Abnormal object detection method and device, storage medium and electronic equipment

Abstract

The invention discloses an abnormal object detection method and device, a storage medium and electronic equipment. The method comprises the steps of obtaining object operation data of a target object; performing time domain feature extraction operation and frequency domain feature extraction operation on the object operation data to obtain transaction mode features of the object operation data; obtaining model parameters output by the feature baseline model; executing a first comparison operation on the transaction mode characteristics and the first parameter, determining a numerical value characteristic deviation degree parameter, executing a second comparison operation on the transaction mode characteristics and the second parameter, and determining a time sequence characteristic deviation degree parameter; and determining an object detection result based on the numerical feature deviation parameter and the time sequence feature deviation parameter. The technical problem that the detection accuracy of the abnormal object is low is solved.

Description

Technical Field

[0001] This application relates to the field of computers, and more specifically, to a method and apparatus for detecting abnormal objects, a storage medium, and an electronic device. Background Technology

[0002] Existing technologies generally use multimodal data fusion to collect transaction data, but they lack sufficient mining of the temporal evolution patterns of customer behavior, making it difficult to effectively identify progressive fraud. Furthermore, feature selection and weight allocation are usually preset and lack adaptive adjustment mechanisms. They cannot be dynamically optimized according to the differences in the importance of features among different customer groups and the evolution of fraud methods. They often adopt a single detection strategy, making it difficult to simultaneously achieve both detection speed and accuracy.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This application provides a method and apparatus for detecting abnormal objects, a storage medium, and an electronic device, to at least solve the technical problem of low detection accuracy of abnormal objects.

[0005] According to one aspect of the embodiments of this application, a method for detecting abnormal objects is provided, comprising: acquiring object operation data of a target object, wherein the object operation data originates from multiple data sources; performing time-domain feature extraction and frequency-domain feature extraction operations on the object operation data to obtain transaction pattern features of the object operation data, wherein the transaction pattern features include at least one of intraday transaction pattern features, weekly transaction pattern features, and monthly transaction pattern features; acquiring model parameters output by a feature baseline model, wherein the model parameters include a first parameter and a second parameter, the first parameter indicating the distribution range and form of numerical features corresponding to the target object, and the second parameter indicating the time dependency of time-series features corresponding to the target object; determining a value feature deviation parameter, and performing a second comparison operation on the transaction pattern features and the second parameter to determine the time-series feature deviation parameter; determining an object detection result based on the value feature deviation parameter and the time-series feature deviation parameter, wherein the object detection result is used to indicate whether the target object has abnormal operations.

[0006] According to another aspect of the embodiments of this application, an abnormal object detection device is also provided, comprising: a first acquisition module, configured to acquire object operation data of a target object, wherein the object operation data originates from multiple data sources; a feature extraction module, configured to perform time-domain feature extraction and frequency-domain feature extraction operations on the object operation data to obtain transaction pattern features of the object operation data, wherein the transaction pattern features include at least one of intraday transaction pattern features, weekly transaction pattern features, and monthly transaction pattern features; a second acquisition module, configured to acquire model parameters output by a feature baseline model, wherein the model parameters include a first parameter and a second parameter, the first parameter indicating the distribution range and form of the numerical features corresponding to the target object, and the second parameter indicating the time dependency of the time-series features corresponding to the target object; an execution module, configured to perform a first comparison operation on the transaction pattern features and the first parameter to determine a numerical feature deviation parameter, and perform a second comparison operation on the transaction pattern features and the second parameter to determine a time-series feature deviation parameter; and a determination module, configured to determine an object detection result based on the numerical feature deviation parameter and the time-series feature deviation parameter, wherein the object detection result is used to indicate whether the target object has abnormal operations.

[0007] As an optional embodiment, the device is used to determine the object detection result based on the numerical feature deviation parameter and the temporal feature deviation parameter in the following manner: performing a merging operation on the numerical feature deviation parameter and the temporal feature deviation parameter to obtain a first transaction deviation parameter; performing a comparison operation on the object operation data and preset transaction threshold data to obtain a second transaction deviation parameter; and determining the object detection result of the target object based on the first transaction deviation parameter and the second transaction deviation parameter.

[0008] As an optional embodiment, the apparatus is used to perform a merging operation on the numerical feature deviation parameter and the time series feature deviation parameter to obtain a first transaction deviation parameter by: determining a first weight value of the numerical feature deviation parameter and a second weight value of the time series feature deviation parameter based on historical operation data; and performing a weighted summation operation on the numerical feature deviation parameter and the time series feature deviation parameter using the first weight value and the second weight value to obtain the first transaction deviation parameter.

