Training method of fraud identification model, fraud identification method and related equipment
By employing feature extraction, filtering, and dimensionality reduction methods, combined with training and optimization techniques using feedforward neural network pools, the problem of existing models ignoring the differences in fraudulent behavior is addressed, thereby improving the accuracy of fraud detection.
Patent Information
- Application Number
- CN202511738087.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-25
- Publication Date
- 2026-02-13
AI Technical Summary
Existing fraud detection models ignore the differences between various fraudulent behaviors, which limits the accuracy of the models and affects the accuracy of fraud detection results.
By acquiring training data, performing feature extraction and filtering, feature vectors associated with preset fraudulent behaviors are obtained. Feature dimensionality reduction and iterative training are then performed, and a feedforward neural network pool is used for model training. Combined with elastic weight solidification and experience replay techniques, the model parameters are optimized.
It improves the accuracy and precision of the fraud detection model, enhancing its ability to identify fraudulent activities.
Smart Images
Figure CN121524978A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of artificial intelligence technology, and in particular to a training method for a fraud detection model, a fraud detection method, and related equipment. Background Technology
[0002] In recent years, fraud involving phone cards and bank cards has posed a serious threat to financial security and people's property, and has fundamentally challenged traditional financial risk control systems. To safeguard financial security, relevant laws provide corresponding fraud identification models to identify whether phone cards and bank cards pose a fraud risk.
[0003] However, the aforementioned fraud detection models employ a single training classification method, resulting in data isolation between different training data sets. For example, the training data may come from different banks and operators, and the timeframes for generating and acquiring the training data often vary significantly. In other words, existing fraud detection models ignore the differences between various fraudulent behaviors, thus limiting model accuracy and affecting the overall accuracy of fraud detection results. Summary of the Invention
[0004] This application provides a training method for a fraud detection model, a fraud detection method, and related equipment, aiming to solve the technical problem that existing fraud detection models ignore the differences between different fraudulent behaviors, thereby limiting the accuracy of the model and affecting the accuracy of fraud detection results.
[0005] In a first aspect, embodiments of this application provide a method for training a fraud detection model, the method comprising:
[0006] Acquire training data, which includes multiple training samples;
[0007] Feature extraction is performed on the multiple training samples to obtain a label feature vector and multiple first feature vectors corresponding to each training sample. The label feature vector is used to characterize the fraudulent behavior associated with the training samples.
[0008] Feature filtering is performed on the plurality of first feature vectors to obtain N first feature vectors associated with preset fraudulent behavior, where N is a positive integer greater than 1;
[0009] Based on the correlation weight value corresponding to each of the N first feature vectors, feature dimensionality reduction is performed on the N first feature vectors to obtain M first feature vectors. The correlation weight value is used to characterize the correlation strength between the first feature vector and the corresponding fraudulent behavior. The M first feature vectors are a subset of the N first feature vectors, and M is a positive integer greater than 1 and less than N.
[0010] The M first feature vectors are input into a preset fraud detection model, and the fraud detection model is iteratively trained based on the label feature vector corresponding to each training sample to obtain the trained target fraud detection model.
[0011] Optionally, the fraud detection model includes a feedforward neural network pool, and the method further includes:
[0012] In each iteration of training, for each model parameter in the feedforward neural network pool, the iteration weight value corresponding to the model parameter is determined based on the expected value of the model parameter in the previous iteration of training.
[0013] The model parameters are adjusted based on the iterative weight values corresponding to the model parameters.
[0014] Optionally, the fraud detection model includes a feedforward neural network pool that stores multiple historical samples, and the method further includes:
[0015] When multiple updated samples are received, the number of samples to be replaced is determined based on the number of historical samples and the number of updated samples.
[0016] K historical samples are randomly deleted from the plurality of historical samples, where K is a value representing the number of samples replaced, and K is a positive integer greater than 1;
[0017] K update samples from the plurality of update samples are stored in the feedforward neural network pool.
[0018] Optionally, acquiring training data includes:
[0019] Obtain multiple training samples;
[0020] Based on the Euclidean distance between each training sample, determine the multiple nearest neighbor samples associated with each training sample;
[0021] For each training sample, an extended sample is generated based on the Euclidean distance between the training sample and the target nearest neighbor sample, wherein the target nearest neighbor sample is any one of the plurality of nearest neighbor samples;
[0022] The training samples and the extended samples corresponding to each training sample are aggregated to generate training data.
[0023] Secondly, embodiments of this application provide a fraud identification method, the method comprising:
[0024] Obtain the data to be identified;
[0025] Feature extraction is performed on the data to be identified to obtain multiple second feature vectors corresponding to the data to be identified;
[0026] The multiple second feature vectors are input into the target fraud detection model to obtain multiple probability values. The multiple probability values correspond one-to-one with multiple fraud tasks. The probability values are used to characterize the probability of fraudulent behavior. The target fraud detection model is trained based on the fraud detection model training method described above.
[0027] The probability value that is higher than the preset threshold is determined as the target probability value;
[0028] Fraud identification results are generated based on the fraud behavior represented by the fraud task corresponding to the target probability value.
