An abnormality detection method and system for transaction stream data

Abstract

The application discloses a kind of transaction flow data exception detection method and system, it is related to big data analysis technical field.The method includes: based on transaction flow data, the operation behavior data of target user in transaction process and the interactive behavior data after transaction completion are collected, and user operation behavior sequence and user interactive behavior sequence are formed by time stamp sorting;The sequence is input into the initial risk coefficient output by pre-training exception risk prediction model, and the model integrates individual behavior baseline and adaptive weight module;The group behavior baseline of similar user group is obtained, and the final risk coefficient is obtained by correcting initial risk coefficient in combination with the matching result of sequence and group baseline;Based on preset risk threshold, final risk coefficient is executed graded exception early warning operation.This application improves the accuracy and timeliness of transaction flow data exception detection by whole-process behavior sequence analysis, individual and group baseline double calibration and dynamic weight adjustment.

Description

Technical Field

[0001] This invention relates to the field of big data analytics, specifically to a method and system for detecting anomalies in transaction log data. Background Technology

[0002] In multi-scenario transaction environments such as financial payments and e-commerce, anomaly detection in transaction flow data is a crucial step in ensuring fund security. Existing technologies generally rely on monitoring and rule-based judgment of macro-indicators such as transaction amount, frequency, or location. While these methods are simple to implement, they lack sensitivity to increasingly covert and dynamically evolving fraudulent activities, resulting in limited detection capabilities. To address this deficiency, some improvement solutions attempt to incorporate user behavior analysis, such as verifying the operator's identity by monitoring the speed at which a user enters a password or the time interval between keystrokes.

[0003] However, such analyses are often limited to a specific stage of the transaction process, failing to comprehensively cover the entire chain of user behavior. In reality, when using self-service devices, users exhibit significant individual inertia and continuity in their behavioral patterns, a characteristic that extends to subsequent interaction stages after the transaction is completed. For example, subtle actions such as the length of time a user stays on the operation page after completing a transaction, whether they print a receipt, or whether they check their balance collectively constitute their unique and stable behavioral characteristics.

[0004] Existing technologies lack the ability to capture and deeply analyze user behavior throughout the entire process, especially interactive behavior after a transaction is completed. This results in insufficient accuracy and comprehensiveness in identifying abnormal changes, making it difficult to effectively combat fraudulent methods such as theft. In practical applications, these technologies suffer from low detection accuracy and delayed risk response. Summary of the Invention

[0005] This invention addresses the shortcomings of existing technologies, such as limited user behavior analysis dimensions and lack of continuous monitoring throughout the entire process, which leads to insufficient accuracy and delayed response in identifying abnormal transaction data. It provides a method and system for detecting anomalies in transaction data.

[0006] The technical solution of the present invention to solve the above-mentioned technical problems is as follows:

[0007] In a first aspect, the present invention provides a method for detecting anomalies in transaction log data, comprising:

[0008] Based on transaction log data, the target user's operational behavior data during the transaction process and interactive behavior data after the transaction is completed are collected. After being sorted by timestamp, user operation behavior sequence and user interaction behavior sequence are formed. The interactive behavior data includes page dwell time, page switching order and operation content.

[0009] The user operation behavior sequence and user interaction behavior sequence are input into the pre-trained anomaly risk prediction model, and the initial risk coefficient is output.

[0010] Obtain the baseline of group behavior of similar user groups, and combine the matching results of the user operation behavior sequence, user interaction behavior sequence and the group behavior baseline to correct the initial risk coefficient and obtain the final risk coefficient;

[0011] Based on a preset risk threshold, a graded anomaly warning operation is performed on the final risk coefficient.

[0012] Secondly, the present invention provides an anomaly detection system for transaction flow data, comprising:

[0013] The data acquisition module is used to collect the target user's operation behavior data during the transaction process and the interaction behavior data after the transaction is completed, based on the transaction flow data. After sorting by timestamp, it forms a user operation behavior sequence and a user interaction behavior sequence. The interaction behavior data includes page dwell time, page switching order, and operation content.

[0014] The abnormal risk prediction module is used to input the user operation behavior sequence and user interaction behavior sequence into the pre-trained abnormal risk prediction model and output the initial risk coefficient.

[0015] The risk coefficient correction module is used to obtain the group behavior baseline of similar user groups, and combine the matching results of the user operation behavior sequence, user interaction behavior sequence and the group behavior baseline to correct the initial risk coefficient and obtain the final risk coefficient.

[0016] The anomaly warning module is used to perform graded anomaly warning operations on the final risk coefficient based on a preset risk threshold.

[0017] The beneficial effects of this invention are:

[0018] Compared to existing technologies, this invention, with user authorization, firstly achieves a full-process, multi-dimensional characterization of user operation patterns by constructing a continuous sequence covering the entire transaction process and post-transaction interaction behaviors, overcoming the limitations of existing technologies that only focus on a single aspect. Secondly, by employing a prediction model integrating individual behavioral baselines and adaptive weight modules, it can accurately quantify the deviation between current behavior and historical patterns and dynamically adjust the contribution weight of each behavioral feature, thereby significantly improving the sensitivity of identifying covert fraudulent behavior. Thirdly, by introducing behavioral baselines of similar user groups to correct the initial risk coefficient, it effectively avoids misjudgments caused by individual user habits, enhancing the rationality and robustness of risk assessment. Finally, by implementing a tiered early warning mechanism based on historical data and correction coefficients, it constructs a complete protection loop from accurate detection to timely response, ultimately achieving a simultaneous improvement in anomaly detection accuracy and response time in complex and ever-changing transaction scenarios. Attached Figure Description

[0019] Figure 1 A flowchart illustrating an anomaly detection method for transaction log data provided by the present invention;

[0020] Figure 2 This is a schematic diagram of the structure of an anomaly detection system for transaction flow data provided by the present invention.

