag-type features based on business rules, such as whether a user is a new user.

[0098] Time series feature calculation extracts valuable information from cleaned data and explores the patterns of changes in the cleaned data over time. This can include basic statistical features, time granularity features, trend and change features, periodic features, and high-frequency fluctuation features.

[0099] Statistical feature aggregation is based on basic data and summarizes and calculates data according to specific dimensions (such as users, time, and categories) or windows (such as fixed periods and sliding windows) to generate features that reflect the patterns of groups or time periods. It can include aggregation by entity dimension, aggregation by time window, aggregation by category grouping, and aggregation by cross-dimensional dimensions.

[0100] Network feature construction involves extracting key information from the network structure to characterize node attributes, connection patterns, and overall topological patterns. For example, the network structure could be a transaction network.

[0101] The working process of S623 for standardized data output is as follows: Figure 7 The semantic analysis is shown in the figure.

[0102] Semantic parsing involves performing semantic analysis on key transaction data to obtain standardized data. Semantic parsing operations may include, but are not limited to, natural language processing of transaction notes, OCR (Optical Character Recognition) text recognition, keyword entity extraction, and semantic similarity calculation. The execution order of these processes is not limited. Natural language processing of transaction notes is performed on the data features to obtain first-level standardized data; OCR text recognition is performed on the data features to obtain second-level standardized data; keyword entity extraction is performed on the data features to obtain third-level standardized data; and semantic similarity calculation is performed on the data features to obtain fourth-level standardized data. The obtained standardized data is used to convert the first, second, third, and fourth-level standardized data into standardized data of a unified format, and this unified-format standardized data is used as the transaction data. The unified format can be determined as needed.

[0103] According to embodiments of this application, transaction note natural language processing can be a process of analyzing, processing, and mining the note information (such as transfer remarks, order notes, transaction descriptions, etc.) filled in by users in transaction records using natural language processing technology, transforming unstructured text information into structured data, and extracting valuable business information.

[0104] OCR text recognition can convert image data in data features into editable and searchable digital text format, and then convert the converted text format into structured data.

[0105] Keyword entity extraction can automatically identify and extract named entities and core keywords from text files in the data features. Entities can be proper nouns with referential meaning in the text, such as organization name, time, amount, etc., while keywords can be words or phrases that can summarize the content of the text, such as subject terms.

[0106] Semantic similarity calculation measures the degree of semantic similarity between data features. Through semantic similarity calculation, it's possible to identify repetitive or highly similar content, and also to match questions with candidate answers.

[0107] According to embodiments of this application, by preprocessing the raw transaction data, the quality of the transaction data can be improved, providing high-quality input for subsequent analysis.

[0108] When operating S330, transaction monitoring is performed.

[0109] Figure 8 A flowchart illustrating transaction monitoring according to an embodiment of this application is shown schematically. Figure 8As shown, the transaction monitoring method includes operations S810 to S880.

[0110] When operating the S810, transaction monitoring begins.

[0111] When operating the S820, input standardized data. Standardized data is transaction data.

[0112] When operating the S830, the analysis engine module is used to detect abnormal transaction data in the standardized data, and the detection results are obtained.

[0113] According to embodiments of this application, abnormal transaction data can be used to represent multiple intermediate candidate abnormal transaction data. The analysis engine module can be used to perform operations such as retrieving multiple transaction data from a transaction graph database based on preset query conditions, and determining multiple intermediate candidate abnormal transaction data from the multiple transaction data; wherein, the transaction graph database includes node attribute data for each of multiple nodes and edge attribute data for each of at least one edge, nodes represent transaction objects, edges are used to connect two nodes with transaction behavior, and transaction data represents transaction behavior data between transaction objects with a transaction relationship.

[0114] In the embodiments of this application, a graph database is constructed based on multiple transaction data. The graph database is used to store the transaction behaviors between the respective accounts of the transaction objects. Multiple transaction data that meet preset query conditions are obtained from the transaction graph database; different implementation methods can typically be selected depending on the type of graph database and the query language used.