[0029] Optionally, the target fraud identification model includes a feedforward neural network pool, a gated network pool, and multiple tower networks. The feedforward neural network pool includes multiple feedforward neural networks, the gated network pool includes multiple gated networks, and the multiple gated networks correspond one-to-one with the multiple tower networks.
[0030] The process of inputting the plurality of second feature vectors into the target fraud detection model yields a plurality of probability values, including:
[0031] Send the plurality of second feature vectors to each feedforward neural network to obtain a plurality of third feature vectors output by each feedforward neural network after performing feature recognition on the plurality of second feature vectors;
[0032] Each third feature vector is sent to the corresponding gating network to obtain the feature representation vector output by each gating network after weighted summation of each third feature vector;
[0033] The feature representation vector output by each gated network is sent to the tower network corresponding to each gated network to obtain multiple probability values.
[0034] Thirdly, embodiments of this application provide a training apparatus for a fraud detection model, the apparatus comprising:
[0035] The first acquisition module is used to acquire training data, which includes multiple training samples.
[0036] The first extraction module is used to extract features from the multiple training samples to obtain a label feature vector and multiple first feature vectors corresponding to each training sample. The label feature vector is used to characterize the fraudulent behavior associated with the training samples.
[0037] The filtering module is used to perform feature filtering on the plurality of first feature vectors to obtain N first feature vectors associated with preset fraudulent behavior, where N is a positive integer greater than 1;
[0038] The dimensionality reduction module is used to perform feature dimensionality reduction on the N first feature vectors according to the correlation weight value corresponding to each first feature vector in the N first feature vectors, to obtain M first feature vectors. The correlation weight value is used to characterize the correlation strength between the first feature vector and the corresponding fraudulent behavior. The M first feature vectors are some feature vectors among the N first feature vectors, and M is a positive integer greater than 1 and less than N.
[0039] The training module is used to input the M first feature vectors into a preset fraud detection model, and to iteratively train the fraud detection model based on the label feature vector corresponding to each training sample to obtain the trained target fraud detection model.
[0040] Fourthly, embodiments of this application provide a fraud detection device, the device comprising:
[0041] The second acquisition module is used to acquire the data to be identified;
[0042] The second extraction module is used to extract features from the data to be identified, and obtain multiple second feature vectors corresponding to the data to be identified.
[0043] The processing module is used to input the multiple second feature vectors into the target fraud identification model to obtain multiple probability values. The multiple probability values correspond one-to-one with multiple fraud tasks. The probability values are used to characterize the probability of fraudulent behavior. The target fraud identification model is trained based on the fraud identification model training method described above.
[0044] The first determining module is used to determine the probability value that is higher than the preset threshold as the target probability value;
[0045] The generation module is used to generate fraud identification results based on the fraud behavior represented by the fraud task corresponding to the target probability value.
[0046] Fifthly, embodiments of this application provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the training method for the fraud detection model as described in the first aspect, or the steps of the fraud detection method as described in the second aspect.
[0047] In a sixth aspect, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the training method for the fraud detection model as described in the first aspect, or the steps of the fraud detection method as described in the second aspect.
[0048] In a seventh aspect, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of a training method for a fraud detection model as described in the first aspect, or the steps of a fraud detection method as described in the second aspect.
[0049] This application provides a training method for a fraud detection model, a fraud detection method, and related equipment. The method includes: acquiring training data, which includes multiple training samples; extracting features from the multiple training samples to obtain a label feature vector and multiple first feature vectors corresponding to each training sample, wherein the label feature vector is used to characterize the fraudulent behavior associated with the training sample; performing feature filtering on the multiple first feature vectors to obtain N first feature vectors associated with a preset fraudulent behavior, where N is a positive integer greater than 1; performing feature dimensionality reduction on the N first feature vectors according to the association weight value corresponding to each of the N first feature vectors to obtain M first feature vectors, wherein the association weight value is used to characterize the correlation strength between the first feature vector and the corresponding fraudulent behavior, and the M first feature vectors are a subset of the N first feature vectors, where M is a positive integer greater than 1 and less than N; inputting the M first feature vectors into a preset fraud detection model, and iteratively training the fraud detection model based on the label feature vector corresponding to each training sample to obtain the trained target fraud detection model. In this embodiment, features are extracted from multiple training samples to obtain multiple first feature vectors; feature filtering is performed on the multiple first feature vectors to obtain N first feature vectors associated with preset fraudulent behaviors; feature dimensionality reduction is performed on the N first feature vectors to obtain M first feature vectors; then the M first feature vectors are input into a preset fraud identification model, and the fraud identification model is iteratively trained. The fraud identification model is trained using first feature vectors that are strongly correlated with fraudulent behaviors, thereby improving the model's identification accuracy and the accuracy of fraud identification results. Attached Figure Description
[0050] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0051] Figure 1 This is a flowchart illustrating a training method for a fraud detection model provided in an embodiment of this application;
[0052] Figure 2 This is a flowchart of a fraud identification method provided in an embodiment of this application;
[0053] Figure 3 This is a schematic diagram of the architecture and data flow of the fraud detection model provided in the embodiments of this application;
[0054] Figure 4 This is a schematic diagram illustrating an application scenario of the fraud detection method provided in the embodiments of this application;
[0055] Figure 5 This is a schematic diagram of the structure of a training device for a fraud detection model provided in an embodiment of this application;
[0056] Figure 6 This is a schematic diagram of the structure of a fraud detection device provided in an embodiment of this application;
[0057] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0058] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0059] It should be noted that the training method for the fraud detection model and the fraud detection method provided in this application embodiment can be applied to telecommunications operator servers to enable telecommunications operators to identify whether a mobile phone number is involved in fraudulent activities. It should also be understood that the training method for the fraud detection model and the fraud detection method provided in this application embodiment can be applied to other scenarios, such as banking systems, to enable banking systems to identify whether bank cards are involved in fraudulent activities.
