Abnormal transaction monitoring method and device, electronic equipment and storage medium

Abstract

The invention discloses an abnormal transaction monitoring method and device, electronic equipment and a storage medium, and relates to the technical field of big data and artificial intelligence or other related fields, and the method comprises the steps: receiving a target transaction data flow, inputting the target transaction data flow into a first model, and outputting a candidate window; feature collection is carried out on the target transaction data flow based on the candidate window, a candidate feature set is obtained, the candidate feature set comprises candidate features of N feature dimensions, and N is a positive integer; inputting the candidate feature set into a second model, and outputting an abnormal attribution result; and selecting an abnormal feature from the N candidate features based on N attribution weights recorded in the abnormal attribution result, and positioning an abnormal transaction instance in the target transaction data stream based on the abnormal feature. Through the method and the device, the technical problem of high false alarm rate caused by inaccurate monitoring due to data sparsity during abnormal transaction monitoring and early warning in related technologies is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of big data and artificial intelligence or other related fields, in particular, to an abnormal transaction monitoring method and device, an electronic device and a storage medium. BACKGROUND

[0002] In the wave of digital transformation of the financial industry, the analysis and mining of customer transaction data have become the key to risk management and service optimization. With the diversification of transaction methods and the unevenness of transaction frequency, transaction data in scenarios involving low-frequency high-value transactions exhibit significant sparsity characteristics. Traditionally, although statistical-based anomaly detection methods have shown certain effectiveness in processing continuous transaction data, their monitoring accuracy drops significantly when facing sparse transaction data, and the false positive rate rises significantly, making it difficult to effectively cope with the complexity and high risk of modern financial transactions.

[0003] In recent years, deep learning technology has been introduced into the field of abnormal transaction monitoring, trying to predict and identify abnormal transactions through the learning of historical transaction data. Although these methods have achieved remarkable results in processing continuous transaction data, they still face challenges when dealing with sparse transaction data. Due to the lack of continuous samples, deep learning models have difficulty capturing effective long-term dependencies and are prone to overlook key transaction patterns, resulting in increased prediction errors, poor abnormal monitoring results, and inevitable false positives and false negatives.

[0004] More problematic is that even if abnormal transactions are detected, existing technologies have difficulty providing in-depth attribution analysis. Usually, anomaly detection only stops at identifying abnormal points, and cannot automatically explain the complex reasons behind the anomalies, making the anomaly detection results lose their practical value in guiding risk management strategies. Manual verification not only consumes time and effort, but also is inefficient, making it difficult to meet the needs of modern financial institutions for rapid response to abnormal transactions.

[0005] To address the above problems, no effective solutions have been proposed so far. SUMMARY

[0006] The main purpose of the present application is to provide an abnormal transaction monitoring method and device, an electronic device and a storage medium, to at least solve the technical problem of inaccurate monitoring due to data sparsity, resulting in high false positive rate, in abnormal transaction monitoring and early warning in the related art.

[0007] To achieve the above object, according to an aspect of the present application, a method for monitoring abnormal transactions is provided, which comprises: receiving a target transaction data stream and inputting the target transaction data stream into a first model to output a candidate window, wherein the first model is a time series model pre-trained based on historical transaction data, and is used to identify a time window in which transaction data exceeding a historical threshold is located; based on the candidate window, feature collection is performed on the target transaction data stream to obtain a candidate feature set, wherein the candidate feature set contains candidate features of N feature dimensions, and N is a positive integer; the candidate feature set is input into a second model to output an abnormal attribution result, wherein the second model is a graph neural network with a preset SHAP analysis strategy, and is used to analyze the contribution of each candidate feature to abnormal transactions, and the abnormal attribution result is used to record attribution weights of N feature dimensions; based on the N attribution weights recorded in the abnormal attribution result, an abnormal feature is selected from the N candidate features, and an abnormal transaction instance is located in the target transaction data stream based on the abnormal feature.

[0008] Further, the first model is obtained by the following steps: obtaining historical transaction data from a financial transaction database, wherein the historical transaction data at least includes: transaction timestamp, transaction amount, transaction frequency, transaction object and abnormal label; dividing the historical transaction data according to a preset time sequence, and performing M rounds of iterative training on an initial time series model using continuous time sequence data, wherein M is a positive integer; after each round of training, the time series model obtained in this round of training is verified P rounds using independent historical data not involved in the training to obtain a verification result, wherein the verification result is used to record model accuracy, and P is a specified value; in the case that the model accuracy recorded in the verification result is greater than or equal to a preset accuracy threshold, the iterative training is stopped, and the first model is obtained.

[0009] Further, the step of inputting the target transaction data stream into the first model and outputting a candidate window comprises: preprocessing the target transaction data, and inputting the preprocessed target transaction data into the first model, wherein the target transaction data at least includes: target transaction timestamp, target transaction amount and target transaction frequency, and the preprocessing at least includes one of the following specific operations: outlier cleaning, missing value filling and data format standardization processing; dividing the target transaction data according to the preset time sequence by the first model to obtain S time sequence window data, wherein S is a positive integer; analyzing each time sequence window data based on the historical threshold to obtain an analysis result, wherein the historical threshold at least includes: historical frequency threshold and historical amount threshold, and the analysis result is used to record the time window in which the transaction frequency or / and the transaction amount deviates from the historical threshold; determining the candidate window based on the analysis result, and outputting the candidate window.

[0010] Further, the step of collecting features based on the candidate window and obtaining a candidate feature set comprises: extracting candidate transaction data corresponding to the candidate window from the target transaction data stream, wherein the candidate transaction data at least includes: candidate transaction frequency, candidate transaction amount and candidate transaction object; generating a transaction frequency feature by analyzing the trend of the candidate transaction frequency in the time sequence within all the candidate windows; calculating a statistical feature value based on all the candidate transaction amounts, and generating a transaction amount feature based on all the statistical feature values; extracting a transaction counterparty customer associated with the candidate transaction object from a financial customer database to generate a customer association graph; querying historical risk data of the candidate transaction object and the transaction counterparty customer based on the customer association graph, and generating a customer association feature based on the historical risk data; taking the transaction frequency feature, the transaction amount feature, the customer association feature and the customer association graph as the candidate features to generate the candidate feature set.

[0011] Further, the second model comprises the following model layers: a feature embedding layer, configured to receive the candidate feature set, and perform numerical value processing on all feature elements to obtain a candidate feature vector, and transmit the candidate feature vector to a graph convolution layer; and the graph convolution layer, configured to receive the candidate feature vector, and perform graph convolution operation on the candidate feature vector in the customer association graph to obtain the contribution degree of each feature dimension.

[0012] Further, the step of inputting the candidate feature set into the second model and outputting an abnormal attribution result comprises: processing the candidate feature set through the feature embedding layer to obtain the candidate feature vector; analyzing the customer association graph through the graph convolution layer to obtain an adjacency matrix, wherein the adjacency matrix is used to describe the connection relationship between the customer nodes in the customer association graph, and the connection relationship is used to represent the transaction relationship; performing aggregation calculation on the candidate feature vector based on the adjacency matrix to obtain a node feature matrix, wherein the aggregation weight is determined by the transaction frequency; analyzing the node feature matrix based on the SHAP analysis strategy to obtain an analysis result, wherein the analysis result records the contribution of the candidate feature to the abnormal transaction; determining the attribution weight of all feature dimensions based on the contribution degrees corresponding to all candidate features, wherein the sum of all attribution weights is 1; and outputting the abnormal attribution result containing the attribution weight corresponding to all feature dimensions.

[0013] Further, based on the N attribution weights recorded in the abnormal attribution result, the step of selecting an abnormal feature from the N candidate features and locating an abnormal transaction instance in the target transaction data stream based on the abnormal feature comprises: selecting P abnormal features from the N candidate features according to the size of the attribution weight, wherein P is a positive integer less than or equal to N; determining an abnormal window based on the abnormal feature, and extracting abnormal transaction data corresponding to the abnormal window in the target transaction data stream; analyzing the abnormal transaction reason of each abnormal feature based on the transaction performance indicated by the abnormal transaction data to obtain an abnormal attribution set; and generating the abnormal transaction instance by combining the abnormal feature, the abnormal window, the abnormal transaction data, and the abnormal attribution set.

[0014] To achieve the above objectives, according to another aspect of this application, an abnormal transaction monitoring device is also provided. The device includes: a first input unit for receiving a target transaction data stream and inputting the target transaction data stream into a first model, outputting a candidate window, wherein the first model is a time-series model pre-trained based on historical transaction data, used to identify the time window where transaction data exceeding a historical threshold is located; a feature acquisition unit for acquiring features from the target transaction data stream based on the candidate window, obtaining a candidate feature set, wherein the candidate feature set contains candidate features of N feature dimensions, where N is a positive integer; a second input unit for inputting the candidate feature set into a second model, outputting an anomaly attribution result, wherein the second model is a graph neural network with a pre-set SHAP parsing strategy, used to parse the contribution of each candidate feature to the abnormal transaction, the anomaly attribution result used to record the attribution weights of the N feature dimensions; and a localization unit for selecting an abnormal feature from the N candidate features based on the N attribution weights recorded in the anomaly attribution result, and locating an abnormal transaction instance in the target transaction data stream based on the abnormal feature.