[0021] In the attached diagram, the components represented by each number are as follows:

[0022] Data acquisition module 11, abnormal risk prediction module 12, risk coefficient correction module 13, abnormal early warning module 14. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0025] In the description of this invention, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this invention is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed herein.

[0026] Example 1, as Figure 1 As shown, this embodiment of the invention provides a method for detecting anomalies in transaction log data, including:

[0027] S10: Based on transaction flow data, collect the target user's operation behavior data during the transaction process and the interaction behavior data after the transaction is completed. After sorting by timestamp, form a user operation behavior sequence and a user interaction behavior sequence. The interaction behavior data includes page dwell time, page switching order, and operation content.

[0028] Based on transaction log data, we collect user action data during the transaction process and user interaction data after the transaction is completed. These are then sorted by timestamp to form user action sequence and user interaction sequence, including:

[0029] Based on transaction flow data, the target user's operational behavior data during the transaction process is collected and sorted by timestamp to form a user operation behavior sequence. The operation behavior data includes at least card insertion speed, card ejection speed, password key press interval, and function key triggering order.

[0030] Based on transaction log data, interactive behavior data of target users after a transaction is completed is collected, including page dwell time, page switching order, and operation content. These data are then sorted by timestamp to form a user interaction behavior sequence. The operation content includes at least balance inquiry, receipt printing, and transfer operations.

[0031] First, data on the operational behavior of target users during the transaction process is collected. Target users refer to individual customers engaging in transactions; they are the specific objects of this behavioral feature analysis. Specifically, this operational behavior data comprehensively records the key operational characteristics of the target user's substantive interaction with the transaction device. For example, in online scenarios such as e-commerce platforms, the operational behavior data covers the complete interaction process from the user entering the checkout page to the final completion of payment. Collection dimensions include: page dwell time, such as the time spent on the order confirmation page; click intervals, such as the time interval between clicking the "Buy Now" button and the "Submit Order" button; information input rhythm, such as the input speed and modification frequency when filling in the shipping address or entering a discount code; and payment operation characteristics, such as the time interval between adjacent key presses when switching payment methods or entering a payment password.

[0032] In offline scenarios such as physical stores or self-checkout terminals, operational behavior data covers the complete operational chain from when a user begins checkout to when payment is completed. Collection dimensions include: device interaction speed, such as the adjustment time for a user to scan a product barcode with a barcode scanner or the approach speed for swiping a card or making contactless payments on a POS machine; payment confirmation intervals, such as the time intervals between steps when a user enters a password on the keypad or confirms with a signature; interface operation sequence, such as the order in which a user selects functions like points redemption or invoice issuance on the checkout interface; and overall checkout time, such as the total duration from scanning the first item to successful payment. After strictly sorting the operational behavior data points generated chronologically by timestamp, a sequence of user operational behaviors reflecting the user's core transaction habits is formed.

[0033] Secondly, data on the target user's interactive behavior after the core transaction process is completed is collected. This interactive behavior data focuses on the user's subsequent interactions with the device interface after a successful transaction. Examples include: the duration of user dwell time on various display interfaces such as the transaction results page and function selection page; the order in which the user switches between different interfaces; and the specific actions performed by the user before finally leaving the device, such as whether they performed a balance inquiry, selected transaction receipt printing, or initiated a subsequent transfer. After precisely sorting these time-series interactive behavior data points by timestamp, a sequence of user interactive behaviors reflecting the user's subsequent behavioral preferences is constructed.

[0034] It should be noted that the collection of transaction data involved in this application is based on user authorization and strictly follows relevant regulations on data security and privacy protection.

[0035] In summary, user operation behavior sequences and user interaction behavior sequences together constitute a multi-dimensional time-series data set that characterizes user behavior features. They respectively represent users' operational habits and patterns in the core transaction process and their interactive decision preferences in the post-transaction stage. This data can be used to build accurate user behavior profiles and identify abnormal activities that deviate from normal patterns, facilitating the full-process, fine-grained dynamic assessment and early warning of transaction risks.

[0036] S20: Input the user operation behavior sequence and user interaction behavior sequence into the pre-trained abnormal risk prediction model and output the initial risk coefficient;

[0037] Specifically, the user operation behavior sequence and user interaction behavior sequence are input into a pre-trained anomaly risk prediction model, which outputs an initial risk coefficient, including:

[0038] Invoke a pre-trained anomaly risk prediction model, wherein the anomaly risk prediction model integrates the individual behavioral baseline of the target user and an adaptive weight module;

[0039] Input the user operation behavior sequence and user interaction behavior sequence;

[0040] The abnormal risk prediction model is based on the individual behavioral baseline of the target user and calculates the degree of deviation of each operation dimension and the degree of deviation of each interaction dimension.

[0041] The abnormal risk prediction model dynamically adjusts the weight coefficients corresponding to the deviation degree of each operation dimension and the deviation degree of each interaction dimension through an adaptive weight module.

[0042] The initial risk coefficient is obtained by weighted summation based on the degree of deviation of each operation dimension, the degree of deviation of each interaction dimension, and the corresponding weight coefficients.

