Abnormal transaction behavior detection method and device, equipment, medium and program product

Abstract

The invention provides an abnormal transaction behavior detection method and device, equipment, a storage medium and a program product, can be applied to the technical field of artificial intelligence, and relates to application of a large model in a financial science and technology scene. The method comprises the steps that multi-dimensional feature extraction is carried out on transaction data to obtain multi-dimensional feature data, the multi-dimensional feature data comprises time sequence features, text features and associated features, the text features comprise transaction opponent types and transaction remark information, and the associated features represent transaction features between clients and corresponding transaction opponents; respectively inputting the time sequence features and the text features into a feature extraction model to obtain a time sequence vector and a text vector; encoding the associated features by using a graph neural network to obtain an associated vector; fusing the time sequence vector, the text vector and the association vector to obtain a fused feature vector; and inputting the fusion feature vector into an anomaly detection model, and determining an abnormal transaction behavior.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and relates to application of a large model in a financial technology scene, and more particularly to an abnormal transaction behavior detection method, device, equipment, medium and program product. BACKGROUND

[0002] Traditional abnormal transaction behavior detection methods mainly rely on preset rules, and such methods have the following limitations: (1) it is difficult to accurately identify new abnormal transaction behaviors; (2) it is necessary to manually update detection rules, which is costly and cannot detect abnormal transaction behaviors in real time according to the evolution of fraud means, and has poor adaptability; (3) it is only based on single-dimensional transaction features for analysis, and has low recognition accuracy; (4) it only performs simple statistical analysis on transaction data, and has a high false positive rate. These limitations will reduce the accuracy of abnormal transaction behavior detection. In addition, in existing methods, the method of detecting abnormal transaction behaviors by using a machine learning model cannot adaptively learn the nonlinear interaction of high-dimensional features, thereby resulting in low detection accuracy. SUMMARY

[0003] In view of the above problems, the present application provides an abnormal transaction behavior detection method, device, equipment, medium and program product for improving the accuracy of abnormal transaction behavior detection.

[0004] According to a first aspect of the present application, an abnormal transaction behavior detection method is provided, comprising: performing multi-dimensional feature extraction on transaction data to obtain multi-dimensional feature data, wherein the multi-dimensional feature data includes time sequence features, text features and association features, the text features include transaction counterparty types and transaction note information, and the association features represent transaction features between a customer and each transaction counterparty corresponding to the customer; inputting the time sequence features and the text features into a feature extraction model respectively to obtain a time sequence vector and a text vector; encoding the association features by using a graph neural network to obtain an association vector; fusing the time sequence vector, the text vector and the association vector to obtain a fused feature vector; and inputting the fused feature vector into an anomaly detection model to determine abnormal transaction behaviors.

[0005] According to an embodiment of the present application, the time sequence feature and the text feature are respectively input into a feature extraction model to obtain a time sequence vector and a text vector, including: in the feature extraction model, the time sequence feature is converted into a time sequence embedding sequence through a first embedding layer, and the text feature is converted into a text embedding sequence through a second embedding layer, wherein the first embedding layer includes a first position encoding and a time decay factor, the time decay factor is used to focus on the current transaction data, and the second embedding layer includes a word embedding and a second position encoding; the time sequence vector is obtained based on the time sequence embedding sequence and the time decay factor; a global semantic vector of the text feature is extracted from the text embedding sequence; a local semantic vector is extracted from the global semantic vector by using a convolution pooling layer; and a feature after fusion of the global semantic vector and the local semantic vector is subjected to nonlinear transformation to obtain the text vector.

[0006] According to an embodiment of the present application, the time sequence vector is obtained based on the time sequence embedding sequence and the time decay factor, including: generating a first query matrix, a first key matrix and a first value matrix according to the time sequence embedding sequence; calculating a first attention weight of the time sequence feature according to the first query matrix, the first key matrix and the time decay factor; and performing nonlinear transformation on a feature after weighting of the first attention weight and the first value matrix to obtain the time sequence vector.

[0007] According to an embodiment of the present application, the global semantic vector of the text feature is extracted from the text embedding sequence, including: generating a second query matrix, a second key matrix and a second value matrix according to the text embedding sequence; calculating a second attention weight of the text feature according to the second query matrix and the second key matrix; and performing nonlinear transformation on a feature after weighting of the second attention weight and the second value matrix to obtain the global semantic vector of the text feature.

[0008] According to an embodiment of the present application, the method further includes: generating a heat map according to the current transaction data and the historical associated transaction data thereof; respectively extracting key information of a first historical associated transaction and a second historical associated transaction in the heat map, wherein a first attention weight of the first historical associated transaction is greater than a first preset threshold, and a second attention weight of the second historical associated transaction is greater than a second preset threshold; and verifying an abnormal transaction behavior based on the key information.

[0009] According to an embodiment of the present application, the time sequence vector, the text vector and the associated vector are fused to obtain a fusion feature vector, including: taking the time sequence vector as a query vector, and taking the text vector and the associated vector as a key vector and a value vector respectively; inputting the query vector, the key vector and the value vector into a cross-attention network to obtain the fusion feature vector.

[0010] According to an embodiment of the present application, the fusion feature vector is input into the anomaly detection model to determine the abnormal transaction behavior, including: obtaining the non-linear correlation relationship between each feature in the fusion feature vector through the feature extraction network; dividing the correlation feature map constructed based on the transaction features into multiple communities, and determining the abnormal transaction node in the community based on a preset abnormal node discrimination rule, wherein the preset abnormal node discrimination rule includes at least one of a degree deviation rule, a node mode deviation rule, and a fund flow direction rule, the degree deviation rule representing the deviation degree of the degree of the node relative to the degree of the same type node, the node mode deviation rule representing the deviation degree of the transaction feature of the node relative to the overall transaction feature of the community where the node is located, and the fund flow direction rule representing the abnormal degree of the fund path flowing through the node; if the density of the abnormal transaction node is greater than a preset threshold, calculating the probability of the abnormal transaction behavior occurring in the community based on the density, wherein the density of the abnormal transaction node represents the proportion of the abnormal transaction node in all nodes in the same community; if the probability is greater than a preset probability, obtaining the abnormal transaction behavior type matching the non-linear correlation relationship from a transaction type mapping library, wherein the transaction type mapping library represents the mapping relationship between the non-linear correlation relationship and the abnormal transaction behavior type, and the transaction type mapping library is continuously updated according to the abnormal transaction behavior type.

[0011] According to an embodiment of the present application, the probability of the abnormal transaction behavior occurring in the community is calculated based on the density, including: for any abnormal transaction node, calculating the correlation of the abnormal transaction node with other nodes in the community where the abnormal transaction node is located to obtain a correlation score of the abnormal transaction node; calculating the mean value of the correlation scores of the abnormal transaction nodes in the same community to obtain the correlation mean value of the abnormal transaction nodes in the community; and weighting the density of the abnormal transaction nodes in the same community and the correlation mean value to obtain the probability of the abnormal transaction behavior occurring in the community.

[0012] According to an embodiment of the present application, the method further includes: if the probability is greater than the preset probability and no abnormal transaction behavior type is obtained from the transaction type mapping library, generating an early warning information and sending the early warning information to the customer; if the customer confirms that the current transaction is an abnormal transaction, labeling the type of the abnormal transaction, and storing the non-linear correlation relationship of the current transaction and the labeled type of the abnormal transaction into the transaction type mapping library.

