Abnormal recognition model training method, abnormal transaction data recognition method and device

Abstract

The invention provides an anomaly recognition model training method which can be applied to the technical field of big data. The training method comprises the following steps: acquiring a plurality of historical transaction data of a plurality of transaction objects; determining corresponding nodes and edges according to the plurality of historical transaction data, and constructing a knowledge graph according to the nodes and the edges; determining a plurality of abnormal item sets based on the knowledge graph and the plurality of transaction objects; based on a preset support degree threshold value, updating the plurality of abnormal item sets, and obtaining rule features of the plurality of updated abnormal item sets; determining structural features and time sequence features of the knowledge graph according to the rule features; and after feature fusion is carried out on the rule features, the structure features and the time sequence features, the features are input into a preset anomaly recognition model for training, a trained anomaly recognition model is obtained, and the trained anomaly recognition model is used for carrying out anomaly recognition on the real-time transaction data of the real-time transaction object. The invention further provides an abnormal transaction data identification method and device.

Description

Technical Field

[0001] This application relates to the field of big data technology, and more specifically to an anomaly identification model training method, an anomaly transaction data identification method and apparatus. Background Technology

[0002] In various transaction scenarios such as financial transactions and e-commerce payments, as the financial industry advances its digital transformation, real-time monitoring of transaction data of transaction objects through anomaly identification models has become a key means to prevent transaction anomalies and avoid business risks.

[0003] Currently, there are three main methods for detecting abnormal transaction data in real-time trading: The first method mainly relies on a watchlist and rule-based cross-comparison, but it is difficult to adapt to the ever-changing trading environment and depends on the attribute characteristics of a single transaction data point, making it difficult to capture potential anomalies in complex trading networks; The second method introduces knowledge graphs into the model, or extracts spatial information through graph neural networks and constructs triple structures to import into graph databases, focusing on the single-dimensional features of the graph and ignoring the temporal evolution and rule-based characteristics of abnormal trading behavior, resulting in insufficient adaptability to dynamically changing abnormal trading patterns; The third method uses the full volume of transaction data for feature extraction and model training, without screening and optimizing key features related to anomalies, which can easily lead to a decrease in model recognition accuracy due to interference from redundant features. Summary of the Invention

[0004] In view of the above problems, this application provides an anomaly identification model training method, an anomaly transaction data identification method and apparatus. By constructing a knowledge graph of related transaction carriers, mining anomaly itemsets and extracting rule features based on the knowledge graph, and integrating the structural features of the knowledge graph with the temporal features of the anomaly transactions for model training, the method solves the problems of incomplete model feature mining, weak adaptability to complex transaction scenarios, and difficulty in balancing identification accuracy and training efficiency, thereby improving the accuracy and timeliness of anomaly transaction identification.

[0005] According to the first aspect of this application, an anomaly detection model training method is provided, comprising: acquiring multiple historical transaction data of multiple transaction objects; determining corresponding nodes and edges based on the multiple historical transaction data, and constructing a knowledge graph based on the nodes and edges, wherein nodes represent transaction carriers associated with each transaction object, and edges represent the association relationships between different transaction carriers; determining multiple anomaly itemsets based on the knowledge graph and multiple transaction objects, wherein each anomaly itemset represents a set of historical anomaly transaction behaviors of a transaction object; updating the multiple anomaly itemsets based on a preset support threshold, and acquiring the rule features of the updated multiple anomaly itemsets; determining the structural features and temporal features of the knowledge graph based on the rule features; and after feature fusion of the rule features, structural features, and temporal features, inputting them into a preset anomaly detection model for training, thereby obtaining a trained anomaly detection model, which is used to perform anomaly detection on real-time transaction data of real-time transaction objects.

[0006] According to an embodiment of this application, constructing a knowledge graph based on nodes and edges includes: determining the node type of a node based on transaction carriers of multiple historical transaction data; determining the edge type of an edge based on the association between transaction carriers, where edge types include holding relationship, transaction relationship, login relationship, and kinship relationship; and instantiating nodes and edges according to node type and edge type to construct the knowledge graph.

[0007] According to an embodiment of this application, multiple abnormal itemsets are determined based on a knowledge graph and multiple transaction objects, including: selecting multiple historical abnormal transaction data that meet preset conditions from multiple historical transaction data based on the knowledge graph; converting multiple historical abnormal transaction data into multiple historical abnormal transaction behaviors based on preset behavior rules; and clustering multiple historical abnormal transaction behaviors based on the transaction object corresponding to each historical abnormal transaction data to obtain multiple abnormal itemsets.

[0008] According to an embodiment of this application, filtering out multiple historical abnormal transaction data that meet preset conditions from multiple historical transaction data includes: determining the connection topology of nodes and edges based on a knowledge graph; when the connection topology corresponding to a node meets any preset abnormal structure, the historical transaction data corresponding to the node is taken as historical abnormal transaction data.

[0009] According to embodiments of this application, the connection topology corresponding to a node satisfies any preset abnormal structure, including: for any first node, if the number of nodes connected to the first node through edges of the same type is greater than or equal to a preset first threshold, the connection topology corresponding to the first node is designated as a first abnormal structure; for any second node, if the second node forms a closed loop with nodes connected through edges of the same type, the connection topology corresponding to the second node is designated as a second abnormal structure; for any third node, a set of first nodes connected to the third node through edges of the first type is determined, a set of second nodes connected to the third node through edges of the second type is determined, and nodes connected to at least one node in the set of first nodes through edges of the third type are selected from the set of second nodes to form an intersection node set; when the number of nodes in the intersection node set is greater than or equal to a preset third threshold, the connection topology corresponding to the third node is designated as a third abnormal structure.

[0010] According to an embodiment of this application, updating multiple anomalous itemsets based on a preset support threshold includes: traversing multiple anomalous itemsets to determine the frequency of occurrence of each historical anomalous transaction behavior in the multiple anomalous itemsets; for any historical anomalous transaction behavior, removing the historical anomalous transaction behavior when its frequency of occurrence is less than the support threshold; traversing the multiple anomalous itemsets after removing the historical anomalous transaction behavior until the frequency of occurrence of the historical anomalous transaction behavior in each anomalous itemset is greater than or equal to the support threshold, thereby obtaining multiple updated anomalous itemsets.

[0011] According to an embodiment of this application, obtaining rule features of multiple updated abnormal itemsets includes: generating multiple candidate association rules based on the updated multiple abnormal itemsets, wherein the candidate association rules represent the association relationship between each historical abnormal transaction behavior; obtaining the confidence level of each candidate association rule, wherein the confidence level represents the probability that one historical abnormal transaction behavior occurs simultaneously with another historical abnormal transaction behavior; and using the candidate association rule as a rule feature when the confidence level is greater than or equal to a preset confidence level threshold.

