Big data-based financial field consumption fraud detection method

Abstract

The application relates to the technical field of financial fraud detection, and discloses a financial field consumption fraud detection method based on big data. The method comprises the following steps: acquiring financial consumption transaction data and multi-dimensional user behavior data, and performing segmented processing according to a preset time window; determining a time sequence offset according to the correlation of transaction data sequences in multiple time windows, and calculating a behavior consistency index by combining transaction feature distribution and user behavior feature distribution after time sequence offset; determining the abnormal probability of different feature dimensions of each time window and screening abnormal feature dimensions according to the frequency domain energy difference of transaction features of adjacent time windows, the behavior consistency index and the user behavior trajectory change amount; generating a dynamic fraud risk value according to the distribution of abnormal feature dimensions, and updating the detection model parameters based on the value to complete real-time detection. Through multi-dimensional data fusion and time sequence analysis, the method dynamically captures transaction and user behavior changes, and improves the accuracy and real-time performance of financial consumption fraud detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of financial fraud detection, in particular to a financial field consumption fraud detection method based on big data. BACKGROUND

[0002] With the rapid development of financial technology, financial consumption scenarios are increasingly rich, online and offline transaction channels are continuously expanding, and transaction size is growing exponentially. In this process, consumption fraud methods are increasingly covert and diversified, and traditional fraud detection methods are gradually difficult to cope with complex fraud behaviors.

[0003] Currently, most financial institutions still rely on static rule libraries for fraud detection, that is, fixed judgment rules are summarized based on historical fraud cases, and when the transaction meets the rules, an early warning is triggered. However, this approach has obvious limitations: fraudsters will constantly adjust strategies to avoid rules, resulting in frequent updates to the rule library, high maintenance costs; static rules are difficult to capture dynamic changes and potential associations in transactions, and have weak recognition ability for new fraud patterns, which can easily lead to missed or false detections.

[0004] With the development of big data technology, although some methods attempt to use multi-dimensional data for fraud detection, there are still deficiencies in data processing and feature analysis. For example, in the time dimension, the time sequence correlation of transaction data in different time windows is not effectively mined, resulting in insufficient accuracy in grasping the dynamic changes of transaction behavior; in feature fusion, there is a lack of consistency analysis of transaction features and user behavior features, making it difficult to distinguish between normal behavior fluctuations and abnormal fraud behavior, affecting the accuracy and timeliness of detection. Therefore, constructing a method that can fully utilize the advantages of big data, dynamically capture transaction features and user behavior changes, and improve the accuracy and real-time performance of fraud detection, has become a problem that needs to be solved in the current financial field. SUMMARY

[0005] The purpose of the present application is to provide a financial field consumption fraud detection method based on big data to solve the problems raised in the background art.

[0006] To achieve the above purpose, the present application provides a financial field consumption fraud detection method based on big data, which comprises:

[0007] obtaining financial consumption transaction data and multi-dimensional user behavior data; segmenting the financial consumption transaction data and multi-dimensional user behavior data according to a preset time window;

[0008] According to the correlation between the financial consumption transaction data sequences in multiple time windows, the time sequence offset between different transaction data sequences is determined; and according to the transaction feature distribution in each time window and the user behavior feature distribution after the time sequence offset, the behavior consistency index of each time window is calculated.

[0009] According to the energy difference of the transaction features in adjacent time windows in the frequency domain, the behavior consistency index and the user behavior trajectory change amount, the abnormal probability of each time window in different feature dimensions is determined; and according to the abnormal probability of all feature dimensions, the abnormal feature dimension is screened.

[0010] According to the abnormal feature dimension distribution of all time windows, a dynamic fraud risk value is generated; and based on the dynamic fraud risk value, the detection model parameters are updated to complete real-time detection of financial consumption fraud.

[0011] Preferably, the determination of the time sequence offset between different transaction data sequences comprises:

[0012] The initial value and the iterative increment of the time sequence offset between two transaction data sequences are preset;

[0013] The numerical difference of different transaction data sequences at consecutive time points is used to construct a cross-correlation function;

[0014] The output value of the cross-correlation function after each iteration is calculated, and the time sequence offset corresponding to the maximum output value is taken as the final time sequence offset.

[0015] Preferably, the calculation of the behavior consistency index of each time window comprises:

[0016] The transaction feature distribution curve and the user behavior feature distribution curve in the same time window are extracted;

[0017] The similarity measurement result between the two distribution curves is calculated, and the similarity measurement result is taken as the behavior consistency index of the time window.

[0018] Preferably, the acquisition method of the user behavior feature distribution is: feature extraction is performed on multi-dimensional user behavior data to generate a user behavior interaction graph, and a behavior feature distribution curve is generated according to the connection strength between nodes in the user behavior interaction graph.

[0019] Preferably, the determination of the abnormal probability of each time window in different feature dimensions comprises:

[0020] For two consecutive time windows, the transaction features of the previous time window are superimposed with the time sequence offset to generate an offset feature sequence;

[0021] All sub-windows in the next time window that have time overlap with the offset feature sequence are identified;

[0022] According to the difference between the offset feature sequence of the previous time window and the numerical value of the same feature dimension in all overlapping sub-windows, and the change amplitude of the behavior consistency index, a temporary anomaly coefficient of each feature dimension is calculated;

[0023] The ratio of the behavior consistency index to the temporary anomaly coefficient is normalized, the normalized result is subtracted by a preset reference value, and the average of the cumulative results of the difference in all feature dimensions is taken as the anomaly probability of the current feature dimension of the time window.

[0024] Preferably, the calculation of the temporary anomaly coefficient of each feature dimension comprises:

[0025] The numerical change rate of the same feature dimension between the offset feature sequence of the previous time window and each overlapping sub-window is calculated respectively;

[0026] The data distribution offset degree of the same feature dimension between the offset feature sequence of the previous time window and each overlapping sub-window is calculated respectively.

[0027] The temporary anomaly coefficient of each feature dimension is composed of the numerical change rate and the data distribution offset degree; the temporary anomaly coefficient is positively correlated with the numerical change rate, and is positively correlated with the data distribution offset degree.

[0028] Preferably, the screening of the abnormal feature dimension according to the anomaly probability of all feature dimensions comprises:

[0029] The anomaly probability of each time window is calculated respectively, and the feature dimension whose anomaly probability exceeds a preset threshold is marked as an abnormal feature dimension.