[0043] First, the pre-trained anomaly risk prediction model is invoked. This model is a sequence data processing model built on a long short-term memory network architecture. It integrates an individual behavior baseline pre-established based on the target user's historical data and includes an adaptive weight module that can dynamically adjust parameters. This anomaly risk prediction model maps the complex nonlinear relationship between multidimensional behavioral sequence features and transaction risk probabilities. It is used to quantitatively assess the degree of deviation of the current user's behavior from their historical habitual patterns and outputs an initial risk coefficient representing the likelihood of anomalies.

[0044] Specifically, calling the pre-trained anomaly risk prediction model includes:

[0045] Collect the target user's historical operation behavior sequence set and historical interaction behavior sequence set within a preset historical time period to form a sample feature set;

[0046] Obtain the historical risk coefficients corresponding to each sequence in the sample feature set as annotation information to form a sample label set;

[0047] After preprocessing the historical operation behavior sequence set and historical interaction behavior sequence set in the sample feature set, the individual behavior baseline of the target user is extracted;

[0048] An adaptive weight module is constructed based on the incremental learning algorithm.

[0049] The basic architecture for an anomaly risk prediction model is based on LSTM network, which integrates the individual behavior baseline of the target user and the adaptive weight module to form a complete anomaly risk prediction model.

[0050] Using the sample feature set as input and the sample label set as the supervision target, the complete anomaly risk prediction model is trained under supervision until it is verified to converge.

[0051] First, all historical operation and interaction sequences of the target user within a preset historical time period are collected. This historical time period refers to the data observation period selected for training the anomaly risk prediction model, and is set according to the stable period of user behavior and the data volume requirements for model training in the business scenario. For example, the most recent three months are selected as the data collection window. The collected sequence data are integrated to form the sample feature set for model training. At the same time, the historical risk coefficient corresponding to each sequence in the sample feature set is obtained. The historical risk coefficient is a quantitative assessment value obtained by business experts through annotation or by backtracking analysis based on historically verified anomaly cases. This historical risk coefficient is used to characterize the probability of anomalies in the corresponding historical transaction behavior at that time. Each historical risk coefficient is used as annotation information to form the sample label set required for training the anomaly risk prediction model.

[0052] Furthermore, the sample feature set is preprocessed by cleaning and standardizing the historical operation behavior sequence set and the historical interaction behavior sequence set to extract the individual behavior baseline that can represent the target user's habit pattern.

[0053] Specifically, after preprocessing the historical operation behavior sequence set and historical interaction behavior sequence set in the sample feature set, the individual behavior baseline of the target user is extracted, including:

[0054] For the historical operation behavior sequence set and historical interaction behavior sequence set in the sample feature set, extreme outliers are removed by box plot method to obtain standard historical operation behavior sequence set and standard historical interaction behavior sequence set;

[0055] Based on the aforementioned standard historical operation behavior sequence set, the mean and standard deviation of each operation behavior are calculated, and the normal numerical range of each operation behavior is determined using the 3σ principle.

[0056] Based on the standard historical interaction behavior sequence set, the mean and standard deviation of each interaction behavior are calculated, and the normal numerical range of each interaction behavior is determined by using the 3σ principle.

[0057] By integrating the normal numerical ranges of each operational behavior and each interactive behavior, an individual behavioral baseline for the target user is formed.

[0058] First, box plots are used to clean outliers from the historical operation and interaction behavior sequences. Box plots are a statistical analysis method based on data distribution. By calculating the upper quartile, lower quartile, and interquartile range (IIR) of each data sequence, the normal fluctuation range of the data is determined. Specifically, the upper quartile plus 1.5 times the IIR is used as the upper limit of the normal value, and the lower quartile minus 1.5 times the IIR is used as the lower limit. Extreme outliers outside these limits are identified and removed, resulting in a reliable set of standard historical operation and interaction behavior sequences after data cleaning.

[0059] Secondly, based on the cleaned set of standard historical operational behavior sequences, the arithmetic mean and standard deviation of each operational behavior dimension's data item are calculated. The arithmetic mean represents the typical level of central tendency of the operational behavior within the historical period; the standard deviation represents the dispersion and fluctuation range of the corresponding operational behavior data. Furthermore, applying the 3σ principle, with the mean as the center and plus or minus three standard deviations as the range, the normal value interval for each operational behavior dimension is determined. This interval will cover more than 99.7% of the normal behavior data. Specifically, the 3σ principle is a data range determination criterion established based on the characteristics of normal distribution. It constructs a statistical tolerance interval covering the vast majority of normal data by setting three standard deviation boundaries based on the mean. The final determined normal value intervals for each operational behavior serve as a benchmark reference range representing the target user's habitual behavior patterns in that dimension, used for deviation calculation and anomaly identification benchmarks during subsequent real-time behavior data comparison.

[0060] Similarly, based on a standard historical set of interaction behavior sequences, the arithmetic mean and standard deviation of each interaction behavior dimension data item are calculated. The arithmetic mean represents the typical performance level of the interaction behavior within the historical period; the standard deviation represents the volatility characteristics of the corresponding interaction behavior data. Then, applying the same 3σ principle, with the mean as the center and plus or minus three standard deviations as the range, the normal value range for each interaction behavior dimension is determined. This normal value range also covers more than 99.7% of the normal interaction behavior data.

[0061] Finally, the normal numerical ranges for each operational behavior dimension and each interactive behavior dimension are systematically integrated to construct an individual behavioral baseline that comprehensively reflects the behavioral habits of the target user. This individual behavioral baseline is a structured, multi-dimensional behavioral feature reference system that characterizes the stable behavioral patterns and reasonable fluctuation ranges of the target user in each operational and interactive dimension under normal conditions. It serves as a benchmark for subsequent quantitative comparison and anomaly identification of real-time behavioral data and historical normal patterns.