[0012] According to an embodiment of this application, the input is trained in a preset anomaly recognition model to obtain a trained anomaly recognition model, including: acquiring multiple historical abnormal transaction data of multiple transaction objects; performing anomaly recognition on each historical abnormal transaction data based on the anomaly recognition model to obtain a first probability of the historical abnormal transaction data; calculating the error gradient between the first probability and a preset second probability; and training the anomaly recognition model based on the error gradient corresponding to each historical abnormal transaction data to obtain a trained anomaly recognition model.

[0013] The second aspect of this application provides a method for identifying abnormal transaction data, comprising: acquiring a target anomaly identification model, wherein the target anomaly identification model is trained according to the training method of the above-mentioned anomaly identification model; acquiring multiple real-time transaction data of at least one real-time transaction object; inputting the multiple real-time transaction data into the target anomaly identification model, and acquiring the abnormal transaction data output by the target anomaly identification model.

[0014] A third aspect of this application provides an anomaly recognition model training device, comprising: a data acquisition module for acquiring multiple historical transaction data of multiple transaction objects; a graph construction module for determining corresponding nodes and edges based on the multiple historical transaction data, and constructing a knowledge graph based on the nodes and edges, wherein nodes represent transaction carriers associated with multiple transaction objects, and edges represent the association relationships between different transaction carriers; an anomaly processing module for determining multiple anomaly itemsets based on the knowledge graph and multiple transaction objects, wherein each anomaly itemset represents a set of historical anomaly transaction behaviors of a transaction object; updating the multiple anomaly itemsets based on a preset support threshold, and acquiring the rule features of the updated multiple anomaly itemsets; a feature acquisition module for determining the structural features and temporal features of the knowledge graph based on the rule features; and a model training module for fusing the rule features, structural features, and temporal features, and then inputting them into a preset anomaly recognition model for training, thereby obtaining a trained anomaly recognition model, which is used to perform anomaly recognition on real-time transaction data of real-time transaction objects.

[0015] The fourth aspect of this application provides an abnormal transaction data identification device, comprising: a model acquisition module for acquiring a target abnormal identification model, wherein the target abnormal identification model is trained according to the training method of the above-mentioned abnormal identification model; a data acquisition module for acquiring multiple real-time transaction data of at least one real-time transaction object; and an abnormal identification module for inputting the multiple real-time transaction data into the target abnormal identification model to acquire the abnormal transaction data output by the target abnormal identification model.

[0016] A fifth aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0017] A sixth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0018] A seventh aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0019] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0020] Figure 1 The illustration shows an application scenario diagram of the anomaly identification model training method, the abnormal transaction data identification method, and the apparatus according to embodiments of this application;

[0021] Figure 2 A flowchart illustrating an anomaly recognition model training method according to an embodiment of this application is shown schematically.

[0022] Figure 3 This illustration schematically shows the connection topology of a knowledge graph according to an embodiment of the present application;

[0023] Figure 4 A flowchart illustrating an abnormal transaction data identification method according to an embodiment of this application is shown schematically.

[0024] Figure 5 This schematic diagram illustrates the structure of an anomaly recognition model training apparatus according to an embodiment of this application;

[0025] Figure 6 This schematically illustrates a structural block diagram of an abnormal transaction data identification device according to an embodiment of this application; and

[0026] Figure 7 A block diagram of an electronic device suitable for implementing an anomaly recognition model training method and an anomaly transaction data recognition method according to embodiments of this application is illustrated.

[0027] Figure label:

[0028] 300 - Knowledge Graph; 310 - Star Structure; A1 - First Node; A2 - First Edge; 320 - Closed Structure; B1 - Second Node; B2 - Second Edge; 330 - Network Structure; C11 - Third Node; C12 / C13 - First Type Node; C14 / C15 - Second Type Node; C21 - First Type Edge; C22 - Second Type Edge; C23 - Third Type Edge; 340 - Normal Structure; D1 - Fourth Node; D2 - Fourth Edge. Detailed Implementation

[0029] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0030] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0031] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0032] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0033] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0034] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this application all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0035] Figure 1 The illustration shows an application scenario of the anomaly identification model training method, the anomaly transaction data identification method, and the apparatus according to embodiments of this application.

[0036] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0037] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0038] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0039] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0040] It should be noted that the anomaly identification model training method or the anomaly transaction data identification method provided in the embodiments of this application can generally be executed by server 105. Correspondingly, the anomaly identification model training device or the anomaly transaction data identification device provided in the embodiments of this application can generally be located in server 105. The anomaly identification model training method and the anomaly transaction data identification method provided in the embodiments of this application can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the anomaly identification model training device or the anomaly transaction data identification device provided in the embodiments of this application can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0041] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0042] The following will be based on Figure 1 The scenario described herein provides a detailed description of the anomaly identification model training method and the anomaly transaction data identification method according to embodiments of this application.

[0043] Figure 2 A flowchart illustrating an anomaly recognition model training method according to an embodiment of this application is shown.

[0044] like Figure 2 As shown, the anomaly recognition model training method in this embodiment includes operations S210 to S260.

[0045] In operation S210, multiple historical transaction data of multiple trading objects are obtained.

[0046] A trading counterparty can be any entity participating in a transaction, including the initiator or recipient of the transaction. Different trading counterparties can be distinguished by identifiers, and the same trading counterparty can play different roles in multiple transactions. Historical transaction data can be a collection of structured or unstructured data generated from the trading activities completed by trading counterparties within a certain period of time in the past. It serves as the basis for recording trading behavior, tracing the trading process, and analyzing trading patterns.

[0047] For example, the counterparty in a transaction can be an individual, a business, or an organization.

[0048] For example, historical transaction data can be attribute information of the transaction, such as transaction type, payment method, transaction channel, transaction status, or transaction time.

[0049] Before acquiring historical transaction data from multiple trading entities, a time period can be preset to filter only historical transaction data within this period. This avoids data redundancy due to an excessively broad time range or analytical bias due to an excessively narrow data range. When collecting multiple historical transaction data sets, data logs can be recorded. These logs include the collection time, source, and volume of each historical transaction data set, facilitating subsequent troubleshooting of data quality issues.

[0050] For example, the transaction partner can be a merchant, with a preset time period from XX / XX / 20XX to XX / YY / 20YY, and all order data of the merchant from XX / XX / 20XX to XX / YY / 20YY can be obtained.

