Abnormal transaction detection method and device and storage medium

Abstract

The invention discloses an abnormal transaction detection method and device and a storage medium. Relates to the field of artificial intelligence, and the method comprises the steps that under the condition that authorization of a target user is obtained, target transaction information of the target user is obtained, and the target transaction information at least comprises transaction data of the target user and environment data corresponding to the target user in the transaction data generation process; the target transaction information is input into the abnormal transaction detection model, the abnormal transaction detection model is used for predicting a detection result of the target transaction information, and a loss function used in the training process of the abnormal transaction detection model is a waveform loss function. Through the method and the device, the problem of relatively low accuracy of abnormal transaction detection in related technologies is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence, in particular to an abnormal transaction detection method and device and storage medium. BACKGROUND

[0002] Abnormal transaction detection is to identify transactions that do not conform to the regular pattern and may involve abnormal transactions using data analysis and artificial intelligence algorithms, which is beneficial to protect the property safety of financial institutions and users.

[0003] In the prior art, abnormal transaction detection is mainly performed by training a machine learning model or a deep learning model. However, the samples of abnormal transaction data present the characteristics of class imbalance, for example, normal transactions account for more than 99%, and abnormal transactions are extremely rare. Moreover, machine learning models still rely on feature engineering, which leads to insufficient accuracy of abnormal transaction detection in the prior art.

[0004] Currently, there is no effective solution to the problem of low accuracy of abnormal transaction detection in related technologies. SUMMARY

[0005] The main purpose of the present application is to provide an abnormal transaction detection method, device and storage medium to solve the problem of low accuracy of abnormal transaction detection in related technologies.

[0006] In order to achieve the above purpose, according to one aspect of the present application, an abnormal transaction detection method is provided. The method comprises: obtaining target transaction information of a target user under the authorization of the target user, wherein the target transaction information at least includes transaction data of the target user and environment data corresponding to the target user in the process of generating the transaction data; inputting the target transaction information into an abnormal transaction detection model, and predicting a detection result of the target transaction information by using the abnormal transaction detection model, wherein a loss function used in the training process of the abnormal transaction detection model is a waveform loss function.

[0007] Further, the training step of the abnormal transaction detection model comprises: obtaining an abnormal transaction detection training data set, wherein the abnormal transaction detection training data set includes a plurality of sample data and a label of each sample data, the type of the label includes normal transaction and abnormal transaction, and the sample data includes transaction sample data and environment sample data; training a preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, to obtain the abnormal transaction detection model.

[0008] Further, before training the preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, the method further comprises: obtaining a detection intensity coefficient, wherein the detection intensity coefficient is used to represent the strictness of the detection; obtaining a risk sensitivity slope, wherein the risk sensitivity slope is used to represent the degree of punishment for abnormal transactions; determining a risk punisher according to the transaction risk deviation and the risk sensitivity slope, wherein the risk punisher is used to make a nonlinear punishment according to the degree of misjudgment of the detection; and determining the waveform loss function according to the detection intensity coefficient, the risk sensitivity slope and the risk punisher.

[0009] Further, determining the risk punisher according to the transaction risk deviation and the risk sensitivity slope comprises: determining the transaction risk deviation according to the deviation between the prediction result output by the preset machine learning model and the label of the sample data; exponentially amplifying the transaction risk deviation according to the risk sensitivity slope to obtain an exponential penalty term; determining a square penalty term according to the square of the transaction risk deviation; and determining the risk punisher according to the exponential penalty term and the square penalty term.

[0010] Further, the preset machine learning model is a twin support vector machine model, and training the preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set comprises: determining a positive class hyperplane optimization problem and a negative class hyperplane optimization problem of the preset machine learning model according to the slack variable; and solving the positive class hyperplane optimization problem and the negative class hyperplane optimization problem according to the abnormal transaction detection training data set under the constraint of the waveform loss function, to update the parameters of the preset machine learning model, and obtain the abnormal transaction detection model.

[0011] Further, before training the preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, the method further comprises: obtaining a preset kernel function; and mapping the sample data in the abnormal transaction detection training data set to a preset space according to the kernel function, so that the sample data in the mapped abnormal transaction detection training data set has a linear classification boundary.

[0012] To achieve the above-mentioned purpose, according to another aspect of the present application, an abnormal transaction detection device is provided. The device comprises: an information acquisition unit, configured to acquire target transaction information of a target user under the condition that the target user is authorized, wherein the target transaction information at least includes transaction data of the target user and environment data corresponding to the target user in the process of generating the transaction data; and an abnormality detection unit, configured to input the target transaction information into an abnormal transaction detection model, and use the abnormal transaction detection model to predict a detection result of the target transaction information, wherein a loss function used by the abnormal transaction detection model in a training process is a waveform loss function.

[0013] Further, the apparatus further comprises a dataset obtaining unit, configured to obtain an abnormal transaction detection training dataset, wherein the abnormal transaction detection training dataset comprises a plurality of sample data and a label of each sample data, the label type comprises a normal transaction and an abnormal transaction, and the sample data comprises transaction sample data and environment sample data; and a model training unit, configured to train a preset machine learning model under the constraint of a waveform loss function according to the abnormal transaction detection training dataset, to obtain an abnormal transaction detection model.