[0062] Furthermore, an adaptive weight module is constructed based on the incremental learning algorithm. This adaptive weight module is a dynamic parameter adjustment component integrated into the anomaly risk prediction model. During the process of the anomaly risk prediction model processing real-time behavioral data, it continuously optimizes the weight allocation of each feature dimension. It can be used to dynamically adjust the contribution of different behavioral features in risk calculation according to the latest changes in user behavior patterns, thereby improving the model's adaptability to the evolution of user behavior habits and the accuracy of anomaly identification.

[0063] Specifically, based on the incremental learning algorithm, an adaptive weight module is constructed, including:

[0064] Assign initial weights to each operation dimension and each interaction dimension of the user action behavior sequence and user interaction behavior sequence;

[0065] A sliding window is used to collect incremental data of the target user within a preset period. The incremental data includes the actual values ​​of each operation dimension, the actual values ​​of each interaction dimension, and the corresponding degree of deviation.

[0066] The incremental learning algorithm is used to calculate the deviation contribution of each operation dimension and each interaction dimension based on the incremental data.

[0067] The initial weights are dynamically adjusted based on the deviation contribution to obtain an adaptive weight module.

[0068] First, assign initial weight values ​​to each operation dimension and interaction dimension in the user operation behavior sequence and user interaction behavior sequence. These initial weights are set based on the results of feature importance analysis or the principle of equal weight. For example, differentiated weights are assigned according to the correlation between each dimension and risk events in historical data, or the same basic weight is assigned to all dimensions.

[0069] Secondly, a sliding window mechanism is used to collect incremental data from target users within the most recent preset period. This preset period is configured according to business scenario requirements, for example, set to 30 consecutive transaction days. The collected incremental data includes the actual values ​​of each operation dimension, the actual values ​​of each interaction dimension, and the deviation calculated from the normal value range of the corresponding dimension of the individual behavior baseline. In the specific calculation process, the actual observed value of each dimension is compared with the upper and lower limits of the normal value range of that dimension determined in the individual behavior baseline. If the actual value exceeds the normal range, the absolute distance from the nearest boundary is calculated as the deviation degree; if the actual value falls within the normal range, the deviation degree is recorded as zero.

[0070] Furthermore, the collected incremental data is processed using an incremental learning algorithm, a machine learning method that continuously integrates new data and dynamically updates model parameters without relying on retraining with complete historical data. Specifically, based on the frequency, magnitude, and correlation with other dimensions of the deviation degree of each dimension within the recent window, the deviation contribution of each operational dimension and each interaction dimension to the overall risk identification is calculated. This calculation process quantifies the discriminative ability and influence of each dimension in recent risk events by analyzing the statistical distribution characteristics of the deviation values ​​of each dimension and their co-occurrence patterns in time series, thereby forming an objective assessment of the importance of each dimension.

[0071] Secondly, the initial weights are dynamically adjusted based on the calculated deviation contribution of each dimension. Specifically, a weight update method based on an exponential normalization function is adopted. The calculation process involves using the deviation contribution of each dimension as input to an exponential function, converting the contribution into a positive value through exponential operations, then summing the exponential results of all dimensions, and using the ratio of the exponential result of a single dimension to the sum as the final weight of that dimension. Under this mechanism, dimensions with higher deviation contributions, due to their larger exponential results, will automatically receive higher weights after normalization; dimensions with lower deviation contributions, due to their smaller exponential results, will be assigned lower weights after normalization. This weight update process ensures that the sum of all adjusted weights remains constant, while simultaneously achieving automatic differentiated weight allocation between different dimensions, ultimately forming an adaptive weight module that accurately reflects the importance of the latest behavioral characteristics.

[0072] Furthermore, an LSTM (Long Short-Term Memory) network is used as the basic architecture to construct the anomaly risk prediction model. The aforementioned individual behavior baseline and adaptive weight module are integrated into this framework, thus forming a complete anomaly risk prediction model structure. Specifically, the sample feature set is used as the model input, and the sample label set is used as the supervised training target. The complete anomaly risk prediction model is trained in a supervised manner. The model parameters are continuously adjusted through iterative optimization until the performance on the validation set reaches a convergent state, thus obtaining the trained anomaly risk prediction model. The convergence condition is set based on the stability of the model's performance indicators on the validation set. For example, when the fluctuation of the validation set loss function value is less than a preset threshold of 0.5% over ten consecutive training periods, or when the improvement of the model accuracy indicator is less than 0.1% over ten consecutive training periods, the model is considered to have reached a convergence state.

[0073] Furthermore, the user operation behavior sequence and user interaction behavior sequence, which are collected and sorted in real time, are used as input data and imported into the anomaly risk prediction model. During the operation of the anomaly risk prediction model, based on its integrated target user individual behavior baseline, the data of each operation dimension and interaction dimension in the current input sequence are compared with the corresponding normal intervals in the baseline, thereby calculating the specific deviation degree of each operation dimension and each interaction dimension.

[0074] Meanwhile, based on this, the adaptive weight module inside the abnormal risk prediction model starts to work. According to the preset algorithm strategy, the adaptive weight module dynamically adjusts the weight coefficients corresponding to the deviation degree of each operation dimension and the deviation degree of each interaction dimension calculated at the moment, so that the contribution of different dimensions in the final risk assessment can be updated in real time.

[0075] Finally, the anomaly risk prediction model performs a weighted summation operation on the adjusted weight coefficients of each dimension, along with the corresponding deviations in the operational and interaction dimensions. This weighted sum serves as the initial risk coefficient output, representing the overall probability of anomalies in the current trading behavior. This initial risk coefficient is a quantitative assessment value obtained through multi-dimensional weighted fusion, representing the overall deviation and anomaly probability of the current user's behavior sequence relative to their individual historical behavior patterns. It is used for further correction and calibration of the risk coefficient by combining it with the group behavior baseline.