[0051] In operation S220, the corresponding nodes and edges are determined based on multiple historical transaction data, and a knowledge graph is constructed based on the nodes and edges. Nodes represent transaction carriers associated with each transaction object, and edges represent the relationships between different transaction carriers.

[0052] A node can be a structured mapping of historical transaction data to transaction carriers; it is an entity identifier associated with a transaction, and one node can represent a specific transaction carrier. Nodes can be bound to transaction attribute information.

[0053] An edge can be a line segment connecting two nodes, used to represent the relationship between different transaction carriers. It is an abstraction of the transaction behavior logic, such as buying, supplying, or binding. Nodes establish connections with other nodes through edges. Some edges can have a clear logical direction, and each edge can correspond to a specific relationship type. The thickness of the edge can represent the frequency of transactions, the total amount of transactions, etc.; the length of the edge can represent the tightness of the relationship between two nodes.

[0054] Knowledge graphs can be triplet network structures composed of nodes, edges, and attribute information. They can visualize the relationships between entities (nodes) and are used to mine, organize, manage, and display complex relationships between entities.

[0055] For example, a node can be a user, account, device, or address.

[0056] For example, an edge could be merchant A supplying goods to merchant B, or user C purchasing goods from merchant D.

[0057] In operation S230, based on the knowledge graph and multiple transaction objects, multiple abnormal itemsets are identified. Each abnormal itemset represents a set of historical abnormal transaction behaviors of a transaction object.

[0058] An anomaly itemset is a collection of multiple historical anomaly transactions for a single transaction object. Each anomaly itemset corresponds to a transaction object and collectively reflects the historical anomaly transaction patterns of that object, such as frequent large-amount transfers, transactions via logins from different locations, and association with unfamiliar accounts. The historical anomaly transactions within the set must be logically related, such as all revolving around anomalies in fund transfers or commodity transactions. Anomaly itemsets can correspond to specific risk scenarios.

[0059] Abnormal historical trading behavior can be trading actions that deviate from the normal historical trading patterns of the trading object.

[0060] For example, if a user's daily transaction amount is around 100 yuan, and a large transaction of 100,000 yuan suddenly occurs, it can be considered an abnormal transaction behavior that deviates from their usual transaction behavior.

[0061] In operation S240, based on a preset support threshold, multiple anomalous itemsets are updated, and the rule features of the updated multiple anomalous itemsets are obtained.

[0062] Support thresholds can be used to measure how frequently a particular historical anomalous transaction occurs across all anomalous sets. Rule features describe the logical relationship between combinations of anomalous features and anomalous outcomes, and can include attributes such as anomalous feature combinations, anomaly type and risk level, and support.

[0063] For example, if the rule characteristics of a certain abnormal itemset are "login from a different location, unverified mobile phone number, and excessive single consumption", it is judged as "account abnormal risk".

[0064] Calculating the support of each candidate anomaly itemset can filter out low-frequency anomaly itemsets with no statistical significance (avoiding misjudgments caused by accidental anomalies), retain high-frequency and highly correlated anomaly itemsets, and extract rule features that can be directly used for decision-making (such as equipment fault warning rules).

[0065] In the S250 operation, the structural and temporal features of the knowledge graph are determined based on the rule features.

[0066] Structural features can be the spatial topology of entities and relationships in a knowledge graph, or the static association patterns that reflect rule features, including the number of connections between entities, the connection paths between entities, or subgraphs formed by entities with strong associations.

[0067] For example, an abnormal risk is triggered by a combination of 10 abnormal features, and the number of connections between entities is 10; another example is from logging in from a different location to a large transfer, and then to an abnormal risk, the connection path length between entities is 2.

[0068] Temporal features can be the patterns of change of entities or relations in a knowledge graph over time. They can reflect the temporal correlation of rule features, including the occurrence time of entities or relations, the time interval between rule triggers, the temporal order of entities or relations, and the frequency of occurrence of entities or relations.

[0069] For example, if there are 3 logins from different locations within 7 consecutive days, the rule will be triggered at intervals of 7 days.

[0070] After fusing the rule features, structural features, and temporal features in the S260 operation, the feature is input into the preset anomaly recognition model for training, resulting in the trained anomaly recognition model. The trained anomaly recognition model is used to identify anomalies in the real-time transaction data of real-time transaction objects.

[0071] By integrating rule features, structural features, and temporal features across dimensions to eliminate feature redundancy and enhance complementary information, the anomaly detection model can more comprehensively capture abnormal patterns. The anomaly detection model can be a pre-defined algorithm trained based on fused features, used to identify data deviations from normal patterns, and can output the probability or type of anomaly in transaction data.

[0072] Real-time trading objects can include the multiple trading objects mentioned above, or various new trading objects that participate in trading activities in real-time trading scenarios.

[0073] The anomaly recognition model training method based on the embodiments of this application comprehensively captures complex anomaly patterns through multi-dimensional feature fusion, and improves the accuracy of recognition and reduces the false judgment rate by using knowledge graphs to mine hidden associations and make decision-making logic traceable. The support threshold dynamically filters high-frequency effective anomaly itemsets and eliminates redundancy, adapting to the dynamic changes of new anomaly patterns. It can flexibly adapt to multiple transaction objects and diverse scenarios, while taking into account the model's generalization ability.

[0074] In embodiments of this application, constructing a knowledge graph based on nodes and edges includes: determining the node type of a node based on transaction carriers of multiple historical transaction data; determining the edge type of an edge based on the association between transaction carriers, where edge types include holding relationships, transaction relationships, login relationships, and kinship relationships; and instantiating nodes and edges according to node types and edge types to construct the knowledge graph.

[0075] Node types can be classification labels based on the semantic attributes and functions of the transaction carrier, used to distinguish different types of nodes. Edge types can be semantic labels used to define the relationships between different transaction carriers (i.e., nodes), clarifying the interaction logic between nodes.

[0076] Holding relationships can refer to the ownership or binding relationship between an entity and an account or device, such as a user binding an account or holding a device; transaction relationships can refer to the fund transfer relationship between entities or accounts, such as a user paying a merchant or transferring funds between accounts; login relationships can refer to the login operation association between a user and a device, such as a user logging into a payment account through a device; kinship relationships can refer to the kinship association between users, such as family members sharing an account or relatives making payments on behalf of each other.

[0077] Instantiation is the process of transforming abstract node and edge types into concrete, uniquely identified nodes and edges, and establishing relationships between them. Key fields are extracted from historical transaction data, and each transaction carrier is labeled with a type according to node type classification rules. Only one unique identifier is retained for each transaction carrier (e.g., the same bank card number). Based on interactive behaviors in historical transaction data, the relationships between different transaction carriers are determined, and corresponding edge types are matched. A unique edge type is assigned to each pair of related nodes, and connections are made according to a node-edge-node pattern to form a knowledge graph.