[0014] Further, the apparatus further comprises a first obtaining unit, configured to obtain a detection intensity coefficient before training the preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training dataset, wherein the detection intensity coefficient is used to represent the strictness of detection; a second obtaining unit, configured to obtain a risk sensitivity slope, wherein the risk sensitivity slope is used to represent the punishment degree of abnormal transactions; a third determining unit, configured to determine a risk punisher according to the transaction risk deviation and the risk sensitivity slope, wherein the risk punisher is used to make a nonlinear punishment according to the misjudgment degree of detection; and a fourth determining unit, configured to determine the waveform loss function according to the detection intensity coefficient, the risk sensitivity slope and the risk punisher.

[0015] Further, the third determining unit comprises a deviation determining module, configured to determine the transaction risk deviation according to the deviation between the prediction result output by the preset machine learning model and the label of the sample data; a first penalty term module, configured to exponentially amplify the transaction risk deviation according to the risk sensitivity slope, to obtain an exponential penalty term; a second penalty term module, configured to determine a square penalty term according to the square of the transaction risk deviation; and a punisher determining module, configured to determine the risk punisher according to the exponential penalty term and the square penalty term.

[0016] Further, the preset machine learning model is a twin support vector machine model, and the model training unit comprises a problem determining module, configured to determine a positive class hyperplane optimization problem and a negative class hyperplane optimization problem of the preset machine learning model according to the slack variable; and a parameter updating module, configured to solve the positive class hyperplane optimization problem and the negative class hyperplane optimization problem according to the abnormal transaction detection training dataset under the constraint of the waveform loss function, to update the parameters of the preset machine learning model, to obtain the abnormal transaction detection model.

[0017] Further, the apparatus further comprises a kernel function obtaining unit, configured to obtain a pre-set kernel function before training the preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training dataset; and a data mapping unit, configured to map the sample data in the abnormal transaction detection training dataset to a preset space according to the kernel function, so that the sample data in the mapped abnormal transaction detection training dataset has a linear classification boundary.

[0018] According to another aspect of the present application, a computer-readable storage medium is provided, which includes a stored program, wherein the computer-readable storage medium controls a device where the computer-readable storage medium is located to perform any one of the detection methods of abnormal transactions when the program is running.

[0019] According to another aspect of the present application, an electronic device is provided, which includes one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include a program for performing any one of the detection methods of abnormal transactions.

[0020] According to another aspect of the present application, a computer program product is provided, which includes computer instructions for implementing the steps of any one of the detection methods of abnormal transactions when the computer instructions are executed by a processor.

[0021] In the embodiments of the present application, the target transaction information of the target user is obtained under the condition that the target user is authorized, wherein the target transaction information at least includes transaction data of the target user and environment data corresponding to the target user in the process of generating the transaction data; the target transaction information is input into an abnormal transaction detection model, and the detection result of the target transaction information is predicted by using the abnormal transaction detection model, wherein the loss function used by the abnormal transaction detection model in the training process is a waveform loss function, thereby solving the technical problem of low accuracy of abnormal transaction detection in the prior art.

[0022] By obtaining the target transaction information including the transaction data and the environment data, rich features are provided for the abnormal transaction detection model, and since the waveform loss function gives higher loss to misjudged abnormal transactions through a nonlinear penalty mechanism, the abnormal transaction detection model is obtained by introducing the waveform loss function for training, and the boundedness, smoothness and robustness to noise of the waveform loss function are utilized, thereby improving the accuracy of abnormal transaction detection. BRIEF DESCRIPTION OF DRAWINGS

[0023] The accompanying drawings, which form a part of the present application, are intended to provide further understanding of the present application, and the illustrative embodiments of the present application and their description serve the purpose of explaining the present application. The accompanying drawings should not be construed as an inappropriate limitation on the present application. In the drawings:

[0024] Figure 1 A hardware structure block diagram of a computer terminal for implementing the detection method of abnormal transactions is shown;

[0025] Figure 2 A flowchart of the detection method of abnormal transactions provided according to the embodiments of the present application is shown;

[0026] Figure 3is a schematic diagram of an abnormal transaction detection device according to an embodiment of the application;

[0027] Figure 4 is a structural block diagram of an electronic device according to an embodiment of the application. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to the process, method, product or device.

[0030] First, some of the nouns or terms that appear in the description of the embodiments of the present application are applicable to the following explanations:

[0031] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, analyzed data, etc.) involved in the present application are information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to choose authorization or refusal. For example, the system and the interface between the related users or institutions provide the user with a corresponding operation portal for the user to choose to agree or refuse the automatic decision result; if the user chooses to refuse, the expert decision process is entered.

[0032] Embodiment 1

[0033] According to the embodiments of the present application, a method for detecting abnormal transaction is also provided. It should be noted that the steps shown in the flowchart can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0034] The method embodiments provided by the embodiments of the present application can be executed in a mobile terminal, a computer terminal or similar computing device. Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing the method for detecting abnormal transaction is shown. As shown in the figure, Figure 1 The computer terminal 10 (or mobile device) can include one or more processors 102 (the processor 102 can include but not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication function. In addition, it can also include a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which can be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. Those skilled in the art can understand, Figure 1 The structure shown is only schematic, which does not limit the structure of the above-mentioned electronic device. For example, the computer terminal 10 can include more or less components than those shown in Figure 1 or have a different configuration from that shown in Figure 1 .