[0076] S30: Obtain the group behavior baseline of similar user groups, and combine the matching results of the user operation behavior sequence, user interaction behavior sequence and the group behavior baseline to correct the initial risk coefficient and obtain the final risk coefficient;

[0077] Specifically, based on transaction flow data, a baseline of group behavior for similar user groups is obtained. Combined with the user operation behavior sequence and user interaction behavior sequence, the initial risk coefficient is corrected to obtain the final risk coefficient, including:

[0078] Based on the user operation behavior sequence and user interaction behavior sequence of the target user, similar users with similarity that meet the preset similarity threshold are selected from the transaction flow data to form a similar user group;

[0079] Collect sets of similar operation behavior sequences and sets of similar interaction behavior sequences of the similar user groups, and extract the group behavior baseline of the similar user groups;

[0080] The similarity between individual behavioral baselines and group behavioral baselines in each dimension is calculated, and the mean of the similarity in each dimension is calculated as a correction coefficient.

[0081] The final risk coefficient is obtained by multiplying the initial risk coefficient by the correction coefficient.

[0082] First, based on the target user's user action behavior sequence and user interaction behavior sequence, users with similar behavioral patterns are screened from the transaction log database. Specifically, this can be achieved by calculating metrics such as Euclidean distance or cosine similarity between user action behavior sequences and user interaction behavior sequences, selecting users whose similarity reaches a preset similarity threshold to form a similar user group. For example, when using Euclidean distance as a similarity metric, the calculation process is as follows: Each user's action behavior sequence and interaction behavior sequence are represented as multi-dimensional feature vectors, where each dimension corresponds to a specific behavioral feature, such as card insertion speed, password input interval, page dwell time, etc.; the Euclidean distance between the two user behavior sequences is obtained by calculating the square root of the sum of the squared differences between the target user's feature vector and the candidate user's feature vector in each dimension. The smaller the distance value, the more similar the user behavior patterns.

[0083] The similarity threshold is set based on actual business needs and experimental verification results. For example, the Euclidean distance threshold is set to 0.85. When the Euclidean distance between the feature vectors of the target user and the candidate user is less than or equal to 0.85, the candidate user is determined to have a similar behavioral pattern to the target user and is included in the similar user group.

[0084] Secondly, historical operation and interaction behavior sequences of this similar user group are collected to form a set of similar operation behavior sequences and a set of similar interaction behavior sequences. Then, using the same statistical methods as those used to establish individual behavior baselines, the arithmetic mean and standard deviation of each operation and interaction dimension are calculated, and the 3σ principle is applied to determine the normal value range for each dimension. Finally, these are integrated to form a group behavior baseline that characterizes the common behavioral features of this similar user group.

[0085] Furthermore, the individual behavioral baseline of the target user is compared with the group behavioral baseline of similar user groups across multiple dimensions. For each operational and interaction dimension, the overlap between the two baselines within that dimension's numerical range is calculated, yielding a similarity score for each dimension. The specific overlap calculation employs an interval intersection ratio method: first, the intersection range of the individual and group behavioral baselines within the current dimension's numerical range is determined; then, the ratio of this intersection range length to the total coverage length of the two intervals is calculated; this ratio is the similarity score for that dimension. The arithmetic mean of the similarity scores for all dimensions is calculated; this mean is the correction coefficient. This correction coefficient is a normalized value between 0 and 1, used to characterize the degree of consistency between the target user's individual behavioral patterns and the common behavioral patterns of similar user groups.

[0086] Finally, the initial risk coefficient output by the anomaly risk prediction model is multiplied by the calculated correction coefficient, and the product is used as the final risk coefficient. This correction process effectively reduces the risk of misjudgment caused by individual user behavior habits, ensuring that the risk assessment results reflect both individual characteristics and group patterns. The final risk coefficient represents the comprehensive anomaly probability after calibration with group behavior patterns and can serve as a direct basis for determining the anomaly level and triggering corresponding warning actions in the tiered early warning mechanism.

[0087] S40: Based on a preset risk threshold, perform a graded anomaly warning operation on the final risk coefficient.

[0088] Specifically, based on a preset risk threshold, a graded anomaly warning operation is performed on the final risk coefficient, including:

[0089] Based on the risk coefficient distribution of historical abnormal transaction data, a first preset risk threshold is set;

[0090] Based on the correction coefficient, the first preset risk threshold is adaptively adjusted to obtain the second preset risk threshold, wherein the first preset risk threshold is greater than the second preset risk threshold.

[0091] The final risk coefficient is compared with the first preset risk threshold and the second preset risk threshold, and a graded anomaly warning operation is performed according to the preset response rules.

[0092] First, based on the statistical distribution characteristics of the final risk coefficients in historical abnormal transaction data, a basic risk threshold is set as the first preset risk threshold. This first preset risk threshold is determined by performing quantile analysis on historical risk coefficients; for example, the 95th percentile of the risk coefficients in historical abnormal cases is taken as the benchmark value of the first preset risk threshold.

[0093] Secondly, the first preset risk threshold is adaptively adjusted based on the consistency between individual user behavior and group behavior. Specifically, the first preset risk threshold is multiplied by a correction coefficient, and the product is used as the second preset risk threshold. Since the correction coefficient is a value between 0 and 1, the second preset risk threshold is necessarily lower than the first preset risk threshold. This adjustment mechanism ensures that when individual user behavior is highly consistent with group patterns, a stricter risk judgment standard is adopted, thereby enhancing the ability to identify covert fraud that imitates normal group behavior, while reducing false alarms caused by normal but special individual behavioral habits. This improves detection sensitivity while ensuring warning accuracy.