[0078] The anomaly detection model training method based on the embodiments of this application clearly presents multi-dimensional transaction carrier relationships by explicitly defining the node types corresponding to the transaction carriers, avoiding the loss of association information caused by isolated data. This enables the constructed knowledge graph to fully capture the contextual information of transaction behavior, helping to uncover hidden anomaly relationships and improving the comprehensiveness of anomaly detection.

[0079] In the embodiments of this application, multiple abnormal itemsets are determined based on a knowledge graph and multiple transaction objects, including: based on the knowledge graph, selecting multiple historical abnormal transaction data that meet preset conditions from multiple historical transaction data; based on preset behavior rules, converting multiple historical abnormal transaction data into multiple historical abnormal transaction behaviors; and clustering multiple historical abnormal transaction behaviors based on the transaction object corresponding to each historical abnormal transaction data to obtain multiple abnormal itemsets.

[0080] Based on the constructed knowledge graph (including nodes such as users, accounts, and devices, as well as related edges such as holding and transactions), the structured semantic association capabilities of the knowledge graph (such as node attribute verification and edge relationship tracing) are used to accurately filter out historical abnormal transaction data that meet preset abnormal conditions from massive historical transaction data, such as transaction amount exceeding the user's historical threshold, login device not associated with commonly used nodes, transaction location deviating from the user's commonly used regional nodes, etc., to achieve preliminary targeted screening of abnormal data.

[0081] After screening, standardized transaction units are defined (such as large-amount transfers, logins from overseas addresses, new device activations, changes to bound mobile phones, and other scenario-based types). Each selected historical abnormal transaction data is mapped to the corresponding type of historical abnormal transaction behavior according to the session dimension (such as a transfer exceeding the limit corresponding to a large-amount transfer transaction unit, and a transaction initiated by an unfamiliar overseas address corresponding to an overseas address login transaction unit), thus completing the transformation from historical abnormal transaction data to historical abnormal transaction behavior.

[0082] Multiple historical abnormal transaction behaviors of the same transaction object are grouped and aggregated. At the same time, the database is scanned to calculate the support of each aggregated candidate abnormal behavior combination. Valid combinations with support not lower than the dynamic threshold are selected, and finally multiple abnormal itemsets associated with the scenario are formed.

[0083] The anomaly identification model training method based on the embodiments of this application relies on the node association and edge relationship tracing capabilities of the knowledge graph to accurately filter historical abnormal transaction data that meets preset conditions, avoiding the omission of anomalies caused by isolated data. Abnormal transaction data is transformed into standardized abnormal transaction behaviors according to preset behavioral rules, unifying the data format, improving the identifiability of abnormal patterns, reducing the difficulty of subsequent clustering, and achieving accurate grouping of abnormal transaction behaviors.

[0084] In the embodiments of this application, filtering out multiple historical abnormal transaction data that meet preset conditions from multiple historical transaction data includes: determining the connection topology of nodes and edges based on a knowledge graph; when the connection topology corresponding to a node meets any preset abnormal structure, the historical transaction data corresponding to the node is taken as historical abnormal transaction data.

[0085] The connection topology is the spatial association pattern formed by nodes and edges in a knowledge graph, reflecting the network structural relationships between transaction carriers. The pre-defined abnormal structure can be a topology template with abnormal characteristics, pre-defined based on transaction risk scenarios, and serves as the basis for determining abnormal node associations.

[0086] For example, abnormal structure types can include high node degree anomalies (such as misappropriation of multiple accounts), dense clustering anomalies (such as closed-loop fund transfers), short-path cross-domain anomalies (such as unauthorized login transfers), and combinations of abnormal edge types.

[0087] When the connection topology of a node belongs to any preset abnormal structure, all historical transaction data associated with that node (including transaction records corresponding to transaction edges where the node is the starting or ending point) are the historical abnormal transaction data that need to be filtered.

[0088] The anomaly recognition model training method based on the embodiments of this application captures cross-node and cross-type anomaly combinations through the network association of knowledge graphs, comprehensively covering complex transaction risk scenarios and improving the comprehensiveness and accuracy of anomaly recognition.

[0089] In the embodiments of this application, the connection topology structure corresponding to a node satisfies any preset abnormal structure, including: for any first node, if the number of nodes connected to the first node through edges of the same type is greater than or equal to a preset first threshold, the connection topology structure corresponding to the first node is designated as a first abnormal structure; for any second node, if the second node forms a closed loop with nodes connected through edges of the same type, the connection topology structure corresponding to the second node is designated as a second abnormal structure; for any third node, a set of first nodes connected to the third node through edges of the first type is determined, a set of second nodes connected to the third node through edges of the second type is determined, and from the set of second nodes, nodes connected to at least one node in the set of first nodes through edges of the third type are selected to form an intersection node set; when the number of nodes in the intersection node set is greater than or equal to a preset third threshold, the connection topology structure corresponding to the third node is designated as a third abnormal structure.

[0090] The following is combined with Figure 3 The topological structure of the connections between nodes and edges in the obtained knowledge graph is introduced.

[0091] Figure 3 The diagram illustrates the connection topology of a knowledge graph according to an embodiment of this application.

[0092] like Figure 3 As shown, the knowledge graph 300 contains various connection topologies such as star structure 310, closed structure 320, mesh structure 330 and normal structure 340. Among them, star structure 310, closed structure 320 and mesh structure 330 correspond to preset abnormal structures, which are explained in detail below.

[0093] In the star structure 310, the core node is the first node A1, and all edges connected to the first node A1 are of the same type, namely, edge A2. It can be seen that the first node A1 is connected to at least 5 nodes simultaneously through edge A2. This number of connections reaches a preset first threshold (e.g., the first threshold is set to 3). Therefore, the star structure 310 corresponding to the first node A1 meets the condition that for any first node, the number of nodes connected to the first node through edges of the same type is greater than or equal to the first threshold, and it belongs to the first abnormal structure.

[0094] In closed structure 320, the core node is the second node B1. All nodes within this structure (including B1) are connected by a second edge B2 of the same type. It can be seen that these nodes, together with the second edge B2, form a complete closed loop (i.e., nodes are connected end-to-end in sequence via the second edge B2, forming a circular topology). This satisfies the condition that for any second node, the second node forms a closed loop with nodes connected by edges of the same type. Therefore, closed structure 320 corresponding to the second node B1 belongs to the second anomalous structure.