[0035] It should be noted that the one or more processors 102 and / or other data processing circuits described above can be referred to as "data processing circuits" herein. The data processing circuit can be embodied in whole or in part as software, hardware, firmware or any other combination. In addition, the data processing circuit can be a single independent processing module, or any one of the other elements combined into the computer terminal 10 (or mobile device) in whole or in part. As referred to in the embodiments of the present application, the data processing circuit as a kind of processor control (for example, the selection of the variable resistance terminal path connected with the interface).

[0036] The memory 104 can be used to store software programs of application software and modules, such as program instructions / data storage means corresponding to the abnormal transaction detection method in the embodiments of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implements the abnormal transaction detection method described above. The memory 104 can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 104 can further include a memory remotely arranged with respect to the processor 102, which can be connected to the computer terminal 10 through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0037] The transmission device 106 is used to receive or send data via a network. Specific examples of the above-mentioned network can include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to be able to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet in a wireless manner.

[0038] The display can be, for example, a touch screen type liquid crystal display (LCD), which can enable a user to interact with the user interface of the computer terminal 10 (or mobile device).

[0039] In the above-mentioned operating environment, the present application provides an abnormal transaction detection method as shown in Figure 2 Figure 2 is a flowchart of the abnormal transaction detection method according to Embodiment 1 of the present application.

[0040] In step S201, target transaction information of a target user is acquired under the condition that authorization of the target user is obtained, wherein the target transaction information at least includes transaction data of the target user and environment data corresponding to the target user in the process of generating the transaction data.

[0041] Optionally, the target transaction information of the target user about a preset transaction can be acquired under the condition that authorization of the target user is obtained through page interaction or short message verification code interaction. The preset transaction can be a transaction such as transfer or payment of the target user in a mobile application program of a target financial institution, and the target transaction information includes transaction data and environment data. The transaction data can include transaction amount, transaction time, etc., and the environment data can include IP address and device fingerprint corresponding to the target user. ​

[0042] In step S202, the target transaction information is input into the abnormal transaction detection model, and a detection result of the target transaction information is predicted by using the abnormal transaction detection model. In the training process, the loss function used by the abnormal transaction detection model is a waveform loss function.

[0043] Optionally, the transaction data and the environmental data in the target transaction information can be preprocessed according to the data types. If the data type of the transaction data or the environmental data is discrete, the transaction data or the environmental data is vectorized by using a one-hot encoding processing mode. The preprocessed target transaction information is input into the abnormal transaction detection model. The label type of the detection result output by the abnormal transaction detection model can be normal transaction and abnormal transaction. The baseline model of the abnormal transaction detection model can be a machine learning model such as a random forest, a gradient boosting tree, or a support vector machine. Compared with a deep learning model, the inference speed of the machine learning model is faster. Based on the above introduction of the baseline model and the output data, a person skilled in the art can select a suitable baseline model according to the requirements, and train the baseline model by using a training data set to obtain the abnormal transaction detection model. It should be noted that in the training process of obtaining the abnormal transaction detection model by using the model training, the loss function used is a waveform loss function. The waveform loss function is a loss function that adjusts the loss value to nonlinearly punish the prediction error.

[0044] In summary, the target transaction information including the transaction data and the environmental data is obtained, and rich features are provided for the abnormal transaction detection model. Because the waveform loss function gives a higher loss to the misjudged abnormal transaction by using a nonlinear punishment mechanism, the abnormal transaction detection model is obtained by training by using the waveform loss function. The boundedness, smoothness, and robustness to noise of the waveform loss function are used, so that the accuracy of the abnormal transaction detection is improved.

[0045] In order to improve the real-time performance of the abnormal transaction detection, the training step of the abnormal transaction detection model includes: obtaining an abnormal transaction detection training data set, wherein the abnormal transaction detection training data set includes a plurality of sample data and a label of each sample data. The label type includes normal transaction and abnormal transaction. The sample data includes transaction sample data and environmental sample data. The pre-set machine learning model is trained under the constraint of the waveform loss function according to the abnormal transaction detection training data set, and the abnormal transaction detection model is obtained.

[0046] For example, sample data about transactions can be collected from the mobile application database of the target financial institution with the authorization of the user, each piece of sample data including transaction sample data and environment sample data. After the sample data is collected, each piece of sample data is labeled, and the sample data of normal transactions is labeled as 0, and the sample data of abnormal transactions is labeled as 1. A preset machine learning model such as a support vector machine or a random forest can be selected as a baseline model to improve the inference speed of the abnormal transaction detection model and ensure the real-time performance of abnormal transaction detection. The preset machine learning model can be trained under the constraint of the waveform loss function. The waveform loss function can be defined as an optimization objective in the training process. The abnormal transaction detection training data set is input into the preset machine learning model, and the model is trained by minimizing the waveform loss function until the model converges or reaches a predetermined number of iterations. The training is stopped, and the abnormal transaction detection model is obtained.