[0030] Preferably, the generation of the dynamic fraud risk value according to the distribution of the abnormal feature dimension of all time windows comprises:

[0031] The set of abnormal feature dimensions of each time window is counted, and the intersection of the abnormal feature dimensions of all time windows is extracted as the core abnormal dimension;

[0032] The numerical distribution variance of the core abnormal dimension of each time window is calculated, and the weighted result of the variance and the user behavior trajectory change amount is taken as the fraud risk factor of the current time window;

[0033] The fraud risk factors of all time windows are normalized, and the normalized result is taken as the dynamic fraud risk value of each time window.

[0034] Preferably, the updating of the detection model parameters based on the dynamic fraud risk value comprises:

[0035] The product of the dynamic fraud risk value of each time window and the historical detection model parameter is taken as the temporary parameter of the current detection model.

[0036] The temporary parameters of all time windows are averaged, and the average is taken as the updated detection model actual parameter.

[0037] Preferably, the real-time detection of the completed financial consumption fraud comprises:

[0038] An integrated classifier is constructed using the updated detection model actual parameter; the real-time input financial consumption transaction data and multi-dimensional user behavior data are input into the integrated classifier, and a fraud behavior marking result is output.

[0039] Compared with the prior art, the present application has the beneficial effects that:

[0040] By obtaining the financial consumption transaction data and multi-dimensional user behavior data, a data foundation is laid for comprehensive analysis of user behavior. With the aid of preset time windows for segmented processing of data, a continuous transaction process can be divided into an analyzable unit, facilitating detailed investigation of behavior characteristics in different time periods.

[0041] In terms of time series analysis, by determining the time series offset between different transaction data sequences, the correlation between transaction data in the time dimension can be effectively captured, the dynamic change law of transaction behavior is revealed, and the problem of insufficient consideration of time factors in traditional methods is avoided. By calculating the behavior consistency index of each time window, the transaction feature distribution is combined with the user behavior feature distribution after time series offset, the matching degree between the two can be analyzed in depth, which helps to distinguish between normal behavior fluctuations and abnormal fraud signs.

[0042] Based on the energy difference of the transaction features of adjacent time windows in the frequency domain, the behavior consistency index and the user behavior trajectory change amount, the abnormal probability is determined, and multi-dimensional feature fusion analysis is realized. This multi-factor comprehensive consideration method can depict the abnormality degree of transaction behavior from different angles, reduce the deviation that may be caused by single feature analysis, and improve the comprehensiveness of abnormal behavior identification.

[0043] By screening abnormal feature dimensions and generating a dynamic fraud risk value, fraud detection can be updated in real time with time and behavior changes, and the response capability to dynamic fraud behavior is enhanced. Based on the dynamic fraud risk value, the detection model parameters are updated, forming a continuous optimization closed loop, so that the model can continuously adapt to new fraud modes and behavior changes, and the adaptability and flexibility of the detection method are improved. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 A working principle diagram of the financial field consumption fraud detection method based on big data according to the present application;

[0045] Figure 2A flowchart for determining the time offset between different transaction data sequences;

[0046] Figure 3 A flowchart for calculating the behavior consistency indicator of each time window;

[0047] Figure 4 A flowchart for determining the anomaly probability of each time window in different feature dimensions;

[0048] Figure 5 A flowchart for generating a dynamic fraud risk value based on the anomaly feature dimension distribution of all time windows. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0050] Please refer to Figure 1 The present application provides a financial field consumer fraud detection method based on big data, which comprises:

[0051] By integrating financial consumer transaction data and multi-dimensional user behavior data, time series analysis and feature distribution comparison are used to achieve efficient fraud detection. The method obtains financial consumer transaction data from data sources, including transaction amount, time, location, merchant type, and multi-dimensional user behavior data such as user login frequency, device information, browsing history, and interaction behavior. These data are usually obtained from bank systems, payment platforms, or mobile application logs, and are stored in structured or semi-structured form. After data acquisition, segmented processing is performed according to the preset time window. The length of the time window can be adjusted according to the actual application scenario. Segmented processing divides continuous data streams into multiple time segments, and the data in each time window is aggregated into a sequence form for subsequent analysis.

[0052] According to the correlation between the financial consumption transaction data sequences in multiple time windows, the time sequence offset between different transaction data sequences is determined, which is achieved by analyzing the similarity and time difference between the sequences, aiming to align the changes of different sequences in the time dimension, so as to more accurately compare the behavior patterns. Based on the transaction feature distribution in each time window and the user behavior feature distribution after time sequence offset, the behavior consistency index is calculated. The transaction feature distribution is a statistical feature extracted from the transaction data, such as transaction frequency, amount distribution, etc.; the user behavior feature distribution is derived from multi-dimensional user behavior data, reflecting the overall pattern of user activity. The behavior consistency index quantifies the consistency between transaction behavior and user behavior, and the higher the value, the more normal the behavior.

[0053] Based on the behavior consistency index, combined with the energy difference of the transaction features in the frequency domain and the change amount of the user behavior trajectory of the adjacent time windows, the abnormal probability of each time window in different feature dimensions is calculated. The frequency energy difference is obtained by Fourier transform or other spectrum analysis methods, which is used to detect the periodic change of transaction features; the user behavior trajectory change amount is obtained by calculating the time derivative or difference of behavior data. The abnormal probability reflects the degree of deviation from the normal mode in each feature dimension. According to the abnormal probability of all feature dimensions, the abnormal feature dimensions are screened, and those dimensions with probability exceeding the threshold are marked as abnormal. According to the abnormal feature dimension distribution of all time windows, the dynamic fraud risk value is generated, which integrates the historical abnormal patterns and adapts to real-time data streams by updating the detection model parameters, completing the real-time detection of financial consumption fraud. The whole process realizes the automation from data preprocessing to risk assessment, which is suitable for high-concurrency and large-data financial environment.