[0115] For example, intermediate candidate abnormal transaction data can be abnormal transaction data screened from multiple transaction data. Screening abnormal transaction data can be done through quantitative analysis or rule matching to filter out transactions that deviate from the normal pattern, for example, based on statistical outlier detection or based on a multi-dimensional rule engine.

[0116] According to embodiments of this application, by progressively determining candidate abnormal transaction data through multiple steps, more accurate candidate abnormal transaction data can be screened out.

[0117] According to an embodiment of this application, a community detection algorithm is used to divide multiple transaction data into multiple transaction groups; at least one first intermediate candidate abnormal transaction data is determined from the multiple transaction groups according to anomaly detection indicators; at least one second intermediate candidate abnormal transaction data is determined from the multiple transaction data according to a fourth detection result obtained by processing the multiple transaction data using a third anomaly detection model; and multiple intermediate candidate abnormal transaction data are obtained based on at least one of the at least one first intermediate candidate abnormal transaction data or at least one second intermediate candidate abnormal transaction data.

[0118] For example, multiple trading groups can be closely connected groups of accounts. The degree of anomalousness of trading data in each trading group is quantified based on anomaly detection metrics, thereby identifying at least one first intermediate candidate anomalous trading data from the multiple trading groups. The first intermediate candidate anomalous trading data is the trading data in the multiple trading groups whose quantified anomalousness meets preset conditions. For example, the anomaly detection metric is a first preset rule; the first preset rule is applied to calculate the score of the trading data in each trading group, and when the score meets the preset conditions, the trading data whose score meets the preset conditions is selected as the first intermediate candidate anomalous trading data.

[0119] According to the embodiments of this application, hidden financial communities can be identified by applying community detection algorithms. Furthermore, key nodes within the community can be identified by combining centrality indicators (such as degree centrality and betweenness centrality). By utilizing the structural characteristics of the community (such as average transaction amount, transaction frequency, and number of cross-community connections), the community risk can be quantitatively assessed, and the first intermediate candidate abnormal transaction data in multiple transaction groups can be determined.

[0120] For example, the third anomaly detection model can be a time series analysis model. For time series data (such as daily transaction volume), an autoregressive integral moving average model or a long short-term memory network can be used to capture the changing patterns of transaction data over time. When the transaction data does not meet the changing patterns, the transaction data is determined to be the second intermediate candidate anomaly transaction data.

[0121] According to embodiments of this application, multiple intermediate candidate abnormal transaction data may be at least one first intermediate candidate abnormal transaction data, at least one second intermediate candidate abnormal transaction data, or at least one first intermediate candidate abnormal transaction data and at least one second intermediate candidate abnormal transaction data.

[0122] According to embodiments of this application, intermediate candidate abnormal transaction data are generated through different algorithms, the complementarity between algorithms is used to cover more abnormal patterns, and the reliability of the results is improved through cross-validation of the candidate set.

[0123] According to an embodiment of this application, the third anomaly detection model includes multiple isolated trees, and the fourth detection result includes anomaly evaluation values ​​for each of the multiple transaction data. The process of determining at least one second intermediate candidate anomaly transaction data from the multiple transaction data based on the fourth detection result obtained by processing the multiple transaction data using the third anomaly detection model includes: determining the path length of the transaction data in each of the multiple isolated trees for any given transaction data; obtaining anomaly evaluation values ​​based on the multiple path lengths; and determining at least one second intermediate candidate anomaly transaction data from the multiple transaction data based on the anomaly evaluation values ​​for each of the multiple transaction data.

[0124] For example, for any transaction data in the transaction data, key features of the transaction data are extracted, such as transaction amount, frequency, time, location, account history behavior, etc. For each isolated tree, the key features of the transaction data are traversed starting from the root node, and the number of edges (path length) traversed from the root to the leaf node is recorded. For any transaction data, the average path length in all isolated trees is calculated. Based on the theoretical formula of isolated forest, the average path length is converted into a standardized outlier score. All transactions are sorted in descending order of outlier score, and at least one second intermediate candidate outlier transaction data is determined from multiple transaction data.