[0015] Furthermore, the abnormal transaction monitoring device further includes: a training unit for training the first model, the training unit comprising: an acquisition module for acquiring historical transaction data from a financial transaction database, wherein the historical transaction data includes at least: transaction timestamp, transaction amount, transaction frequency, transaction object, and abnormal marker; a training module for dividing the historical transaction data according to a preset time series and performing M rounds of iterative training on the initial time series model using continuous time series data, wherein M is a positive integer; a verification module for performing P rounds of verification on the time series model obtained from each round of training using independent historical data that did not participate in the training, and obtaining a verification result, wherein the verification result is used to record the model accuracy, and P is a specified value; and a stopping module for stopping iterative training when the model accuracy recorded in the verification result is greater than or equal to a preset accuracy threshold, thereby obtaining the first model.

[0016] Further, the first input unit includes: an input module, used to preprocess the target transaction data and input the preprocessed target transaction data into the first model, wherein the target transaction data includes at least: target transaction timestamp, target transaction amount, and target transaction frequency, and the preprocessing includes at least one of the following specific operations: outlier cleaning, missing value filling, and data format standardization; a segmentation module, used by the first model to segment the target transaction data according to the preset time series to obtain S segments of time series window data, wherein S is a positive integer; a first analysis module, used to analyze each segment of the time series window data based on the historical threshold to obtain analysis results, wherein the historical threshold includes at least: historical frequency threshold and historical amount threshold, and the analysis results are used to record: the time window where the transaction frequency and / or the transaction amount deviates from the historical threshold; and a first output module, used to determine the candidate window based on the analysis results and output the candidate window.

[0017] Further, the feature acquisition unit includes: a first extraction module, used to extract candidate transaction data corresponding to the candidate window from the target transaction data stream, wherein the candidate transaction data includes at least: candidate transaction frequency, candidate transaction amount, and candidate transaction object; a first generation module, used to generate transaction frequency features by analyzing the temporal trend of the candidate transaction frequency in all candidate windows; a second generation module, used to calculate statistical feature values ​​based on all candidate transaction amounts, and generate transaction amount features based on all statistical feature values; a third generation module, used to extract counterparty customers related to the candidate transaction object from a financial customer database, and generate a customer association graph; a fourth generation module, used to query historical risk data of the candidate transaction object and the counterparty customer based on the customer association graph, and generate customer association features based on the historical risk data; and a fifth generation module, used to generate the candidate feature set using the transaction frequency feature, the transaction amount feature, the customer association feature, and the customer association graph as the candidate features.

[0018] Furthermore, the second model includes the following model layers: a feature embedding layer, used to receive the candidate feature set, perform numerical processing on all feature elements to obtain candidate feature vectors, and pass the candidate feature vectors to a graph convolutional layer; the graph convolutional layer, used to receive the candidate feature vectors, perform graph convolution operations on the candidate feature vectors in the customer association graph, and obtain the contribution of each feature dimension.

[0019] Further, the second input unit includes: a processing module, used to process the candidate feature set through the feature embedding layer to obtain the candidate feature vector; a second analysis module, used to analyze the customer association graph through the graph convolutional layer to obtain an adjacency matrix, wherein the adjacency matrix is ​​used to describe the connection relationship between each customer node in the customer association graph, and the connection relationship is used to characterize transactions; a calculation module, used to perform aggregation calculation on the candidate feature vector based on the adjacency matrix to obtain a node feature matrix, wherein the aggregation weight is determined by the transaction frequency; a parsing module, used to parse the node feature matrix based on the SHAP parsing strategy to obtain a parsing result, wherein the parsing result records the contribution of the candidate features to abnormal transactions; a determination module, used to determine the attribution weights of all feature dimensions based on the contribution of all candidate features, wherein the sum of all attribution weights is 1; and a second output module, used to output the abnormal attribution result containing the attribution weights corresponding to all feature dimensions.

[0020] Further, the localization unit includes: a selection module, configured to select P anomalous features from N candidate features according to the magnitude of the attribution weights, where P is a positive integer less than or equal to N; a second extraction module, configured to determine an anomalous window based on the anomalous features and extract the anomalous transaction data corresponding to the anomalous window from the target transaction data stream; a third analysis module, configured to analyze the anomalous transaction reasons for the occurrence of each anomalous feature based on the transaction performance indicated by the anomalous transaction data, and obtain an anomalous attribution set; and a sixth generation module, configured to combine the anomalous features, the anomalous window, the anomalous transaction data, and the anomalous attribution set to generate the anomalous transaction instance.

[0021] To achieve the above objectives, according to another aspect of this application, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the abnormal transaction monitoring method described in any one of the above claims.

[0022] To achieve the above objectives, according to another aspect of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the abnormal transaction monitoring method described in any of the above claims.

[0023] To achieve the above objectives, according to another aspect of this application, a computer program product is also provided, including computer instructions, wherein when the computer instructions are executed by a processor, they implement the steps of the abnormal transaction monitoring method described in any one of the above claims.

[0024] This invention proposes a method for monitoring abnormal transactions. First, a target transaction data stream is received and input into a first model, which outputs a candidate window. The first model is a time-series model pre-trained based on historical transaction data, used to identify the time window containing transaction data exceeding historical thresholds. Then, features are collected from the target transaction data stream based on the candidate window to obtain a candidate feature set, which contains candidate features with N feature dimensions, where N is a positive integer. Next, the candidate feature set is input into a second model, which outputs anomaly attribution results. The second model is a graph neural network with a pre-set SHAP parsing strategy, used to analyze the contribution of each candidate feature to the abnormal transaction. The anomaly attribution results are used to record the attribution weights of the N feature dimensions. Finally, based on the N attribution weights recorded in the anomaly attribution results, anomaly features are selected from the N candidate features, and abnormal transaction instances are located in the target transaction data stream based on these anomaly features.

[0025] This invention adopts an innovative approach that integrates time series analysis and interpretable machine learning. By constructing a two-stage intelligent analysis model, it achieves the goal of accurately monitoring and deeply analyzing abnormal transaction behavior, thereby improving the accuracy of abnormal transaction detection and reducing the false alarm rate. This solves the technical problem in related technologies where abnormal transaction monitoring and early warning are inaccurate due to data sparsity, resulting in a high false alarm rate.

[0026] Specifically, this invention receives real-time changing target transaction data streams and uses a first model (i.e., a large time series model) pre-trained with deep learning based on historical transaction data to effectively filter out candidate time windows that deviate significantly from conventional transaction patterns. This model, through a self-attention mechanism, can capture the long-term dependence of transaction behavior even in data-sparse environments, thereby accurately locating the time nodes of abnormal transactions. Subsequently, a set of candidate features related to transaction behavior is automatically collected for these candidate windows, covering candidate features across multiple feature dimensions, aiming to comprehensively capture various potential abnormal clues in the transaction process. Next, a second model (a graph neural network with a pre-set SHAP parsing strategy) is activated to quantify the importance of each candidate feature, analyze its contribution to abnormal transaction events, and generate anomaly attribution results. These results record the attribution weights of each feature dimension in detail, providing data support for in-depth analysis of the causes of abnormal transactions. Finally, based on the ranking of multiple attribution weights in the anomaly attribution results, the core features that cause anomalies are efficiently identified from multiple candidate features, and abnormal transaction instances are accurately located in the target transaction data stream accordingly, generating an abnormal transaction report.

[0027] In summary, this invention, through the collaborative operation of two models, achieves the process from initial screening of abnormal time windows to in-depth attribution analysis of abnormal features, and then to precise location of abnormal transaction instances. This not only significantly improves the accuracy and timeliness of abnormal transaction monitoring, but also greatly enhances the interpretability of monitoring results, effectively reduces the workload of manual verification, and minimizes the negative impact of false alarms. Attached Figure Description

[0028] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0029] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for monitoring abnormal transactions is shown.

[0030] Figure 2 This is a flowchart of an optional abnormal transaction monitoring method according to an embodiment of the present invention;

[0031] Figure 3 This is a schematic diagram of an optional abnormal transaction monitoring device according to an embodiment of the present invention;

[0032] Figure 4 This is a structural block diagram of an electronic device for a method of monitoring abnormal transactions according to an embodiment of the present invention. Detailed Implementation

[0033] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0035] To facilitate understanding of the present invention by those skilled in the art, some terms or nouns involved in the various embodiments of the present invention are explained below:

[0036] A temporal model is a machine learning model capable of processing time-series data and learning the temporal dependencies between data points. In financial transaction data processing, temporal models are particularly suitable for capturing long-term trading patterns. In this invention, the pre-trained temporal model refers to a deep learning model trained on a large amount of historical transaction data that can extract sparse trading features and predict abnormal trading time windows, such as TimeSformer, which utilizes a self-attention mechanism to process long-term time-series data.

[0037] SHAP, or Shapley Additive exPlanations, is a method for interpreting the prediction results of machine learning models. Based on Shapley value theory, it quantifies the contribution of each feature to the model's prediction. In this invention, SHAP values ​​are integrated into a graph neural network model to analyze the attribution weights of each candidate feature in abnormal transaction detection, thereby achieving automated analysis and explanation of the causes of abnormal transactions.