[0054] Embodiment 1: see Figure 2 In the process of determining the time sequence offset between different transaction data sequences, financial consumption transaction data sequences need to be processed, which are usually obtained from bank or payment system transaction records and contain information such as timestamp, transaction amount, merchant code, etc. The data sequences are arranged in chronological order, and each sequence represents the transaction activity in a period of time. In order to compare two sequences and detect pattern changes, the initial value of the preset time sequence offset is set, which is usually set to zero, indicating that there is no time difference between the sequences. However, in actual data, due to data collection delay or asynchronous transmission, the sequences often have time differences. The iteration increment is the step size of adjusting the offset, which is set according to the data sampling rate; for example, if the data is recorded every minute, the iteration increment can be set to 1 minute, allowing the offset to change in minutes. This preset process is achieved by configuring parameters, and the variable and Ensure iterations begin from a reasonable starting point. The choice of initial values ​​and iteration increments is based on domain knowledge; for example, financial transaction data is often granular at the second or minute level, so the increment setting must match this granularity to avoid overcomputation or missing important offsets. Load two sequences from the database or data stream, examine their time ranges, and initialize offset extremes. The sequence data is converted into a numerical array where each element corresponds to a transaction value at a given time point, such as the cumulative transaction amount or frequency count. Numerical differences refer to the differences in values ​​of the sequences at the same or different time points, used to quantify the similarity between sequences; for example, sequences... In time Values ​​and sequences In time The difference between the values. When constructing the cross-correlation function, these numerical differences are utilized. The cross-correlation function is a mathematical function used to measure the correlation strength between two sequences at different offsets. It is implemented by iterating through all possible offsets and summing the products or differences of the corresponding points at the extremes. In the extremes, for each candidate offset, the sequences are... with sequence After translation, the aggregated value of the numerical differences at all time points of the extreme value is obtained by comparison, such as summation or averaging.

[0055] This function outputs a value representing the degree of matching between the sequences at that offset; the higher the output value, the more similar the sequences. The iterative process starts from the initial offset and gradually increases or decreases the offset by iteration increments, resetting the output value of the cross-correlation function after each adjustment. When outputting the extreme value, a loop structure is used; the maximum value is identified by comparing all extreme values, and a simple comparison algorithm is used to record the maximum value and its offset. The final time-series offset is used in subsequent steps, such as aligning sequences for consistency checks. In implementation, considering the efficiency of extreme values, due to the large volume of financial data, optimization algorithms such as the Fast Fourier Transform may be used to accelerate cross-correlation extreme values, but the core remains iterative based on numerical differences. In terms of terminology, the time-series offset refers to the relative movement of two sequences on the time axis, much like adjusting the synchronization of video and audio, but here it is used for data sequences; the initial value is the initial guess; the iteration increment is the step size of each adjustment; the cross-correlation function is a tool for measuring sequence similarity; the numerical difference is the difference between sequence values; the output value is the result of the cross-correlation function; and the final time-series offset is the determined optimal alignment value. The entire process ensures the temporal extrema of the sequences, providing a foundation for subsequent analysis, but does not assert the validity of the results; it only describes the method itself. The construction of the cross-correlation function is based on the numerical differences at continuous time points. Specifically, for two sequences... and The lengths are respectively and Cross-correlation function Defined as for offset ,extremum and The function values ​​over all valid t. Numerical differences can take various forms, such as absolute differences, differences of squares, or dot products, but the dot product form is most commonly used:

[0056]

[0057] in: Represents the offset. and This is the extremum of a function over all valid t. Since the sequences may have varying lengths or missing time intervals, boundary conditions need to be handled, such as by padding or truncating the sequence to ensure the extremum's feasibility. When constructing the function, the sequence is normalized or standardized to avoid scaling effects; for example, subtracting the mean from the sequence values ​​and dividing by the standard deviation ensures the data are on the same scale. An offset is defined. Scope The range, from the negative maximum offset to the positive maximum offset, is determined by the time span of the sequence; for example, if the sequence covers one day of data, The range may be from -24 hours to +24 hours, with hourly increments for each iteration. The extreme value is the output value for each iteration, i.e., for each... ,extremum The value of the extreme value is obtained by iterating through all time points, for each... ,examine If a cross-correlation function exists, it is skipped or a default value is used if the value is outside the sequence range, but typically only the overlapping extreme values ​​are considered. The way numerical differences are aggregated affects the function's behavior; if a dot product is used, high values ​​indicate positive correlation; if a sum of squared differences is used, low values ​​indicate similarity. In financial data, trading sequences may be noisy, so the cross-correlation function needs to be smoothed, for example, by applying a moving average or filtering to the before extreme values ​​of the sequence to reduce the impact of random fluctuations. The iterative process is implemented as a loop in the code, initializing variables... and For each ,extremum ,if Greater than Then update and Iterative incremental control The step size of the iteration is crucial; a smaller step size results in higher accuracy but a larger number of extreme values, thus requiring a balance. For example, for high-frequency trading data, the iteration increment might be set to milliseconds, while for daily data, it might be set to hours. When outputting extreme values, parallel extrema might be used to handle large datasets, such as partitioning the range τ across multiple processors for simultaneous extrema. Determining whether the output value has reached its maximum requires considering multiple local maxima, but it is usually assumed that a global maximum exists, and this is achieved by comparing all... The value is determined. When the iteration is complete, The final time shift is the maximum of the cross-correlation function. The continuous time points refer to the data points arranged in chronological order; the numerical difference is the difference between values; the cross-correlation function is a similarity measure of the output sequence of a function; the output value is the result of the function extremum; the iteration is the repeated extremum process. Implementing the extremum ensures data integrity, such as handling timestamp errors or missing values, by maintaining sequence continuity through interpolation or omission.

[0058] Once the cross-correlation function extremum is completed and the output value maximum shift extremum is identified, this final time shift is used to adjust the sequence time extremum. For example, if the final time shift of sequence A and sequence B is 2 hours, it means moving sequence B forward 2 hours or sequence A backward 2 hours to make them best aligned. This shift is stored as metadata for subsequent steps such as extremum behavior consistency indicators. In implementation, the final time shift may be negative, indicating that sequence A leads sequence B, so the adjustment direction needs to be handled according to the sign. The extremum process may involve multiple iterations to refine the results, such as coarse adjustment first and then fine adjustment: first find the approximate range with large iteration increments, and then reduce the increment for local search to improve accuracy. When the output value of the cross-correlation function is maximum, it may not be the only point, so you need to handle the tie situation, such as choosing the first or last maximum value, but usually take the first one to ensure consistency. In the financial context, the time shift helps to identify the time delay of trading patterns, such as the user's transactions on different devices may have a time delay. In terms of terminology explanation, the final time shift is the determined time adjustment value; the output value maximum means the best matching point. Code implementation includes function definition, loop structure and value comparison, using programming languages such as The library where The function can be used for extremum cross-correlation, but custom implementation allows more flexible control. Data sequences come from big data platforms such as Hadoop or Spark, and when processing distributed data, sequences need to be distributed to node extremum cross-correlation. The time shift is used for subsequent analysis, but it does not claim to improve detection, only as part of the method. The whole process emphasizes detailed steps to ensure implementability and avoid vague descriptions.