[0094] Finally, the calculated final risk coefficient is compared with the first and second preset risk thresholds. According to preset response rules, a transaction is considered normal when the final risk coefficient is lower than the second preset risk threshold; a medium-level alert is triggered when the final risk coefficient is between the second and first preset risk thresholds, initiating transaction record marking and manual review; and a high-level alert is triggered when the final risk coefficient is higher than the first preset risk threshold, initiating real-time transaction blocking and security alarm operations. This tiered alert mechanism optimizes the allocation efficiency of risk control resources while ensuring the accuracy of risk identification.

[0095] It should be noted that the collection of transaction data involved in this application is based on user authorization and strictly follows relevant regulations on data security and privacy protection.

[0096] For example, to further improve the accuracy of anomaly detection in transaction log data, this application may optionally incorporate non-sensitive features from backend transaction data, such as transaction frequency and transaction channel type, as supplementary references, provided that the above technical logic and compliance are met. It should be noted that the collection of backend transaction data is also based on user authorization and strictly adheres to data security and privacy protection regulations. This data is only used as a supplementary dimension for anomaly detection calibration and does not change the technical solution of this application, which is based on user behavior inertia for anomaly identification.

[0097] In summary, the embodiments of this application have at least the following technical effects:

[0098] Compared to existing technologies, this application, with user authorization, firstly achieves a complete characterization of user operation patterns by constructing a continuous behavioral sequence covering the entire transaction process and post-transaction interactions, breaking through the limitations of existing technologies that only focus on a single aspect. Secondly, by employing a prediction model that integrates individual behavioral baselines and adaptive weight modules, it can accurately quantify behavioral deviations and dynamically adjust feature weights, significantly improving the sensitivity to identify concealed fraudulent behavior. Thirdly, by introducing a group behavioral baseline to correct the risk coefficient, it effectively avoids misjudgments caused by individual special habits, enhancing the rationality of risk assessment. Finally, through an adaptive threshold-based hierarchical early warning mechanism based on correction coefficients, it constructs a risk prevention and control closed loop from accurate detection to intelligent response, ultimately achieving a simultaneous improvement in the accuracy and timeliness of anomaly detection in complex and ever-changing trading environments.

[0099] Example 2, as Figure 2 As shown, based on the same inventive concept as the anomaly detection method for transaction flow data provided in Embodiment 1, this embodiment of the invention also provides an anomaly detection system for transaction flow data, including:

[0100] The data acquisition module 11 is used to collect the target user's operation behavior data during the transaction process and the interaction behavior data after the transaction is completed, based on the transaction flow data. After sorting by timestamp, the data forms a user operation behavior sequence and a user interaction behavior sequence. The interaction behavior data includes page dwell time, page switching order, and operation content.

[0101] The abnormal risk prediction module 12 is used to input the user operation behavior sequence and user interaction behavior sequence into the pre-trained abnormal risk prediction model and output the initial risk coefficient.

[0102] The risk coefficient correction module 13 is used to obtain the group behavior baseline of similar user groups, and combine the matching results of the user operation behavior sequence, user interaction behavior sequence and the group behavior baseline to correct the initial risk coefficient and obtain the final risk coefficient.

[0103] The anomaly warning module 14 is used to perform a graded anomaly warning operation on the final risk coefficient based on a preset risk threshold.

[0104] Specifically, the data acquisition module 11 is used for:

[0105] Based on transaction log data, we collect user action data during the transaction process and user interaction data after the transaction is completed. These are then sorted by timestamp to form user action sequence and user interaction sequence, including:

[0106] Based on transaction flow data, the target user's operational behavior data during the transaction process is collected and sorted by timestamp to form a user operation behavior sequence. The operation behavior data includes at least card insertion speed, card ejection speed, password key press interval, and function key triggering order.

[0107] Based on transaction log data, interactive behavior data of target users after a transaction is completed is collected, including page dwell time, page switching order, and operation content. These data are then sorted by timestamp to form a user interaction behavior sequence. The operation content includes at least balance inquiry, receipt printing, and transfer operations.

[0108] The abnormal risk prediction module 12 is specifically used for:

[0109] The user operation behavior sequence and user interaction behavior sequence are input into a pre-trained anomaly risk prediction model, which outputs an initial risk coefficient, including:

[0110] Invoke a pre-trained anomaly risk prediction model, wherein the anomaly risk prediction model integrates the individual behavioral baseline of the target user and an adaptive weight module;

[0111] Input the user operation behavior sequence and user interaction behavior sequence;

[0112] The abnormal risk prediction model is based on the individual behavioral baseline of the target user and calculates the degree of deviation of each operation dimension and the degree of deviation of each interaction dimension.

[0113] The abnormal risk prediction model dynamically adjusts the weight coefficients corresponding to the deviation degree of each operation dimension and the deviation degree of each interaction dimension through an adaptive weight module.

[0114] The initial risk coefficient is obtained by weighted summation based on the degree of deviation of each operation dimension, the degree of deviation of each interaction dimension, and the corresponding weight coefficients.

[0115] First, invoke the pre-trained anomaly risk prediction model, including:

[0116] Collect the target user's historical operation behavior sequence set and historical interaction behavior sequence set within a preset historical time period to form a sample feature set;

[0117] Obtain the historical risk coefficients corresponding to each sequence in the sample feature set as annotation information to form a sample label set;

[0118] After preprocessing the historical operation behavior sequence set and historical interaction behavior sequence set in the sample feature set, the individual behavior baseline of the target user is extracted;

[0119] An adaptive weight module is constructed based on the incremental learning algorithm.