[0038] GNN, or Graph Neural Network, is a deep learning model for processing graph-structured data, capable of capturing complex relationships between nodes. In this invention, GNN is used to process customer association graph features. By fusing it with transaction frequency and amount distribution features, it provides a more comprehensive understanding of the multi-dimensional characteristics of abnormal transactions, improving the accuracy and interpretability of anomaly detection.

[0039] It should be noted that the abnormal transaction monitoring method and device in this application can be used in the fields of big data and artificial intelligence technology for real-time anomaly detection and deep attribution analysis of financial transaction data, and can also be used in any field other than big data and artificial intelligence technology for real-time anomaly detection and deep attribution analysis of financial transaction data. This application does not limit the application field of the abnormal transaction monitoring method and device.

[0040] It should be noted that all relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) involved in this application are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, processing, transmission, provision, disclosure, use, and handling of such data comply with the laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse access. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.

[0041] The information collection (e.g., user voice, video, and text collection) and analysis operations involved in this application have provided users with corresponding operation entry points during execution, allowing users to choose to agree to or reject the automated decision results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0042] The following embodiments of the present invention can be applied to various systems / applications / devices that require monitoring and deep attribution analysis of financial transactions, enabling the creation of an intelligent early warning platform for abnormal transactions based on a time-series large-scale model and graph neural networks. The present invention uses a time-series large-scale model pre-trained on historical transaction data to initially screen for abnormal windows in the transaction data stream. Then, through an integrated strategy of graph neural networks and SHAP values, it performs deep analysis and attribution analysis on the multi-dimensional features of abnormal transactions. This allows for better capture of long-term dependencies in sparse transaction data and quantification of the impact of different features on the occurrence of anomalies. Simultaneously, suspected abnormal transactions are further confirmed through business logic verification.

[0043] This invention also dynamically adjusts the anomaly threshold to accurately locate abnormal transaction instances, performs weighted evaluation of transaction characteristics, and makes the testing process flexible and efficient, quickly and accurately locating anomalies, reducing the false alarm rate, and improving the response speed and decision-making quality of financial institutions in monitoring abnormal transactions.

[0044] The present invention will now be described in detail with reference to various embodiments.

[0045] Example 1

[0046] According to an embodiment of the present invention, an embodiment of a method for monitoring abnormal transactions is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0047] The abnormal transaction monitoring method provided in Embodiment 1 of the present invention can be executed on a mobile terminal, computer terminal or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a method to monitor abnormal transactions is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0048] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0049] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal transaction monitoring method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the above-mentioned abnormal transaction monitoring method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0050] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0051] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0052] Under the above operating environment, the present invention provides, as follows: Figure 2The method for monitoring abnormal transactions shown is implemented by an intelligent financial risk control system. It combines deep learning and graph data analysis technologies for real-time transaction monitoring and early warning scenarios, particularly addressing the anomaly monitoring and attribution analysis of low-frequency, high-value transactions. This is achieved by constructing a two-stage intelligent analysis architecture: initial anomaly time window detection followed by multi-dimensional feature fusion and attribution analysis. This aims to improve the accuracy and interpretability of abnormal transaction monitoring. This innovative method not only strengthens financial institutions' ability to respond immediately to abnormal transactions but also significantly enhances the sophistication of risk management.

[0053] The embodiments of the present invention will now be described in detail with reference to each specific step.

[0054] Figure 2 This is a flowchart of an optional abnormal transaction monitoring method according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0055] Step S201: Receive the target transaction data stream and input the target transaction data stream into the first model, and output a candidate window. The first model is a time series model pre-trained based on historical transaction data, which is used to identify the time window where transaction data exceeding the historical threshold is located.

[0056] It should be noted that the target transaction data stream is a sequence of transaction data updated in real time or periodically, including data points related to transaction behavior such as transaction amount, frequency, timestamp, and counterparty information. In this invention, the data stream is received continuously, with the aim of monitoring transaction behavior in real time and capturing any anomalies that deviate from the normal transaction pattern.

[0057] The first model refers to a pre-trained deep learning model based on time series analysis. It learns long-term patterns and potential regularities in trading behavior through training on historical trading data. The first model is specifically designed to handle sparse data, that is, data points that are unevenly distributed along the time axis. Through techniques such as self-attention mechanisms, this model can effectively mine long-term dependencies from discontinuous data points and identify time windows of abnormal transactions.

[0058] The candidate window refers to the time period output by the first model that may contain abnormal transactions. In this invention, determining the candidate window is a crucial step in the anomaly detection process. It not only helps to narrow down the scope of subsequent analysis and improve efficiency, but also provides important clues for multi-dimensional feature analysis through precise positioning in the time dimension. The candidate window is set based on the deviation between the predicted transaction volume range and the actual transaction data. When the actual value exceeds the predicted range ±3σ, it is considered an anomaly. Here, σ represents the standard deviation, a statistical indicator that measures the degree of deviation between the predicted and actual values.

[0059] To control the overfitting risk of the first model and to automate and intelligently train the first model, optionally, in the abnormal transaction monitoring method provided in this embodiment of the invention, the first model is trained through the following steps: obtaining historical transaction data from a financial transaction database, wherein the historical transaction data includes at least: transaction timestamp, transaction amount, transaction frequency, transaction object, and abnormal marker; dividing the historical transaction data according to a preset time series, and using continuous time series data to perform M rounds of iterative training on the initial time series model, wherein M is a positive integer; after each round of training, using independent historical data that did not participate in the training to perform P rounds of verification on the time series model obtained in that round of training, and obtaining verification results, wherein the verification results are used to record the model accuracy, and P is a specified value; if the model accuracy recorded in the verification results is greater than or equal to a preset accuracy threshold, the iterative training is stopped, and the first model is obtained.

[0060] It should be noted that a financial transaction database refers to a database within a financial institution that stores historical transaction records. This database contains a wealth of transaction information, such as transaction timestamps, transaction amounts, transaction frequencies, transaction counterparties, and anomaly markers. This data forms the basis for building the first model (i.e., the anomaly time window detection model). By analyzing patterns and anomalies in historical transaction data, the model can learn and identify potential anomaly signals in future transactions.

[0061] Historical transaction data contains a series of transaction-related information. Among them, anomaly markers are labeled by humans or existing systems based on abnormal behaviors in historical transaction data. They can be used as labels for model training to help the model distinguish between normal and abnormal transactions, thereby learning more effective anomaly detection patterns.

[0062] In this embodiment of the invention, the preset time series refers to dividing historical transaction data into continuous time series samples according to certain time intervals (such as daily or monthly). This division method is to ensure that the model can learn the patterns of transaction behavior based on the same time scale, which helps to capture long-term transaction trends and cyclical patterns.

[0063] Model accuracy is a metric that measures a model's predictive ability, typically evaluated by comparing the model's predictions with the actual results. In the process of this invention embodiment, model accuracy is used to evaluate the model's ability to predict abnormal transactions based on unseen historical data after each training round, and is an important monitoring signal during the model's iterative training process.

[0064] During training, an expected model accuracy standard needs to be set. The training process stops when the model's accuracy reaches or exceeds this threshold. The preset accuracy threshold is determined based on business needs and risk tolerance levels to ensure that the first model has a sufficiently high detection accuracy before being deployed in actual applications, thereby reducing false negatives and false negatives of abnormal transactions.

[0065] Another option, besides the preset time series division method, is to use a sliding window technique or adaptive time intervals instead of fixed time series divisions to adapt to the characteristics of different trading frequencies or abnormal patterns. A sliding window can capture short-term fluctuations in trading behavior, while an adaptive time interval dynamically adjusts according to the density of trading data, enabling the model to adapt to different types of trading sequences.

[0066] Alternatively, in addition to using deep learning-based time-series analysis models, this invention can also employ statistical methods, such as ARIMA (Autoregressive Integral Moving Average) or state-space models, to identify time windows of abnormal transactions. These methods are suitable for time series analysis and can be adapted to anomaly detection needs with different data distributions through parameter adjustments. Furthermore, the isolated forest model can also identify outliers in sparse datasets in an unsupervised manner, serving as an alternative for detecting abnormal time windows.

[0067] To address data quality and event sequence processing issues in abnormal transaction detection and further improve overall performance, optionally, in the abnormal transaction monitoring method provided in this embodiment of the invention, the step of inputting the target transaction data stream into a first model and outputting candidate windows includes: preprocessing the target transaction data and inputting the preprocessed target transaction data into the first model, wherein the target transaction data includes at least: target transaction timestamp, target transaction amount, and target transaction frequency, and the preprocessing includes at least one of the following specific operations: outlier cleaning, missing value filling, and data format standardization; dividing the target transaction data by the first model according to a preset time series to obtain S segments of time series window data, where S is a positive integer; analyzing each segment of time series window data based on historical thresholds to obtain analysis results, wherein the historical thresholds include at least: historical frequency thresholds and historical amount thresholds, and the analysis results are used to record: the time windows where transaction frequency and / or transaction amount deviate from the historical thresholds; determining candidate windows based on the analysis results and outputting candidate windows.