[0059] Example 2: refer to Figure 3In calculating the behavior consistency indicator of each time window, it is necessary to extract the corresponding feature distribution curve from the financial consumption transaction data and multi-dimensional user behavior data. The transaction feature distribution curve is generated by aggregating the transaction data within the time window. For example, for a preset one-hour time window, the transaction data includes transaction amount, transaction frequency, merchant type, etc. These data are aggregated into statistical features such as the average value, standard deviation or histogram distribution of the amount, thereby forming a curve representing the distribution of transaction features over time or value. In specific implementation, after querying the transaction data from the database, the data processing library such as Pandas is used for grouping and aggregation, generating a numerical vector or sequence, where each element represents a feature value or the frequency of a bucket. The acquisition of the user behavior feature distribution curve involves the processing of multi-dimensional user behavior data; the multi-dimensional user behavior data includes user login frequency, page browsing history, device information, interaction events, etc. These data are usually stored in log files and need to be cleaned and feature extracted first. The feature extraction process includes identifying key behavior indicators such as login frequency, session length, click rate, etc. These indicators are used to construct a user behavior interaction graph. The user behavior interaction graph is a graph structure in which nodes represent different behavior entities or event types, such as login nodes, transaction nodes, browsing nodes, and edges represent the association between behaviors, with connection strength determined by calculating co-occurrence frequency, time proximity or correlation weight; for example, if a user often makes a transaction immediately after logging in, the edge weight between the login node and the transaction node is high. From the user behavior interaction graph, the behavior feature distribution curve is generated by analyzing the node attributes or edge weights, for example, calculating the degree centrality or clustering coefficient of each node, and sorting or normalizing these values to form a distribution curve representing the overall pattern of user behavior. Once the two curves, the transaction feature distribution curve and the user behavior feature distribution curve, are ready, the next step is to calculate their similarity measure; the similarity measure is used to quantify the consistency of the two curves. Common methods include cosine similarity, Euclidean distance or dynamic time warping, but in this implementation, cosine similarity is used as an example because it can effectively capture directional consistency and is computationally efficient. Similarity measure The formula is:

[0060]

[0061] Where: represents the transaction feature distribution curve vector, represents the user behavior feature distribution curve vector, represents the dot product of vectors and , i.e. the sum of the products of corresponding elements, represents the Euclidean norm of vector , i.e. the square root of the sum of the squares of all elements, and similarly is the Euclidean norm of vector . Dot product measures the alignment of two vectors in direction, the larger the element values and the same direction, the larger the dot product; norm is used to normalize the vector length, making the similarity value range between -1 and 1, but usually take absolute value or adjust to 0 to 1 range, where 1 means complete agreement, 0 means no correlation. Ensure that the two curve vectors have the same length, which can be processed by interpolation or clipping; encode dot product and norm using programming languages such as Python library. This similarity measure result is directly used as the behavior consistency indicator of this time window, the higher the value, the more consistent the transaction behavior with the user behavior, the lower the potential fraud risk. The entire extraction and calculation process is automated and integrated into a data stream processing system to process real-time data streams; for example, in the framework, window functions and vector operations are used to achieve efficient computation. Transaction feature distribution curve is a line chart showing the statistical summary of transaction data, user behavior feature distribution curve is a similar line chart representing user activity patterns, user behavior interaction graph is a network graph showing how behaviors are connected, dot product is a mathematical operation , norm is a vector length measure, and similarity measure is a number representing the matching degree. In implementation, data noise and missing values need to be handled, such as smoothing the curve by moving average or filling with default values, to ensure calculation stability.

[0062] The method for obtaining user behavior feature distribution involves in-depth processing of multi-dimensional user behavior data, which usually comes from multiple sources such as application server logs, database records or third-party APIs, containing structured fields such as timestamp, user ID, behavior type and unstructured data such as device fingerprint or IP address. Data preprocessing includes cleaning invalid records, handling missing values, and standardizing timestamps to align time windows; for example, the time window is set to 1 hour, and all behavior data is grouped by hour. Feature extraction stage identifies key behavior features, which can be numerical, categorical or sequential; common techniques include count aggregation, one-hot encoding or sequence embedding, but in order to generate user behavior interaction graph, the focus is on extracting the association between behavior events. The construction of user behavior interaction graph starts with defining nodes and edges; nodes represent unique behavior events or categories, such as each node corresponding to a behavior type like "login" or "transaction", or more granular like "login_from_mobile"; edges represent the continuity between behaviors, and the connection strength is quantified by calculating the behavior co-occurrence probability or time difference; for example, use sliding window to analyze behavior sequence, if two behaviors often occur continuously in a short time, the edge weight between them is higher. Weight calculation can use similarity, pointwise mutual information, or simple frequency counts; in implementation, use a graph database like Neo4j or in-memory data structure like an adjacency matrix to store the graph. Once the graph is constructed, behavioral feature distribution curves are derived from the graph; this is achieved by analyzing graph properties, e.g. computing the degree values of each node and sorting these values to form a distribution curve; or using graph algorithms like or community detection to output node importance scores, normalizing these scores into a distribution. The distribution curve can be a histogram, a probability density function, or a simple list of values; for example, a degree value distribution curve shows that most nodes have few connections and a few nodes have many connections, which reflects the concentration of user behavior. After generating the curve, align it with the transaction feature distribution curve in the time dimension, as user behavior data can have delays, use a time offset to adjust the user behavior curve timestamps to ensure comparison within the same time range. Implementation details include using libraries like to handle graph operations, code example for computing node degree distribution: , using to generate the distribution curve. Multi-dimensional user behavior data is a record of user activities from multiple sources, the user behavior interaction graph is a network that visualizes the relationship between behaviors, nodes are points in the graph representing behaviors, edges are connecting lines representing relationships, connection strength is the weight of the edge representing the strength of the association, and the behavioral feature distribution curve is a line graph showing the distribution of behavior values. The whole process emphasizes scalability, using distributed computing like to efficiently handle billions of behavior events. Data privacy considerations, anonymize user information before processing, comply with regulatory requirements. In implementation, curve generation may involve smoothing techniques like kernel density estimation to reduce noise, but the core is to extract feature distribution based on graph theory principles.