[0125] According to embodiments of this application, by applying the principle of the isolated forest algorithm, it is possible to accurately identify second intermediate candidate abnormal transaction data from multiple transaction data.

[0126] According to an embodiment of this application, the third anomaly detection model includes an encoder and a decoder, and the fourth detection result includes reconstruction error values ​​for each of the multiple transaction data. The process of determining at least one second intermediate candidate anomalous transaction data from the multiple transaction data based on the fourth detection result obtained by processing the multiple transaction data using the third anomaly detection model includes: inputting the multiple transaction data into the encoder and outputting coded transaction feature data for each of the multiple transaction data; inputting the coded transaction feature data for each of the multiple transaction data into the decoder and outputting reconstructed transaction data for each of the multiple transaction data; determining, for any one of the transaction data, the reconstruction error value between the transaction data and the reconstructed transaction data of the transaction data; and determining at least one second intermediate candidate anomalous transaction data from the multiple transaction data based on the reconstruction error values ​​for each of the multiple transaction data.

[0127] According to embodiments of this application, key features of multiple transaction data, such as amount, frequency, and time, are extracted and standardized. A third anomaly detection model is trained using normal transaction data, enabling the decoder to accurately reconstruct normal transactions. The key features of each transaction data are input into the trained third anomaly detection model to obtain reconstructed transaction data for each transaction data. The reconstruction error between each transaction data and its corresponding reconstructed transaction data is calculated, and transaction data whose reconstruction error meets a preset error condition is selected as the second intermediate candidate anomaly transaction data.

[0128] According to the embodiments of this application, the accuracy of the second intermediate candidate abnormal transaction data as intermediate candidate abnormal transaction data can be improved, and the generalization ability can be enhanced.

[0129] According to embodiments of this application, determining candidate abnormal transaction data from multiple transaction data sets can be a real-time detection method. When a real-time detection method is selected, the original transaction data is acquired in real-time, and data cleaning, key information extraction, and semantic parsing operations are performed on the original transaction data in real-time to obtain the actual transaction data. A third anomaly detection model is applied to detect abnormal transaction data in real-time, obtaining intermediate candidate abnormal transaction data in real-time. A second anomaly detection model is then applied to detect abnormal transaction data in real-time on the intermediate candidate abnormal transaction data, obtaining the actual candidate abnormal transaction data in real-time. When a real-time detection method is selected, the third anomaly detection model may include at least one of the following: a model applying the Isolation Forest algorithm or a model including an encoder and a decoder.

[0130] In operation S840, it is determined whether there is abnormal transaction data in the detection results. If abnormal transaction data is found in the detection results, operation S850 is executed; if no abnormal transaction data is found in the detection results, operation S880 is executed.

[0131] When operating the S850, the machine learning module is used to verify abnormal transaction data and obtain verification results.

[0132] According to an embodiment of this application, the machine learning module is a second anomaly detection model. Based on a third detection result obtained by processing multiple intermediate candidate anomaly transaction data using the second anomaly detection model, candidate anomaly transaction data is determined from the multiple intermediate candidate anomaly transaction data.

[0133] For example, the second anomaly detection model can be a machine learning algorithm, such as a random forest or support vector machine. The machine learning algorithm is applied to detect multiple intermediate candidate anomaly transaction data to determine the candidate anomaly transaction data.

[0134] According to an embodiment of this application, multiple intermediate candidate abnormal transaction data determined from multiple transaction data are used as first screening data. Based on the detection results obtained by processing multiple transaction data using a second anomaly detection model, second screening data are determined from multiple transaction data. The transaction data corresponding to the first screening data and the second screening data are used as candidate abnormal transaction data.