[0013] According to an embodiment of the present application, the method further includes: obtaining a prompt word template matching the abnormal transaction behavior from a prompt word template library, wherein the prompt word template library is continuously updated according to the determined abnormal transaction behavior; filling the multi-dimensional feature data into the prompt word template to obtain an inference instruction; performing reasoning according to the inference instruction, calculating the similarity between the abnormal transaction behavior type obtained by reasoning and the abnormal transaction behavior type output by the anomaly detection model; and if the similarity is greater than a preset similarity threshold, correcting the output of the anomaly detection model according to the reasoning process.

[0014] The second aspect of the present application provides an abnormal transaction behavior detection device, comprising: a multi-dimensional feature data acquisition module, configured to perform multi-dimensional feature extraction on transaction data to obtain multi-dimensional feature data, wherein the multi-dimensional feature data comprises time sequence features, text features and association features, the text features comprise transaction counterparty types and transaction note information, and the association features represent transaction features between a client and each transaction counterparty corresponding to the client; a first vector acquisition module, configured to input the time sequence features and the text features into a feature extraction model respectively to obtain a time sequence vector and a text vector; a second vector acquisition module, configured to encode the association features by using a graph neural network to obtain an association vector; a fused feature vector acquisition module, configured to fuse the time sequence vector, the text vector and the association vector to obtain a fused feature vector; and an abnormal transaction behavior determination module, configured to input the fused feature vector into an anomaly detection model to determine an abnormal transaction behavior.

[0015] The third aspect of the present application provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method.

[0016] The fourth aspect of the present application further provides a computer-readable storage medium having a computer program or instructions stored thereon, wherein the computer program or instructions are executed by a processor to implement the steps of the method.

[0017] The fifth aspect of the present application further provides a computer program product comprising a computer program or instructions, wherein the computer program or instructions are executed by a processor to implement the steps of the method. BRIEF DESCRIPTION OF DRAWINGS

[0018] The above and other objects, features and advantages of the present application will become more apparent from the following description of embodiments of the present application, taken in conjunction with the accompanying drawings, in which:

[0019] Figure 1 An application scenario diagram of an abnormal transaction behavior detection method, device, equipment, medium and program product according to an embodiment of the present application is schematically shown;

[0020] Figure 2 A flowchart of an abnormal transaction behavior detection method according to an embodiment of the present application is schematically shown;

[0021] Figure 3 An acquisition method diagram of a time sequence vector and a text vector according to an embodiment of the present application is schematically shown;

[0022] Figure 4 A first abnormal transaction behavior verification method diagram according to an embodiment of the present application is schematically shown;

[0023] Figure 5 FIG. 5 schematically illustrates a flowchart of a method for determining abnormal transaction behavior according to an embodiment of the present application;

[0024] Figure 6 FIG. 6 schematically illustrates a flowchart of a second method for verifying abnormal transaction behavior according to an embodiment of the present application;

[0025] Figure 7 FIG. 7 schematically illustrates a block diagram of an abnormal transaction behavior detection device according to an embodiment of the present application; and

[0026] Figure 8 FIG. 8 schematically illustrates a block diagram of an electronic device adapted to implement the abnormal transaction behavior detection method according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. It is to be understood, however, that these descriptions are merely exemplary and are intended to illustrate the scope of the present application, not to limit it. In the following detailed description of the embodiments of the present application, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to one skilled in the art that the embodiments of the present application can be practiced without these specific details. In other instances, well-known structures and functions have been omitted or simplified in order not to obscure the concepts of the present application.

[0028] The terms used herein are merely used to describe specific embodiments, and are not intended to limit the present application. The terms "include" and "have" and the like used herein indicate the presence of the described features, steps, operations, and / or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

[0029] All terms used herein, including technical and scientific terms, have the same meanings as those generally understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the present specification, and should not be interpreted in an idealized or excessively formal manner.

[0030] In the case of using expressions similar to "at least one of A, B, and C, etc.", it should generally be interpreted to include at least one of A, B, or C, or a combination thereof, unless otherwise defined. For example, "a system having at least one of A, B, and C" should be interpreted to include a system having at least one of A, B, or C, or a system having a combination of A, B, and C, etc.

[0031] In the technical solutions of the present application, the user information (including but not limited to user personal information, user image information, user device information such as location information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards, necessary security measures are taken, do not violate public order and good customs, and appropriate operation portals are provided for users to choose authorization or refusal.

[0032] In the scenario of making automated decisions using personal information, the method, device and system provided by the embodiments of the present application all provide corresponding operation portals for users to choose to agree or refuse the automated decision result; if the user chooses to refuse, the expert decision process is entered. The expression "automated decision" here refers to the activity of automatically analyzing, evaluating the behavior habits, interests and hobbies or economic, health, credit status of individuals, etc. by computer programs and making decisions. The expression "expert decision" here refers to the activity of making decisions by personnel who are engaged in a certain field of work, have special experience, knowledge and skills and reach a certain professional level.

[0033] The embodiments of the present application provide an abnormal transaction behavior detection method. In view of the problem of low detection accuracy in existing abnormal transaction behavior detection methods, the present application deeply mines time sequence features and text features through a feature extraction model, deeply mines correlation features by using a graph neural network, comprehensively analyzes complex patterns in transaction data by combining time sequence features, text features and correlation features, identifies abnormal transaction behaviors, and improves identification accuracy.

[0034] Figure 1 An application scenario diagram of the abnormal transaction behavior detection method according to the embodiments of the present application is schematically shown.

[0035] As shown in Figure 1 According to the application scenario 100 of the embodiment, the first terminal device 101, the second terminal device 102, the third terminal device 103, the network 104 and the server 105 can be included. The network 104 is used as a medium to provide a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0036] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0037] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smartphones, tablet computers, laptop computers, desktop computers, etc.

[0038] The server 105 can be a server providing various services, such as a background management server supporting websites browsed by the user using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (only as examples). The background management server can analyze and process received user requests and other data, and feed back the processing results (such as web pages, information, or data, etc. obtained or generated according to user requests) to the terminal device.

[0039] It should be noted that the abnormal transaction behavior detection method provided in the embodiments of the present application can generally be executed by the server 105. Correspondingly, the abnormal transaction behavior detection device provided in the embodiments of the present application can generally be arranged in the server 105. The abnormal transaction behavior detection method provided in the embodiments of the present application can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105. Correspondingly, the abnormal transaction behavior detection device provided in the embodiments of the present application can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105.

[0040] It should be understood that Figure 1 The number of terminal devices, networks, and servers in the above

[0041] The abnormal transaction behavior detection method according to the embodiments of the present application will be described in detail based on the scenarios described below. Figure 1 Figures 2-6

[0042] Figure 2 The flowchart of the abnormal transaction behavior detection method according to the embodiments of the present application is schematically shown.​​

[0043] As shown in Figure 2 The abnormal transaction behavior detection method 200 of this embodiment includes operation S210 to operation S250.

[0044] In operation S210, multi-dimensional feature extraction is performed on the transaction data to obtain multi-dimensional feature data, wherein the multi-dimensional feature data includes time sequence features, text features, and association features, the text features include transaction counterparty types and transaction note information, and the association features represent transaction features between the customer and each transaction counterparty corresponding to the customer.

[0045] In operation S220, the time sequence features and the text features are respectively input into a feature extraction model to obtain a time sequence vector and a text vector.

[0046] In operation S230, a graph neural network is used to encode the association features to obtain an association vector.

[0047] In operation S240, the time sequence vector, the text vector, and the association vector are fused to obtain a fused feature vector.

[0048] In operation S250, the fused feature vector is input into an anomaly detection model to determine an abnormal transaction behavior.