[0063] One financial application scenario, time window set to 1 hour, transaction data includes user's transaction amount and time, user behavior data includes login time, device switching, page view count. For transaction feature distribution curve, extract transaction amount distribution from transaction data: bucket the amount (e.g. 0-100, 100-500, etc.), calculate transaction frequency for each bucket, form a curve representing amount distribution, e.g. vector A=[freq_bucket1, freq_bucket2,...]. For user behavior feature distribution curve, process behavior data: collect user's login events, browse events, etc. within an hour, feature extraction identifies key indicators such as login frequency, average session duration, construct user behavior interaction graph; define nodes as behavior types: "login", "browse", "transaction", edges based on time series association: if a transaction occurs within 5 minutes after login, increase edge weight; use co-occurrence frequency to calculate weight, generate behavior feature distribution curve by calculating weighted degree of each node, sort these values to form distribution vector B=[weighted_degree_login, weighted_degree_browse,...]. In code, implement dot product and norm, implement division; for example in Python, use :dot_product= .dot(A,B),norm_A= ,norm_B= ,S=dot_product / (norm_A*norm_B). This S value is the behavior consistency indicator, if S is close to 1, it indicates that the transaction amount distribution and behavior association distribution are highly consistent, indicating normal behavior; if S is low, it may indicate abnormality. In implementation, when processing actual data, the vectors may not be of the same length, so zero padding or dynamic time warping is used for alignment. The entire process is integrated into a real-time detection system, running automatically once an hour, using stream processing frameworks such as Kafka and to process data streams, output the consistency indicator for subsequent anomaly probability calculation. The transaction feature distribution curve is like a line showing how transaction money is distributed, the user behavior feature distribution curve is similar to a line showing user action patterns, the user behavior interaction graph is a network graph where points represent action types, lines represent how actions are linked, connection strength is the thickness of the line indicating the strength of the association, dot product is a mathematical calculation, norm is the calculation of vector length, similarity measure is a number that tells us how well two lines match. Implementation ensures robustness, handles edge cases such as division by zero errors, and logs are recorded for debugging.

[0064] Example 3: see Figure 4In determining the anomaly probability of each time window in different feature dimensions, the data of the two consecutive time windows is processed; for the two consecutive time windows, the transaction features of the previous time window are superimposed to generate an offset feature sequence after the time offset obtained from the previous step, the time offset is a time adjustment value for aligning the data of different time windows, and the offset feature sequence is a sequence obtained by shifting the transaction feature data of the previous time window on the time axis by the offset, for example, if the transaction features of the previous time window include a sequence of numerical values of the average transaction amount per hour, and the time offset is determined as several time units, then the offset feature sequence is generated by removing or adjusting the time index, ensuring that it partially overlaps with the time range of the next time window. Identify all sub-windows in the next time window that have a time overlap with the offset feature sequence; the sub-window is a smaller time segment within the next time window, which may have a fixed or variable length, for example, if the time window is one hour, the sub-window can be set to fifteen minutes, and the identification is based on timestamp matching, which traverses all possible sub-windows in the next window and checks whether their time range intersects with the time range of the offset sequence, for example, the offset sequence covers a certain time point, and the sub-window of the next window covers another time point, if the time points overlap, there is an overlap.

[0065] All overlapping sub-windows are identified using a sliding window algorithm or a time interval query, and their time ranges and feature data are stored. The temporary anomaly coefficient of each feature dimension is calculated according to the difference in the same feature dimension between the offset feature sequence of the previous time window and the numerical value in all overlapping sub-windows, and the change amplitude of the behavior consistency indicator; the numerical difference is the difference between the values of the offset sequence and the sub-window sequence in the same feature dimension, which can be an absolute difference, a relative difference, or a statistical difference; the change amplitude of the behavior consistency indicator is the absolute value of the difference between the behavior consistency indicators of the previous and next windows, and the behavior consistency indicator is obtained from the previous step and represents the degree of behavior consistency. The temporary anomaly coefficient is composed of the numerical change rate and the data distribution offset degree; the numerical change rate is a quantitative measure of the numerical difference, calculated as the percentage or derivative of the value change of the offset sequence and the sub-window sequence in the feature dimension; the data distribution offset degree is a measure of the change in the shape of the distribution, obtained by comparing the data distribution of the offset sequence and the sub-window sequence, for example, using a statistical distance function. The temporary anomaly coefficient is positively correlated with the numerical change rate and the data distribution offset degree, meaning that the larger the change rate or offset degree, the higher the coefficient; in implementation, the coefficient calculation can be represented as a weighted sum. After calculating the temporary anomaly coefficient of each feature dimension, the ratio of the behavior consistency indicator to the temporary anomaly coefficient is normalized; the behavior consistency indicator is the value of the current time window, the temporary anomaly coefficient is the calculated value, the ratio is obtained by division, and the normalization scales the ratio to the range of zero to one, for example, using min-max normalization or The function is subtracted by a preset reference value, which is usually set to one, representing the ideal state, and the difference is calculated by subtraction. The average of the cumulative results of the difference in all feature dimensions is taken as the anomaly probability of the current feature dimension in the time window; the difference of all feature dimensions is accumulated and divided by the number of features to obtain the average, which is the anomaly probability. The higher the value, the greater the possibility of abnormality in that dimension. In implementation, the feature dimensions include transaction amount, frequency, user behavior indicators, etc. The above process is repeated for each dimension, and the anomaly probability value of each dimension is output. The whole process is automated, and programming is used to realize loops and mathematical operations, integrated into a stream processing system for real-time execution. The time window is a time period such as one hour, the feature dimension is a data attribute such as transaction amount, the time series offset is the time moving value, the offset feature sequence is the data sequence adjusted in time, the sub-window is a small time period, the numerical difference is the value difference, the behavior consistency indicator is the behavior matching score, the temporary anomaly coefficient is the temporary anomaly score, the numerical change rate is the change speed, the data distribution offset degree is the distribution change degree, the normalization is the scaled value, the preset reference value is the reference value, and the anomaly probability is the measure of the possibility of abnormality. Implementation ensures that boundary conditions are handled, such as setting the anomaly probability to a default value when there is no overlapping sub-window, and recording calculation logs.