[0095] In the mesh structure 330, the core node is the third node C11. Nodes connected to the third node C11 via the first type edge C21 (corresponding to the black solid line in the diagram) form the first node set, which includes two first type nodes, C12 and C13. Nodes connected to the third node C11 via the second type edge C22 (corresponding to the smaller-spaced dashed lines in the diagram) form the second node set, which includes two second type nodes, C14 and C15.

[0096] Next, nodes are selected from the second node set. Second type node C14 is connected to first type node C12 in the first node set through third type edge C23 (corresponding to the larger interval of the dashed line). Second type node C15 is connected to first type node C13 in the first node set through third type edge C23. Therefore, both second type nodes C14 and C15 are nodes that are connected to at least one node in the first node set through third type edges, and the number of nodes in the intersection node set is 2.

[0097] If the preset third threshold is 2, then the number of intersection nodes satisfies the condition that for any third node, the number of intersection nodes is greater than or equal to the third threshold. Therefore, the mesh structure 330 corresponding to the third node C11 belongs to the third abnormal structure.

[0098] In normal structure 340, the fourth node D1 is connected to other nodes through the fourth edge D2. However, the connection method does not involve a single node connecting to a large number of nodes through the same type of edge, nor does it form a closed loop, nor does it have a complex network relationship with multiple types of edges crossing each other. Therefore, it does not belong to the abnormal structure in the knowledge graph.

[0099] The anomaly recognition model training method based on the embodiments of this application includes three different types of anomaly structures, covering anomalies in various aspects such as the number of connections, loop formation, and complex relationships between nodes. By analyzing the connection topology of nodes from different perspectives, it avoids the detection defects caused by focusing only on a single anomaly feature.

[0100] In the embodiments of this application, multiple anomalous itemsets are updated based on a preset support threshold, including: traversing multiple anomalous itemsets to determine the frequency of occurrence of each historical anomalous transaction behavior in the multiple anomalous itemsets; for any historical anomalous transaction behavior, removing the historical anomalous transaction behavior when the frequency of occurrence of the historical anomalous transaction behavior is less than the support threshold; traversing the multiple anomalous itemsets after removing the historical anomalous transaction behavior until the frequency of occurrence of the historical anomalous transaction behavior in each anomalous itemset is greater than or equal to the support threshold, thereby obtaining multiple updated anomalous itemsets.

[0101] Set the set of all exception itemsets as each For an abnormal itemset, , All values ​​are positive integers; the set of historical abnormal transaction behaviors is defined as follows: each This is a historically unusual transaction. , All are positive integers.

[0102] For example, to calculate the frequency of each historical anomalous transaction, which is the proportion of times that anomalous transaction occurred in all sets of anomalous items to the total number of anomalous items, the frequency can be calculated using the following formula:

[0103]

[0104] In the formula, Historical abnormal trading behavior The frequency of occurrence, The number of all anomalous itemsets. To include historical abnormal transaction behavior The number of abnormal itemsets.

[0105] For example, the support threshold can be expressed using the following formula:

[0106]

[0107] In the formula, For the support threshold, This represents the historical anomaly probability.

[0108] Traverse all exception itemsets Statistical analysis of each historical abnormal transaction behavior The frequency of occurrence, then filter out Historical abnormal trading behavior yields a set of high-frequency abnormal trading behaviors. Simultaneously remove all abnormal items from the set. The historical unusual trading behavior.

[0109] for ( (This is the number of abnormal transactions contained in the anomaly item set). Repeat the following steps until the frequency of behavior in all anomaly item sets is greater than or equal to the support threshold.

[0110] Step 1, candidate anomaly itemset generation, from the already retained anomaly itemsets. Select two that contain Anomaly itemsets of historical abnormal transaction behavior ,if and Compared to the past If the behaviors of several historical abnormal transactions are the same, they are merged into one containing... Candidate anomaly itemsets of historical abnormal transaction behavior ,Right now ,in, Include An unusual historical transaction.

[0111] Step 2, candidate anomaly itemset pruning, for each candidate anomaly itemset Check the abnormal itemset In A historically unusual transaction, namely from Does the set obtained after removing any historical abnormal trading behavior all belong to the previously selected set of high-frequency abnormal trading behaviors? If any historical abnormal transaction is not in the valid set, then that candidate abnormal itemset is deleted. .

[0112] Step 3: Process the remaining candidate anomaly itemset after pruning. Calculate each of the historical abnormal transaction behaviors. The frequency of occurrence will be used to determine the candidate anomaly itemset. All itemsets that appear at a frequency greater than or equal to the support threshold are considered as the updated outlier itemsets.

[0113] The anomaly identification model training method based on the embodiments of this application removes low-frequency historical abnormal transaction behaviors through multiple traversals until the frequency of occurrence of historical abnormal transaction behaviors in each anomaly item set is greater than or equal to the support threshold, which can ensure that the updated anomaly item set has consistency in the frequency dimension.

[0114] In the embodiments of this application, obtaining the rule features of the updated multiple abnormal itemsets includes: generating multiple candidate association rules based on the updated multiple abnormal itemsets, wherein the candidate association rules represent the association relationship between each historical abnormal transaction behavior; obtaining the confidence level of each candidate association rule, wherein the confidence level represents the probability that one historical abnormal transaction behavior and another historical abnormal transaction behavior occur simultaneously; and using the candidate association rule as a rule feature when the confidence level is greater than or equal to a preset confidence level threshold.

[0115] The anomaly recognition model training method based on the embodiments of this application determines a relatively small number of rule features through the confidence threshold, which are more accurate. When performing rule matching, it can reduce the number of matching attempts and the amount of computation, thereby improving matching efficiency.

[0116] In the embodiments of this application, the input is trained in a preset anomaly recognition model to obtain a trained anomaly recognition model, including: acquiring multiple historical abnormal transaction data of multiple transaction objects; performing anomaly recognition on each historical abnormal transaction data based on the anomaly recognition model to obtain a first probability of the historical abnormal transaction data; calculating the error gradient between the first probability and a preset second probability; and training the anomaly recognition model based on the error gradient corresponding to each historical abnormal transaction data to obtain a trained anomaly recognition model.

[0117] Using historical abnormal transaction data from multiple trading entities as the training set for the anomaly detection model, the first probability... This refers to the probability that the anomaly detection model predicts historical trading behavior as historical anomalous trading behavior. The pre-set second probability... This can serve as a baseline probability for classifying a transaction as abnormal.

[0118] Set the training set as ,in, For the first Feature vectors of historical abnormal transaction data For the first The tag of each transaction ( Indicates an anomaly. (Indicates normal) , All are positive integers.