[0135] According to embodiments of this application, the second anomaly detection model includes at least one of the following: a local neural network model, a temporal neural network model, or a graph neural network model; wherein the method further includes: inputting multiple intermediate candidate anomaly transaction data into the feature extraction layer of the local neural network model, and outputting local transaction feature data of each of the multiple intermediate candidate anomaly transaction data; inputting the local transaction feature data of each of the multiple intermediate candidate anomaly transaction data into the classification layer of the local neural network model, and obtaining a first classification result of each of the multiple intermediate candidate anomaly transaction data; inputting the multiple intermediate candidate anomaly transaction data into the temporal neural network model, and outputting a second classification result of each of the multiple intermediate candidate anomaly transaction data; inputting the multiple intermediate candidate anomaly transaction data into the graph neural network model, and outputting a third classification result of each of the multiple intermediate candidate anomaly transaction data; and obtaining a third detection result based on at least one of the first classification result, the second classification result, or the third classification result of each of the multiple intermediate candidate transaction data.

[0136] According to embodiments of this application, the local neural network model can be a convolutional neural network, and the temporal neural network model can be a recurrent neural network or a long short-term memory network.

[0137] According to embodiments of this application, high-credibility candidate abnormal transaction data are accurately screened through deep feature learning and multi-dimensional pattern capture.

[0138] According to an embodiment of this application, the second anomaly detection model is trained using multiple sample transaction data, which are obtained by processing multiple original sample transaction data using a sample balancing strategy.

[0139] For example, during the training of the second anomaly detection model, techniques such as oversampling, undersampling, or generative adversarial networks are used to increase the number of minority class samples. Simultaneously, hyperparameters are adjusted and model performance is optimized through methods such as cross-validation and grid search. Model performance is evaluated using methods such as cross-validation, and hyperparameters are further optimized. When labels are clearly defined, the second anomaly detection model is trained using labeled historical data.

[0140] For example, in the absence of explicit labels, the second anomaly detection model can be a model built using a clustering algorithm to find candidate anomalous transaction data within the transaction data. Reinforcement learning algorithms can also be applied to dynamically adjust the model parameters of the second anomaly detection model.

[0141] According to the embodiments of this application, the ability of the second anomaly detection model to identify minority anomaly samples can be effectively improved, the risk of overfitting can be reduced, and the model's generalization ability can be enhanced.

[0142] In operation S860, it is determined whether there is abnormal transaction data in the verification result. If abnormal transaction data is found in the verification result, operation S870 is executed; if no abnormal transaction data is found in the verification result, operation S880 is executed.

[0143] When operating the S870, abnormal transaction data is output. This output abnormal transaction data includes candidate abnormal transaction data.

[0144] Trading monitoring ended after operating the S880.

[0145] This application is for S340 operation, early warning and response.

[0146] Figure 9 A flowchart illustrating the warning and response process according to an embodiment of this application is shown. Figure 9 As shown, the early warning and response method includes operations S901~S911.

[0147] Input candidate abnormal transaction data when operating S901.

[0148] During the S902 operation, the rule engine performs initial screening.

[0149] In operation S903, the rule matching result is executed. If the rule matching result matches a medium-risk rule, operation S904 is executed; if the rule matching result matches a high-risk rule, operation S908 is executed; if the rule matching result matches a low-risk rule, operation S907 is executed.

[0150] In S904, decision tree depth analysis is performed.

[0151] In operation S905, output the decision tree analysis results. If the decision tree analysis results match a medium-risk rule, execute operation S906; if the decision tree analysis results match a high-risk rule, execute operation S908; if the decision tree analysis results match a low-risk rule, execute operation S907.

[0152] When operating S906, human-machine collaborative review is conducted.

[0153] According to an embodiment of this application, for transactions determined by the decision tree to be of medium risk, a human-machine collaboration process is triggered. Human reviewers use a dedicated review interface to view detailed transaction information, analysis results, and relevant evidence. Combining this with experience and case studies from an expert knowledge base, they manually review the transaction and ultimately determine whether an alert needs to be issued.

[0154] During S907 operation, normal transaction archiving.

[0155] S908 is in operation, Level 1 warning.