[0066] The detailed process of calculating the temporary anomaly coefficient of each feature dimension involves multiple steps. For each feature dimension, such as the transaction amount dimension, the numerical change rate of the offset feature sequence of the previous time window and each overlapping sub-window in the same feature dimension is calculated respectively. The numerical change rate is the rate of value change, which is calculated as the relative or absolute change of the sub-window value and the offset sequence value. In implementation, for each overlapping sub-window, the average or median of the feature dimension in the sub-window is calculated, and compared with the corresponding value of the offset sequence to obtain the numerical change rate, which is a scalar value or multiple values. The data distribution offset degree of the offset feature sequence of the previous time window and each overlapping sub-window in the same feature dimension is calculated respectively. The data distribution offset degree is a measure of distribution difference, which is achieved through statistical tests or distance functions, such as using divergence or variance ratio to calculate the difference between the two sequence distributions. In implementation, the sequence distribution is obtained through histogram or kernel density estimation, and the distribution distance is calculated. For each sub-window, the data distribution offset degree value is calculated. The temporary anomaly coefficient of each feature dimension is composed of the numerical change rate and the data distribution offset degree; the coefficient is calculated as a function of the numerical change rate and the data distribution offset degree, such as linear combination. The temporary anomaly coefficient is positively correlated with the numerical change rate and the data distribution offset degree, indicating that if the numerical change is fast or the distribution change is large, the coefficient increases; the weight is adjusted according to the application scenario. The formula is:

[0067]

[0068] Wherein: represents the temporary anomaly coefficient, is a scalar value; represents the numerical variation rate, calculated as the average of all overlapping sub-window numerical variation rates, measures the average rate of value changes; represents the data distribution deviation, calculated as the average of all overlapping sub-window data distribution deviations, measures the average degree of distribution difference; represents the weight of the numerical variation rate, is a coefficient for adjusting the importance of the numerical variation rate in the temporary anomaly coefficient; represents the weight of the data distribution deviation, is a coefficient for adjusting the importance of the data distribution deviation in the temporary anomaly coefficient. and is the weight coefficient, usually satisfies = 1, set according to experience, for example, by training historical data or fixed values such as = 0.6, = 0.4. Calculating R and D requires aggregating the results of all overlapping sub-windows, using a loop to iterate through the sub-windows, calculating the numerical variation rate and data distribution deviation of each sub-window, and averaging. When processing large data, use the map-reduce mode for parallel computing. The numerical variation rate is a measure of the speed of value change, the data distribution deviation is a measure of the size of the data distribution change, the temporary anomaly coefficient is a score that combines these changes, and the weight is an importance coefficient. Implementation includes error handling, such as division by zero error, and ensures consistency in distribution calculation.

[0069] Two consecutive time windows: a preceding time window W1 and a following time window W2, the timing offset is determined as two time units, the transaction feature of W1 is a sequence of numerical values of transaction amounts, and the offset feature sequence generated after superimposing the offset is adjusted to a specific value. The transaction feature of W2 is other numerical values, and the overlapping sub-window is identified: if the length of the sub-window is set to a certain time unit, W2 has multiple sub-windows, and the offset sequence time range is compared with the W2 sub-window time range to determine the overlapping sub-window. For the transaction amount dimension, the numerical value change rate is calculated: for each overlapping sub-window, the value is compared with other values, and the numerical value change rate is calculated as a ratio or difference. Calculate the data distribution offset degree: compare the distribution of the offset sequence with the distribution of the sub-window, and use the variance ratio or other methods to calculate the distribution offset degree. If there are multiple feature dimensions, accumulate the difference values of all dimensions to obtain the average as the anomaly probability. In implementation, the feature dimensions may include other indicators, and the calculation is repeated for each dimension to output the anomaly probability. The formula character meanings have been explained. The implementation ensures real-time, uses a stream processing framework, automatically calculates each time window, and outputs the anomaly probability for risk decision-making. The time window is a time period, the feature dimension is a data category such as the amount, the timing offset is the time movement, the offset feature sequence is the data adjusted in time, the sub-window is a small time period, the numerical value change rate is the value change percentage, the data distribution offset degree is the distribution change size, the temporary anomaly coefficient is the temporary anomaly score, the behavior consistency indicator is the behavior matching degree, the normalization is the numerical value range adjustment, the preset reference value is the reference number, and the anomaly probability is the anomaly opportunity. The implementation handles data missing, such as skipping calculation when there is no data, and optimizes the calculation efficiency by pre-computing distribution statistics. The whole process is based on mathematical principles, providing a repeatable way to evaluate anomaly probability.

[0070] Embodiment 4: refer to Figure 5 When screening abnormal feature dimensions according to the anomaly probability of all feature dimensions, the anomaly probability of all feature dimensions in each time window needs to be calculated respectively. The anomaly probability is a numerical value obtained from the previous step, indicating the degree of deviation of each feature dimension from the normal mode, with a value range of 0 to 1, and the higher the value, the greater the abnormality probability. In implementation, for each time window, all feature dimensions such as transaction amount, transaction frequency, user login times, and device switching frequency are traversed, and their anomaly probability values are read. The preset threshold is a threshold value for judging whether it is abnormal or not, which is usually set according to historical data or field experience, for example, set to 0.7, indicating that when the anomaly probability exceeds 0.7, the feature dimension is considered abnormal. Feature dimensions with anomaly probability exceeding the preset threshold are marked as abnormal feature dimensions; the marking process involves conditional judgment, for example, using if statements in the code: The result is a set of abnormal feature dimensions, containing labeled dimension names or indices, for subsequent analysis. The implementation ensures that all time windows are processed, using a loop structure to iterate through each window, and outputs a set of abnormal feature dimensions for each window. Data storage uses data structures such as lists or dictionaries to record abnormal dimensions for each time window. Feature dimensions are data attributes or indicators, such as transaction amount; abnormal probability is a numerical value of abnormality likelihood; preset threshold is a judgment threshold; abnormal feature dimension is a data attribute labeled as abnormal. The implementation includes error handling, such as skipping when abnormal probability is null, and logging for auditing.

[0071] To generate dynamic fraud risk values from the distribution of abnormal feature dimensions across all time windows, count the set of abnormal feature dimensions for each time window; for example, the set of abnormal dimensions for time window W1 is {A, B}, W2 is {A, C}, and W3 is {B, C}, where A, B, and C represent different feature dimensions such as transaction amount, frequency, etc. Extract the intersection of abnormal feature dimensions across all time windows as core abnormal dimensions; the intersection refers to those abnormal dimensions that appear in all time windows, achieved through set operations, such as intersection = W1 ∩ W2 ∩ W3, if A appears in all windows, then the core abnormal dimensions include A; otherwise, it can be empty or multiple dimensions. In the implementation, use set operations in programming languages such as Python, set.intersection(*all_sets), where all_sets is a list of abnormal dimension sets for all windows. Core abnormal dimensions represent persistent abnormal patterns, which may indicate systematic fraudulent behavior. Calculate the variance of the numerical distribution of core abnormal dimensions for each time window; the numerical distribution refers to the sequence of numerical values of the core abnormal dimension within that time window, for example, for core dimension A, the numerical values in time window W1 are [100, 150, 200], the variance calculates the degree of dispersion of these values, the specific calculation process is to calculate the mean value of the numerical sequence, calculate the square of the difference between each numerical value and the mean value, and take the average of these square values. The weighted result of this variance and the user behavior trajectory change amount is taken as the fraud risk factor of the current time window; the user behavior trajectory change amount is calculated from user behavior data. Normalize the fraud risk factors for all time windows, which scales values to the range of 0-1. The normalized result is taken as the dynamic fraud risk value of each time window, with higher values indicating higher fraud risk. In the implementation, dynamic fraud risk values are stored as a time series for real-time monitoring. The set of abnormal feature dimensions is a group of abnormal dimensions; the core abnormal dimension is a common abnormal dimension; the variance of the numerical distribution is the degree of value fluctuation; the user behavior trajectory change amount is the size of behavior change; the fraud risk factor is the risk score; normalization is numerical scaling; the dynamic fraud risk value is the final risk score. The implementation ensures computational efficiency by precomputing statistical values and handling data missing cases, as shown in Table 1.