[0049] In some embodiments, before operation S210, the transaction data is preprocessed, and the preprocessing includes data cleaning and standardization processing. The data cleaning can be to eliminate null values, format errors (for example, transaction time format confusion), and data with obvious abnormal values (for example, transaction amount is negative or far beyond the reasonable range) in the transaction data, and can also be to perform deduplication processing on repeated transaction records, for example, the same transaction is uploaded multiple times to generate repeated transaction records, and only one transaction record can be retained for each transaction through deduplication processing. The standardization processing includes time standardization and text standardization. The time standardization refers to uniformly converting time data involved in the transaction data into millisecond timestamps. The text standardization refers to unifying the representation of transaction types (for example, “transfer remittance” and “bank transfer” are unified as “transfer”), converting transaction counterparty names, transaction note information, and the like into Chinese, and converting traditional Chinese characters into simplified Chinese.

[0050] In some embodiments, the application has a wide range of applications and can accurately identify abnormal transaction behaviors of the elderly, children, and disabled people. For this group of people who are not very convenient to directly obtain transaction data, other means can be used to collect transaction data, for example, associating the bank account of the elderly, children, or disabled people with their relatives, collecting their transaction data after being confirmed by the relatives, or collecting transaction data through log information in screen reading software. The screen reading software can obtain information such as voice instructions, gesture instructions, and touch instructions of the customer.

[0051] In some embodiments, during operation S210, time-series features can characterize some statistical features of transaction data, such as transaction intervals, transaction cycles, transaction frequencies, and the peak time of daily transaction amounts. Furthermore, transaction frequency can be obtained using a sliding window, or transaction amounts can be processed using a logarithmic method to reduce the impact of numerical scale on the long-tail distribution. Decomposing the time series of transaction data using short-term Fourier transform reveals the periodic patterns of the transaction data. For example, customers may purchase daily necessities once a week. Decomposing the time series also reveals the changing trends, seasonal patterns, and uncertain transactions caused by random events. Seasonal patterns could include large amounts of money transfers during peak agricultural product purchasing seasons, or close financial transactions with counterparties producing heating equipment in winter. Uncertain transactions caused by random events could include transaction data generated due to temporary replacement of payment devices caused by payment device malfunctions, or transactions conducted during purchase restrictions, etc. Long Short-Term Memory (LSTM) networks can be used to further analyze time series data and obtain the hidden state of trading intervals. This hidden state can be patterns that are not directly observable, such as "fluctuation trends," "periodic patterns," or "correlation with historical trading intervals." If this hidden state differs significantly from the characteristics of trading intervals under normal trading behavior, anomalies may exist. The statistical characteristics of trading data, the periodic patterns of trading data, the changing trends of trading data, seasonal variations, uncertainties caused by random events, and the hidden state of trading intervals all fall under the category of time series characteristics.

[0052] Based on a pre-defined risk vocabulary, the names of trading partners and transaction notes are segmented into words to identify trading partners and transaction notes with transaction risks. According to the segmentation results, the counterparty type is identified from the counterparty name using a Bidirectional Long Short-Term Memory - Conditional Random Field (BiLSTM-CRF) model. The counterparty type includes individuals, merchants, etc. The geographical label of the counterparty is identified from the transaction notes. The counterparty type, geographical label, and transaction notes are all text features.

[0053] Transaction characteristics include transaction amount, transaction frequency, and transaction time, while related characteristics can include transaction frequency, transaction amount, and transaction time between the customer and different counterparties.

[0054] In some embodiments, in operation S220, the feature extraction model can be a large model or a model constructed with a Transformer encoder as the core. The large model can refer to a deep learning model with a large number of model parameters. A large model usually contains hundreds of millions, billions, tens of billions, or even hundreds of billions of model parameters. The large model can include a large-scale language model, a visual large model, a multi-modal large model, and the like. The large model involved in the embodiments of the present disclosure can be a general-purpose large model, or can also be a specialized large model obtained by fine-tuning based on requirements, which is not limited in the embodiments of the present disclosure.

[0055] In some embodiments, in operation S230, the customer and each counterparty of the customer are regarded as an account node respectively. For each account node, the graph neural network randomly samples a fixed number of neighbor nodes from its neighbor nodes, then aggregates the feature representations of the sampled neighbor nodes by an aggregation function to obtain a neighbor feature representation of the node, and finally combines the feature representation of the node itself and the aggregated neighbor feature representation to update the feature representation of the node. That is, each counterparty account corresponds to an account node, and the feature representations of the neighbor account nodes are aggregated to the node itself by the graph embedding algorithm.

[0056] According to the embodiments of the present application, the time series features and the text features are deeply mined by the feature extraction model, the correlation features are deeply mined by the graph neural network, the complex patterns in the transaction data are analyzed by integrating the time series features, the text features and the correlation features, and the abnormal transaction behavior is identified, thereby improving the identification accuracy.

[0057] Figure 3 An acquisition method of a time series vector and a text vector according to an embodiment of the present application is schematically shown.

[0058] In some embodiments, the time series features and the text features are respectively input into the feature extraction model to obtain the time series vector and the text vector, including: in the feature extraction model, converting the time series features into a time series embedding sequence by a first embedding layer, and converting the text features into a text embedding sequence by a second embedding layer, wherein the first embedding layer includes a first position encoding and a time decay factor, the time decay factor is used to focus on the current transaction data, and the second embedding layer includes a word embedding and a second position encoding; obtaining the time series vector based on the time series embedding sequence and the time decay factor; extracting a global semantic vector of the text features from the text embedding sequence; extracting a local semantic vector from the global semantic vector by using a convolutional pooling layer; and performing nonlinear transformation on the features after fusion of the global semantic vector and the local semantic vector to obtain the text vector.

[0059] As Figure 3As shown, the time sequence feature 301 can pass through the first embedding layer 302 to obtain a time sequence embedding sequence 303, a time decay factor 304 can be introduced into the time sequence embedding sequence to obtain a time vector 305, the text feature 306 can pass through the second embedding layer 307 to obtain a text embedding sequence 308, a global semantic vector 309 of the text feature can be extracted from the text embedding sequence, the global semantic vector can pass through the convolutional pooling layer 310 to obtain a local semantic vector 311 of the text feature, and after the global semantic vector and the local semantic vector are fused, a nonlinear transformation, i.e., operation S310, is performed to obtain a text vector 312.

[0060] Further, the time sequence embedding sequence is obtained by: adding position information to the vector of each time step in the time sequence feature through the first position encoding, distinguishing the time sequence, introducing a time decay factor, multiplying the vector of each time step after adding the position information by the time decay factor, so that the feature extraction model pays more attention to recent transactions, and mapping the vector multiplied by the time decay factor to the feature embedding dimension through the fully connected layer to obtain the time sequence embedding sequence.

[0061] The text embedding sequence is obtained by: performing word embedding on the text feature to make the semantic relevant word vectors closer; using the second position encoding to positionally encode the word-embedded vectors to distinguish the order of the word units in the text; inserting a word unit representing the global semantic information of the text sequence at the front of the positionally encoded text sequence, which is used to aggregate the overall semantic information of the text, i.e., the global semantic vector, so as to facilitate the extraction of the global semantic vector from the text embedding sequence; fusing the text sequence with the word unit representing the global semantic information of the text sequence with the attention mask and mapping to the feature embedding dimension to obtain the text embedding sequence, wherein the fusion with the attention mask is to ensure that only valid semantic information is contained in the text embedding sequence.

[0062] In some embodiments, the feature extraction model can be continuously optimized according to the continuously acquired abnormal transaction behaviors. Specifically, an incremental training method can be used to continuously optimize the feature extraction model, i.e., according to the continuously acquired abnormal transaction behaviors, the bottom-layer parameters of the feature extraction model are frozen, and only the top-layer classification head and part of the attention layer of the feature extraction model are updated, so as to realize the optimization of the model, and further ensure that the feature extraction model can be more adaptive to the continuously changing abnormal transaction patterns, thereby improving the detection accuracy.