[0156] According to embodiments of this application, based on the results of a rule engine, decision tree, and human-machine collaboration, early warning signals are issued for high-risk and confirmed medium-risk transactions. These early warning signals can be communicated to relevant personnel via SMS, email, system pop-ups, etc., and a detailed early warning report is generated, including transaction information, risk analysis results, and early warning level.

[0157] When operating the S909, an early warning and response mechanism is implemented.

[0158] According to an embodiment of this application, the abnormal transaction processing method further includes: if the candidate abnormal transaction data has a first-level risk, performing a freezing operation on the transaction account associated with the candidate abnormal transaction data.

[0159] According to an embodiment of this application, the first level of risk corresponds to a high-risk level. When the risk level of candidate abnormal transaction data is high-risk, a freeze operation is performed on the transaction account associated with the candidate abnormal transaction data.

[0160] According to the embodiments of this application, it is possible to promptly block the spread of risks, reduce the risk of financial losses, and prevent further capital outflows and risk expansion.

[0161] Generate a regulatory report: Compile detailed information and analysis results of the alerted transactions into a regulatory report. Send notifications to risk control personnel, compliance personnel, and other relevant personnel, requiring them to conduct further investigations and handle the alerted transactions, and to take appropriate risk control measures.

[0162] Data security operation when operating S910.

[0163] According to an embodiment of this application, the abnormal transaction processing method further includes: storing the operations performed to obtain at least one of a first detection result, a second detection result, or an early warning information into an operation log.

[0164] According to embodiments of this application, all operations during the early warning and response process are recorded in an operation log, including early warning triggering, manual review, and account freezing. Auditing the operation log ensures compliance and traceability. During early warning reporting and data transmission, sensitive information (such as account balance, ID number, and contact information) is anonymized using encryption and masking techniques to protect user privacy and data security. Early warning transaction data and related analysis results are encrypted and stored using encryption algorithms to ensure data security during storage and prevent data leakage and unauthorized access.

[0165] According to embodiments of this application, traceability is achieved by storing the performed operations in an operation log.

[0166] According to the embodiments of this application, the automated detection of abnormal transactions significantly reduces labor costs and improves the efficiency of regulatory work; through machine learning algorithms, abnormal transactions can be identified more accurately, reducing the false alarm rate.

[0167] Based on the above-described abnormal transaction processing method, this application also provides an abnormal transaction processing apparatus. The following will be combined with... Figure 10 The device is described in detail.

[0168] Figure 10 A schematic block diagram of an abnormal transaction processing apparatus according to an embodiment of this application is shown. Figure 10 As shown, the abnormal transaction processing device 1000 of this embodiment includes a data determination module 1010, a result output module 1020, and a risk warning module 1030.

[0169] The data determination module 1010 is used to determine candidate abnormal transaction data from multiple transaction data. In one embodiment, the data determination module 1010 can be used to perform the operation S210 described above, which will not be repeated here.

[0170] The result output module 1020 is used to input the candidate abnormal transaction data into the first anomaly detection model and output a second detection result when the first detection result of the candidate abnormal transaction data indicates that the candidate transaction data has a second level of risk according to the preset anomaly detection strategy. In one embodiment, the result output module 1020 can be used to perform the operation S220 described above, which will not be repeated here.

[0171] The risk warning module 1030 is used to, in response to the detection that a review control in the review interface indicating that the candidate abnormal transaction data has a first-level risk is triggered when the second detection result indicates that the candidate abnormal transaction data has a second-level risk, output a warning message indicating that the candidate abnormal transaction data has a first-level risk, wherein the first-level risk is higher than the second-level risk. In one embodiment, the risk warning module 1030 can be used to perform the operation S230 described above, which will not be repeated here.