[0068] It's important to note that before inputting the target transaction data stream into the first model, it needs to be preprocessed, including outlier cleaning, missing value imputation, and data format standardization. Outlier cleaning identifies and handles obviously unreasonable or extreme transaction data, such as abnormally large transaction amounts or transaction frequencies exceeding normal ranges. These outliers may stem from data entry errors or special circumstances; without processing, they will interfere with the model's training and prediction results. Missing value imputation completes the dataset by filling in missing information, such as missing frequency data for a particular transaction, which can be filled using historical averages, medians, or other statistical methods. Data format standardization unifies the data format, such as converting all timestamps to a uniform format under the same time base, ensuring the model can correctly interpret the data.

[0069] Time-series window data refers to dividing the target transaction data stream into continuous data segments with time spans according to a preset time series. Such time window division allows the model to focus on transaction patterns within a specific time period, which helps to capture the short-term dynamics and long-term trends of transactions, thereby more accurately identifying the time windows of abnormal transactions.

[0070] Historical thresholds are standard values ​​derived from historical transaction data to determine whether target transaction data is abnormal. They include at least historical frequency thresholds and historical amount thresholds, reflecting the frequency and amount distribution of normal transaction behavior. If the average transaction frequency or transaction amount of target transaction data within a certain time window exceeds the historical threshold, it indicates that the transaction behavior during that period may be abnormal and requires further analysis and confirmation.

[0071] The analysis of each time-series window data is based on historical thresholds. The analysis results record which transaction data deviate from the historical thresholds in terms of transaction frequency or transaction amount, as well as the degree of deviation and the time window. The analysis results form the basis for subsequent determination of candidate windows and indicate which time periods of transaction behavior need to be focused on.

[0072] Candidate windows refer to specific time windows that, based on the analysis results, may contain anomalous transactions. Identifying candidate windows narrows the scope of anomaly searches, allowing subsequent in-depth analysis to be more focused and efficient. Once candidate windows are determined, resources can be concentrated on more detailed feature extraction and attribution analysis of the transaction data within these windows.

[0073] Alternatively, in addition to the preprocessing methods mentioned above, embodiments of the present invention can also employ deep learning-based adaptive preprocessing techniques, such as autoencoders, for data cleaning and feature reconstruction. Autoencoders can learn the inherent structure of data, automatically identify and repair outliers or fill in missing values, while maintaining the original data features. Furthermore, techniques such as normalization or Z-score standardization can be used to unify the data format and adjust its scale.

[0074] Step S202: Based on the candidate window, feature acquisition is performed on the target transaction data stream to obtain a candidate feature set, wherein the candidate feature set contains candidate features of N feature dimensions, where N is a positive integer.

[0075] It should be noted that after identifying candidate windows containing abnormal transactions, a series of features related to anomaly detection are extracted from the target transaction data stream to form a candidate feature set. This set aims to capture multiple aspects of transaction behavior, including but not limited to transaction frequency, amount distribution characteristics, and the strength of the relationship with the counterparty, to assist in subsequent deep attribution analysis. The feature acquisition process is automated, enabling the rapid extraction of valuable information from massive amounts of data, providing rich and comprehensive input to the model.

[0076] N feature dimensions refer to the number of different types of features that constitute the candidate feature set. In the context of this invention, feature dimensions cover multiple aspects of a transaction, such as the temporal trend of transaction frequency (e.g., changes in the average number of daily transactions), the statistical characteristics of transaction amounts (e.g., skewness, kurtosis), the credit score and risk label of the counterparty, the proportion of cross-channel transactions by the customer, and customer profile labels (e.g., industry, size, historical risk level). These feature dimensions work together to ensure that anomaly detection is not only based on the numerical changes of the transaction itself, but also considers the transaction environment and customer background, greatly enhancing the model's insight and judgment accuracy.

[0077] Candidate features are a set of attributes highly correlated with transaction anomaly detection, collected and analyzed within a candidate window. Each feature is extracted from the target transaction data stream and reflects a specific aspect of transaction behavior, such as sudden increases in trading volume, unusual transaction timing, or frequent interactions with high-risk counterparties. The selection and processing of candidate features is one of the key steps in the entire technical solution, ensuring that the model can capture the information from the data that best reveals the nature of the anomaly.

[0078] To refine the dimensions of anomaly detection and enhance decision support, optionally, in the abnormal transaction monitoring method provided in this embodiment of the invention, the step of collecting features from the target transaction data stream based on candidate windows to obtain a candidate feature set includes: extracting candidate transaction data corresponding to the candidate windows from the target transaction data stream, wherein the candidate transaction data includes at least: candidate transaction frequency, candidate transaction amount, and candidate transaction object; generating transaction frequency features by analyzing the temporal trend of candidate transaction frequency within all candidate windows; calculating statistical feature values ​​based on all candidate transaction amounts, and generating transaction amount features based on all statistical feature values; extracting counterparty customers with relationships with candidate transaction objects from a financial customer database to generate a customer relationship graph; querying historical risk data of candidate transaction objects and counterparty customers based on the customer relationship graph, and generating customer relationship features based on the historical risk data; and generating a candidate feature set using transaction frequency features, transaction amount features, customer relationship features, and customer relationship graph as candidate features.

[0079] It should be noted that candidate transaction data is specific transaction data extracted from the target transaction data stream within the candidate window. It at least covers information on candidate transaction frequency, candidate transaction amount, and candidate transaction object, representing transaction records selected for further in-depth analysis after preliminary anomaly detection.

[0080] To capture trends in trading frequency over time, time-series analysis of trading frequencies within a candidate window is required to generate trading frequency characteristics. This involves calculating statistical indicators such as the average frequency, volatility, and growth rate, as well as identifying non-stationary characteristics such as periodic fluctuations, sudden increases, or abnormal decreases in frequency. Trading frequency characteristics help reveal anomalies in trading patterns, such as an unusual increase in the number of trades within a short period.

[0081] In-depth statistical analysis of candidate transaction amounts can yield a series of statistical characteristics, such as mean, median, standard deviation, skewness, and kurtosis. These characteristics are then used to generate transaction amount features that describe the distribution of transaction amounts and their deviation from historical norms. Transaction amount features are crucial for identifying large or small abnormal transactions, especially those exhibiting unusual patterns in amount.

[0082] The process involves identifying counterparty clients in a financial customer database who are related to candidate trading partners, and constructing a customer relationship graph based on these relationships. This graph not only shows the direct connections between the transacting parties but also includes a broader trading network, revealing complex transaction networks and potential risk chains. Historical risk data, including but not limited to historical violations and related customer credit scores, is then queried based on the graph to generate customer relationship characteristics, which are used to assess the customer risk and relationship complexity behind the transactions.

[0083] These steps together constitute the process of extracting in-depth features from the candidate window, providing a detailed data foundation for subsequent anomaly attribution analysis. For example, in a case of suspected abnormal transaction behavior, the system implementation may detect a sudden surge in transaction frequency, a regular small distribution of transaction amounts, and frequent interactions between the transaction parties and high-risk customers. These features combined point to a typical abnormal transaction pattern.

[0084] In another alternative embodiment, in addition to feature extraction methods based on time-series changes and statistical analysis, embodiments of the present invention can also employ feature engineering using machine learning or deep learning. For example, recurrent neural networks (RNNs) can be used to capture long-term and short-term frequency and amount changes, or convolutional neural networks (CNNs) can be used to identify spatial patterns in the distribution of transaction amounts (if geographical location information is available). Furthermore, feature cross-referencing techniques can be used to fuse features from different dimensions to discover deeper transaction patterns.

[0085] Alternatively, besides constructing customer relationship graphs, embodiments of the present invention can also utilize Social Network Analysis (SNA) technology to understand customer transaction networks from a broader social and economic perspective. SNA can analyze interaction patterns, group structures, and social capital among customers, providing more perspectives for attributing anomalous transactions. Furthermore, blockchain data analysis can serve as a supplement, especially when dealing with cross-border or cryptocurrency transactions. By analyzing transaction records and fund flows on the blockchain, hidden customer relationships and risk patterns can be revealed.

[0086] Step S203: Input the candidate feature set into the second model and output the anomaly attribution result. The second model is a graph neural network with a pre-set SHAP parsing strategy, which is used to parse the contribution of each candidate feature to the abnormal transaction. The anomaly attribution result is used to record the attribution weights of N feature dimensions.

[0087] It should be noted that the second model is a deep learning model that integrates graph structure data processing capabilities and the SHAP parsing strategy. Its main function is to perform in-depth analysis of the candidate feature set to determine the degree of influence of each feature on abnormal transaction detection. In this invention, the second model employs a Graph Neural Network (GNN), which can effectively process graph structure data and capture the relationships between nodes, making it highly suitable for analyzing complex financial transaction networks.

[0088] It's worth noting that GNNs are a neural network architecture specifically designed for processing graph data. They can automatically learn representations of nodes and edges in a graph to perform graph-level classification, clustering, or prediction tasks. In the context of financial risk control, graph neural networks can model transaction relationships between customers and identify potential risk clusters or abnormal behavior patterns.

[0089] Anomaly attribution results, produced by the second model, not only indicate which transactions are abnormal, but more importantly, provide possible reasons for the anomalies. Anomaly attribution results are an output that delves into the inner workings of trading behavior, analyzing its anomaly nature. They are typically represented as a ranked list of features' contributions, or "attribution weights."