[0063] In some embodiments, since the feature extraction model has the ability to process data quickly, the use of the feature extraction model can quickly obtain the time series vector and the text vector, thereby improving the detection speed and meeting the real-time requirements of abnormal transaction detection in the financial field. Compared with traditional machine learning models such as random forest model and support vector machine model, the feature extraction model has obvious advantages in processing complex data, learning complex transaction patterns, adapting to new abnormal transaction behaviors, and data processing efficiency. The harmonic mean of the precision and recall of the feature extraction model is higher, indicating that the prediction is more accurate. The feature extraction model has a lower time consumption of 0.3 seconds per 10,000 data, indicating that the data processing speed is extremely fast, and a large amount of transaction data can be processed quickly. Moreover, by continuously optimizing the feature extraction model, the model can capture the features corresponding to new abnormal transaction behaviors in time, thereby discovering new abnormal transaction behaviors in time and having stronger adaptability.

[0064] According to the embodiments of the present application, the time series features and the text features can be converted into low-dimensional sequences through the embedding layer, reducing the calculation cost. The time decay factor can be used to retain key time series features in the process of time series feature embedding. The global semantic vector and the local semantic vector can be obtained based on the text embedding sequence and fused, which can avoid the loss of text information, thereby improving the accuracy of information mining.

[0065] In some embodiments, based on the time series embedding sequence and the time decay factor, the time series vector is obtained, including: generating a first query matrix, a first key matrix and a first value matrix according to the time series embedding sequence; calculating a first attention weight of the time series features according to the first query matrix, the first key matrix and the time decay factor; and performing nonlinear transformation on the features weighted by the first attention weight and the first value matrix to obtain the time series vector.

[0066] Specifically, the time series embedding sequence is mapped in dimension through three independent learnable linear projection layers to obtain the first query matrix, the first key matrix and the first value matrix. The first attention weight of the time series features is calculated according to the first attention weight calculation formula. The first feedforward network performs nonlinear transformation on the features weighted by the first attention weight and the first value matrix using an activation function to obtain the time series vector. The calculation formula of the first attention weight is as follows:

[0067]

[0068] wherein, , denote the first query matrix and the first key matrix, respectively, is a normalization function, denotes a scaling factor for scaling ​The inner product result avoids the problem of the gradient of the normalization function disappearing due to the excessively large inner product value caused by the excessively large feature dimension of the first query matrix and the first key matrix, The weight coefficient represents a time decay factor, which is used to control the influence intensity of the time decay factor on the first attention weight, The time decay rate is used to control the speed of time decay, The time interval between the The time interval between the The activation function can be a Gaussian Error Linear Unit (GELU), and the nonlinear transformation using the activation function can enhance the strength of the nonlinear transformation. Through the nonlinear transformation, the feature extraction model can learn to mine complex transaction behaviors, such as a customer frequently transferring small amounts of money to a certain transaction counterpart account, the transaction counterpart account performing a large amount of transfer operations every certain period of time, and the transaction counterpart account being frozen, which is one of the complex transaction behaviors.

[0069] Further, the first attention weight of the time sequence feature can also assist in detecting abnormal transaction behaviors. For example, if the first attention weight corresponding to the feature representing the customer's recent frequent night-time transfer to the same transaction counterpart account in the time sequence feature is high, it can be indicated that the transaction can be an abnormal transaction. If the customer transfers a transaction amount to a certain transaction counterpart account, and the transaction counterpart account frequently performs a large amount of transfer recently, the transaction can also be an abnormal transaction.

[0070] Further, the sparse attention mechanism is also used in the process of calculating the first attention weight, which can greatly reduce the computational complexity.

[0071] According to the embodiments of the present application, through the calculation of the first query matrix and the first key matrix, the correlation degree between the transaction data at different time steps can be accurately measured, the time decay factor is introduced to make the feature extraction model focus on the key information of recent transactions and reduce the interference of invalid information. The first attention weight determines the contribution proportion of each value position in the first value matrix in the time sequence vector, and the weighting of the first attention weight and the first value matrix can effectively distinguish the importance of the information in the time sequence vector.

[0072] In some embodiments, the global semantic vector of the text feature is extracted from the text embedding sequence, including: generating a second query matrix, a second key matrix and a second value matrix according to the text embedding sequence; calculating a second attention weight of the text feature according to the second query matrix and the second key matrix; performing nonlinear transformation on the weighted feature of the second attention weight and the second value matrix to obtain the global semantic vector of the text feature.

[0073] Specifically, the text embedding sequence is dimensionally mapped by another three independent learnable linear projection layers respectively to obtain a second query matrix, a second key matrix and a second value matrix, the inner product of the second query matrix and the second key matrix is calculated and the inner product value is scaled in the feature dimension, the scaled value is normalized to obtain a second attention weight of the text feature, and the second feedforward network performs nonlinear transformation on the feature weighted by the second attention weight and the second value matrix by using an activation function to obtain a text vector.

[0074] Further, the second attention weight of the text feature can also assist in detecting abnormal transaction behavior. For example, the transaction remark information indicates that the current transaction is an investment and financial management, but the transaction counterparty account belongs to a game company, and the second attention weight corresponding to this feature is high. The current transaction may be an abnormal transaction, and a warning message needs to be sent to the customer to remind the customer.

[0075] According to the embodiments of the present application, the second attention weight is calculated by using the second query matrix and the second key matrix, which can enable the feature extraction model to automatically identify important information in the text, effectively filter redundant information, and effectively capture the association between words far apart in the text, solving the limitation of word position. Through the second attention weight, it can be clear which words the feature extraction model focuses on when processing the text feature, solving the "black box" problem; weighting the second attention weight and the second value matrix can effectively distinguish the importance of information in the global semantic vector.

[0076] Figure 4 A first abnormal transaction behavior verification method according to an embodiment of the present application is schematically shown.

[0077] In some embodiments, the method further comprises: generating a heat map according to the current transaction data and its historical associated transaction data; extracting key information of a first historical associated transaction and a second historical associated transaction in the heat map respectively, wherein the first attention weight of the first historical associated transaction is greater than a first preset threshold, and the second attention weight of the second historical associated transaction is greater than a second preset threshold; verifying the abnormal transaction behavior based on the key information.

[0078] As Figure 4As shown, the heat map 403 is constructed according to the current transaction data 401 and the historical associated transaction data 402, key information of the historical associated transaction data with the first attention weight greater than the first preset threshold, i.e., the key information 404 of the first historical associated transaction, is extracted from the heat map, and key information of the historical associated transaction data with the second attention weight greater than the second preset threshold, i.e., the key information 405 of the second historical associated transaction, is extracted from the heat map, and based on the key information 404 of the first historical associated transaction and the key information 405 of the second historical associated transaction, the abnormal transaction behavior is verified, i.e., operation S410 is performed. For example, after the anomaly detection model determines the abnormal transaction behavior, a heat map is constructed according to the current transaction data of the customer and the historical associated transaction data related to the current transaction, from which the historical associated transaction with a higher attention weight can be obtained, and further key information can be obtained from the historical associated transaction, for example, the first attention weight of the customer's recent transfer to a certain technology company in the heat map is greater than the first preset threshold, and the second attention weight of the pension investment noted in the transaction note information is greater than the second preset threshold, so the key information can be "recent transfer to a certain technology company" and "transaction note is pension investment", and based on the key information, it can be verified whether the result given by the anomaly detection model is accurate or the output result of the anomaly detection model is further confirmed to confirm the type of abnormal transaction behavior, for example, the type of abnormal transaction behavior given by the anomaly detection model is "abnormal investment behavior", and according to the key information, the abnormal transaction behavior can be further determined as "abnormal pension investment".