[0060] For the purpose of clearly explaining the technical solution, the following uses the training method of the fraud recognition model provided in the embodiments of this application and the application of the fraud recognition method to the telecommunications operator server as an example to illustrate the technical solution.
[0061] See Figure 1 , Figure 1 This is a flowchart illustrating a training method for a fraud detection model provided in an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:
[0062] Step 101: Obtain training data, which includes multiple training samples.
[0063] The training samples mentioned above include, but are not limited to: data from telecommunications operators, external collaboration data, and terminal behavior data.
[0064] This data from telecom operators includes call details, customer relationship management data, and billing data. Telecom operator data forms the basic profile of user communication behavior.
[0065] External collaborative data includes historical fraudulent phone number lists and high-risk area information provided by partner institutions such as banks and public security bureaus. This external collaborative data serves as a source of tagged feature vectors characterizing fraudulent behavior.
[0066] Terminal behavior data includes user application usage data collected through legal authorization, reflecting users' internet behavior preferences.
[0067] In this step, training samples are obtained by fusing the original data of the training samples, namely, telecom operator data, external collaboration data, and terminal behavior data. Optionally, during the data fusion process of multiple original data, data cleaning can be performed, for example, using interpolation or mean imputation to handle missing values, and using box plots or Z-score methods to identify and remove outliers.
[0068] Step 102: Extract features from the multiple training samples to obtain a label feature vector and multiple first feature vectors corresponding to each training sample. The label feature vector is used to characterize the fraudulent behavior associated with the training sample.
[0069] The training samples can be obtained through the above steps. In this step, features are extracted from multiple training samples to transform unstructured and semi-structured raw data into numerical feature vectors that the model can understand. Optionally, the feature vector corresponding to each training sample can represent basic communication behavior features, user attribute features, social network features, advanced behavior and content features, and historical tag features.
[0070] The aforementioned basic communication behavior characteristics include the number of calls made / received within the statistical period, total call duration, number of SMS messages sent and received, caller ID ratio, and nighttime call ratio. The aforementioned user attribute characteristics include static or semi-static features such as multiple phone numbers under one ID card, network usage duration, plan type, and terminal device model. The aforementioned social network characteristics include the user's social graph, calculating the degree centrality and betweenness centrality of nodes, and the dispersion of called numbers. The aforementioned advanced behavioral and content characteristics include the regularity of communication time, the temporal pattern of application usage sequences, and whether high-frequency contacts are in the risk number database. The aforementioned historical tag characteristics characterize whether the user has been labeled as a certain risk type in the past.
[0071] In this process, the feature vector representing the historical label features can be called the label feature vector, and the other feature vectors can be called the first feature vectors. This yields the label feature vector and multiple first feature vectors for each training sample.
[0072] Optionally, the data structure of the training samples is such that each training sample consists of one row and multiple columns, and each row of the training sample corresponds to one feature vector.
[0073] Step 103: Perform feature filtering on the plurality of first feature vectors to obtain N first feature vectors associated with preset fraudulent behavior, where N is a positive integer greater than 1.
[0074] In this step, multiple first feature vectors can be filtered to remove feature vectors that are not associated with fraudulent behavior, thereby obtaining N first feature vectors that are associated with preset fraudulent behavior.
[0075] Optionally, the Frequent Pattern Growth (FP-Growth) algorithm can be used for feature selection. FP-Growth directly mines frequent patterns from the FP-tree, avoiding a large amount of computational overhead. It is especially suitable for processing high-dimensional sparse data, thereby quickly locating feature vectors associated with fraudulent behavior. That is, multiple first feature vectors are input into the FP-Growth algorithm to obtain N first feature vectors.
[0076] Step 104: Based on the correlation weight value corresponding to each of the N first feature vectors, perform feature dimensionality reduction on the N first feature vectors to obtain M first feature vectors. The correlation weight value is used to characterize the correlation strength between the first feature vector and the corresponding fraudulent behavior. The M first feature vectors are some feature vectors among the N first feature vectors, and M is a positive integer greater than 1 and less than N.
[0077] It should be noted that a corresponding association weight value is pre-set for each first feature vector. The aforementioned association weight value is used to characterize the correlation strength between the first feature vector and the corresponding fraudulent behavior. In other words, the higher the association weight value corresponding to a certain first feature vector, the stronger the correlation between the first feature vector and the corresponding fraudulent behavior.
[0078] In this step, optionally, the Recursive Feature Elimination (RFE) method can be used to reduce the dimensionality of the N first feature vectors to obtain M first feature vectors.