[0072] Table 1: Time window anomaly feature dimension table.

[0073] Time window number Abnormal feature dimension set Core abnormal dimension Numerical distribution variance User behavior trajectory change amount Fraud risk factor Normalized risk value W1 A, B A 50.0 0.3 30.3 0.65 W2 A, C A 48.5 0.4 29.5 0.63 W3 B, C None 0.0 0.5 0.2 0.05

[0074] Three time windows W1, W2, W3, after anomaly probability calculation, filter anomaly feature dimensions: in W1, dimension A anomaly probability 0.8 exceeds threshold 0.7, dimension B anomaly probability 0.75 exceeds threshold, so anomaly feature dimension set is {A, B}; in W2, dimension A anomaly probability 0.9, dimension C anomaly probability 0.8, set is {A, C}; in W3, dimension B anomaly probability 0.78, dimension C anomaly probability 0.85, set is {B, C}. Extract all window anomaly dimension intersection: W1∩W2∩W3={}, so core anomaly dimension is empty. But for example, assume A appears in all windows, then core anomaly dimension is A. Calculate each time window core anomaly dimension numerical distribution variance: for W1, core dimension A numerical value is [100, 150, 200], calculate average, calculate the square of the difference between each numerical value and the average, and the average of these square values is the variance. For W2, core dimension A numerical value [110, 160, 210], variance is similar to calculate; W3 has no core dimension, variance is set to 0. User behavior trajectory change quantity is calculated from behavior data, assume W1 is 0.3, W2 is 0.4, W3 is 0.5. Fraud risk factor calculation: set weight w1=0.6, w2=0.4, W1 factor=0.61666.67+0.40.3≈1000.002. Normalized risk value: factor value is scaled to 0-1, assume W1 factor 1000, W2 factor 950, W3 factor 10, then normalized W1 risk value=(1000-10) / (1000-10)≈1.0, but the example value in the table is 0.65 based on actual calculation. Dynamic fraud risk value is used to update the detection model, driving real-time alerts.

[0075] In the process of updating detection model parameters based on dynamic fraud risk values, it is necessary to obtain the dynamic fraud risk value of each time window, which is calculated from the previous step and represents the degree of fraud risk of each time window, usually ranging from 0 to 1, the higher the value, the greater the risk. The historical detection model parameters are the values obtained from the previous model training or initialization, which may include weights, biases or other model configuration parameters, and the initial value is usually based on historical data training or default settings. The product of the dynamic fraud risk value of each time window and the historical detection model parameter is used as the temporary parameter of the current detection model; this product operation takes the risk value as a scaling factor to adjust the historical parameter, for example, if the dynamic fraud risk value is R and the historical parameter is P, then the temporary parameter T is equal to R multiplied by P. In implementation, for each time window, read its dynamic fraud risk value and multiply it with the historical parameter to get the temporary parameter corresponding to this window, the temporary parameter is stored as an intermediate result for subsequent calculation. Ensure that the model parameters are adjusted dynamically according to the real-time risk, enhance the adaptability of the model to the current data. Take the average of all temporary parameters as the updated detection model actual parameter; the average calculation is realized by summing all temporary parameters and dividing by the number of time windows, for example, if there are N time windows and the temporary parameters are T1 to TN, then the actual parameter is equal to T1 plus T2 to TN divided by N. This average operation smooths the parameter change and avoids the instability of the model caused by the risk fluctuation of a single time window, ensuring that the updated parameter reflects the overall risk trend. Implementation details include using programming loops to iterate through all time windows, calculating products and cumulative sums, and taking averages; data storage uses array or list structure to ensure efficient calculation.

[0076] To perform real-time detection of financial consumer fraud, an updated detection model actual parameter is used to build an ensemble classifier. An ensemble classifier is a machine learning model that combines multiple base classifiers, such as random forests or gradient boosting machines. The actual parameter is used to configure the hyperparameters or weights of these classifiers, such as the number of decision trees, depth, or learning rate. The building process involves initializing the classifier architecture, assigning the actual parameter to the corresponding configuration, such as setting the parameters of the classifier in the code, for example, the number of trees takes the first value of the actual parameter, and the maximum depth takes the second value of the actual parameter. The real-time input financial consumer transaction data and multi-dimensional user behavior data are input into the ensemble classifier. The real-time data is read from data stream sources such as message queues or databases, pre-processed such as cleaning and feature extraction, and converted into the input format required by the classifier, such as a numerical feature vector. The output is a fraud behavior label result. The label result is usually a binary classification output, 0 for normal transaction and 1 for fraudulent transaction, possibly accompanied by a confidence score, such as an output probability value representing the fraud likelihood. In implementation, the ensemble classifier serves as an inference engine, processing input data in real-time, and the output result is stored or sent to an alarm system. The entire real-time detection process is integrated into a stream processing framework to ensure low-latency processing; code implementation includes model loading, data preprocessing, prediction calling, and result output. The implementation ensures system scalability, handling high-concurrency data, and includes model version management and rollback mechanisms to prevent update failures. Assuming there are three time windows W1, W2, W3, with dynamic fraud risk values of 0.65, 0.63, and 0.05 respectively, and the historical detection model parameters are assumed to be two numerical values, for example, 100 and 0.5. Calculate the temporary parameters: for W1, the temporary parameters are equal to 0.65 multiplied by 100 to get the first value, and 0.65 multiplied by 0.5 to get the second value; for W2, the temporary parameters are equal to 0.63 multiplied by 100 to get the first value, and 0.63 multiplied by 0.5 to get the second value; for W3, the temporary parameters are equal to 0.05 multiplied by 100 to get the first value, and 0.05 multiplied by 0.5 to get the second value.