[0079] According to an embodiment of the present application, the accuracy of the abnormal transaction behavior based on the heat map can be verified, the false positive probability can be reduced, and the accuracy of the abnormal transaction behavior detection can be improved.

[0080] In some embodiments, the time sequence vector, the text vector and the associated vector are fused to obtain a fused feature vector, including: taking the time sequence vector as a query vector, and taking the text vector and the associated vector as a key vector and a value vector respectively; inputting the query vector, the key vector and the value vector into a cross attention network to obtain the fused feature vector.

[0081] According to an embodiment of the present application, the cross attention network can accurately capture the dependency relationship between the time sequence vector, the text vector and the associated vector. Some abnormal transaction behaviors are not obvious in a certain dimension, and by analyzing the dependency relationship between different dimension data, such abnormal transaction behaviors can be accurately located. Moreover, by fusing the time sequence vector, the text vector and the associated vector, the false judgment caused by accidental fluctuations of single dimension data can be reduced, thereby improving the detection accuracy and making the detection result more reliable.

[0082] Figure 5A schematic diagram of a method for determining abnormal transaction behavior according to an embodiment of the present application is shown.

[0083] In some embodiments, the fusion feature vector is input into an anomaly detection model to determine abnormal transaction behavior, including: obtaining a nonlinear correlation relationship between each feature in the fusion feature vector through a feature extraction network; dividing an association feature map constructed based on transaction features into a plurality of communities, and determining an abnormal transaction node in the community based on a preset abnormal node discrimination rule, wherein the preset abnormal node discrimination rule includes at least one of a degree deviation rule, a node pattern deviation rule, and a fund flow direction rule, the degree deviation rule representing a deviation degree of a node degree relative to a degree of a same type node, the node pattern deviation rule representing a deviation degree of a transaction feature of a node relative to an overall transaction feature of a community where the node is located, and the fund flow direction rule representing an abnormal degree of a fund path flowing through the node; if a density of the abnormal transaction node is greater than a preset threshold, calculating a probability of an abnormal transaction behavior occurring in the community based on the density, wherein the density of the abnormal transaction node represents a proportion of abnormal transaction nodes in all nodes in the same community in the community; and if the probability is greater than a preset probability, obtaining an abnormal transaction behavior type matching the nonlinear correlation relationship from a transaction type mapping library, wherein the transaction type mapping library represents a mapping relationship between the nonlinear correlation relationship and the abnormal transaction behavior type, and the transaction type mapping library is continuously updated according to the abnormal transaction behavior type.

[0084] As Figure 5As shown, the association feature map 502 is constructed according to the transaction features 501 between the client and its transaction counterpart, specifically, the client and each transaction counterpart corresponding to the client are taken as nodes, and the transaction features are taken as edges, to construct the association feature map 502. The association feature map 502 is divided into a plurality of communities, for example, a first community 503, a second community 504, and an Nth community 505, and the like, and abnormal transaction nodes in each community are determined based on a preset abnormal node determination rule, for example, the first community includes a first node 506, a second node 507, an Mth node 509, and the like, and the first abnormal transaction node 508 is included in these nodes, the Nth community includes an M+1th node 510 and an Lth node, and the like, M, L, and N are each an integer greater than 1, and the Nth community also contains a second abnormal transaction node 511 and a third abnormal transaction node 512, and the like, the density of the abnormal transaction nodes in each community is calculated, and the density is compared with a preset threshold, for example, the first abnormal transaction node density 514 of the first community is calculated according to the abnormal transaction nodes determined in the first community, the Nth abnormal transaction node density 515 of the Nth community is calculated according to the abnormal transaction nodes determined in the Nth community, operation S510 is performed, and whether the first abnormal transaction node density is greater than the preset threshold is determined, if the first abnormal transaction node density is less than or equal to the preset threshold, it indicates that the transactions in the first community are normal, and transaction normal information 520 is generated, if the Nth abnormal transaction node density is greater than the preset threshold, it indicates that there may be abnormal transactions in the Nth community, operation S520 is performed, and the probability of abnormal transaction behavior in the corresponding community is calculated, that is, the probability of abnormal transaction behavior in the Nth community is calculated, and then operation S530 is performed to determine whether the calculated probability is greater than a preset probability, if not, it indicates that no abnormal transaction has occurred in the community, and transaction normal information 520 is obtained, if yes, the abnormal transaction behavior type 519 matched with the nonlinear association relationship 518 is obtained from the transaction type mapping library 517, further, the nonlinear association relationship 518 refers to the association relationship between the features in the feature vector 516, for example, the nonlinear association relationship can be that a certain client transfers a large amount of money to a certain stranger's account at night, or a certain client recently transfers money to a first transaction counterpart account and a second transaction counterpart account multiple times, and the first transaction counterpart account and the second transaction counterpart account both transfer the received transfer amount to a third transaction counterpart account, and this transaction path of scattered transfer and concentrated transfer can involve abnormal transaction behavior.

[0085] In some embodiments, the loss function in the abnormal transaction detection model training process includes a binary cross-entropy loss function and a multi-class cross-entropy loss function, wherein the binary cross-entropy loss function is used to determine whether the transaction behavior is abnormal, and the multi-class cross-entropy loss function is used to identify the type of abnormal transaction behavior. In the training stage, a large amount of historical customer transaction data is used as a training sample, and the abnormal transaction behavior and the type label of the abnormal transaction behavior labeled by the risk control expert are used as a label to train the abnormal transaction detection model. After each round of training, the difference between the misidentified transaction behavior and the true label of the transaction behavior is calculated, and according to the difference, the training weight of this transaction behavior is appropriately increased in the next round of training process to improve the recognition ability of the abnormal transaction detection model to complex transactions.

[0086] According to the embodiments of the present application, by dividing the associated feature map into multiple communities, the abnormal transaction nodes in the community are determined, which effectively avoids the interference of irrelevant data and avoids the misjudgment risk caused by excessive sensitivity to single isolated abnormal nodes. The nonlinear correlation between the features in the feature vector reveals the deep connection between the features, and according to this deep connection, the type of abnormal transaction behavior is determined, which improves the accuracy of abnormal transaction behavior detection.

[0087] In some embodiments, the probability of abnormal transaction behavior occurring in the community is calculated based on the density, including: for any abnormal transaction node, the correlation between the abnormal transaction node and other nodes in the community is calculated to obtain the correlation score of the abnormal transaction node; the average value of the correlation scores of the abnormal transaction nodes in the same community is calculated to obtain the average correlation of the abnormal transaction nodes in the community; and the density of the abnormal transaction nodes in the same community and the average correlation are weighted to obtain the probability of abnormal transaction behavior occurring in the community.

[0088] For example, there are multiple abnormal transaction nodes in a community, and the abnormal transaction nodes with higher correlation with each node in the community are given higher correlation scores. For example, the transaction frequency between an abnormal transaction node and each node in the community is higher, and the correlation score of the abnormal transaction node is higher. The average correlation score of all abnormal transaction nodes in the community is calculated to obtain the average correlation of the abnormal transaction nodes in the community. Finally, the abnormal transaction density and the average correlation of the community are weighted and standardized to obtain the probability of abnormal transaction behavior occurring in the community. The abnormal transaction node density of the community can reflect the coverage of the abnormal transaction nodes in the community, and the average correlation can reflect the influence degree of the abnormal transaction nodes in the community. By considering the influence of both, the probability of abnormal transaction behavior occurring in the community is calculated, which can improve the prediction accuracy.