[0079] The RFE method is a wrapper-style feature selection method. Its working principle is as follows: First, an external evaluation model is trained using all features; then, the features are ranked according to the weights or importance given by the model, and one or more of the least important features are removed; then, the above process is repeated using the remaining features until the number of features reaches the preset target.
[0080] Step 105: Input the M first feature vectors into the preset fraud detection model, and iteratively train the fraud detection model based on the label feature vector corresponding to each training sample to obtain the trained target fraud detection model.
[0081] It should be understood that the fraud identification model described above can be a multi-gate mixture-of-experts with continuous learning (MMoE-CL) model.
[0082] In this step, M first feature vectors are input into a preset fraud detection model, and the fraud detection model is trained iteratively. During the iterative training process, a loss function is calculated based on the label feature vector corresponding to each training sample to update the model parameters of the fraud detection model, and finally the trained target fraud detection model is obtained.
[0083] In this embodiment, features are extracted from multiple training samples to obtain multiple first feature vectors; feature filtering is performed on the multiple first feature vectors to obtain N first feature vectors associated with preset fraudulent behaviors; feature dimensionality reduction is performed on the N first feature vectors to obtain M first feature vectors; then the M first feature vectors are input into a preset fraud identification model, and the fraud identification model is iteratively trained. The fraud identification model is trained using first feature vectors that are strongly correlated with fraudulent behaviors, thereby improving the model's identification accuracy and the accuracy of fraud identification results.
[0084] It should be understood that the fraud detection model in this embodiment includes a feedforward neural network pool, also known as an expert network pool. The feedforward neural network pool has a continuous learning mechanism, that is, it integrates elastic weight fixation technology and experience replay technology, which will be explained in detail below.
[0085] Optionally, the fraud detection model includes a feedforward neural network pool, and the method further includes:
[0086] In each iteration of training, for each model parameter in the feedforward neural network pool, the iteration weight value corresponding to the model parameter is determined based on the expected value of the model parameter in the previous iteration of training.
[0087] The model parameters are adjusted based on the iterative weight values corresponding to the model parameters.
[0088] In this embodiment, the feedforward neural network pool applies elastic weight fixation technology, which is a regularization-based continuous learning method. Its core idea is to identify and protect network weights that are crucial to the old tasks when learning a new task, limiting the extent of their modification.
[0089] Specifically, during each training iteration, the iterative weight value for each model parameter in the feedforward neural network pool is determined based on the expected value of the model parameter in the previous training iteration. The iterative weight value can be calculated using the following formula:
[0090]
[0091] in Indicates the iterative weight value. Indicates the expected value. Indicates iterative training task That is, the previous iteration training task. Indicates model parameters, This is the symbol for partial derivative calculations.
[0092] In this embodiment, if the iterative weight value corresponding to a certain model parameter is large, it means that the model parameter is more important to the previous iteration training task. In the current iteration training task, the adjustment of the model parameter is controlled within a preset range, thereby protecting the network weights that are crucial to the old task.
[0093] In this embodiment, by introducing elastic weight fixation technology into the feedforward neural network pool, the adjustment range of model parameters is controlled according to the importance of model parameters in each iteration of the training task, thereby ensuring the stability of the fraud detection model.
[0094] Optionally, the fraud detection model includes a feedforward neural network pool that stores multiple historical samples, and the method further includes:
[0095] When multiple updated samples are received, the number of samples to be replaced is determined based on the number of historical samples and the number of updated samples.
[0096] K historical samples are randomly deleted from the plurality of historical samples, where K is a value representing the number of samples replaced, and K is a positive integer greater than 1;
[0097] K update samples from the plurality of update samples are stored in the feedforward neural network pool.
[0098] It should be understood that the feedforward neural network pool utilizes experience replay technology, which is a memory-based continuous learning method. By maintaining a limited-capacity experience replay buffer, a reservoir sampling strategy is employed to store a small number of representative historical samples. Reservoir sampling is an algorithm that can randomly select a fixed number of samples with equal probability from unknown or massive data streams.
[0099] In this embodiment, the feedforward neural network pool stores multiple historical samples, and the samples stored in the feedforward neural network pool are updated through experience replay technology.
[0100] Specifically, when multiple updated samples are received, the number of sample replacements is determined based on the number of historical samples and the number of updated samples. This number can be represented by the value denoted by K. Optionally, the ratio of the number of historical samples to the number of updated sample indices can be used to determine the number of sample replacements.
[0101] Furthermore, K historical samples are randomly deleted from multiple historical samples, and K updated samples from multiple updated samples are stored in the feedforward neural network pool.
[0102] In this embodiment, by introducing experience replay technology into the feedforward neural network pool, each updated sample has an equal chance of being stored during the process of updating the samples stored in the feedforward neural network pool, thereby ensuring the representativeness of the sampled samples.
[0103] In this embodiment, sample balancing can be performed on the training samples to expand the number of training samples.