[0047] Optionally, during the training of the preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, the Adam (an optimizer) method can be used for optimization. The Adam method automatically adjusts the update step of different features by considering historical information and variation amplitude, is suitable for processing abnormal transaction detection tasks, and is beneficial to improving the accuracy of abnormal transaction detection. Small batch training can also be used to balance the accuracy and convergence speed of the preset machine learning model.

[0048] In summary, by obtaining the abnormal transaction detection training data set and training the preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, the inference speed of the abnormal transaction detection model is improved, and the real-time performance of the abnormal transaction detection is improved.

[0049] In order to ensure the accuracy of abnormal transaction detection under the premise of high real-time performance, optionally, before training the preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, the method further comprises: obtaining a detection intensity coefficient, wherein the detection intensity coefficient is used to represent the strictness of detection; obtaining a risk sensitivity slope, wherein the risk sensitivity slope is used to represent the degree of punishment for abnormal transactions; determining a risk punisher according to the transaction risk deviation and the risk sensitivity slope, wherein the risk punisher is used to make a nonlinear punishment according to the degree of misjudgment of detection; determining the waveform loss function according to the detection intensity coefficient, the risk sensitivity slope, and the risk punisher.

[0050] Optionally, the detection intensity coefficient is used to represent the strictness of the detection, representing the strictness of the target financial institution in monitoring abnormal transactions. Different business scenarios can be configured with corresponding detection intensity coefficients. For example, if the proportion of abnormal transactions in A business scenario is higher than that in B business scenario, a higher detection intensity coefficient can be set for the abnormal transaction detection model of A business scenario. For business scenarios where the transaction amount is higher than the preset amount but the proportion of abnormal transactions is low, a higher risk sensitivity slope can be set to ensure that the abnormal transaction detection model responds sensitively to transactions in this business scenario. The greater the transaction amount of abnormal transactions, the greater the degree of misjudgment of abnormal transactions as normal transactions, and the strength of the non-linear punishment of the risk punisher can be proportional to the degree of misjudgment. The detection intensity coefficient, the risk sensitivity slope, and the risk punisher can be integrated into the formula to determine the waveform loss function.

[0051] In summary, by obtaining the detection intensity coefficient, the risk sensitivity slope, and the risk penalty term, and determining the waveform loss function according to the detection intensity coefficient, the risk sensitivity slope, and the risk punisher, the training process can make a non-linear punishment according to the degree of misjudgment of the detection, that is, when facing a small deviation of normal transactions, the punishment of the loss function is relatively mild, and when facing a large deviation of abnormal transactions, especially when missing reports, the punishment will be enhanced, thereby effectively suppressing the overfitting of the model to normal transactions and enhancing the recognition ability of the model to abnormal transactions, thereby improving the accuracy of abnormal transaction detection on the basis of ensuring real-time.

[0052] In order to ensure the accuracy of abnormal transaction detection under the premise of high real-time, optionally, the risk punisher is determined according to the transaction risk deviation and the risk sensitivity slope, including: determining the transaction risk deviation according to the deviation between the prediction result output by the preset machine learning model and the label of the sample data; exponentially amplifying the transaction risk deviation according to the risk sensitivity slope to obtain an exponential penalty term; determining a square penalty term according to the square of the transaction risk deviation; and determining the risk punisher according to the exponential penalty term and the square penalty term.

[0053] For example, the waveform loss function of the present embodiment can be as follows:

[0054]

[0055] Wherein, u represents a transaction risk deviation degree, the transaction risk deviation degree is used to represent the deviation between the prediction result of a preset machine learning model for a certain sample data and the label (i.e. the real result) of the sample data, when u is 0, the prediction is completely accurate, when u is greater than 0, the prediction underestimates the risk (for example, missing abnormal transactions), when u is less than 0, the prediction overestimates the risk (for example, misjudging normal transaction sample data as abnormal transactions). Lambda represents a detection intensity coefficient, which is a parameter set by the target financial institution according to compliance requirements, when lambda is larger, it means to impose stronger punishment on abnormal transactions, when lambda is smaller, it means to impose weaker punishment on abnormal transactions (i.e. tolerate occasional abnormalities). A represents a risk sensitivity slope, which is used to control the steepness of the punishment of the preset machine learning model on abnormal transactions, when a is larger, the punishment is greater. 2 e au represents a risk punisher, which is used to make a nonlinear punishment according to the degree of misjudgment of the detection, 2 represents a square punishment term; e au represents an exponential punishment term. L wave (u) represents a risk loss value, when the risk loss value is close to 0, it means that the transaction classification is correct, when the risk loss value is close to 1 / lambda, it means that the parameters of the preset machine learning model need to be updated.

[0056] In summary, by determining the exponential punishment term and the square punishment term according to the transaction risk deviation degree, and then determining the risk punisher, and then determining the waveform loss function in the embodiment, the waveform loss function can effectively suppress the missing of abnormal transactions through the exponential punishment term, while maintaining the square punishment for the misjudgment of normal transactions. The nonlinear punishment mechanism of the abnormal transaction detection model trained by this mechanism can maintain high robustness when processing complex data, and improve the accuracy of abnormal transaction detection.