[0089] According to the embodiments of the present application, by analyzing the association degree of the abnormal transaction node and other nodes, the hidden relationship between the nodes can be mined, and the abnormal transactions caused by collaborative fraud can be effectively identified, thereby improving the accuracy of abnormal transaction behavior identification. According to the average association of the abnormal transaction nodes in the community and the density of the abnormal transaction nodes, the probability of the abnormal transaction behavior occurring in the community can be obtained, and the possibility of the abnormal transaction behavior occurring can be quantified.

[0090] In some embodiments, the method further comprises: if the probability is greater than the preset probability and no abnormal transaction behavior category is obtained from the transaction category mapping library, generating an early warning information and sending it to the customer; if the customer confirms that the current transaction is an abnormal transaction, labeling the category of the abnormal transaction, and storing the nonlinear association relationship of the current transaction and the labeled category of the abnormal transaction into the transaction category mapping library.

[0091] Further, if the probability of the abnormal transaction behavior occurring in a community is greater than the preset probability, but the current transaction category mapping library does not have a transaction category matching the transaction, it indicates that the abnormal transaction behavior belongs to a new type of abnormal transaction. In this case, an early warning information should be sent to the customer in time to remind the customer to pay attention to transaction security. If the customer feedback that the transaction is indeed an abnormal transaction, the category of the transaction is labeled and stored into the transaction category mapping library, so as to realize the timely updating of the transaction category mapping library, so that the abnormal transaction behavior consistent with the new abnormal transaction behavior category in the library can be determined in time in the subsequent detection process. In this way, the change of the abnormal transaction mode can be quickly adapted, the newly emerging abnormal transaction can be found in time, and the labor cost is reduced.

[0092] According to the embodiments of the present application, by labeling the category of the abnormal transaction determined by the customer and storing it into the transaction category mapping library, the category of the new type of abnormal transaction behavior can be updated in the transaction category mapping library in time, so that the new type of abnormal transaction behavior can be identified in time, and the detection accuracy and timeliness are improved.

[0093] Figure 6 A second abnormal transaction behavior verification method according to an embodiment of the present application is schematically shown.

[0094] In some embodiments, the method further comprises: obtaining a prompt word template matching the abnormal transaction behavior from a prompt word template library, wherein the prompt word template library is continuously updated according to the determined abnormal transaction behavior; filling the multi-dimensional feature data into the prompt word template to obtain an inference instruction; performing inference according to the inference instruction, calculating the similarity between the abnormal transaction behavior category obtained by inference and the abnormal transaction behavior category output by the abnormal detection model; and if the similarity is greater than a preset similarity threshold, correcting the output of the abnormal detection model according to the inference process.

[0095] As Figure 6As shown, the multi-dimensional feature data 601 is filled into the prompt word template 602 matching the abnormal transaction behavior, to generate inference instructions 603, for example, the abnormal transaction behavior output by the anomaly detection model belongs to transferring money to a stranger, and the prompt word template matching the abnormal transaction behavior can be "according to the historical transaction counterparty type, historical transaction record, current transaction counterparty type, current transaction amount, current transaction counterparty geographical label and current transaction purpose of the customer, judge whether the current transaction is transferring money to a stranger and whether it is an abnormal transaction behavior", according to the inference instruction to infer, to obtain the abnormal transaction behavior category 604, combine the output result 605 of the anomaly detection model, execute operation S610, calculate the similarity, if the similarity is less than the preset similarity threshold, it means that the output result of the anomaly detection model is not very accurate, and the output of the anomaly detection model needs to be corrected according to the inference process, that is, operation S620 is executed.

[0096] According to the embodiments of the present application, based on the initial multi-dimensional feature data and the prompt word template, the inference result is used to verify whether the output result of the anomaly detection model is correct, which can reduce the misjudgment problem caused by missing some information in the initial transaction data, thereby further enhancing the accuracy and reliability of the abnormal transaction behavior detection.

[0097] Based on the above abnormal transaction behavior detection method, the present application also provides an abnormal transaction behavior detection device. The following will be described in detail Figure 7 The device.

[0098] Figure 7 The structure block diagram of the abnormal transaction behavior detection device according to the embodiments of the present application is schematically shown.

[0099] As Figure 7 shown, the abnormal transaction behavior detection device 700 of the embodiment includes a multi-dimensional feature data acquisition module 710, a first vector acquisition module 720, a second vector acquisition module 730, a fusion feature vector acquisition module 740 and an abnormal transaction behavior determination module 750.

[0100] The multi-dimensional feature data acquisition module 710 is used for multi-dimensional feature extraction of transaction data to obtain multi-dimensional feature data, wherein the multi-dimensional feature data includes time sequence feature, text feature and association feature, the text feature includes transaction counterparty type and transaction note information, and the association feature represents the transaction characteristics between the customer and each transaction counterparty corresponding thereto. In an embodiment, the multi-dimensional feature data acquisition module 710 can be used to execute the operation S210 described in the foregoing, which will not be described here.

[0101] The first vector obtaining module 720 is configured to input the time sequence feature and the text feature into the feature extraction model respectively to obtain a time sequence vector and a text vector. In an embodiment, the first vector obtaining module 720 can be configured to perform the operation S220 described above, and details are not repeated here.

[0102] The second vector obtaining module 730 is configured to encode the association feature by using a graph neural network to obtain an association vector. In an embodiment, the second vector obtaining module 730 can be configured to perform the operation S230 described above, and details are not repeated here.

[0103] The fusion feature vector obtaining module 740 is configured to fuse the time sequence vector, the text vector and the association vector to obtain a fusion feature vector. The fusion feature vector obtaining module 740 can be configured to perform the operation S240 described above, and details are not repeated here.

[0104] The abnormal transaction behavior determining module 750 is configured to input the fusion feature vector into the anomaly detection model to determine an abnormal transaction behavior. The abnormal transaction behavior determining module 750 can be configured to perform the operation S250 described above, and details are not repeated here.

[0105] According to the embodiments of the present application, the device 700 can deeply mine the time sequence feature, the text feature and the association feature, comprehensively analyze the complex patterns in the transaction data, and recognize the abnormal transaction behavior, thereby improving the recognition accuracy.

[0106] In some embodiments, the first vector obtaining module 720 is specifically configured to: in the feature extraction model, convert the time sequence feature into a time sequence embedding sequence by a first embedding layer, and convert the text feature into a text embedding sequence by a second embedding layer, wherein the first embedding layer includes a first position encoding and a time decay factor, the time decay factor is used to focus on the current transaction data, and the second embedding layer includes a word embedding and a second position encoding; obtain the time sequence vector based on the time sequence embedding sequence and the time decay factor; extract a global semantic vector of the text feature from the text embedding sequence; extract a local semantic vector from the global semantic vector by using a convolutional pooling layer; and perform nonlinear transformation on the feature after the global semantic vector and the local semantic vector are fused to obtain the text vector.

[0107] In some embodiments, the first vector obtaining module 720 is specifically further configured to: generate a first query matrix, a first key matrix and a first value matrix according to the time sequence embedding sequence; calculate a first attention weight of the time sequence feature according to the first query matrix, the first key matrix and the time decay factor; and perform nonlinear transformation on the feature after the first attention weight and the first value matrix are weighted to obtain the time sequence vector.

[0108] In some embodiments, the first vector obtaining module 720 is specifically further configured to: generate a second query matrix, a second key matrix and a second value matrix according to the text embedding sequence; calculate a second attention weight of the text feature according to the second query matrix and the second key matrix; and perform nonlinear transformation on the second attention weight and the weighted feature of the second value matrix to obtain a global semantic vector of the text feature.

[0109] In some embodiments, the device 700 is specifically further configured to: generate a heat map according to the current transaction data and the historical associated transaction data thereof; extract key information of a first historical associated transaction and a second historical associated transaction in the heat map respectively, wherein a first attention weight of the first historical associated transaction is greater than a first preset threshold, and a second attention weight of the second historical associated transaction is greater than a second preset threshold; and verify the abnormal transaction behavior based on the key information.