[0104] Optionally, acquiring training data includes:
[0105] Obtain multiple training samples;
[0106] Based on the Euclidean distance between each training sample, determine the multiple nearest neighbor samples associated with each training sample;
[0107] For each training sample, an extended sample is generated based on the Euclidean distance between the training sample and the target nearest neighbor sample, wherein the target nearest neighbor sample is any one of the plurality of nearest neighbor samples;
[0108] The training samples and the extended samples corresponding to each training sample are aggregated to generate training data.
[0109] In this embodiment, for a given training sample, the Euclidean distance between the training sample and other samples is calculated, and a predetermined number of samples with the shortest Euclidean distance are identified as the nearest neighbors of the training sample. In an optional implementation, the five samples with the shortest Euclidean distance to a given training sample can be identified as the nearest neighbors of the training sample.
[0110] Randomly select one nearest neighbor sample from multiple nearest neighbor samples as the target nearest neighbor sample. On the line connecting the training sample and the target nearest neighbor sample, randomly select a point as the newly generated extended sample. In this way, the extended sample corresponding to each training sample is obtained. Then, multiple training samples and the extended sample corresponding to each training sample are aggregated to generate training data.
[0111] In this embodiment, by performing sample balancing on the training samples, the number of training samples is effectively increased, and the coverage area in the feature space is expanded, thereby helping the fraud detection model learn a more robust classification boundary and avoiding inaccurate recognition results due to data imbalance.
[0112] See Figure 2 , Figure 1 This is a flowchart of a fraud identification method provided in an embodiment of this application, such as... Figure 3 As shown, the method includes the following steps:
[0113] Step 201: Obtain the data to be identified.
[0114] In this step, the data to be identified is obtained. Optionally, the data to be identified may be data from telecommunications operators or terminal behavior data.
[0115] Step 202: Extract features from the data to be identified to obtain multiple second feature vectors corresponding to the data to be identified.
[0116] In this step, features are extracted from the data to be identified, resulting in multiple second feature vectors corresponding to the data. The specific implementation method for feature extraction from the data to be identified is the same as that for feature extraction from the training data, and will not be repeated here.
[0117] Step 203: Input the multiple second feature vectors into the target fraud identification model to obtain multiple probability values. The multiple probability values correspond one-to-one with multiple fraud tasks. The probability values are used to characterize the probability of fraudulent behavior. The target fraud identification model is trained based on the fraud identification model training method described above.
[0118] It should be noted that the target fraud model in this step is trained based on the fraud identification model training method described above.
[0119] In this step, after obtaining the second feature vector, multiple second feature vectors are input into the target fraud detection model to obtain multiple probability values. These probability values correspond one-to-one with the fraud task, and each probability value represents the probability of fraudulent behavior. In other words, the higher the probability value, the stronger the correlation between the second feature vector and fraudulent behavior.
[0120] Step 204: Determine the probability value that is higher than the preset threshold as the target probability value.
[0121] Step 205: Generate fraud identification results based on the fraud behavior represented by the fraud task corresponding to the target probability value.
[0122] In the above steps, the probability value that is higher than a preset threshold among multiple probability values can be determined as the target probability value. The fraudulent behavior represented by the fraud task corresponding to the target probability value is determined as other fraudulent behaviors associated with the data to be identified, thereby generating fraud identification results.
[0123] The above-mentioned preset threshold is a customizable value. Optionally, the above-mentioned preset threshold is 0.8.
[0124] In this embodiment, data to be identified is acquired; features are extracted from the data to be identified to obtain multiple second feature vectors; these multiple second feature vectors are input into a target fraud identification model to obtain multiple probability values; and then a fraud identification result is generated based on these multiple probability values. The target fraud identification model is trained using the training method described above, meaning that the target fraud identification model has high identification accuracy, thereby improving the accuracy of the fraud identification result.
[0125] Optionally, the target fraud identification model includes a feedforward neural network pool, a gated network pool, and multiple tower networks. The feedforward neural network pool includes multiple feedforward neural networks, the gated network pool includes multiple gated networks, and the multiple gated networks correspond one-to-one with the multiple tower networks.
[0126] The process of inputting the plurality of second feature vectors into the target fraud detection model yields a plurality of probability values, including:
[0127] Send the plurality of second feature vectors to each feedforward neural network to obtain a plurality of third feature vectors output by each feedforward neural network after performing feature recognition on the plurality of second feature vectors;
[0128] Each third feature vector is sent to the corresponding gating network to obtain the feature representation vector output by each gating network after weighted summation of each third feature vector;
[0129] The feature representation vector output by each gated network is sent to the tower network corresponding to each gated network to obtain multiple probability values.
[0130] For the purpose of clearly explaining the technical solution of this embodiment, please refer to the following: Figure 3 , Figure 3 This is a schematic diagram of the architecture and data flow of the fraud detection model provided in the embodiments of this application, as shown below. Figure 3 As shown, the fraud detection model includes a shared expert network, namely the feedforward neural network pool mentioned in the above embodiments; a task-specific gating network, namely the gating network pool mentioned above; and a tower network.
[0131] Among them, the feedforward neural network includes multiple feedforward neural networks. Optionally, the feedforward neural network can be a network structure containing two fully connected layers, each with 128 neurons, and using a Rectified Linear Unit (ReLU) as the activation function.