[0119] After obtaining historical abnormal transaction data, the features can be encoded and optimized to provide high-quality input for training the anomaly recognition model.

[0120] For example, the error gradient between the first probability and the preset second probability can be expressed by the following formula:

[0121]

[0122] In the formula, For the t-th iteration The error gradient of each sample. For loss function, For the preset gradient boosting ensemble model, For the first The features of each sample are input into the ensemble model to obtain the initial predicted value. The values ​​are the predictions from the ensemble model for the first t-1 trees.

[0123] For example, using the error gradient To achieve the training objective, train a new decision tree. To control the correction magnitude using a learning rate and avoid overfitting, the following formula must be satisfied:

[0124]

[0125] In the formula, For the ensemble model after the t-th iteration, This is the learning rate.

[0126] A new decision tree is used in each round. The bias of the previous ensemble model is corrected, making the predictions of the updated model closer to the second probability, and the corresponding first probability is also more accurate.

[0127] At the end of training, the model with the best performance on the validation set for the required number of iterations is automatically loaded. After training, performance can be evaluated on either the test or validation set. Finally, the trained anomaly detection model is used to predict real-time transaction data and obtain the prediction probability.

[0128] The contribution of a specific feature to the prediction can be determined by the change in the average predicted value brought about by the feature vector during tree splitting. The interpretation of a single sample can be visualized by calculating the contribution value of a batch of samples using an interpreter, and then a global view of the feature importance can be obtained by using the mean of the absolute values ​​of the contributions of all samples.

[0129] After training, a dynamic feedback mechanism can be established to provide the rule engine with risk levels and risk attributions, avoiding blind validation by the rule engine and focusing on high-value risk points.

[0130] After receiving the output from the prediction system, the rules engine extracts the core entities in the transactions, marking them with high-risk tags. The rules engine then feeds these core entities into the knowledge graph to query the relationships between entities and verify whether hidden risk patterns exist. By combining the association mining capabilities of the knowledge graph, it supplements the hidden risks not captured by the anomaly detection model, avoiding missed detections due to single-point feature judgments.

[0131] It eliminates the need to retrain the entire model; it updates model parameters based solely on new trading data and new fusion features, transforming real-time risk data into new capabilities for the model.

[0132] The anomaly identification model training method based on the embodiments of this application trains the model based on new data and error gradients, enabling the model to learn more diverse anomaly patterns and features, enhancing the model's adaptability to different types of abnormal transaction data, and improving the model's generalization ability.

[0133] Figure 4 A flowchart illustrating an abnormal transaction data identification method according to an embodiment of this application is shown.

[0134] like Figure 4 As shown, the abnormal transaction data identification method of this embodiment includes operations S410 to S430.

[0135] When operating S410, the target anomaly recognition model is obtained. The target anomaly recognition model is trained according to the training method of the anomaly recognition model.

[0136] The target anomaly identification model can be an anomaly identification model that has completed feature fusion, gradient boosting iterative training based on historical anomaly transaction data and has been connected to a dynamic feedback mechanism, and whose evaluation indicators in the test samples meet the business's preset threshold.

[0137] In operation S420, multiple real-time transaction data of at least one real-time transaction object are acquired.

[0138] When operating the S430, multiple real-time transaction data are input into the target anomaly identification model to obtain the abnormal transaction data output by the target anomaly identification model.

[0139] The anomaly recognition model training method based on the embodiments of this application accurately captures hidden anomaly patterns through feature optimization and dynamic iteration of the target anomaly recognition model. Combined with risk-level differentiated processing, it effectively reduces the loss of false positives and false negatives, and the prediction basis can be traced. It supports flexible configuration for multiple business scenarios and achieves continuous model optimization in conjunction with the dynamic feedback mechanism, which greatly reduces manual maintenance costs.

[0140] Based on the above-mentioned anomaly detection model training method, this application also provides an anomaly detection model training device. The following will combine... Figure 5 The device is described in detail.

[0141] Figure 5 A schematic block diagram of an anomaly recognition model training apparatus according to an embodiment of this application is shown.

[0142] like Figure 5As shown, the anomaly recognition model training device 500 of this embodiment includes a data acquisition module 510, a map construction module 520, an anomaly processing module 530, a feature acquisition module 540, and a model training module 550.

[0143] The data acquisition module 510 is used to acquire multiple historical transaction data of multiple trading objects. In one embodiment, the data acquisition module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0144] The graph construction module 520 is used to determine the corresponding nodes and edges based on multiple historical transaction data, and to construct a knowledge graph based on the nodes and edges. Nodes represent transaction carriers associated with multiple transaction objects, and edges represent the relationships between different transaction carriers. In one embodiment, the graph construction module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0145] The anomaly handling module 530 is used to determine multiple anomaly itemsets based on a knowledge graph and multiple transaction objects. Each anomaly itemset represents a set of historical anomaly transaction behaviors of a transaction object. Based on a preset support threshold, the multiple anomaly itemsets are updated, and the rule features of the updated multiple anomaly itemsets are obtained. In one embodiment, the anomaly handling module 530 can be used to perform the operations S230~S240 described above, which will not be repeated here.

[0146] The feature acquisition module 540 is used to determine the structural and temporal features of the knowledge graph based on the rule features. In one embodiment, the feature acquisition module 540 can be used to perform the operation 250 described above, which will not be repeated here.

[0147] The model training module 550 is used to fuse rule features, structural features, and temporal features, and then input these features into a preset anomaly detection model for training, resulting in a trained anomaly detection model. This trained model is used to identify anomalies in the real-time transaction data of real-time trading objects. In one embodiment, the model training module 550 can be used to perform the operation 260 described above, which will not be repeated here.

[0148] According to an embodiment of this application, the graph construction module 520 includes a type determination unit and an instance construction unit. The type determination unit is used to determine the node type of a node based on transaction carriers from multiple historical transaction data; and to determine the edge type based on the relationships between transaction carriers, whereby edge types include holding relationships, transaction relationships, login relationships, and kinship relationships. The instance construction unit is used to instantiate nodes and edges according to the node type and edge type to construct the knowledge graph.

[0149] According to an embodiment of this application, the anomaly handling module 530 includes an anomaly filtering unit, an anomaly transformation unit, and an anomaly clustering unit. The anomaly filtering unit is used to filter out multiple historical anomaly transaction data that meet preset conditions from multiple historical transaction data based on a knowledge graph. The anomaly transformation unit is used to transform multiple historical anomaly transaction data into multiple historical anomaly transaction behaviors based on preset behavioral rules. The anomaly clustering unit is used to cluster multiple historical anomaly transaction behaviors based on the transaction object corresponding to each historical anomaly transaction data, obtaining multiple anomaly itemsets.