[0172] According to an embodiment of this application, the data determination module 1010 includes: a data acquisition submodule, a data determination submodule, and a data selection submodule. The data acquisition submodule is used to acquire multiple transaction data from a transaction graph database according to preset query conditions. The transaction graph database includes node attribute data for each of multiple nodes and edge attribute data for each of at least one edge. Nodes represent transaction objects, edges connect two nodes with transaction behavior, and transaction data represents transaction behavior data between transaction objects with a transaction relationship. The data determination submodule is used to determine multiple intermediate candidate abnormal transaction data from the multiple transaction data. The data selection submodule is used to determine candidate abnormal transaction data from the multiple intermediate candidate abnormal transaction data based on a third detection result obtained by processing the multiple intermediate candidate abnormal transaction data using a second anomaly detection model.

[0173] According to an embodiment of this application, the data determination submodule includes: a data partitioning unit, a first determination unit, a second determination unit, and an abnormal data determination unit. The data partitioning unit is used to divide multiple transaction data into multiple transaction groups using a community detection algorithm. The first determination unit is used to determine at least one first intermediate candidate abnormal transaction data from the multiple transaction groups based on anomaly detection indicators. The second determination unit is used to determine at least one second intermediate candidate abnormal transaction data from the multiple transaction data based on a fourth detection result obtained by processing the multiple transaction data using a third anomaly detection model. The abnormal data determination unit is used to obtain multiple intermediate candidate abnormal transaction data based on at least one of at least one first intermediate candidate abnormal transaction data or at least one second intermediate candidate abnormal transaction data.

[0174] According to an embodiment of this application, for any transaction data in the transaction data, the second determining unit includes: a length determining subunit, an evaluation subunit, and a first abnormal transaction determining subunit. The length determining subunit is used to determine the path length of the transaction data in each of the multiple isolated trees. The evaluation subunit is used to obtain an anomaly evaluation value based on the multiple path lengths. The first abnormal transaction determining subunit is used to determine at least one second intermediate candidate abnormal transaction data from the multiple transaction data based on the respective anomaly evaluation values ​​of the multiple transaction data.

[0175] According to an embodiment of this application, the second determining unit includes: a feature data output subunit, a reconstruction subunit, an error value determining subunit, and a second abnormal transaction determining subunit. The feature data output subunit is used to input multiple transaction data into an encoder and output coded transaction feature data for each of the multiple transaction data. The reconstruction subunit is used to input the coded transaction feature data for each of the multiple transaction data into a decoder and output reconstructed transaction data for each of the multiple transaction data. The error value determining subunit is used to determine a reconstruction error value between the transaction data and its reconstructed transaction data for any given transaction data. The second abnormal transaction determining subunit is used to determine at least one second intermediate candidate abnormal transaction data from the multiple transaction data based on the reconstructed error values ​​for each of the multiple transaction data.

[0176] According to embodiments of this application, the data selection submodule includes a feature extraction unit, a first result determination unit, a second result determination unit, a third result determination unit, and a classification result determination unit. The feature extraction unit is used to input multiple intermediate candidate abnormal transaction data into the feature extraction layer of a local neural network model and output local transaction feature data for each of the multiple intermediate candidate abnormal transaction data. The first result determination unit is used to input the local transaction feature data for each of the multiple intermediate candidate abnormal transaction data into the classification layer of the local neural network model to obtain a first classification result for each of the multiple intermediate candidate abnormal transaction data. The second result determination unit is used to input multiple intermediate candidate abnormal transaction data into a temporal neural network model and output a second classification result for each of the multiple intermediate candidate abnormal transaction data. The third result determination unit is used to input multiple intermediate candidate abnormal transaction data into a graph neural network model and output a third classification result for each of the multiple intermediate candidate abnormal transaction data. The classification result determination unit is used to obtain a third detection result based on at least one of the first, second, or third classification results for each of the multiple intermediate candidate transaction data.