[0057] In order to ensure the accuracy of abnormal transaction detection under the premise of high real-time performance, optionally, the preset machine learning model is a twin support vector machine model, the preset machine learning model is trained under the constraint of the waveform loss function according to the abnormal transaction detection training data set, to obtain an abnormal transaction detection model, including: determining a positive class hyperplane optimization problem and a negative class hyperplane optimization problem of the preset machine learning model according to the slack variable; under the constraint of the waveform loss function, solving the positive class hyperplane optimization problem and the negative class hyperplane optimization problem according to the abnormal transaction detection training data set, to update the parameters of the preset machine learning model, and obtaining the abnormal transaction detection model.

[0058] Optionally, the preset machine learning model in the embodiment can be a twin support vector machine model. The twin support vector machine model creates corresponding hyperplanes for sample data of different categories, obtains two hyperplanes that are not in parallel relationship with each other, and each category of sample data is as close as possible to the corresponding hyperplane and far away from the other hyperplane, so as to achieve the purpose of maximum interval between the hyperplanes. Unlike the traditional support vector machine model, the twin support vector machine model solves two non-parallel hyperplanes, divides the large-scale optimization problem into two smaller optimization problems, significantly reduces the solving time, and thus improves the real-time performance of the abnormal transaction detection. Moreover, the twin support vector machine model can avoid being disturbed by noise data in a data set containing noise, thereby further ensuring the accuracy of the abnormal transaction detection.

[0059] For example, the positive class hyperplane optimization problem and the negative class hyperplane optimization problem of the preset machine learning model determined according to the slack variable can be as follows:

[0060]

[0061]

[0062] wherein A represents a sample set composed of sample data of normal transactions, B represents a sample set composed of sample data of abnormal transactions; w (1) represents a normal transaction discrimination weight (w (2) represents an abnormal transaction discrimination weight, used to correspond to the importance of different transaction characteristics; b (1) and b (2) represent a discrimination threshold adjustment amount, the more conservative the risk preference of the target financial institution is, the smaller the discrimination threshold adjustment amount is; c1 represents a misjudgment penalty coefficient, used to control the tolerance of misjudging abnormal transactions as normal transactions, and c2 represents a misjudgment penalty coefficient, used to control the tolerance of misjudging normal transactions as abnormal transactions; ξ - and ξ + represent slack variables, used to prevent model overfitting, that is, a small amount of abnormal transactions can be allowed to be misjudged as normal transactions.

[0063] In summary, by effectively combining the twin support vector machine model with the waveform loss function, the positive class hyperplane optimization problem and the negative class hyperplane optimization problem determined by solving can avoid the influence of the imbalance between positive and negative samples in the training process, enhance the robustness of the abnormal transaction detection model, and improve the accuracy of the abnormal transaction detection.

[0064] To ensure the accuracy of the abnormal transaction detection under high real-time, optionally, before training the preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, the method further includes: obtaining a preset kernel function; mapping the sample data in the abnormal transaction detection training data set to a preset space according to the kernel function, so that the sample data in the mapped abnormal transaction detection training data set has a linear classification boundary.

[0065] For example, the preset kernel function can be a radial basis function kernel function, so as to effectively process the nonlinear relationship between the adjustments, map the sample data to the preset space (i.e. high-dimensional space), so that all sample data in the abnormal transaction detection training data set becomes linearly separable in the high-dimensional space, at this time, the abnormal transaction detection training data set has a clean linear classification boundary in the high-dimensional space, facilitating the twin support vector machine model to solve the optimization problem of two hyperplanes in the training process.

[0066] In summary, since the linear classification boundary is constructed by the preset kernel function mapping in the training phase, the abnormal transaction detection model can quickly and accurately identify abnormal transactions when predicting.

[0067] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown.

[0068] Embodiment 2

[0069] The embodiments of the present application also provide an abnormal transaction detection device. It should be noted that the abnormal transaction detection device of the embodiments of the present application can be used to execute the abnormal transaction detection method provided by the embodiments of the present application. The abnormal transaction detection device provided by the embodiments of the present application is introduced as follows.

[0070] According to the embodiments of the present application, an apparatus for implementing the above-mentioned abnormal transaction detection method is also provided, as shown in Figure 3 The apparatus includes:

[0071] The information acquisition unit 301 is configured to acquire target transaction information of a target user under the condition that the target user authorizes, wherein the target transaction information at least includes transaction data of the target user and environment data corresponding to the target user in the process of generating the transaction data;

[0072] The anomaly detection unit 302 is configured to input the target transaction information into an abnormal transaction detection model, and predict a detection result of the target transaction information by using the abnormal transaction detection model, wherein the loss function used in the training process of the abnormal transaction detection model is a waveform loss function.

[0073] The anomaly detection device provided in the embodiments of the present application obtains target transaction information of a target user under the condition that the target user is authorized, wherein the target transaction information at least includes transaction data of the target user and environment data corresponding to the target user in the process of generating the transaction data; the anomaly detection unit 302 is configured to input the target transaction information into an abnormal transaction detection model, and predict a detection result of the target transaction information by using the abnormal transaction detection model, wherein the loss function used in the training process of the abnormal transaction detection model is a waveform loss function, thereby solving the problem of low accuracy of abnormal transaction detection in the related art. In this way, the accuracy of abnormal transaction detection is improved.