[0150] According to embodiments of this application, the anomaly filtering unit includes a structure determination subunit and an anomaly determination subunit. The structure determination subunit is used to determine the connection topology of nodes and edges based on the knowledge graph. The anomaly determination subunit is used to treat the historical transaction data corresponding to a node as historical anomalous transaction data when the connection topology of a node satisfies any preset anomaly structure.

[0151] According to embodiments of this application, the anomaly determination subunit includes a first structural subunit, a second structural subunit, and a third structural subunit. The first structural subunit is used to, for any first node, identify the connection topology corresponding to the first node as a first anomaly structure if the number of nodes connected to the first node via edges of the same type is greater than or equal to a preset first threshold. The second structural subunit is used to, for any second node, identify the connection topology corresponding to the second node as a second anomaly structure if the second node forms a closed loop with nodes connected via edges of the same type. The third structural subunit is used to, for any third node, determine a set of first nodes connected to the third node via edges of the first type, determine a set of second nodes connected to the third node via edges of the second type, and select nodes from the second node set that are connected to at least one node in the first node set via edges of the third type, forming an intersection node set; when the number of nodes in the intersection node set is greater than or equal to a preset third threshold, the connection topology corresponding to the third node is identified as a third anomaly structure.

[0152] According to an embodiment of this application, the anomaly handling module 530 includes a frequency determination unit and an itemset update unit. The frequency determination unit is used to traverse multiple anomaly itemsets and determine the frequency of occurrence of each historical anomaly transaction in the multiple anomaly itemsets. The itemset update unit is used to remove any historical anomaly transaction if its frequency is less than a support threshold; it traverses the multiple anomaly itemsets after removing the historical anomaly transaction until the frequency of occurrence of the historical anomaly transaction in each anomaly itemset is greater than or equal to the support threshold, thus obtaining multiple updated anomaly itemsets.

[0153] According to an embodiment of this application, the anomaly handling module 530 further includes a rule generation unit, a confidence level acquisition unit, and a rule determination unit. The rule generation unit generates multiple candidate association rules based on the updated multiple anomaly itemsets, where each candidate association rule represents the association relationship between historical anomaly transactions. The confidence level acquisition unit acquires the confidence level of each candidate association rule, where the confidence level represents the probability that one historical anomaly transaction occurs simultaneously with another. The rule determination unit uses the candidate association rule as a rule feature when the confidence level is greater than or equal to a preset confidence level threshold.

[0154] According to an embodiment of this application, the model training module 550 includes a probability acquisition unit, a gradient calculation unit, and a model training unit. The probability acquisition unit acquires multiple historical abnormal transaction data points for multiple trading objects; based on the anomaly detection model, it performs anomaly detection on each historical abnormal transaction data point to obtain a first probability of the historical abnormal transaction data point. The gradient calculation unit calculates the error gradient between the first probability and a preset second probability. The model training unit trains the anomaly detection model based on the error gradient corresponding to each historical abnormal transaction data point to obtain a trained anomaly detection model.

[0155] According to embodiments of this application, any multiple modules among the data acquisition module 510, map construction module 520, anomaly handling module 530, feature acquisition module 540, and model training module 550 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the data acquisition module 510, map construction module 520, anomaly handling module 530, feature acquisition module 540, and model training module 550 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the data acquisition module 510, the map construction module 520, the anomaly handling module 530, the feature acquisition module 540, and the model training module 550 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0156] Based on the above-mentioned abnormal transaction data identification method, this application also provides an abnormal transaction data identification device. The following will be combined with... Figure 6The device is described in detail.

[0157] Figure 6 A schematic block diagram of an abnormal transaction data identification device according to an embodiment of this application is shown.

[0158] like Figure 6 As shown, the abnormal transaction data identification device 600 of this embodiment includes a model acquisition module 610, a data acquisition module 620, and an anomaly identification module 630.

[0159] The model acquisition module 610 is used to acquire a target anomaly recognition model, which is trained according to the training method for anomaly recognition models. In one embodiment, the model acquisition module 610 can be used to perform the operation S410 described above, which will not be repeated here.

[0160] The data acquisition module 620 is used to acquire multiple real-time transaction data of at least one real-time transaction object. In one embodiment, the data acquisition module 620 can be used to perform the operation S420 described above, which will not be repeated here.

[0161] The anomaly identification module 630 is used to input multiple real-time transaction data into the target anomaly identification model and obtain the abnormal transaction data output by the target anomaly identification model. In one embodiment, the anomaly identification module 630 can be used to perform the operation S430 described above, which will not be repeated here.

[0162] According to embodiments of this application, any plurality of modules among the model acquisition module 610, data acquisition module 620, and anomaly recognition module 630 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the model acquisition module 610, data acquisition module 620, and anomaly recognition module 630 can be at least partially implemented as a hardware circuit, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented by any other reasonable means of integrating or packaging the circuit, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the model acquisition module 610, data acquisition module 620, and anomaly recognition module 630 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0163] Figure 7A block diagram of an electronic device suitable for implementing an anomaly recognition model training method and an anomaly transaction data recognition method according to embodiments of this application is illustrated.

[0164] like Figure 7 As shown, an electronic device 700 according to an embodiment of this application includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage portion 707 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0165] RAM 703 stores various programs and data required for the operation of electronic device 700. Processor 701, ROM 702, and RAM 703 are interconnected via bus 704. Processor 701 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 702 and / or RAM 703. It should be noted that the programs may also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0166] According to embodiments of this application, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to a bus 704. The electronic device 700 may also include one or more of the following components connected to the input / output (I / O) interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the input / output (I / O) interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0167] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the anomaly recognition model training method or the anomaly transaction data recognition method according to the embodiments of this application.

[0168] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 702 and / or RAM 703 and / or one or more memories other than ROM 702 and RAM 703 described above.

[0169] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the anomaly recognition model training method or the anomaly transaction data recognition method provided in the embodiments of this application.

[0170] When the computer program is executed by the processor 701, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0171] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 709, and / or installed from a removable medium 711. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0172] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0173] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0174] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0175] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A method for training an anomaly detection model, characterized in that, The method comprises the following steps: obtaining a plurality of historical transaction data of a plurality of transaction objects; determining corresponding nodes and edges according to the plurality of historical transaction data, and constructing a knowledge graph according to the nodes and the edges, wherein the nodes represent transaction carriers associated with each of the transaction objects, and the edges represent association relationships between different transaction carriers; based on the knowledge graph and the plurality of transaction objects, determining a plurality of abnormal item sets, each of which represents a set of historical abnormal transaction behaviors of a transaction object; based on a preset support threshold, updating the plurality of abnormal item sets, and obtaining rule features of the updated plurality of abnormal item sets; determining structure features and timing features of the knowledge graph according to the rule features; after feature fusion of the rule features, the structure features and the timing features, inputting into a preset abnormality recognition model for training to obtain a trained abnormality recognition model, which is used for abnormality recognition of real-time transaction data of real-time transaction objects.