[0090] SHAP (Shape Analysis and Interpretation) is an advanced model interpretation technique used to quantify the contribution of input features to model prediction results. In this application, the SHAP strategy is integrated into a graph neural network, enabling the model not only to accurately predict anomalous transactions but also to precisely identify which feature dimensions play a decisive role in the occurrence of anomalies, thus providing a scientific basis for anomaly attribution.

[0091] The contribution of each candidate feature to the anomaly detection is one of the core outputs of the SHAP parsing strategy, quantifying the influence of each feature in the candidate feature set on the final anomaly detection result. This contribution calculation considers not only the properties of the feature itself, but also the interaction between the feature and other features, forming the basis of anomaly attribution analysis.

[0092] Attribution weights, or feature contribution values ​​processed by the SHAP parsing strategy, are used to guide subsequent risk management measures. Attribution weights can be presented in various forms, such as percentages, scores, or other relative contribution measures, clearly indicating which feature dimensions play the most important role in trading anomalies.

[0093] To provide direct data support for anomaly attribution analysis, it is necessary to achieve deep feature understanding and contribution quantification. Optionally, in the abnormal transaction monitoring method provided in this embodiment of the invention, the second model includes the following model layers: a feature embedding layer, used to receive a set of candidate features, perform numerical processing on all feature elements to obtain candidate feature vectors, and pass the candidate feature vectors to a graph convolution layer; a graph convolution layer, used to receive candidate feature vectors, perform graph convolution operations on the candidate feature vectors in the customer association graph, and obtain the contribution of each feature dimension.

[0094] It's important to note that the feature embedding layer is a crucial component of deep learning models. It's responsible for converting different types of features (such as categorical features, text descriptions, and graphical structures) from the candidate feature set into numerical vectors, i.e., candidate feature vectors. This involves feature encoding; for example, converting categorical features into one-hot encoded or embedding vectors, and text descriptions into word vectors or sequence vectors. After numerical processing, the features can be more effectively processed and analyzed by subsequent model layers (such as convolutional layers), enhancing the model's ability to capture complex features.

[0095] Feature embedding layers aim to address the challenge of processing non-numerical features, ensuring that all types of features can be represented and understood within a unified numerical space. This process is essential because raw features may contain non-numerical data, such as classification information of trading objects or customer types, while neural network models typically can only handle numerical inputs. Feature embedding layers encode these features into vector form, enabling the model to understand and analyze them. The goal of this technology is to enable subsequent machine learning or deep learning algorithms to handle multi-type, heterogeneous data, thereby improving the accuracy and comprehensiveness of abnormal transaction monitoring.

[0096] Alternatively, when processing various types of data, including text, images, and numerical data, multimodal learning techniques, such as multimodal neural networks, can be used. These techniques process data of different modes separately in multiple embedding layers and then integrate them through a fusion layer to obtain richer feature representations.

[0097] Another point to note is that graph convolutional layers are a core component of graph neural networks, used to perform graph convolution operations on candidate feature vectors on a customer association graph. Graph convolution operations can capture the interactions between nodes in the graph structure and quantify the contribution of each feature dimension to abnormal transaction detection. In the graph convolutional layer, the feature vector of each node is fused with the feature vectors of its neighboring nodes. Through a weight update mechanism, the relationship between node features and the graph structure is learned, and the contribution of each feature dimension is output.

[0098] The purpose of graph convolutional layers is to leverage the characteristics of graph structures to deeply analyze the propagation patterns and influence scope of candidate transaction data within customer relationship networks. This operation learns the degree of influence, or contribution, of each feature dimension on transaction behavior throughout the entire graph through the connections between nodes. For example, a certain feature (such as the credit rating of a trading partner) may not play a decisive role in customer A's transactions, but its contribution will significantly increase in a scenario where customer B frequently transacts with high-risk counterparties, indicating that it plays a crucial role in identifying abnormal transactions. By calculating feature contribution, we can identify which features play a key role in abnormal transaction detection, improving the interpretability and reliability of anomaly detection.

[0099] Alternatively, GAT (Graph Attention Network) can be used to assign different weights to each node, adaptively adjusting the weights based on the interaction between the node and its neighbors. This can more accurately quantify the contribution of feature dimensions, especially when dealing with a large number of nodes and complex relationships in a customer relationship graph.

[0100] Alternatively, GraphSAGE (a node embedding method for large-scale graphs) can be used. It reduces the need for computing resources by sampling and aggregating the features of neighboring nodes, while effectively extracting the local dependencies of node features in the graph structure. It is suitable for the analysis of customer association graphs.

[0101] To more accurately capture abnormal patterns in low-frequency user transactions and improve detection accuracy, optionally, in the abnormal transaction monitoring method provided in this embodiment of the invention, the step of inputting a candidate feature set into a second model and outputting anomaly attribution results includes: processing the candidate feature set through a feature embedding layer to obtain candidate feature vectors; analyzing the customer association graph through a graph convolutional layer to obtain an adjacency matrix, wherein the adjacency matrix is ​​used to describe the connection relationships between customer nodes in the customer association graph, and the connection relationships are used to characterize transaction interactions; performing aggregation calculations on the candidate feature vectors based on the adjacency matrix to obtain a node feature matrix, wherein the aggregation weight is determined by the transaction frequency; parsing the node feature matrix based on the SHAP parsing strategy to obtain a parsing result, wherein the parsing result records the contribution of candidate features to abnormal transactions; determining the attribution weights of all feature dimensions based on the contribution of all candidate features, wherein the sum of all attribution weights is 1; and outputting anomaly attribution results containing the attribution weights corresponding to all feature dimensions.

[0102] It should be noted that, under the processing of the feature embedding layer, the original set of candidate features is transformed into numerical vector form, namely candidate feature vectors. These vectors can capture the intrinsic attributes of each feature and the relationships between them, providing structured input for subsequent deep analysis and model training.

[0103] The adjacency matrix is ​​the foundation of customer association graph analysis in graph convolutional layer analysis. It is a two-dimensional matrix used to describe the connection relationship between customer nodes in the graph. Each element value reflects the intensity of transactions between nodes. For example, transaction frequency and transaction amount can be used as the basis for weights in the adjacency matrix.

[0104] In graph convolution operations, based on the adjacency matrix, candidate feature vectors are integrated into each node through aggregation calculation to form a node feature matrix. This matrix not only contains the features of the node itself, but also incorporates the feature information of its neighboring nodes. By adjusting the aggregation weights, the information transmission and sharing in the graph structure are enhanced, making the feature representation of each node more comprehensive and richer.

[0105] The analysis results obtained by using the SHAP parsing strategy to analyze the node feature matrix record the contribution of different features to abnormal transactions. SHAP (SHapley Additive exPlanations) is an interpretability algorithm that quantifies the contribution of each feature to the model's prediction results based on the Shapley value in game theory, thereby making the model's decision-making process transparent and interpretable.

[0106] Based on the analysis results, the attribution weights for all feature dimensions are determined, reflecting the importance of specific features in anomaly detection. The sum is normalized to 1 to ensure the rationality of the weight allocation. These attribution weights provide crucial evidence for subsequent risk assessment and anomaly attribution, helping to analyze and understand the root causes of abnormal transactions.

[0107] In a specific implementation scenario, a financial institution uses a time-series large-scale model to discover significant anomalies in a user's recent transaction behavior, such as a sudden and substantial increase in transaction amounts. The model's feature embedding layer then transforms relevant features (including transaction frequency, transaction amount, and the identity of the transaction counterparties) into numerical vectors. The model's graph convolutional layer analyzes the user's customer relationship graph, identifying frequent transactions between the user and multiple high-risk accounts prior to the abnormal transactions. Relevant feature information is aggregated based on the adjacency matrix of the graph convolutional layer to generate a node feature matrix. The SHAP parsing strategy is applied to the node feature matrix, and the results show that "sudden increase in transaction amount" and "frequent transactions with high-risk accounts" are the main factors causing the transaction anomalies, contributing 62% and 28% respectively. Furthermore, based on these contributions, attribution weights can be calculated to form an anomaly attribution result, clarifying the key driving forces behind the abnormal transactions.

[0108] Step S204: Based on the N attribution weights recorded in the anomaly attribution results, select anomaly features from the N candidate features, and locate the anomaly transaction instance in the target transaction data stream based on the anomaly features.

[0109] It should be noted that anomalous features refer to those features whose attribution weights are recorded in the anomalous attribution results and are considered to contribute significantly to anomalous trading phenomena. Once the feature set is input into the second model and processed by a graph neural network and the SHAP parsing strategy, the attribution weight of each feature is calculated, demonstrating its importance in detecting anomalous transactions. The selection of anomalous features is based on their weight ranking; the higher the weight, the more likely the feature is to trigger anomalous trading.

[0110] The aforementioned features encompass multiple dimensions, including transaction frequency and temporal distribution, statistical characteristics of transaction amounts, and customer relationship graphs. Each dimension's features can potentially become anomalous features, depending on their weight in a specific anomaly attribution analysis. For example, if a sudden increase in transaction amount results in a high attribution weight, then the "transaction amount" feature will be classified as an anomalous feature, prompting subsequent analysis to focus on anomalous transaction instances within that dimension.