[0132] like Figure 3 As shown, the implementation steps are as follows: sending feature x to each expert network included in the shared expert network, and using the output of each expert network as the input of each gating network. That is, in this embodiment, sending multiple second feature vectors to each feedforward neural network to obtain multiple third feature vectors output by each feedforward neural network; and sending each third feature vector to the corresponding gating network.
[0133] like Figure 3 As shown, each gating network performs a weighted summation on each received third feature vector and outputs the result to the corresponding tower network to obtain the predicted value output by each tower network. The predicted value mentioned above is the probability value referred to in this embodiment.
[0134] It should be noted that each gated network corresponds to one fraudulent activity. One possibility is that different gated networks correspond to different types of fraudulent activities; for example, one gated network might correspond to "online fraud" while another corresponds to "loan fraud." Another possibility is that different gated networks might correspond to the same type of fraudulent activity, but with different data sources or time periods; for example, one gated network might correspond to "loan fraud - bank tag" while another corresponds to "loan fraud - police tag."
[0135] In this embodiment, each gated network performs a weighted summation of each third feature vector to output a feature representation vector. The aforementioned feature representation vector can be determined using the following formula:
[0136]
[0137] in, The feature vector represents the feature vector. Indicates gating network The i-th weight of the output, Let represent the output of the i-th expert, and n represent the number of expert networks.
[0138] For a better understanding of the overall technical solution, please refer to [link / reference]. Figure 4 ,like Figure 4As shown, multi-source data, i.e. training data, is input into the data and feature engineering module. The data and feature engineering module performs the feature extraction, feature filtering, and feature dimensionality reduction operations described in this embodiment. The feature vector output by the data and feature engineering module is input into the model training and update platform to iteratively train the fraud detection model.
[0139] After the fraud detection model is trained, it is deployed in the model service module. During the model application phase, the business system calls the model service module through an interface. Based on the data to be identified sent by the business system, the model service module sends the fraud detection results back to the business system.
[0140] See Figure 5 , Figure 5 This is a schematic diagram of the structure of a training device for a fraud detection model provided in an embodiment of this application, as shown below. Figure 5 As shown, the training device 500 for the fraud detection model includes:
[0141] The first acquisition module 501 is used to acquire training data, the training data including multiple training samples;
[0142] The first extraction module 502 is used to extract features from the plurality of training samples to obtain a label feature vector and a plurality of first feature vectors corresponding to each training sample. The label feature vector is used to characterize the fraudulent behavior associated with the training samples.
[0143] The filtering module 503 is used to perform feature filtering on the plurality of first feature vectors to obtain N first feature vectors associated with preset fraudulent behavior, where N is a positive integer greater than 1;
[0144] The dimension reduction module 504 is used to perform feature dimension reduction on the N first feature vectors according to the correlation weight value corresponding to each first feature vector in the N first feature vectors to obtain M first feature vectors. The correlation weight value is used to characterize the correlation strength between the first feature vector and the corresponding fraudulent behavior. The M first feature vectors are some feature vectors among the N first feature vectors, and M is a positive integer greater than 1 and less than N.
[0145] The training module 505 is used to input the M first feature vectors into a preset fraud detection model, and to iteratively train the fraud detection model based on the label feature vector corresponding to each training sample to obtain the trained target fraud detection model.
[0146] Optionally, the fraud detection model includes a feedforward neural network pool, and the training device 500 for the fraud detection model further includes:
[0147] The first determining module is used to determine the iterative weight value corresponding to each model parameter in the feedforward neural network pool during each iteration training process, based on the expected value of the model parameter in the previous iteration training process.
[0148] The adjustment module is used to adjust the model parameters according to the iterative weight values corresponding to the model parameters.
[0149] Optionally, the fraud detection model includes a feedforward neural network pool that stores multiple historical samples, and the training device 500 for the fraud detection model further includes:
[0150] The second determining module is used to determine the number of samples to be replaced based on the number of historical samples and the number of updated samples when multiple updated samples are received.
[0151] The deletion module is used to randomly delete K historical samples from the plurality of historical samples, where K is a value representing the number of sample replacements, and K is a positive integer greater than 1;
[0152] A storage module is used to store K updated samples out of the plurality of updated samples into the feedforward neural network pool.
[0153] Optionally, the first acquisition module 501 is specifically used for:
[0154] Obtain multiple training samples;
[0155] Based on the Euclidean distance between each training sample, determine the multiple nearest neighbor samples associated with each training sample;
[0156] For each training sample, an extended sample is generated based on the Euclidean distance between the training sample and the target nearest neighbor sample, wherein the target nearest neighbor sample is any one of the plurality of nearest neighbor samples;
[0157] The training samples and the extended samples corresponding to each training sample are aggregated to generate training data.
[0158] The training device 500 for the fraud detection model is capable of implementing each process of the various embodiments of the above-described fraud detection model training method. The technical features are one-to-one and can achieve the same technical effect. To avoid repetition, it will not be described again here.
[0159] See Figure 6 , Figure 6 This is a schematic diagram of the structure of a fraud detection device provided in an embodiment of this application, as shown below. Figure 6 As shown, the fraud detection device 600 includes:
[0160] The second acquisition module 601 is used to acquire the data to be identified;
[0161] The second extraction module 602 is used to extract features from the data to be identified and obtain multiple second feature vectors corresponding to the data to be identified.