[0074] Optionally, in the anomaly detection device provided in the embodiments of the present application, the device further includes a data set acquisition unit configured to acquire an abnormal transaction detection training data set, wherein the abnormal transaction detection training data set includes a plurality of sample data and a label of each sample data, the type of the label includes normal transaction and abnormal transaction, and the sample data includes transaction sample data and environment sample data; and a model training unit configured to train a preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, to obtain the abnormal transaction detection model.

[0075] Optionally, in the anomaly detection device provided in the embodiments of the present application, the device further includes a first acquisition unit configured to acquire a detection intensity coefficient before training the preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, wherein the detection intensity coefficient is used to represent the strictness of detection; a second acquisition unit configured to acquire a risk sensitivity slope, wherein the risk sensitivity slope is used to represent the degree of punishment for abnormal transactions; a third determination unit configured to determine a risk punisher according to the transaction risk deviation and the risk sensitivity slope, wherein the risk punisher is used to make a nonlinear punishment according to the misjudgment degree of detection; and a fourth determination unit configured to determine the waveform loss function according to the detection intensity coefficient, the risk sensitivity slope, and the risk punisher.

[0076] Optionally, in the device for detecting abnormal transactions provided in the embodiments of the present application, the third determination unit comprises: a deviation determination module, configured to determine a transaction risk deviation according to a deviation between a prediction result output by the preset machine learning model and a label of the sample data; a first penalty term module, configured to exponentially amplify the transaction risk deviation according to a risk sensitivity slope to obtain an exponential penalty term; a second penalty term module, configured to determine a square penalty term according to a square of the transaction risk deviation; and a punisher determination module, configured to determine a risk punisher according to the exponential penalty term and the square penalty term.

[0077] Optionally, in the device for detecting abnormal transactions provided in the embodiments of the present application, the preset machine learning model is a twin support vector machine model, and the model training unit comprises: a problem determination module, configured to determine a positive hyperplane optimization problem and a negative hyperplane optimization problem of the preset machine learning model according to the slack variable; and a parameter updating module, configured to solve the positive hyperplane optimization problem and the negative hyperplane optimization problem according to the abnormal transaction detection training data set under the constraint of the wave loss function, to update parameters of the preset machine learning model, and obtain an abnormal transaction detection model.

[0078] Optionally, in the device for detecting abnormal transactions provided in the embodiments of the present application, the device further comprises: a kernel function obtaining unit, configured to obtain a preset kernel function before training the preset machine learning model according to the abnormal transaction detection training data set under the constraint of the wave loss function; and a data mapping unit, configured to map sample data in the abnormal transaction detection training data set to a preset space according to the kernel function, so that the sample data in the mapped abnormal transaction detection training data set exist a linear classification boundary.

[0079] It should be noted that the information obtaining unit 301 and the abnormality detection unit 302 correspond to steps S201 to S202 in Embodiment 1, and the units have the same instances and application scenarios as the corresponding steps, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above-mentioned modules or units can be hardware components or software components stored in the memory (for example, the memory 104) and processed by one or more processors (for example, the processors 102a, 102b, …, 102n), and the above-mentioned modules can also be a part of the device and can run in the computer terminal 10 provided in Embodiment 1.

[0080] Embodiment 3

[0081] Embodiments of the present application can provide an electronic device, Figure 4 is a structural block diagram of an electronic device according to an embodiment of the present application. As Figure 4 shown, the electronic device can include one or more (for example, two or more) processors (for example, the processors 102a, 102b, …, 102n) and one or more (for example, two or more) memories (for example, the memories 104a, 104b, …, 104n). Figure 4The processor 1002, the memory 1004, a storage controller, and a peripheral interface are shown in FIG. 1. The peripheral interface is connected with a radio frequency module, an audio module, and a display.

[0082] The memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application. The processor executes various functions and data processing by running the software programs and modules stored in the memory, that is, implements the above-described methods. The memory can include a high-speed random access memory, and can further include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory can further include a memory remotely arranged with respect to the processor, which can be connected to the terminal through a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0083] The processor can call information and application programs stored in the memory through the transmission device to perform the following steps: obtaining target transaction information of a target user under the authorization of the target user, wherein the target transaction information at least includes transaction data of the target user and environment data corresponding to the target user in the process of generating the transaction data; inputting the target transaction information into an abnormal transaction detection model, and predicting a detection result of the target transaction information by using the abnormal transaction detection model, wherein a loss function used in the training process of the abnormal transaction detection model is a waveform loss function.

[0084] The processor can also call information and application programs stored in the memory through the transmission device to perform the following steps: obtaining an abnormal transaction detection training data set, wherein the abnormal transaction detection training data set includes a plurality of sample data and a label of each sample data, the type of the label includes normal transaction and abnormal transaction, and the sample data includes transaction sample data and environment sample data; training a preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, to obtain an abnormal transaction detection model.

[0085] The processor can also call information and application programs stored in the memory through the transmission device to perform the following steps: obtaining a detection intensity coefficient, wherein the detection intensity coefficient is used to represent the strictness of detection; obtaining a risk sensitivity slope, wherein the risk sensitivity slope is used to represent the degree of punishment for abnormal transactions; determining a risk punisher according to the transaction risk deviation and the risk sensitivity slope, wherein the risk punisher is used to make a nonlinear punishment according to the misjudgment degree of detection; and determining the waveform loss function according to the detection intensity coefficient, the risk sensitivity slope, and the risk punisher.