[0111] Anomaly transaction instances are specific transaction events located within the target transaction data stream based on anomalous characteristics. By identifying and weighting these anomalous characteristics, we can focus on transaction instances that highly match these characteristics, thereby quickly and accurately pinpointing operations that may actually pose a risk. Locating anomaly transaction instances is a crucial step in the entire risk control process, ensuring that subsequent interventions (such as freezing accounts, contacting customers, and initiating investigations) are targeted and efficient in responding to and handling abnormal situations.

[0112] To accurately locate abnormal transactions, optionally, in the abnormal transaction monitoring method provided in this embodiment of the invention, the step of selecting abnormal features from N candidate features based on N attribution weights recorded in the abnormal attribution results, and locating abnormal transaction instances in the target transaction data stream based on the abnormal features, includes: selecting P abnormal features from N candidate features according to the magnitude of the attribution weights, where P is a positive integer less than or equal to N; determining an abnormal window based on the abnormal features, and extracting the abnormal transaction data corresponding to the abnormal window from the target transaction data stream; analyzing the abnormal transaction reasons for the occurrence of each abnormal feature based on the transaction performance indicated by the abnormal transaction data, and obtaining an abnormal attribution set; and generating an abnormal transaction instance by combining the abnormal features, abnormal window, abnormal transaction data, and abnormal attribution set.

[0113] It's important to note that the process of analyzing transaction performance based on abnormal transaction data primarily focuses on in-depth analysis of the abnormal transaction data already screened by the model to identify which anomalous characteristics constitute the main reasons for the abnormal transactions. These characteristics may include, but are not limited to: sudden changes in transaction amounts, atypical increases in transaction frequency, and increased counterparty risk levels. By analyzing the specific manifestations of these anomalous characteristics in the transaction data, a detailed set of anomaly attributions can be constructed—that is, a series of specific reasons explaining why the transaction was considered abnormal.

[0114] The final step involves comprehensively considering the anomaly characteristics, anomaly window, specific abnormal transaction data, and the resulting set of anomaly attributions to generate an anomaly transaction instance report or alert. This report not only identifies the transaction anomaly but also details the specific time window in which the anomaly occurred, the details of the abnormal transaction, and the attribution explanation for each anomaly characteristic, providing financial institutions or enterprises with clear and actionable information on abnormal transactions.

[0115] Through steps S201 to S204 above, the target transaction data stream can be received first and input into the first model to output a candidate window. The first model is a time series model pre-trained based on historical transaction data, used to identify the time window where transaction data exceeding historical thresholds are located. Then, based on the candidate window, features are collected from the target transaction data stream to obtain a candidate feature set. The candidate feature set contains candidate features of N feature dimensions, where N is a positive integer. Then, the candidate feature set is input into the second model to output anomaly attribution results. The second model is a graph neural network with a pre-set SHAP parsing strategy, used to analyze the contribution of each candidate feature to the abnormal transaction. The anomaly attribution results are used to record the attribution weights of the N feature dimensions. Finally, based on the N attribution weights recorded in the anomaly attribution results, anomaly features are selected from the N candidate features, and anomaly transaction instances are located in the target transaction data stream based on the anomaly features.

[0116] In this embodiment of the invention, an innovative approach integrating time series analysis and interpretable machine learning is adopted. By constructing a two-stage intelligent analysis model, the goal of accurately monitoring and deeply analyzing abnormal transaction behavior is achieved. This results in improving the accuracy of abnormal transaction detection and reducing the false alarm rate. It also solves the technical problem in related technologies where abnormal transaction monitoring and early warning are inaccurate due to data sparsity, leading to a high false alarm rate.

[0117] Specifically, this embodiment of the invention receives a real-time changing target transaction data stream and uses a first model (i.e., a large time series model) pre-trained based on historical transaction data through deep learning to effectively filter out candidate time windows that deviate significantly from the conventional transaction pattern. This model, through a self-attention mechanism, can capture the long-term dependence of transaction behavior even in a data-sparse environment, thereby accurately locating the time nodes of abnormal transactions. Subsequently, a set of candidate features related to transaction behavior is automatically collected for these candidate windows, covering candidate features across multiple feature dimensions, aiming to comprehensively capture various potential abnormal clues in the transaction process. Next, a second model (a graph neural network with a pre-set SHAP parsing strategy) is activated to quantify the importance of each candidate feature, analyze its contribution to the abnormal transaction event, and generate anomaly attribution results. These results record the attribution weights of each feature dimension in detail, providing data support for in-depth analysis of the causes of abnormal transactions. Finally, based on the ranking of multiple attribution weights in the anomaly attribution results, the core features that cause the anomaly are efficiently identified from multiple candidate features, and the abnormal transaction instances are accurately located in the target transaction data stream accordingly, generating an abnormal transaction report.

[0118] In summary, this embodiment of the invention, through the collaborative operation of two models, achieves the process from initial screening of abnormal time windows to in-depth attribution analysis of abnormal features, and then to precise location of abnormal transaction instances. This not only significantly improves the accuracy and timeliness of abnormal transaction monitoring, but also greatly enhances the interpretability of monitoring results, effectively reduces the workload of manual verification, and minimizes the negative impact caused by false alarms.

[0119] The invention will now be described in conjunction with another alternative embodiment.

[0120] Example 2

[0121] This invention also provides an abnormal transaction monitoring device. It should be noted that the abnormal transaction monitoring device of this invention includes multiple implementation units, which can be used to execute the abnormal transaction monitoring method provided in the first embodiment above. Each implementation unit corresponds to each implementation step in the first embodiment above.

[0122] Figure 3 This is a schematic diagram of an optional abnormal transaction monitoring device according to an embodiment of the present invention, such as... Figure 3 As shown, the device may include: a first input unit 31, a feature acquisition unit 32, a second input unit 33, and a positioning unit 34.

[0123] The first input unit 31 is used to receive the target transaction data stream, input the target transaction data stream into the first model, and output a candidate window. The first model is a time series model pre-trained based on historical transaction data, used to identify the time window where transaction data exceeding historical thresholds are located.

[0124] The feature acquisition unit 32 is used to acquire features from the target transaction data stream based on the candidate window to obtain a candidate feature set, wherein the candidate feature set contains candidate features with N feature dimensions, where N is a positive integer.

[0125] The second input unit 33 is used to input the candidate feature set into the second model and output the anomaly attribution result. The second model is a graph neural network with a pre-set SHAP parsing strategy, which is used to parse the contribution of each candidate feature to the abnormal transaction. The anomaly attribution result is used to record the attribution weights of N feature dimensions.

[0126] The positioning unit 34 is used to select abnormal features from N candidate features based on the N attribution weights recorded in the abnormal attribution results, and locate abnormal transaction instances in the target transaction data stream based on the abnormal features.

[0127] The aforementioned abnormal transaction monitoring device can first receive the target transaction data stream through the first input unit 31 and input the target transaction data stream into the first model, outputting a candidate window. The first model is a time series model pre-trained based on historical transaction data, used to identify the time window where transaction data exceeding historical thresholds are located. Then, the feature acquisition unit 32 performs feature acquisition on the target transaction data stream based on the candidate window to obtain a candidate feature set. The candidate feature set contains candidate features of N feature dimensions, where N is a positive integer. Then, the candidate feature set is input into the second model through the second input unit 33, outputting anomaly attribution results. The second model is a graph neural network with a pre-set SHAP parsing strategy, used to analyze the contribution of each candidate feature to the abnormal transaction. The anomaly attribution results are used to record the attribution weights of the N feature dimensions. Finally, the positioning unit 34 selects anomaly features from the N candidate features based on the N attribution weights recorded in the anomaly attribution results, and locates the abnormal transaction instance in the target transaction data stream based on the anomaly features.

[0128] In this embodiment of the invention, an innovative approach integrating time series analysis and interpretable machine learning is adopted. By constructing a two-stage intelligent analysis model, the goal of accurately monitoring and deeply analyzing abnormal transaction behavior is achieved. This results in improving the accuracy of abnormal transaction detection and reducing the false alarm rate. It also solves the technical problem in related technologies where abnormal transaction monitoring and early warning are inaccurate due to data sparsity, leading to a high false alarm rate.

[0129] Specifically, this embodiment of the invention receives a real-time changing target transaction data stream and uses a first model (i.e., a large time series model) pre-trained based on historical transaction data through deep learning to effectively filter out candidate time windows that deviate significantly from the conventional transaction pattern. This model, through a self-attention mechanism, can capture the long-term dependence of transaction behavior even in a data-sparse environment, thereby accurately locating the time nodes of abnormal transactions. Subsequently, a set of candidate features related to transaction behavior is automatically collected for these candidate windows, covering candidate features across multiple feature dimensions, aiming to comprehensively capture various potential abnormal clues in the transaction process. Next, a second model (a graph neural network with a pre-set SHAP parsing strategy) is activated to quantify the importance of each candidate feature, analyze its contribution to the abnormal transaction event, and generate anomaly attribution results. These results record the attribution weights of each feature dimension in detail, providing data support for in-depth analysis of the causes of abnormal transactions. Finally, based on the ranking of multiple attribution weights in the anomaly attribution results, the core features that cause the anomaly are efficiently identified from multiple candidate features, and the abnormal transaction instances are accurately located in the target transaction data stream accordingly, generating an abnormal transaction report.