[0162] The processing module 603 is used to input the plurality of second feature vectors into the target fraud identification model to obtain a plurality of probability values. The plurality of probability values correspond one-to-one with a plurality of fraud tasks. The probability values are used to characterize the probability of fraudulent behavior. The target fraud identification model is trained based on the fraud identification model training method described above.
[0163] The first determining module 604 is used to determine the probability value that is higher than the preset threshold as the target probability value;
[0164] The generation module 605 is used to generate fraud identification results based on the fraud behavior represented by the fraud task corresponding to the target probability value.
[0165] Optionally, the target fraud identification model includes a feedforward neural network pool, a gated network pool, and multiple tower networks. The feedforward neural network pool includes multiple feedforward neural networks, the gated network pool includes multiple gated networks, and the multiple gated networks correspond one-to-one with the multiple tower networks.
[0166] The processing module 603 is specifically used for:
[0167] Send the plurality of second feature vectors to each feedforward neural network to obtain a plurality of third feature vectors output by each feedforward neural network after performing feature recognition on the plurality of second feature vectors;
[0168] Each third feature vector is sent to the corresponding gating network to obtain the feature representation vector output by each gating network after weighted summation of each third feature vector;
[0169] The feature representation vector output by each gated network is sent to the tower network corresponding to each gated network to obtain multiple probability values.
[0170] The fraud detection device 600 is capable of implementing each process of the above-described fraud detection method, with one-to-one correspondence of technical features and achieving the same technical effect. To avoid repetition, it will not be described in detail here.
[0171] For details, see Figure 7 This application also provides an electronic device, including a bus 701, a transceiver 702, an antenna 703, a bus interface 707, a processor 705, and a memory 706.
[0172] The transceiver 702 is used to acquire training data, which includes multiple training samples.
[0173] The processor 705 is used to extract features from the plurality of training samples to obtain a label feature vector and a plurality of first feature vectors corresponding to each training sample. The label feature vector is used to characterize the fraudulent behavior associated with the training samples.
[0174] Feature filtering is performed on the plurality of first feature vectors to obtain N first feature vectors associated with preset fraudulent behavior, where N is a positive integer greater than 1;
[0175] Based on the correlation weight value corresponding to each of the N first feature vectors, feature dimensionality reduction is performed on the N first feature vectors to obtain M first feature vectors. The correlation weight value is used to characterize the correlation strength between the first feature vector and the corresponding fraudulent behavior. The M first feature vectors are a subset of the N first feature vectors, and M is a positive integer greater than 1 and less than N.
[0176] The M first feature vectors are input into a preset fraud detection model, and the fraud detection model is iteratively trained based on the label feature vector corresponding to each training sample to obtain the trained target fraud detection model.
[0177] The transceiver 702 is also used to acquire data to be identified;
[0178] The processor 705 is further configured to extract features from the data to be identified, thereby obtaining multiple second feature vectors corresponding to the data to be identified;
[0179] The multiple second feature vectors are input into the target fraud detection model to obtain multiple probability values. The multiple probability values correspond one-to-one with multiple fraud tasks. The probability values are used to characterize the probability of fraudulent behavior. The target fraud detection model is trained based on the fraud detection model training method described above.
[0180] The probability value that is higher than the preset threshold is determined as the target probability value;
[0181] Fraud identification results are generated based on the fraud behavior represented by the fraud task corresponding to the target probability value.
[0182] exist Figure 7In this document, a bus architecture (represented by bus 701) is used. Bus 701 can include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 705 and memory represented by memory 706. Bus 701 can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 707 provides an interface between bus 701 and transceiver 702. Transceiver 702 can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 705 is transmitted over a wireless medium via antenna 703, which further receives data and transmits data to processor 705.
[0183] Processor 705 manages bus 701 and general processing, and also provides various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Memory 706 can be used to store data used by processor 705 during operation.
[0184] Optionally, the processor 705 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD).
[0185] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the above-described fraud detection model training method embodiment, or implements the various processes of the above-described fraud detection method embodiment, achieving the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.
[0186] This application also provides a computer program product, including computer instructions. When executed by a processor, the computer instructions implement various processes of the above-described fraud detection model training method embodiment, or implement various processes of the above-described fraud detection method embodiment, and can achieve the same technical effect. To avoid repetition, they will not be described again here.
[0187] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.
[0188] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.
[0189] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.
Claims
1. A training method for a fraud detection model, characterized in that, The method includes: Acquire training data, which includes multiple training samples; Feature extraction is performed on the multiple training samples to obtain a label feature vector and multiple first feature vectors corresponding to each training sample. The label feature vector is used to characterize the fraudulent behavior associated with the training samples. Feature filtering is performed on the plurality of first feature vectors to obtain N first feature vectors associated with preset fraudulent behavior, where N is a positive integer greater than 1; Based on the correlation weight value corresponding to each of the N first feature vectors, feature dimensionality reduction is performed on the N first feature vectors to obtain M first feature vectors. The correlation weight value is used to characterize the correlation strength between the first feature vector and the corresponding fraudulent behavior. The M first feature vectors are a subset of the N first feature vectors, and M is a positive integer greater than 1 and less than N. The M first feature vectors are input into a preset fraud detection model, and the fraud detection model is iteratively trained based on the label feature vector corresponding to each training sample to obtain the trained target fraud detection model.