[0086] The processor can further call information and application programs stored in the memory through the transmission device to perform the following steps: determining a transaction risk deviation degree according to a deviation between a prediction result output by the preset machine learning model and a label of the sample data; performing exponential amplification on the transaction risk deviation degree according to a risk sensitivity slope to obtain an exponential penalty term; determining a square penalty term according to a square of the transaction risk deviation degree; and determining a risk punisher according to the exponential penalty term and the square penalty term.

[0087] The processor can further call information and application programs stored in the memory through the transmission device to perform the following steps: determining a positive class hyperplane optimization problem and a negative class hyperplane optimization problem of the preset machine learning model according to the slack variable; and solving the positive class hyperplane optimization problem and the negative class hyperplane optimization problem according to the abnormal transaction detection training data set under the constraint of the waveform loss function to update parameters of the preset machine learning model and obtain an abnormal transaction detection model.

[0088] The processor can further call information and application programs stored in the memory through the transmission device to perform the following steps: obtaining a preset kernel function; and mapping sample data in the abnormal transaction detection training data set to a preset space according to the kernel function, so that the sample data in the mapped abnormal transaction detection training data set exist a linear classification boundary.

[0089] By obtaining target transaction information of a target user under authorization of the target user, wherein the target transaction information at least includes transaction data of the target user and environment data corresponding to the target user in a process of generating the transaction data, and inputting the target transaction information into an abnormal transaction detection model, a detection result of the target transaction information is predicted by using the abnormal transaction detection model, wherein a loss function used by the abnormal transaction detection model in a training process is a waveform loss function, thereby solving the technical problem of low accuracy of abnormal transaction detection in the prior art.

[0090] Those skilled in the art can understand that Figure 4 The structure shown is only schematic, and the electronic device can also be a terminal device such as a smart phone, a tablet computer, a palm computer, a Mobile Internet Device (MID), a PAD, and the like. Figure 4 It does not limit the structure of the electronic device. For example, the electronic device can further include more or fewer components (such as a network interface, a display device, and the like) than those shown in the figures, or have a different configuration from that shown in the figures. Figure 4 It does not limit the structure of the electronic device. For example, the electronic device can further include more or fewer components (such as a network interface, a display device, and the like) than those shown in the figures, or have a different configuration from that shown in the figures. Figure 4 It does not limit the structure of the electronic device. For example, the electronic device can further include more or fewer components (such as a network interface, a display device, and the like) than those shown in the figures, or have a different configuration from that shown in the figures.

[0091] Those skilled in the art can understand that all or part of the steps in the above-mentioned various methods of the embodiments can be completed by instructing the terminal device related hardware through a program, and the program can be stored in a computer readable storage medium, which can include a flash disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0092] Embodiment 4

[0093] The embodiments of the present application also provide a storage medium. Optionally, in the embodiments, the storage medium can be used to store the program code executed by the method for detecting abnormal transaction provided in the embodiment 1.

[0094] Optionally, in the embodiments, the storage medium can be located in any one of the computer terminals in the computer terminal group in the computer network, or in any one of the mobile terminals in the mobile terminal group.

[0095] Optionally, in the embodiments, the computer readable storage medium is configured to store program code for performing the following steps: obtaining target transaction information of a target user under the condition of obtaining authorization of the target user, wherein the target transaction information at least includes transaction data of the target user and environment data corresponding to the target user in the process of generating the transaction data; inputting the target transaction information into an abnormal transaction detection model, and predicting a detection result of the target transaction information by using the abnormal transaction detection model, wherein a loss function used in a training process of the abnormal transaction detection model is a waveform loss function.

[0096] Optionally, in the embodiments, the computer readable storage medium is further configured to store program code for performing the following steps: obtaining an abnormal transaction detection training data set, wherein the abnormal transaction detection training data set includes a plurality of sample data and a label of each sample data, the type of the label includes normal transaction and abnormal transaction, and the sample data includes transaction sample data and environment sample data; training a preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, to obtain the abnormal transaction detection model.

[0097] Optionally, in the embodiment, the computer readable storage medium is further configured to store program code for performing the following steps: obtaining a detection intensity coefficient, wherein the detection intensity coefficient is used to represent a strictness of the detection; obtaining a risk sensitivity slope, wherein the risk sensitivity slope is used to represent a degree of punishment for the abnormal transaction; determining a risk punisher according to the transaction risk deviation and the risk sensitivity slope, wherein the risk punisher is used to make a non-linear punishment according to a false positive rate of the detection; and determining the waveform loss function according to the detection intensity coefficient, the risk sensitivity slope and the risk punisher.

[0098] Optionally, in the embodiment, the computer readable storage medium is further configured to store program code for performing the following steps: determining the transaction risk deviation according to a deviation between a prediction result output by the preset machine learning model and a label of the sample data; exponentially amplifying the transaction risk deviation according to the risk sensitivity slope to obtain an exponential penalty term; determining a square penalty term according to a square of the transaction risk deviation; and determining the risk punisher according to the exponential penalty term and the square penalty term.