[0130] In summary, this embodiment of the invention, through the collaborative operation of two models, achieves the process from initial screening of abnormal time windows to in-depth attribution analysis of abnormal features, and then to precise location of abnormal transaction instances. This not only significantly improves the accuracy and timeliness of abnormal transaction monitoring, but also greatly enhances the interpretability of monitoring results, effectively reduces the workload of manual verification, and minimizes the negative impact caused by false alarms.

[0131] Furthermore, the abnormal transaction monitoring device also includes: a training unit for training a first model, the training unit comprising: an acquisition module for acquiring historical transaction data from a financial transaction database, wherein the historical transaction data includes at least: transaction timestamp, transaction amount, transaction frequency, transaction object, and abnormal marker; a training module for dividing the historical transaction data according to a preset time series and performing M rounds of iterative training on the initial time series model using continuous time series data, wherein M is a positive integer; a verification module for performing P rounds of verification on the time series model obtained from each round of training using independent historical data that did not participate in the training, and obtaining verification results, wherein the verification results are used to record the model accuracy, and P is a specified value; and a stopping module for stopping iterative training when the model accuracy recorded in the verification results is greater than or equal to a preset accuracy threshold, thus obtaining the first model.

[0132] Further, the first input unit includes: an input module for preprocessing the target transaction data and inputting the preprocessed target transaction data into the first model, wherein the target transaction data includes at least: target transaction timestamp, target transaction amount, and target transaction frequency, and the preprocessing includes at least one of the following specific operations: outlier cleaning, missing value filling, and data format standardization; a segmentation module for dividing the target transaction data by the first model according to a preset time series to obtain S segments of time series window data, wherein S is a positive integer; a first analysis module for analyzing each segment of time series window data based on historical thresholds to obtain analysis results, wherein the historical thresholds include at least: historical frequency thresholds and historical amount thresholds, and the analysis results are used to record: the time windows in which transaction data with transaction frequency and / or transaction amount deviates from the historical thresholds; and a first output module for determining candidate windows based on the analysis results and outputting the candidate windows.

[0133] Furthermore, the feature acquisition unit includes: a first extraction module, used to extract candidate transaction data corresponding to candidate windows from the target transaction data stream, wherein the candidate transaction data includes at least: candidate transaction frequency, candidate transaction amount, and candidate transaction object; a first generation module, used to generate transaction frequency features by analyzing the temporal trend of candidate transaction frequency within all candidate windows; a second generation module, used to calculate statistical feature values ​​based on all candidate transaction amounts, and generate transaction amount features based on all statistical feature values; a third generation module, used to extract counterparty customers related to candidate transaction objects from the financial customer database, and generate a customer association graph; a fourth generation module, used to query historical risk data of candidate transaction objects and counterparty customers based on the customer association graph, and generate customer association features based on the historical risk data; and a fifth generation module, used to generate a candidate feature set using transaction frequency features, transaction amount features, customer association features, and the customer association graph as candidate features.

[0134] Furthermore, the second model includes the following model layers: a feature embedding layer, which receives a set of candidate features, performs numerical processing on all feature elements to obtain candidate feature vectors, and passes the candidate feature vectors to a graph convolutional layer; and a graph convolutional layer, which receives candidate feature vectors, performs graph convolution operations on the candidate feature vectors in the customer association graph, and obtains the contribution of each feature dimension.

[0135] Further, the second input unit includes: a processing module for processing the candidate feature set through a feature embedding layer to obtain candidate feature vectors; a second analysis module for analyzing the customer association graph through a graph convolutional layer to obtain an adjacency matrix, wherein the adjacency matrix is ​​used to describe the connection relationship between each customer node in the customer association graph, and the connection relationship is used to represent transaction interactions; a calculation module for performing aggregation calculation on the candidate feature vectors based on the adjacency matrix to obtain a node feature matrix, wherein the aggregation weight is determined by the transaction frequency; a parsing module for parsing the node feature matrix based on the SHAP parsing strategy to obtain a parsing result, wherein the parsing result records the contribution of the candidate features to the abnormal transactions; a determination module for determining the attribution weights of all feature dimensions based on the contribution of all candidate features, wherein the sum of all attribution weights is 1; and a second output module for outputting the abnormal attribution result containing the attribution weights corresponding to all feature dimensions.

[0136] Furthermore, the localization unit includes: a selection module, used to select P anomalous features from N candidate features according to the magnitude of the attribution weights, where P is a positive integer less than or equal to N; a second extraction module, used to determine anomaly windows based on the anomalous features and extract the anomalous transaction data corresponding to the anomalous windows from the target transaction data stream; a third analysis module, used to analyze the anomalous transaction reasons for the occurrence of each anomalous feature based on the transaction performance indicated by the anomalous transaction data, and obtain an anomalous attribution set; and a sixth generation module, used to combine the anomalous features, anomalous windows, anomalous transaction data and the anomalous attribution set to generate an anomalous transaction instance.

[0137] It should be noted that the first input unit 31, feature acquisition unit 32, second input unit 33, and positioning unit 34 mentioned above correspond to steps S201 to S204 in Embodiment 1. The instances and application scenarios implemented by the above units and corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules or units can also run as part of the device in the computer terminal 10 provided in Embodiment 1.

[0138] The invention will now be described in conjunction with another alternative embodiment.

[0139] Example 3

[0140] The present invention can also provide an electronic device. Figure 4 This is a structural block diagram of an electronic device for a method of monitoring abnormal transactions according to an embodiment of the present invention, as shown below. Figure 4As shown, the electronic device may include: one or more ( Figure 4 Only one of the following is shown: processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0141] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the abnormal transaction monitoring method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the above-mentioned abnormal transaction monitoring method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0142] The processor can access information and applications stored in memory via a transmission device to perform the following steps: receiving a target transaction data stream and inputting it into a first model, outputting a candidate window, wherein the first model is a time series model pre-trained based on historical transaction data, used to identify the time window where transaction data exceeding historical thresholds are located; collecting features from the target transaction data stream based on the candidate window to obtain a candidate feature set, wherein the candidate feature set contains candidate features of N feature dimensions, where N is a positive integer; inputting the candidate feature set into a second model and outputting anomaly attribution results, wherein the second model is a graph neural network with a pre-set SHAP parsing strategy, used to analyze the contribution of each candidate feature to the abnormal transaction, and the anomaly attribution results are used to record the attribution weights of the N feature dimensions; selecting anomaly features from the N candidate features based on the N attribution weights recorded in the anomaly attribution results, and locating abnormal transaction instances in the target transaction data stream based on the anomaly features.

[0143] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: Retrieve historical transaction data from a financial transaction database, wherein the historical transaction data includes at least: transaction timestamps, transaction amounts, transaction frequencies, transaction objects, and anomaly markers; Divide the historical transaction data according to a preset time series, and perform M rounds of iterative training on the initial time series model using continuous time series data, where M is a positive integer; After each round of training, perform P rounds of validation on the time series model obtained from that round of training using independent historical data that did not participate in the training, and obtain validation results, wherein the validation results are used to record the model accuracy, and P is a specified value; If the model accuracy recorded in the validation results is greater than or equal to a preset accuracy threshold, stop the iterative training and obtain the first model.

[0144] The processor can also invoke information and applications stored in the memory via a transmission device to perform the following steps: preprocessing the target transaction data and inputting the preprocessed target transaction data into the first model, wherein the target transaction data includes at least: target transaction timestamp, target transaction amount, and target transaction frequency, and the preprocessing includes at least one of the following specific operations: outlier cleaning, missing value filling, and data format standardization; the first model divides the target transaction data according to a preset time series to obtain S segments of time series window data, wherein S is a positive integer; each segment of time series window data is analyzed based on historical thresholds to obtain analysis results, wherein the historical thresholds include at least: historical frequency thresholds and historical amount thresholds, and the analysis results are used to record: the time windows in which the transaction frequency and / or transaction amount deviate from the historical thresholds; and candidate windows are determined based on the analysis results and output as candidate windows.

[0145] The processor can also invoke information and applications stored in the memory via a transmission device to perform the following steps: extracting candidate transaction data corresponding to candidate windows from the target transaction data stream, wherein the candidate transaction data includes at least: candidate transaction frequency, candidate transaction amount, and candidate transaction object; generating transaction frequency features by analyzing the temporal trend of candidate transaction frequency within all candidate windows; calculating statistical feature values ​​based on all candidate transaction amounts, and generating transaction amount features based on all statistical feature values; extracting counterparty customers related to candidate transaction objects from the financial customer database, and generating a customer association graph; querying historical risk data of candidate transaction objects and counterparty customers based on the customer association graph, and generating customer association features based on the historical risk data; and generating a candidate feature set using transaction frequency features, transaction amount features, customer association features, and the customer association graph as candidate features.

[0146] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: processing the candidate feature set through a feature embedding layer to obtain candidate feature vectors; analyzing the customer association graph through a graph convolutional layer to obtain an adjacency matrix, where the adjacency matrix describes the connection relationships between customer nodes in the customer association graph, and the connection relationships characterize transaction interactions; aggregating the candidate feature vectors based on the adjacency matrix to obtain a node feature matrix, where the aggregation weights are determined by the transaction frequency; parsing the node feature matrix based on the SHAP parsing strategy to obtain parsing results, where the parsing results record the contribution of candidate features to abnormal transactions; determining the attribution weights of all feature dimensions based on the contribution of all candidate features, where the sum of all attribution weights is 1; and outputting an anomaly attribution result containing the attribution weights corresponding to all feature dimensions.