2. The method according to claim 1, characterized in that, The fraud detection model includes a feedforward neural network pool, and the method further includes: In each iteration of training, for each model parameter in the feedforward neural network pool, the iteration weight value corresponding to the model parameter is determined based on the expected value of the model parameter in the previous iteration of training. The model parameters are adjusted based on the iterative weight values corresponding to the model parameters.
3. The method according to claim 1, characterized in that, The fraud detection model includes a feedforward neural network pool, which stores multiple historical samples. The method further includes: When multiple updated samples are received, the number of samples to be replaced is determined based on the number of historical samples and the number of updated samples. K historical samples are randomly deleted from the plurality of historical samples, where K is a value representing the number of samples replaced, and K is a positive integer greater than 1; K update samples from the plurality of update samples are stored in the feedforward neural network pool.
4. The method according to claim 1, characterized in that, The acquisition of training data includes: Obtain multiple training samples; Based on the Euclidean distance between each training sample, determine the multiple nearest neighbor samples associated with each training sample; For each training sample, an extended sample is generated based on the Euclidean distance between the training sample and the target nearest neighbor sample, wherein the target nearest neighbor sample is any one of the plurality of nearest neighbor samples; The training samples and the extended samples corresponding to each training sample are aggregated to generate training data.
5. A fraud detection method, characterized in that, include: Obtain the data to be identified; Feature extraction is performed on the data to be identified to obtain multiple second feature vectors corresponding to the data to be identified; The plurality of second feature vectors are input into the target fraud identification model to obtain a plurality of probability values. The plurality of probability values correspond one-to-one with a plurality of fraud tasks. The probability values are used to characterize the probability of the existence of fraudulent behavior. The target fraud identification model is trained based on the training method of the fraud identification model according to any one of claims 1 to 4. The probability value that is higher than the preset threshold is determined as the target probability value; Fraud identification results are generated based on the fraud behavior represented by the fraud task corresponding to the target probability value.
6. The method according to claim 5, characterized in that, The target fraud detection model includes a feedforward neural network pool, a gated network pool, and multiple tower networks. The feedforward neural network pool includes multiple feedforward neural networks, and the gated network pool includes multiple gated networks. The multiple gated networks correspond one-to-one with the multiple tower networks. The process of inputting the plurality of second feature vectors into the target fraud detection model yields a plurality of probability values, including: Send the plurality of second feature vectors to each feedforward neural network to obtain a plurality of third feature vectors output by each feedforward neural network after performing feature recognition on the plurality of second feature vectors; Each third feature vector is sent to the corresponding gating network to obtain the feature representation vector output by each gating network after weighted summation of each third feature vector; The feature representation vector output by each gated network is sent to the tower network corresponding to each gated network to obtain multiple probability values.
7. A training device for a fraud detection model, characterized in that, The device includes: The first acquisition module is used to acquire training data, which includes multiple training samples. The first extraction module is used to extract features from the multiple training samples to obtain a label feature vector and multiple first feature vectors corresponding to each training sample. The label feature vector is used to characterize the fraudulent behavior associated with the training samples. The filtering module is used to perform feature filtering on the plurality of first feature vectors to obtain N first feature vectors associated with preset fraudulent behavior, where N is a positive integer greater than 1; The dimensionality reduction module is used to perform feature dimensionality reduction on the N first feature vectors according to the correlation weight value corresponding to each first feature vector in the N first feature vectors, to obtain M first feature vectors. The correlation weight value is used to characterize the correlation strength between the first feature vector and the corresponding fraudulent behavior. The M first feature vectors are some feature vectors among the N first feature vectors, and M is a positive integer greater than 1 and less than N. The training module is used to input the M first feature vectors into a preset fraud detection model, and to iteratively train the fraud detection model based on the label feature vector corresponding to each training sample to obtain the trained target fraud detection model.
8. A fraud detection device, characterized in that, include: The second acquisition module is used to acquire the data to be identified; The second extraction module is used to extract features from the data to be identified, and obtain multiple second feature vectors corresponding to the data to be identified. The processing module is used to input the plurality of second feature vectors into the target fraud identification model to obtain a plurality of probability values, wherein the plurality of probability values correspond one-to-one with a plurality of fraud tasks, and the probability values are used to characterize the probability of the existence of fraudulent behavior. The target fraud identification model is trained based on the training method of the fraud identification model according to any one of claims 1 to 4. The first determining module is used to determine the probability value that is higher than the preset threshold as the target probability value; The generation module is used to generate fraud identification results based on the fraud behavior represented by the fraud task corresponding to the target probability value.
9. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the training method for the fraud detection model as described in any one of claims 1 to 4, or the steps of the fraud detection method as described in claim 5 or 6.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the training method for the fraud detection model as described in any one of claims 1 to 4, or the steps of the fraud detection method as described in claim 5 or 6.