[0077] The actual parameter is equal to the sum of the first values of all temporary parameters divided by 3 to get the first actual parameter, and the sum of the second values of all temporary parameters divided by 3 to get the second actual parameter. This actual parameter is used to build an ensemble classifier; for example, using a random forest classifier, setting the number of trees to the first actual parameter rounded, and the learning rate to the second actual parameter. Real-time input data such as user transaction amount 150 yuan, login times 5 times, etc. are input into the classifier after feature engineering, and the output label result is output, such as fraud probability 0.8, which exceeds the threshold and is marked as fraud. In implementation, when processing real-time data stream, each data received is called to predict, and the output result triggers corresponding operations such as generating an alarm or preventing transactions.

[0078] It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting; it is not intended to exclude myriad other embodiments of the present application that other inventors can develop based on the same general inventive concepts embodied by the described embodiments. That is, although the present application is described in terms of particular embodiments and implementations, it is to be understood that the terminology used is for the purpose of descriptive clarity and that it should be taken in its broadest possible sense. For example, the terms "a", "an", and "the" include both singular and plural referents unless the context clearly dictates otherwise. The terms "comprises", "comprising", "includes", "including" and the like can be used in conjunction with the term "consisting of to include the elements or steps listed after such conjunctive language, but not to the exclusion of other elements or steps. The singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise.

[0079] While the embodiments of the application have been shown and described herein, it is to be understood that the application is not limited to these embodiments. Rather, many modifications, changes and substitutions are intended to fall within the scope of the present application, which is limited only by the scope of the claims hereinafter appended.

Claims

1. A method for detecting consumer fraud in the financial sector based on big data, characterized in that, The method includes the following steps: Acquire financial consumer transaction data and multi-dimensional user behavior data; segment the financial consumer transaction data and multi-dimensional user behavior data according to preset time windows; Based on the correlation between financial consumer transaction data sequences within multiple time windows, the time series offset between different transaction data sequences is determined; based on the transaction feature distribution within each time window and the user behavior feature distribution after the time series offset, the behavioral consistency index for each time window is calculated. Based on the energy differences in the frequency domain, behavioral consistency indicators, and changes in user behavior trajectories of transaction characteristics in adjacent time windows, the anomaly probability of each time window in different feature dimensions is determined; and the anomaly feature dimensions are filtered based on the anomaly probabilities of all feature dimensions. Determining the anomaly probability of each time window across different feature dimensions includes: For two consecutive time windows, the transaction characteristics of the previous time window are superimposed with the time series offset to generate an offset feature sequence. Identify all sub-windows within the subsequent time window that overlap with the offset feature sequence in time; Based on the numerical differences between the offset feature sequence of the previous time window and the same feature dimension in all overlapping sub-windows, and the magnitude of change in the behavioral consistency index, calculate the temporary anomaly coefficient for each feature dimension. The ratio of the behavioral consistency index to the temporary anomaly coefficient is normalized. The normalized result is subtracted from the preset benchmark value, and the average of the accumulated difference across all feature dimensions is taken as the anomaly probability of the current feature dimension in the time window. The calculation of the temporary anomaly coefficient for each feature dimension includes: Calculate the rate of change of the previous time window offset feature sequence and the numerical value of each overlapping sub-window in the same feature dimension; Calculate the data distribution offset of the previous time window offset feature sequence and each overlapping sub-window in the same feature dimension; The temporary anomaly coefficient for each feature dimension consists of the rate of change of the numerical value and the data distribution offset; the temporary anomaly coefficient is positively correlated with the rate of change of the numerical value and also positively correlated with the data distribution offset. Dynamic fraud risk values ​​are generated based on the distribution of abnormal features across all time windows; the detection model parameters are updated based on these dynamic fraud risk values ​​to achieve real-time detection of financial consumer fraud. The process of generating dynamic fraud risk values ​​based on the distribution of abnormal features across all time windows specifically includes: Collect the set of abnormal feature dimensions for each time window; extract the intersection of the abnormal feature dimensions of all time windows as the core abnormal dimension; Calculate the variance of the core anomaly dimension values ​​for each time window, and use the weighted result of this variance and the change in user behavior trajectory as the fraud risk factor for the current time window; The fraud risk factors for all time windows are normalized, and the normalization result is used as the dynamic fraud risk value for each time window.

2. The method for detecting consumer fraud in the financial field based on big data as described in claim 1, characterized in that, Determining the time offset between different transaction data sequences includes: Preset the initial value and iteration increment of the time offset between two transaction data sequences; A cross-correlation function is constructed by utilizing the numerical differences of different transaction data sequences at consecutive time points; Calculate the output value of the cross-correlation function after each iteration, and take the time offset corresponding to the maximum output value as the final time offset.

3. The method for detecting consumer fraud in the financial field based on big data as described in claim 1, characterized in that, The calculation of the behavioral consistency index for each time window includes: Extract the transaction feature distribution curve and user behavior feature distribution curve within the same time window; Calculate the similarity measure between the two distribution curves and use the similarity measure as a behavioral consistency indicator for that time window.

4. The method for detecting consumer fraud in the financial field based on big data as described in claim 3, characterized in that, The method for obtaining the user behavior feature distribution is as follows: feature extraction is performed on multidimensional user behavior data to generate a user behavior interaction graph, and a behavior feature distribution curve is generated based on the connection strength between nodes in the user behavior interaction graph.

5. The method for detecting consumer fraud in the financial field based on big data as described in claim 1, characterized in that, The step of filtering anomalous feature dimensions based on the anomaly probability of all feature dimensions specifically includes: Calculate the anomaly probability of all feature dimensions within each time window, and mark the feature dimensions whose anomaly probability exceeds a preset threshold as anomalous feature dimensions.

6. The method for detecting consumer fraud in the financial field based on big data as described in claim 1, characterized in that, The method of updating the detection model parameters based on dynamic fraud risk values ​​includes: The product of the dynamic fraud risk value for each time window and the parameters of the historical detection model is used as the temporary parameter of the current detection model. The average value of the temporary parameters for all time windows is calculated, and this average value is used as the actual parameters of the updated detection model.

7. The method for detecting consumer fraud in the financial field based on big data as described in claim 6, characterized in that, The real-time detection of financial consumer fraud includes: An ensemble classifier is built using the updated detection model's actual parameters; real-time input financial consumer transaction data and multi-dimensional user behavior data are fed into the ensemble classifier, which outputs fraud behavior labeling results.

Images