2. The training method of claim 1, wherein, constructing a knowledge graph according to the nodes and edges, comprising: determining the node type of the node based on the transaction carrier of the plurality of historical transaction data; determining the edge type of the edge based on the association relationship between the transaction carriers, wherein the edge type includes holding relationship, transaction relationship, login relationship and kinship relationship; instantiating the node and the edge according to the node type and the edge type to construct the knowledge graph.

3. The training method of claim 1, wherein, determining a plurality of abnormal item sets based on the knowledge graph and the plurality of transaction objects, comprising: based on the knowledge graph, screening a plurality of historical abnormal transaction data satisfying a preset condition from the plurality of historical transaction data; based on a preset behavior rule, converting the plurality of historical abnormal transaction data into a plurality of historical abnormal transaction behaviors; based on the transaction object corresponding to each of the historical abnormal transaction data, clustering the plurality of historical abnormal transaction behaviors to obtain a plurality of abnormal item sets.

4. The training method of claim 3, wherein, screening a plurality of historical abnormal transaction data satisfying a preset condition from the plurality of historical transaction data, comprising: determining the connection topology structure of the node and the edge based on the knowledge graph; when the connection topology structure corresponding to the node satisfies any preset abnormal structure, the historical transaction data corresponding to the node is taken as the historical abnormal transaction data.

5. The training method of claim 4, wherein, the connection topology structure corresponding to the node satisfies any preset abnormal structure, comprising: for any first node, the number of nodes connected to the first node through the same type of edge is greater than or equal to a preset first threshold, and the connection topology structure corresponding to the first node is taken as a first abnormal structure; for any second node, the second node and the nodes connected through the same type of edge form a closed loop, and the connection topology structure corresponding to the second node is taken as a second abnormal structure; for any third node, determining a first node set connected to the third node through a first type of edge, and determining a second node set connected to the third node through a second type of edge, From the second node set, filter out the nodes connected to at least one node in the first node set by the third type of edge to form an intersection node set; When the number of nodes in the intersection node set is greater than or equal to a preset third threshold, the connection topology corresponding to the third node is taken as a third abnormal structure.

6. The training method of claim 1, wherein, Based on a preset support threshold, updating the plurality of abnormal item sets, comprising: Traverse the plurality of abnormal item sets to determine the frequency of occurrence of each historical abnormal transaction behavior in the plurality of abnormal item sets; For any historical abnormal transaction behavior, when the frequency of occurrence of the historical abnormal transaction behavior is less than the support threshold, remove the historical abnormal transaction behavior; Traverse the plurality of abnormal item sets after removing the historical abnormal transaction behavior until the frequency of occurrence of the historical abnormal transaction behavior in each abnormal item set is greater than or equal to the support threshold, to obtain a plurality of updated abnormal item sets.

7. The training method of claim 1, wherein, Obtain the rule features of the plurality of updated abnormal item sets, comprising: Based on the plurality of updated abnormal item sets, generate a plurality of candidate association rules, the candidate association rules representing the association relationship between each historical abnormal transaction behavior; Obtain the confidence of each candidate association rule, the confidence representing the probability of the occurrence of one historical abnormal transaction behavior and another historical abnormal transaction behavior at the same time; When the confidence is greater than or equal to a preset confidence threshold, the candidate association rule is taken as the rule feature.

8. The training method of claim 1, wherein, Input into a preset abnormal identification model for training to obtain a trained abnormal identification model, comprising: Obtain a plurality of historical abnormal transaction data of the plurality of transaction objects; Based on the abnormal identification model, perform abnormal identification on each historical abnormal transaction data to obtain a first probability of the historical abnormal transaction data; Calculate the error gradient between the first probability and a preset second probability; Based on the error gradient corresponding to each historical abnormal transaction data, train the abnormal identification model to obtain a trained abnormal identification model.

9. An abnormal transaction data identification method characterized by, Comprising: Obtain a target abnormal identification model, the target abnormal identification model being trained according to the training method of the abnormal identification model of any one of claims 1-8; Obtain a plurality of real-time transaction data of at least one real-time transaction object; Input the plurality of real-time transaction data into the target abnormal identification model to obtain abnormal transaction data output by the target abnormal identification model. 10.A device for training an anomaly identification model, comprising: The training device comprises: A data acquisition module for acquiring a plurality of historical transaction data of a plurality of transaction objects; A graph construction module for determining corresponding nodes and edges according to the plurality of historical transaction data, and constructing a knowledge graph according to the nodes and edges, the nodes representing transaction carriers associated with the plurality of transaction objects, and the edges representing the association relationship between different transaction carriers; An exception processing module is configured to determine a plurality of abnormal item sets based on the knowledge graph and the plurality of transaction objects, each of the abnormal item sets representing a set of historical abnormal transaction behaviors of one of the transaction objects; update the plurality of abnormal item sets based on a preset support threshold, and obtain rule features of the updated plurality of abnormal item sets; A feature acquisition module is configured to determine structure features and timing features of the knowledge graph according to the rule features; and A model training module is configured to input the rule features, the structure features, and the timing features into a preset abnormality recognition model after feature fusion, train the abnormality recognition model, and obtain a trained abnormality recognition model, the trained abnormality recognition model being configured to perform abnormality recognition on real-time transaction data of real-time transaction objects.

11. An abnormal transaction data identifying apparatus characterized by comprising: The identification device comprises: A model acquisition module is configured to obtain a target abnormality recognition model, the target abnormality recognition model being obtained by training according to the training method of the abnormality recognition model in any one of claims 1-8; A data acquisition module is configured to obtain a plurality of real-time transaction data of at least one real-time transaction object; and An abnormality recognition module is configured to input the plurality of real-time transaction data into the target abnormality recognition model, and obtain abnormal transaction data output by the target abnormality recognition model.

12. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-9.

13. A computer readable storage medium having stored thereon a computer program or instructions, characterized in that, The computer program or instructions are executed by the processor to implement the steps of the method according to any one of claims 1-9.

14. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instructions are executed by the processor to implement the steps of the method according to any one of claims 1-9. The computer program or instructions are executed by the processor to implement the steps of the method according to any one of claims 1-9.

Images