[0177] According to embodiments of this application, any multiple modules of the data determination module 1010, result output module 1020, and risk warning module 1030 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the data determination module 1010, result output module 1020, and risk warning module 1030 can be at least partially implemented as a hardware circuit, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging the circuit, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the data determination module 1010, result output module 1020, and risk warning module 1030 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0178] Figure 11 A block diagram schematically illustrates an electronic device suitable for implementing an abnormal transaction processing method according to an embodiment of this application. Figure 11 As shown, an electronic device 1100 according to an embodiment of this application includes a processor 1101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1102 or a program loaded from a storage portion 1108 into a random access memory (RAM) 1103. The processor 1101 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1101 may also include onboard memory for caching purposes. The processor 1101 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0179] RAM 1103 stores various programs and data required for the operation of electronic device 1100. Processor 1101, ROM 1102, and RAM 1103 are interconnected via bus 1104. Processor 1101 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 1102 and / or RAM 1103. It should be noted that the programs may also be stored in one or more memories other than ROM 1102 and RAM 1103. Processor 1101 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0180] According to embodiments of this application, the electronic device 1100 may further include an input / output (I / O) interface 1105, which is also connected to a bus 1104. The electronic device 1100 may also include one or more of the following components connected to the input / output (I / O) interface 1105: an input section 1106 including a keyboard, mouse, etc.; an output section 1107 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN card, modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the input / output (I / O) interface 1105 as needed. A removable medium 1111, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1110 as needed so that computer programs read from it can be installed into the storage section 1108 as needed.

[0181] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0182] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 1102 and / or RAM 1103 and / or one or more memories other than ROM 1102 and RAM 1103 described above.

[0183] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the abnormal transaction processing method provided in the embodiments of this application.

[0184] When the computer program is executed by the processor 1101, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0185] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1109, and / or installed from the removable medium 1111. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0186] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 1109, and / or installed from the removable medium 1111. When the computer program is executed by the processor 1101, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0187] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0188] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0189] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A method for handling abnormal transactions, characterized in that, include: Identify candidate abnormal transaction data from multiple transaction data sets; If, based on a preset anomaly detection strategy, the first detection result of the candidate abnormal transaction data indicates that the candidate transaction data has a second level of risk, the candidate abnormal transaction data is input into the first anomaly detection model, and the second detection result is output. If the second detection result indicates that the candidate abnormal transaction data has a second level of risk, in response to the detection that the review control in the review interface indicating that the candidate abnormal transaction data has a first level of risk is triggered, a warning message indicating that the candidate abnormal transaction data has a first level of risk is output, wherein the first level of risk is higher than the second level of risk.

2. The method according to claim 1, characterized in that, The step of identifying candidate abnormal transaction data from multiple transaction data includes: According to preset query conditions, the multiple transaction data are obtained from the transaction graph database, wherein the transaction graph database includes node attribute data of multiple nodes and edge attribute data of at least one edge, the nodes represent transaction objects, the edges are used to connect two nodes with transaction behavior, and the transaction data represents transaction behavior data between transaction objects with transaction relationship; Multiple intermediate candidate abnormal transaction data are identified from the multiple transaction data; Based on the third detection result obtained by processing the plurality of intermediate candidate abnormal transaction data using the second anomaly detection model, the candidate abnormal transaction data is determined from the plurality of intermediate candidate abnormal transaction data.

3. The method according to claim 2, characterized in that, The step of determining multiple intermediate candidate abnormal transaction data from the multiple transaction data includes: The multiple transaction data are divided into multiple transaction groups using a community detection algorithm; At least one first intermediate candidate abnormal transaction data is determined from the plurality of transaction groups based on the anomaly detection index; Based on the fourth detection result obtained by processing the multiple transaction data using the third anomaly detection model, at least one second intermediate candidate anomaly transaction data is determined from the multiple transaction data; The plurality of intermediate candidate abnormal transaction data are obtained based on at least one of the at least one first intermediate candidate abnormal transaction data or the at least one second intermediate candidate abnormal transaction data.

4. The method according to claim 3, characterized in that, The third anomaly detection model includes multiple isolated trees, and the fourth detection result includes the anomaly evaluation value of each of the multiple transaction data. The step of determining at least one second intermediate candidate abnormal transaction data from the plurality of transaction data based on the fourth detection result obtained by processing the plurality of transaction data using the third anomaly detection model includes: For any of the transaction data, Determine the path length of the transaction data in each of the multiple isolated trees; An anomaly assessment value is obtained based on the multiple path lengths described; Based on the anomaly assessment values ​​of the multiple transaction data, at least one second intermediate candidate abnormal transaction data is determined from the multiple transaction data.