[0110] In some embodiments, the fusion feature vector obtaining module 740 is specifically further configured to: take the time sequence vector as a query vector, and take the text vector and the associated vector as a key vector and a value vector respectively; and input the query vector, the key vector and the value vector into a cross-attention network to obtain the fusion feature vector.

[0111] In some embodiments, the abnormal transaction behavior determining module 750 is specifically further configured to: obtain a nonlinear association relationship between features in the fusion feature vector through the feature extraction network; divide an associated feature map constructed based on the transaction features into a plurality of communities, and determine an abnormal transaction node in the community based on a preset abnormal node discrimination rule, wherein the preset abnormal node discrimination rule includes at least one of a degree deviation rule, a node mode deviation rule and a fund flow direction rule, the degree deviation rule represents a deviation degree of a degree of a node relative to a degree of a same type node, the node mode deviation rule represents a deviation degree of a transaction feature of a node relative to an overall transaction feature of a community where the node is located, and the fund flow direction rule represents an abnormal degree of a fund path flowing through the node; if a density of the abnormal transaction node is greater than a preset threshold, calculate a probability of an abnormal transaction behavior occurring in the community based on the density, wherein the density of the abnormal transaction node represents a proportion of the abnormal transaction node in all nodes in the same community; and if the probability is greater than a preset probability, obtain an abnormal transaction behavior type matching the nonlinear association relationship from a transaction type mapping library, wherein the transaction type mapping library represents a mapping relationship between the nonlinear association relationship and the abnormal transaction behavior type, and the transaction type mapping library is continuously updated according to the abnormal transaction behavior type.

[0112] In some embodiments, the abnormal transaction behavior determination module 750 is specifically further configured to: for any abnormal transaction node, calculate the relevance of the abnormal transaction node to other nodes in the community in which the abnormal transaction node is located, to obtain a relevance score of the abnormal transaction node; calculate the mean of the relevance scores of the abnormal transaction nodes in the same community, to obtain a relevance mean of the abnormal transaction nodes in the community; and weight the density of the abnormal transaction nodes in the same community and the relevance mean, to obtain the probability of the abnormal transaction behavior in the community.

[0113] In some embodiments, the abnormal transaction behavior determination module 750 is specifically further configured to: if the probability is greater than a preset probability and no abnormal transaction behavior category is obtained from the transaction category mapping library, generate an early warning information and send it to the customer; if the customer confirms that the current transaction is an abnormal transaction, label the category of the abnormal transaction, and store the nonlinear correlation of the current transaction and the labeled category of the abnormal transaction to the transaction category mapping library.

[0114] In some embodiments, the device 700 is specifically further configured to: obtain a prompt word template matched with the abnormal transaction behavior from a prompt word template library, wherein the prompt word template library is updated according to the determined abnormal transaction behavior; fill the multi-dimensional feature data into the prompt word template to obtain an inference instruction; perform inference according to the inference instruction, calculate the similarity between the abnormal transaction behavior category obtained by inference and the abnormal transaction behavior category output by the abnormal detection model; and if the similarity is greater than a preset similarity threshold, correct the output of the abnormal detection model according to the inference process.

[0115] According to an embodiment of the present application, any of the plurality of modules of the multi-dimensional feature data obtaining module 710, the first vector obtaining module 720, the second vector obtaining module 730, the fused feature vector obtaining module 740 and the abnormal transaction behavior determining module 750 can be combined in one module, or any of the plurality of modules can be split into a plurality of modules. Alternatively, at least part of the function of one or more of the modules can be combined with at least part of the function of the other modules, and implemented in one module. According to an embodiment of the present application, at least one of the multi-dimensional feature data obtaining module 710, the first vector obtaining module 720, the second vector obtaining module 730, the fused feature vector obtaining module 740 and the abnormal transaction behavior determining module 750 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system on package, an application specific integrated circuit (ASIC), or any other reasonable manner of integrating or packaging a circuit, etc. or implemented by hardware or firmware, or implemented in any one of software, hardware and firmware or in a proper combination of any of them. Alternatively, at least one of the multi-dimensional feature data obtaining module 710, the first vector obtaining module 720, the second vector obtaining module 730, the fused feature vector obtaining module 740 and the abnormal transaction behavior determining module 750 can be at least partially implemented as a computer program module which, when executed, can perform the corresponding function.

[0116] Figure 8 A block diagram of an electronic device suitable for implementing the abnormal transaction behavior detection method according to an embodiment of the present application is schematically shown.

[0117] As shown in Figure 8 The electronic device 800 according to an embodiment of the present application includes a processor 801 which can perform various appropriate actions and processes according to a program stored in a read only memory (ROM) 802 or a program loaded from a storage portion 808 into a random access memory (RAM) 803. The processor 801 can include, for example, a general purpose microprocessor (e.g. a CPU), an instruction set processor and / or a related chipset and / or a special purpose microprocessor (e.g. an application specific integrated circuit (ASIC)), etc. The processor 801 can also include an on-board memory for cache use. The processor 801 can include a single processing unit or a plurality of processing units for performing different actions of the method processes according to embodiments of the present application.

[0118] In the RAM 803, various programs and data required for the operation of the electronic device 800 are stored. The processor 801, the ROM 802, and the RAM 803 are connected to each other via the bus 804. The processor 801 performs various operations of the method flow according to the embodiments of the present application by executing the programs in the ROM 802 and / or the RAM 803. It should be noted that the programs can also be stored in one or more memories other than the ROM 802 and the RAM 803. The processor 801 can also perform various operations of the method flow according to the embodiments of the present application by executing the programs stored in the one or more memories.

[0119] According to the embodiments of the present application, the electronic device 800 can further include an input / output (I / O) interface 805, which is also connected to the bus 804. The electronic device 800 can further include one or more of the following components connected to the input / output (I / O) interface 805: an input part 806 including a keyboard, a mouse, and the like; an output part 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a speaker, and the like; a storage part 808 including a hard disk, and the like; and a communication part 809 including a network interface card such as a LAN card, a modem, and the like. The communication part 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output (I / O) interface 805 as necessary. A removable medium 811 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is mounted on the drive 810 as necessary, so that a computer program read therefrom is installed in the storage part 808 as necessary.

[0120] The present application also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, when the one or more programs are executed, the method according to the embodiments of the present application is implemented.

[0121] According to an embodiment of the present application, the computer readable storage medium can be a non-transitory computer readable storage medium, for example, can include but not limited to: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In this application, a computer readable storage medium can be any tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present application, the computer readable storage medium can include the ROM 802 and / or the RAM 803 described above and / or one or more memory other than the ROM 802 and the RAM 803.

[0122] Embodiments of the present application also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the abnormal transaction behavior detection method provided by the embodiments of the present application.

[0123] The above functions defined in the system / device of the embodiments of the present application are performed when the computer program is executed by the processor 801. According to an embodiment of the present application, the system, device, module, unit, etc. described above can be implemented by computer program modules.

[0124] In one embodiment, the computer program can rely on tangible storage media such as optical storage media, magnetic storage media, etc. In another embodiment, the computer program can also be transmitted, distributed, and downloaded in the form of signals on a network medium, and be downloaded and installed through the communication part 809, and / or installed from the detachable medium 811. The program codes contained in the computer program can be transmitted by any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

[0125] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809, and / or installed from the detachable medium 811. When the computer program is executed by the processor 801, the above functions defined in the system of the embodiments of the present application are performed. According to an embodiment of the present application, the system, device, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0126] According to embodiments of the present application, program code for implementing the computer programs provided by embodiments of the present application can be written in any combination of one or more programming languages, and can be implemented in a high-level procedural and / or object-oriented programming language, and / or in assembly / machine language. Programming languages include, but are not limited to, Java, C++, python, "C", or the like. Program code can execute entirely on a user's computing device, partly on the user's device, as a stand-alone software package, partly on a remote computing device, or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider.