[0147] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: select P anomalous features from N candidate features according to the magnitude of the attribution weight, where P is a positive integer less than or equal to N; determine the anomalous window based on the anomalous features and extract the anomalous transaction data corresponding to the anomalous window from the target transaction data stream; analyze the anomalous transaction reasons for the occurrence of each anomalous feature based on the transaction performance indicated by the anomalous transaction data to obtain an anomalous attribution set; and generate an anomalous transaction instance by combining the anomalous features, anomalous window, anomalous transaction data, and anomalous attribution set.

[0148] This invention provides a monitoring scheme for abnormal transactions. It employs an innovative approach integrating time-series analysis and interpretable machine learning. By constructing a two-stage intelligent analysis model, it achieves the goal of accurately monitoring and deeply analyzing abnormal transaction behavior. This improves the accuracy of abnormal transaction detection and reduces the false alarm rate, thereby solving the technical problem of inaccurate monitoring and high false alarm rates caused by data sparsity in related technologies for abnormal transaction monitoring and early warning.

[0149] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0150] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0151] The invention will now be described in conjunction with another alternative embodiment.

[0152] Example 4

[0153] This invention also provides a computer-readable storage medium. Optionally, in this invention, the computer-readable storage medium can be used to store the program code executed by the abnormal transaction monitoring method provided in Embodiment 1.

[0154] Optionally, in this embodiment of the invention, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0155] This invention also provides a computer program product, which, when executed on a data processing device, is suitable for performing the steps of a method for monitoring abnormal transactions: receiving a target transaction data stream and inputting the target transaction data stream into a first model, outputting a candidate window, wherein the first model is a time series model pre-trained based on historical transaction data, used to identify the time window where transaction data exceeding historical thresholds are located; collecting features from the target transaction data stream based on the candidate window to obtain a candidate feature set, wherein the candidate feature set contains candidate features of N feature dimensions, where N is a positive integer; inputting the candidate feature set into a second model, outputting anomaly attribution results, wherein the second model is a graph neural network with a pre-set SHAP parsing strategy, used to parse the contribution of each candidate feature to the abnormal transaction, and the anomaly attribution results are used to record the attribution weights of the N feature dimensions; selecting anomaly features from the N candidate features based on the N attribution weights recorded in the anomaly attribution results, and locating abnormal transaction instances in the target transaction data stream based on the anomaly features.

[0156] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0157] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0158] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0159] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0160] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0161] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0162] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for monitoring abnormal transactions, characterized in that, include: Receive the target transaction data stream and input the target transaction data stream into the first model, and output a candidate window, wherein the first model is a time series model pre-trained based on historical transaction data, used to identify the time window where transaction data exceeding the historical threshold is located; Based on the candidate window, feature acquisition is performed on the target transaction data stream to obtain a candidate feature set, wherein the candidate feature set contains candidate features with N feature dimensions, where N is a positive integer; The candidate feature set is input into the second model, and the anomaly attribution result is output. The second model is a graph neural network with a preset SHAP parsing strategy, which is used to parse the contribution of each candidate feature to the abnormal transaction. The anomaly attribution result is used to record the attribution weights of N feature dimensions. Based on the N attribution weights recorded in the anomaly attribution results, anomaly features are selected from the N candidate features, and anomaly transaction instances are located in the target transaction data stream based on the anomaly features.

2. The monitoring method according to claim 1, characterized in that, The first model was trained through the following steps: Historical transaction data is obtained from a financial transaction database, wherein the historical transaction data includes at least: transaction timestamp, transaction amount, transaction frequency, transaction object, and anomaly marker; The historical transaction data is divided according to a preset time series, and the initial time series model is trained through M rounds of iterative training using continuous time series data, where M is a positive integer; After each training round, the time series model obtained from that round of training is validated P times using independent historical data that was not involved in the training, and the validation results are used to record the model accuracy, where P is a specified value. If the model accuracy recorded in the verification result is greater than or equal to a preset accuracy threshold, the iterative training is stopped, and the first model is obtained.

3. The monitoring method according to claim 2, characterized in that, The steps of inputting the target transaction data stream into the first model and outputting a candidate window include: The target transaction data is preprocessed and then input into the first model. The target transaction data includes at least: target transaction timestamp, target transaction amount, and target transaction frequency. The preprocessing includes at least one of the following specific operations: outlier cleaning, missing value filling, and data format standardization. The first model divides the target transaction data according to the preset time series to obtain S segments of time series window data, where S is a positive integer; Based on the historical threshold, each segment of the time-series window data is analyzed to obtain the analysis result. The historical threshold includes at least a historical frequency threshold and a historical amount threshold. The analysis result is used to record the time window in which the transaction frequency and / or the transaction amount deviates from the historical threshold. The candidate window is determined based on the analysis results, and the candidate window is output.

4. The monitoring method according to claim 1, characterized in that, The step of collecting features from the target transaction data stream based on the candidate window to obtain a candidate feature set includes: Extract candidate transaction data corresponding to the candidate window from the target transaction data stream, wherein the candidate transaction data includes at least: candidate transaction frequency, candidate transaction amount, and candidate transaction object; By analyzing the temporal trends of the frequency of candidate transactions within all candidate windows, transaction frequency features are generated. Statistical feature values ​​are calculated based on all the candidate transaction amounts, and transaction amount features are generated based on all the statistical feature values; Extract counterparty customers that are related to the candidate transaction object from the financial customer database and generate a customer relationship map; Based on the customer association graph, query the historical risk data of the candidate transaction objects and the counterparty customers, and generate customer association features based on the historical risk data; The candidate feature set is generated by using the transaction frequency feature, the transaction amount feature, the customer association feature, and the customer association graph as candidate features.

5. The monitoring method according to claim 1, characterized in that, The second model includes the following model layers: The feature embedding layer is used to receive the candidate feature set, perform numerical processing on all feature elements to obtain candidate feature vectors, and pass the candidate feature vectors to the graph convolutional layer. The graph convolutional layer is used to receive the candidate feature vectors, perform graph convolution operations on the candidate feature vectors in the customer association graph, and obtain the contribution of each feature dimension.

6. The monitoring method according to claim 5, characterized in that, The steps of inputting the candidate feature set into the second model and outputting the anomaly attribution result include: The candidate feature set is processed by the feature embedding layer to obtain the candidate feature vector; The customer association graph is analyzed by the graph convolutional layer to obtain an adjacency matrix, wherein the adjacency matrix is ​​used to describe the connection relationship between each customer node in the customer association graph, and the connection relationship is used to represent transaction interactions. The candidate feature vectors are aggregated based on the adjacency matrix to obtain a node feature matrix, wherein the aggregation weight is determined by the transaction frequency. The node feature matrix is ​​parsed based on the SHAP parsing strategy to obtain the parsing result, wherein the parsing result records the contribution of the candidate feature to the abnormal transaction; The attribution weights of all the feature dimensions are determined based on the contribution of all the candidate features, wherein the sum of all the attribution weights is 1. The output includes the attribution weights corresponding to all feature dimensions.

7. The monitoring method according to claim 1, characterized in that, The steps of selecting anomaly features from the N candidate features based on the N attribution weights recorded in the anomaly attribution results, and locating anomaly transaction instances in the target transaction data stream based on the anomaly features, include: Based on the attribution weights, P anomalous features are selected from the N candidate features, wherein... P is a positive integer less than or equal to N; An abnormal window is determined based on abnormal features, and the abnormal transaction data corresponding to the abnormal window is extracted from the target transaction data stream. Based on the transaction performance analysis indicated by the abnormal transaction data, the cause of each abnormal feature is obtained, resulting in an abnormal attribution set. The abnormal transaction instance is generated by combining the abnormal features, the abnormal window, the abnormal transaction data, and the abnormal attribution set.

8. A device for monitoring abnormal transactions, characterized in that, include: The first input unit is used to receive the target transaction data stream and input the target transaction data stream into the first model, and output a candidate window. The first model is a time series model pre-trained based on historical transaction data, used to identify the time window where transaction data exceeding the historical threshold is located. The feature acquisition unit is used to acquire features from the target transaction data stream based on the candidate window to obtain a candidate feature set, wherein the candidate feature set contains candidate features with N feature dimensions, where N is a positive integer; The second input unit is used to input the candidate feature set into the second model and output the anomaly attribution result. The second model is a graph neural network with a preset SHAP parsing strategy, used to parse the contribution of each candidate feature to the abnormal transaction. The anomaly attribution result is used to record the attribution weights of N feature dimensions. The localization unit is used to select an abnormal feature from the N candidate features based on the N attribution weights recorded in the abnormal attribution result, and locate the abnormal transaction instance in the target transaction data stream based on the abnormal feature.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform the abnormal transaction monitoring method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the abnormal transaction monitoring method according to any one of claims 1 to 7.

11. A computer program product, characterized in that, The method includes computer instructions, wherein when executed by a processor, the computer instructions implement the steps of the abnormal transaction monitoring method according to any one of claims 1 to 7.

Images