[0120] The basic architecture for an anomaly risk prediction model is based on LSTM network, which integrates the individual behavior baseline of the target user and the adaptive weight module to form a complete anomaly risk prediction model.

[0121] Using the sample feature set as input and the sample label set as the supervision target, the complete anomaly risk prediction model is trained under supervision until it is verified to converge.

[0122] Specifically, after preprocessing the historical operation behavior sequence set and historical interaction behavior sequence set in the sample feature set, the individual behavior baseline of the target user is extracted, including:

[0123] For the historical operation behavior sequence set and historical interaction behavior sequence set in the sample feature set, extreme outliers are removed by box plot method to obtain standard historical operation behavior sequence set and standard historical interaction behavior sequence set;

[0124] Based on the aforementioned standard historical operation behavior sequence set, the mean and standard deviation of each operation behavior are calculated, and the normal numerical range of each operation behavior is determined using the 3σ principle.

[0125] Based on the standard historical interaction behavior sequence set, the mean and standard deviation of each interaction behavior are calculated, and the normal numerical range of each interaction behavior is determined by using the 3σ principle.

[0126] By integrating the normal numerical ranges of each operational behavior and each interactive behavior, an individual behavioral baseline for the target user is formed.

[0127] Furthermore, based on the incremental learning algorithm, an adaptive weight module is constructed, including:

[0128] Assign initial weights to each operation dimension and each interaction dimension of the user action behavior sequence and user interaction behavior sequence;

[0129] A sliding window is used to collect incremental data of the target user within a preset period. The incremental data includes the actual values ​​of each operation dimension, the actual values ​​of each interaction dimension, and the corresponding degree of deviation.

[0130] The incremental learning algorithm is used to calculate the deviation contribution of each operation dimension and each interaction dimension based on the incremental data.

[0131] The initial weights are dynamically adjusted based on the deviation contribution to obtain an adaptive weight module.

[0132] Specifically, the risk coefficient correction module 13 is used for:

[0133] Based on transaction flow data, a baseline of group behavior for similar user groups is obtained. Combined with the user operation behavior sequence and user interaction behavior sequence, the initial risk coefficient is corrected to obtain a final risk coefficient, including:

[0134] Based on the user operation behavior sequence and user interaction behavior sequence of the target user, similar users with similarity that meet the preset similarity threshold are selected from the transaction flow data to form a similar user group;

[0135] Collect sets of similar operation behavior sequences and sets of similar interaction behavior sequences of the similar user groups, and extract the group behavior baseline of the similar user groups;

[0136] The similarity between individual behavioral baselines and group behavioral baselines in each dimension is calculated, and the mean of the similarity in each dimension is calculated as a correction coefficient.

[0137] The final risk coefficient is obtained by multiplying the initial risk coefficient by the correction coefficient.

[0138] The anomaly warning module 14 is specifically used for:

[0139] Based on a preset risk threshold, a graded anomaly warning operation is performed on the final risk coefficient, including:

[0140] Based on the risk coefficient distribution of historical abnormal transaction data, a first preset risk threshold is set;

[0141] Based on the correction coefficient, the first preset risk threshold is adaptively adjusted to obtain the second preset risk threshold, wherein the first preset risk threshold is greater than the second preset risk threshold.

[0142] The final risk coefficient is compared with the first preset risk threshold and the second preset risk threshold, and a graded anomaly warning operation is performed according to the preset response rules.

[0143] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this specification. Additionally, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0144] The above description is only a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0145] This specification and accompanying drawings are merely illustrative examples of this application and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from its scope. Therefore, if such modifications and modifications fall within the scope of this application and its equivalents, this application intends to include such modifications and modifications.

Claims

1. A method for detecting anomalies in transaction log data, characterized in that, The method comprises the following steps: Based on transaction flow data, the operation behavior data of the target user during the transaction process and the interaction behavior data after the transaction is completed are collected respectively, and after being sorted by timestamp, the user operation behavior sequence and the user interaction behavior sequence are formed, wherein the interaction behavior data includes page stay time, page switching sequence and operation content; The user operation behavior sequence and the user interaction behavior sequence are input into a pre-trained abnormal risk prediction model to output an initial risk coefficient; Obtain the group behavior baseline of the similar user group, combine the matching results of the user operation behavior sequence, the user interaction behavior sequence and the group behavior baseline, and modify the initial risk coefficient to obtain the final risk coefficient; Based on the preset risk threshold, the final risk coefficient is executed for hierarchical abnormal warning operation; Wherein, the user operation behavior sequence and the user interaction behavior sequence are input into a pre-trained abnormal risk prediction model to output an initial risk coefficient, comprising: Call the pre-trained abnormal risk prediction model, wherein the abnormal risk prediction model integrates the individual behavior baseline of the target user and the adaptive weight module; Input the user operation behavior sequence and the user interaction behavior sequence; The abnormal risk prediction model calculates the deviation degree of each operation dimension and the deviation degree of each interaction dimension based on the individual behavior baseline of the target user; The abnormal risk prediction model dynamically adjusts the weight coefficient corresponding to each operation dimension deviation degree and each interaction dimension deviation degree through the adaptive weight module; Based on each operation dimension deviation degree, each interaction dimension deviation degree and the corresponding weight coefficient, the initial risk coefficient is obtained by weighted summation.