[0099] Optionally, in the embodiment, the computer readable storage medium is further configured to store program code for performing the following steps: determining a positive hyperplane optimization problem and a negative hyperplane optimization problem of the preset machine learning model according to the slack variable; and solving the positive hyperplane optimization problem and the negative hyperplane optimization problem according to the abnormal transaction detection training data set under the constraint of the waveform loss function, to update parameters of the preset machine learning model, and obtain the abnormal transaction detection model.

[0100] Optionally, in the embodiment, the computer readable storage medium is further configured to store program code for performing the following steps: obtaining a preset kernel function; and mapping the sample data in the abnormal transaction detection training data set to a preset space according to the kernel function, so that the sample data in the mapped abnormal transaction detection training data set has a linear classification boundary.

[0101] The application also provides a computer program product, which, when executed on a data processing device, is adapted to perform the steps of the abnormal transaction detection method.

[0102] The above sequence numbers of the embodiments of the application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0103] In the above embodiments of the application, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0104] In several embodiments provided in the present application, it should be understood that the disclosed technology can be implemented by other ways. Among them, the above-described device embodiments are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, units or modules, and can be electrical or other forms.

[0105] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or they can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0106] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0107] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part of the prior art that contributes to the technical solutions or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various program code storage media.

[0108] The above is only the preferred embodiment of the present application, and it should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be considered as the protection scope of the present application.

Claims

1. A method of detecting anomalous transactions, characterized by, The method comprises the following steps: obtaining target transaction information of a target user after obtaining authorization of the target user, wherein the target transaction information comprises at least transaction data of the target user and environment data corresponding to the target user during generation of the transaction data; inputting the target transaction information into an abnormal transaction detection model, and predicting a detection result of the target transaction information by using the abnormal transaction detection model, wherein a loss function used in a training process of the abnormal transaction detection model is a waveform loss function.

2. The method of claim 1, wherein, The training step of the abnormal transaction detection model comprises: obtaining an abnormal transaction detection training data set, wherein the abnormal transaction detection training data set comprises a plurality of sample data and a label of each sample data, the label comprises normal transaction and abnormal transaction, and the sample data comprises transaction sample data and environment sample data; training a preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, to obtain the abnormal transaction detection model.

3. The method of claim 2, wherein, Before training the preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, the method further comprises: obtaining a detection intensity coefficient, wherein the detection intensity coefficient is used to represent the strictness of detection; obtaining a risk sensitivity slope, wherein the risk sensitivity slope is used to represent the degree of punishment for abnormal transactions; determining a risk punisher according to a transaction risk deviation and the risk sensitivity slope, wherein the risk punisher is used to make a nonlinear punishment according to the degree of misjudgment of detection; determining the waveform loss function according to the detection intensity coefficient, the risk sensitivity slope and the risk punisher.

4. The method of claim 3, wherein, Determining the risk punisher according to the transaction risk deviation and the risk sensitivity slope comprises: determining the transaction risk deviation according to a deviation between a prediction result output by the preset machine learning model and the label of the sample data; exponentially amplifying the transaction risk deviation according to the risk sensitivity slope to obtain an exponential penalty term; determining a square penalty term according to a square of the transaction risk deviation; determining the risk punisher according to the exponential penalty term and the square penalty term.

5. The method of claim 2, wherein, The preset machine learning model is a twin support vector machine model, and determining the abnormal transaction detection model by training the preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set comprises: determining a positive class hyperplane optimization problem and a negative class hyperplane optimization problem of the preset machine learning model according to a slack variable; solving the positive class hyperplane optimization problem and the negative class hyperplane optimization problem according to the abnormal transaction detection training data set under the constraint of the waveform loss function, to update parameters of the preset machine learning model, and obtaining the abnormal transaction detection model.

6. The method of claim 2, wherein, Before training the preset machine learning model under the constraint of the waveform loss function according to the abnormal transaction detection training data set, the method further comprises: obtaining a preset kernel function; The sample data in the abnormal transaction detection training data set is mapped to a preset space according to the kernel function, so that the sample data in the mapped abnormal transaction detection training data set has a linear classification boundary.

7. An abnormal transaction detecting apparatus characterized by comprising: Comprise: An information acquisition unit configured to acquire target transaction information of a target user if the target user authorizes, wherein the target transaction information comprises at least transaction data of the target user and environment data corresponding to the target user in a process of generating the transaction data; An anomaly detection unit configured to input the target transaction information into an abnormal transaction detection model, and predict a detection result of the target transaction information by using the abnormal transaction detection model, wherein a loss function used in a training process of the abnormal transaction detection model is a waveform loss function.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored executable program, wherein the executable program controls the device where the computer readable storage medium is located to execute the abnormal transaction detection method of any one of claims 1-6 when the executable program is running.

9. An electronic device, comprising: Comprise: A memory storing an executable program; A processor configured to run the program, wherein the program executes the abnormal transaction detection method of any one of claims 1-6 when the program is running.

10. A computer program product comprising computer instructions, characterized in that, The computer instructions are executed by the processor to implement the steps of the abnormal transaction detection method of any one of claims 1-6.

Images