[0127] The computer program instructions can also be loaded onto a computer or other programmable information processing apparatus to cause a series of operations to be performed on the computer or other programmable information processing apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable information processing apparatus implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0128] Those skilled in the art will appreciate that features recited in the various embodiments of the present application can be combined and / or integrated in various combinations, even if such combinations have not been explicitly recited in the present application. In particular, the features recited in the various embodiments of the present application can be combined and / or integrated in various combinations, without departing from the spirit and teachings of the present application. All such combinations are within the scope of the present application.

Claims

1. A method for detecting abnormal transaction behavior, characterized in that, The method includes: Multidimensional feature extraction is performed on the transaction data to obtain multidimensional feature data, wherein the multidimensional feature data includes time-series features, text features and correlation features, the text features include counterparty type and transaction notes information, and the correlation features represent the transaction characteristics between the customer and its corresponding counterparties. The temporal features and the text features are respectively input into the feature extraction model to obtain temporal vectors and text vectors; The associated features are encoded using a graph neural network to obtain an associated vector; The time-series vector, the text vector, and the association vector are fused to obtain a fused feature vector; The fused feature vector is input into the anomaly detection model to determine abnormal transaction behavior.

2. The method according to claim 1, characterized in that, The step of inputting the temporal features and the text features into the feature extraction model to obtain temporal vectors and text vectors respectively includes: In the feature extraction model, the temporal features are converted into temporal embedding sequences through a first embedding layer, and the text features are converted into text embedding sequences through a second embedding layer. The first embedding layer includes a first positional encoding and a time decay factor, wherein the time decay factor is used to focus on the current transaction data, and the second embedding layer includes word embedding and a second positional encoding. The time-series vector is obtained based on the time-series embedding sequence and the time decay factor; Extract the global semantic vector of the text features from the text embedding sequence; Local semantic vectors are extracted from the global semantic vector using convolutional pooling layers; The text vector is obtained by performing a nonlinear transformation on the features obtained by fusing the global semantic vector and the local semantic vector.

3. The method according to claim 2, characterized in that, The process of obtaining the time-series vector based on the time-series embedded sequence and the time decay factor includes: Generate a first query matrix, a first key matrix, and a first value matrix based on the time-series embedding sequence; The first attention weight of the temporal feature is calculated based on the first query matrix, the first key matrix, and the time decay factor. The time-series vector is obtained by performing a nonlinear transformation on the features weighted by the first attention weight and the first value matrix.

4. The method according to claim 2, characterized in that, The global semantic vector for extracting the text features from the text embedding sequence includes: Generate a second query matrix, a second key matrix, and a second value matrix based on the text embedding sequence; Calculate the second attention weight of the text features based on the second query matrix and the second key matrix; A nonlinear transformation is performed on the features weighted by the second attention weight and the second value matrix to obtain the global semantic vector of the text features.

5. The method according to any one of claims 3 to 4, characterized in that, The method further includes: A heatmap is generated based on the current transaction data and its historical related transaction data; Key information of the first historical related transactions and the second historical related transactions in the heat map is extracted respectively, wherein the first attention weight of the first historical related transaction is greater than the first preset threshold, and the second attention weight of the second historical related transaction is greater than the second preset threshold. Based on the aforementioned key information, the abnormal transaction behavior is verified.

6. The method according to claim 1, characterized in that, The fusion of the temporal vector, the text vector, and the correlation vector to obtain the fused feature vector includes: Use the time-series vector as the query vector, and use the text vector and the association vector, one as the key vector and the other as the value vector; The query vector, the key vector, and the value vector are input into a cross-attention network to obtain the fused feature vector.

7. The method according to claim 1, characterized in that, The step of inputting the fused feature vector into the anomaly detection model to determine abnormal transaction behavior includes: The nonlinear correlation between features in the fused feature vector is obtained through a feature extraction network; The association feature graph constructed based on the transaction features is divided into multiple communities. Abnormal transaction nodes in the communities are determined based on preset abnormal node discrimination rules. The preset abnormal node discrimination rules include at least one of degree deviation rules, node pattern deviation rules, and fund flow rules. The degree deviation rule represents the degree of deviation of the degree of the node relative to the degree of its similar nodes. The node pattern deviation rule represents the degree of deviation of the transaction features of the node relative to the overall transaction features of the community in which the node is located. The fund flow rule represents the degree of abnormality of the fund path flowing through the node. If the density of the abnormal transaction nodes is greater than a preset threshold, the probability of the abnormal transaction behavior occurring in the community is calculated based on the density, wherein the density of the abnormal transaction nodes represents the proportion of the abnormal transaction nodes in the community to all nodes in the same community. If the probability is greater than a preset probability, then an abnormal transaction behavior type matching the nonlinear association is obtained from the transaction type mapping library, wherein the transaction type mapping library represents the mapping relationship between the nonlinear association and the abnormal transaction behavior type, and the transaction type mapping library is continuously updated according to the abnormal transaction behavior type.

8. The method according to claim 7, characterized in that, The calculation of the probability of the abnormal transaction behavior occurring within the community based on the density includes: For any of the abnormal transaction nodes, calculate the correlation between the abnormal transaction node and other nodes in its community to obtain the correlation score of the abnormal transaction node. Calculate the average correlation score of each abnormal transaction node within the same community to obtain the average correlation score of abnormal transaction nodes in that community; The probability of the abnormal transaction behavior occurring within the community is obtained by weighting the density of the abnormal transaction nodes in the same community with the mean of the correlation.

9. The method according to claim 7, characterized in that, The method further includes: If the probability is greater than the preset probability and the abnormal transaction behavior type is not obtained from the transaction type mapping library, an early warning message is generated and sent to the customer. If the customer confirms that the current transaction is an abnormal transaction, then the type of the abnormal transaction is marked, and the nonlinear relationship of the current transaction and the marked type of the abnormal transaction are stored in the transaction type mapping library.

10. The method according to claim 7, characterized in that, The method further includes: Obtain a prompt word template that matches the abnormal transaction behavior from the prompt word template library, wherein the prompt word template library is continuously updated according to the determined abnormal transaction behavior; The multidimensional feature data is filled into the prompt word template to obtain inference instructions; Reasoning is performed according to the reasoning instructions, and the similarity between the abnormal transaction behavior types obtained by reasoning and the abnormal transaction behavior types output by the abnormal detection model is calculated. If the similarity is less than a preset similarity threshold, the output of the anomaly detection model is corrected according to the reasoning process.

11. An abnormal transaction behavior detection device, characterized in that, The device includes: The multidimensional feature data acquisition module is used to extract multidimensional features from transaction data to obtain multidimensional feature data. The multidimensional feature data includes time-series features, text features, and correlation features. The text features include counterparty type and transaction notes. The correlation features represent the transaction features between the customer and its corresponding counterparties. The first vector acquisition module is used to input the temporal features and the text features into the feature extraction model respectively to obtain temporal vectors and text vectors; The second vector acquisition module is used to encode the associated features using a graph neural network to obtain an associated vector; The feature vector fusion acquisition module is used to fuse the time-series vector, the text vector, and the association vector to obtain a fused feature vector. The abnormal transaction behavior determination module is used to input the fused feature vector into the abnormal detection model to determine abnormal transaction behavior.

12. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 10.

13. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 10.

14. A computer program product comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 10.

Images