2. The transaction flow data anomaly detection method according to claim 1, wherein Based on transaction flow data, the operation behavior data of the target user during the transaction process and the interaction behavior data after the transaction is completed are collected respectively, and after being sorted by timestamp, the user operation behavior sequence and the user interaction behavior sequence are formed, comprising: Based on transaction flow data, the operation behavior data of the target user during the transaction process is collected, and sorted by timestamp to form the user operation behavior sequence, wherein the operation behavior data at least includes card insertion speed, card withdrawal speed, password key time interval, function key trigger sequence; Based on transaction flow data, the interaction behavior data of the target user after the transaction is completed, including page stay time, page switching sequence and operation content, is collected, and sorted by timestamp to form the user interaction behavior sequence, wherein the operation content at least includes balance inquiry, receipt printing and transfer operation.

3. The transaction flow data anomaly detection method of claim 1, wherein, Calling the pre-trained abnormal risk prediction model comprises: Collect the historical operation behavior sequence set and the historical interaction behavior sequence set of the target user within the preset historical time to form a sample feature set; Obtain the historical risk coefficient corresponding to each sequence in the sample feature set as the label information to form a sample label set; After preprocessing the historical operation behavior sequence set and the historical interaction behavior sequence set in the sample feature set, the individual behavior baseline of the target user is extracted; Based on the incremental learning algorithm, an adaptive weight module is constructed; The abnormal risk prediction model is constructed based on an LSTM network, and an individual behavior baseline of a target user and an adaptive weight module are integrated to form a complete abnormal risk prediction model; The complete abnormal risk prediction model is supervised and trained until verification convergence is achieved, with the sample feature set as input and the sample label set as a supervised target.

4. The transaction flow data anomaly detection method according to claim 3, wherein, After preprocessing the historical operation behavior sequence set and the historical interaction behavior sequence set in the sample feature set, the individual behavior baseline of the target user is extracted, including: The historical operation behavior sequence set and the historical interaction behavior sequence set in the sample feature set are processed by the box plot method to remove extreme abnormal values, to obtain a standard historical operation behavior sequence set and a standard historical interaction behavior sequence set; Based on the standard historical operation behavior sequence set, the mean and standard deviation of each operation behavior are calculated, and the normal numerical interval of each operation behavior is determined by using the 3σ principle; Based on the standard historical interaction behavior sequence set, the mean and standard deviation of each interaction behavior are calculated, and the normal numerical interval of each interaction behavior is determined by using the 3σ principle; The normal numerical interval of each operation behavior and the normal numerical interval of each interaction behavior are integrated to form the individual behavior baseline of the target user.

5. The transaction flow data anomaly detection method according to claim 3, wherein, Based on an incremental learning algorithm, an adaptive weight module is constructed, including: An initial weight is assigned to each operation dimension and each interaction dimension of the user operation behavior sequence and the user interaction behavior sequence; Incremental data of the target user in a preset period are collected by using a sliding window, wherein the incremental data includes actual values of each operation dimension, actual values of each interaction dimension, and corresponding deviation degrees; The deviation contribution degree of each operation dimension and each interaction dimension is calculated based on the incremental data by using the incremental learning algorithm; The initial weight is dynamically adjusted according to the deviation contribution degree to obtain the adaptive weight module.

6. The transaction flow data anomaly detection method of claim 1, wherein, Based on transaction flow data, a group behavior baseline of a similar user group is obtained, and the initial risk coefficient is corrected to obtain a final risk coefficient, in combination with the user operation behavior sequence and the user interaction behavior sequence, including: Similar users that satisfy a preset similarity threshold are filtered out from the transaction flow data based on the user operation behavior sequence and the user interaction behavior sequence of the target user, to form a similar user group; Similar operation behavior sequence sets and similar interaction behavior sequence sets of the similar user group are collected, and a group behavior baseline of the similar user group is extracted; The similarity of the individual behavior baseline and the group behavior baseline in each dimension is calculated, and the mean of the similarity in each dimension is calculated as a correction coefficient; The initial risk coefficient is multiplied by the correction coefficient to obtain the final risk coefficient.

7. The transaction flow data anomaly detection method of claim 1, wherein, Based on a preset risk threshold, a hierarchical abnormal early warning operation is performed on the final risk coefficient, including: A first preset risk threshold is set based on the risk coefficient distribution of historical abnormal transaction flow data; The first preset risk threshold is adaptively adjusted based on the correction coefficient to obtain a second preset risk threshold, wherein the first preset risk threshold is greater than the second preset risk threshold; The final risk coefficient is compared with the first preset risk threshold and the second preset risk threshold, and a hierarchical abnormality early warning operation is performed according to a preset response rule.

8. An anomaly detection system for transaction stream data, characterized by, An abnormality detection method for transaction flow data according to any one of claims 1-7, comprising: A data collection module configured to collect, based on the transaction flow data, operation behavior data of the target user in a transaction process and interaction behavior data after completion of the transaction, and form a user operation behavior sequence and a user interaction behavior sequence after sorting by time stamp, wherein the interaction behavior data comprises page dwell time, page switching sequence and operation content; An abnormality risk prediction module configured to input the user operation behavior sequence and the user interaction behavior sequence into a pre-trained abnormality risk prediction model and output an initial risk coefficient; A risk coefficient correction module configured to obtain a group behavior baseline of a similar user group, correct the initial risk coefficient based on a matching result of the user operation behavior sequence, the user interaction behavior sequence and the group behavior baseline, and obtain a final risk coefficient; An abnormality early warning module configured to perform a hierarchical abnormality early warning operation on the final risk coefficient based on a preset risk threshold.

Images