5. The method according to claim 3, characterized in that, The third anomaly detection model includes an encoder and a decoder, and the fourth detection result includes the reconstruction error value of each of the multiple transaction data; The step of determining at least one second intermediate candidate abnormal transaction data from the plurality of transaction data based on the fourth detection result obtained by processing the plurality of transaction data using the third anomaly detection model includes: The encoder is input into the plurality of transaction data, and the encoder outputs the coded transaction feature data of each of the plurality of transaction data. The decoder inputs the encoded transaction feature data of each of the multiple transaction data into the decoder and outputs the transaction reconstruction data of each of the multiple transaction data. For any transaction data in the transaction data, determine the reconstruction error value between the transaction data and the transaction reconstruction data of the transaction data; Based on the reconstruction error values ​​of the plurality of transaction data, at least one second intermediate candidate abnormal transaction data is determined from the plurality of transaction data.

6. The method according to any one of claims 2 to 5, characterized in that, The second anomaly detection model includes at least one of the following: a local neural network model, a temporal neural network model, or a graph neural network model; The method further includes: The multiple intermediate candidate abnormal transaction data are input into the feature extraction layer of the local neural network model, and the local transaction feature data of each of the multiple intermediate candidate abnormal transaction data are output. The local transaction feature data of each of the multiple intermediate candidate abnormal transaction data are input into the classification layer of the local neural network model to obtain the first classification result of each of the multiple intermediate candidate abnormal transaction data. The multiple intermediate candidate abnormal transaction data are input into the temporal neural network model, and the second classification result of each of the multiple intermediate candidate abnormal transaction data is output. The graph neural network model is input into the plurality of intermediate candidate abnormal transaction data and the third classification result of each of the plurality of intermediate candidate abnormal transaction data is output. The third detection result is obtained based on at least one of the first classification result, second classification result, or third classification result of the plurality of intermediate candidate transaction data.

7. The method according to claim 6, characterized in that, The second anomaly detection model is trained using multiple sample transaction data, which are obtained by processing multiple original sample transaction data using a sample balancing strategy.

8. The method according to any one of claims 1 to 5, characterized in that, Also includes: If the candidate abnormal transaction data has the first risk level, a freeze operation is performed on the transaction account associated with the candidate abnormal transaction data.

9. The method according to any one of claims 1 to 5, characterized in that, Also includes: The operations performed to obtain at least one of the first detection result, the second detection result, or the warning information are stored in the operation log.

10. The method according to any one of claims 1 to 5, characterized in that, Also includes: The original transaction data is cleaned to obtain cleaned transaction data; Key information is extracted from the cleaned transaction data to obtain key transaction data; The key transaction data is semantically parsed to obtain the transaction data.

11. The method according to claim 10, characterized in that, Also includes: Obtain source transaction data from the data warehouse; The source transaction data is converted to a new format to obtain the original transaction data.

12. An abnormal transaction processing device, characterized in that, The device includes: The data determination module is used to identify candidate abnormal transaction data from multiple transaction data sets; The result output module is used to input the candidate abnormal transaction data into the first anomaly detection model and output the second detection result when the first detection result of the candidate abnormal transaction data is determined to indicate that the candidate transaction data has a second level of risk according to the preset anomaly detection strategy. The risk warning module is used to, in response to the detection that a review control in the review interface indicating that the candidate abnormal transaction data has a first-level risk is triggered when the second detection result indicates that the candidate abnormal transaction data has a second-level risk, output warning information indicating that the candidate abnormal transaction data has a first-level risk, wherein the first-level risk is higher than the second-level risk.

13. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 11.

14. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 11.

15. A computer program product, characterized in that, It includes a computer program or instructions, characterized in that, when the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 11.

Images