[0009] As an optional embodiment, the apparatus is used to perform time-domain feature extraction and frequency-domain feature extraction operations on the object operation data to obtain the transaction pattern features of the object operation data in the following manner: performing the time-domain feature extraction operation on the object operation data to obtain first sub-features with multiple time spans; performing feature aggregation operation on the multiple first sub-features to obtain object time-domain features; performing wavelet transform operation on the object operation data to convert the object operation data from the time domain to the frequency domain; performing the frequency-domain feature extraction operation on the object operation data to obtain object frequency-domain features; and determining the transaction pattern features based on the object time-domain features and the object frequency-domain features.

[0010] As an optional embodiment, the device is used to obtain the model parameters output by the feature baseline model in the following manner: inputting the numerical features corresponding to the historical operation data into a decision tree model to obtain first model parameters; inputting the numerical features corresponding to the historical operation data into a neural network self-attention model to obtain second model parameters; and performing a feature fusion operation on the first model parameters and the first model parameters to obtain the model parameters.

[0011] As an optional embodiment, the device is configured to perform a first comparison operation on the trading pattern feature and the first parameter to determine a numerical feature deviation parameter, and perform a second comparison operation on the trading pattern feature and the second parameter to determine a time-series feature deviation parameter: determining a standard deviation parameter of historical daily average trading data based on the first parameter; determining a current trading parameter based on the trading pattern feature; determining the difference between the standard deviation parameter of the historical daily average trading data and the current trading parameter as the numerical feature deviation parameter; determining a trading data prediction parameter based on the second parameter; and determining the time-series feature deviation parameter based on the mean square error of the trading data prediction parameter and the current trading parameter.

[0012] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer program, and the computer program is configured to execute the above-described method for detecting abnormal objects at runtime.

[0013] According to another aspect of the embodiments of this application, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the abnormal object detection method described above.

[0014] According to another aspect of the embodiments of this application, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-described method for detecting abnormal objects through the computer program.

[0015] In this embodiment, object operation data of the target object is obtained, wherein the object operation data originates from multiple data sources; time-domain feature extraction and frequency-domain feature extraction operations are performed on the object operation data to obtain transaction pattern features of the object operation data, wherein the transaction pattern features include at least one of intraday transaction pattern features, weekly transaction pattern features, and monthly transaction pattern features; model parameters output by the feature baseline model are obtained, wherein the model parameters include a first parameter and a second parameter, the first parameter indicating the distribution range and form of the numerical features corresponding to the target object, and the second parameter indicating the time dependency of the time series features corresponding to the target object; a first... The comparison operation determines the numerical feature deviation parameter, and a second comparison operation is performed on the transaction pattern feature and the second parameter to determine the time-series feature deviation parameter. Based on the numerical and time-series feature deviation parameters, the object detection result is determined. This result indicates whether the target object has abnormal operations. Through comprehensive feature extraction in both the time and frequency domains, combined with comparative analysis of real-time transaction data and a feature baseline model, the transaction patterns of the target object are comprehensively detected. The Z-Score method is used to evaluate the numerical feature deviation, and the MSE of the actual and predicted sequences is calculated to quantify the time-series feature deviation, enabling accurate capture of abnormal fluctuations in transaction amounts and abnormal patterns in the time series. Threshold comparison by the rule engine further enhances the rapid response to significant anomalies. Finally, by weighted fusion of numerical and time deviations, the probability of abnormal operations of the target object is comprehensively judged, improving the accuracy and real-time performance of abnormal object detection. This solves the technical problem of low accuracy in abnormal object detection. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 This is a schematic diagram of an application environment for an optional method for detecting abnormal objects according to an embodiment of this application;

[0018] Figure 2 This is a flowchart illustrating an optional method for detecting abnormal objects according to an embodiment of this application;

[0019] Figure 3This is a schematic diagram of an optional method for detecting abnormal objects according to an embodiment of this application;

[0020] Figure 4 This is a schematic diagram of another optional method for detecting abnormal objects according to an embodiment of this application;

[0021] Figure 5 This is a schematic diagram of another optional method for detecting abnormal objects according to an embodiment of this application;

[0022] Figure 6 This is a schematic diagram of another optional method for detecting abnormal objects according to an embodiment of this application;

[0023] Figure 7 This is a schematic diagram of another optional method for detecting abnormal objects according to an embodiment of this application;

[0024] Figure 8 This is a schematic diagram of the structure of an optional abnormal object detection device according to an embodiment of this application;

[0025] Figure 9 This is a schematic diagram of the structure of an optional electronic device according to an embodiment of this application. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] It should be noted that all data used in this application is data authorized for use by the user.

[0029] The present application will be described below with reference to embodiments:

[0030] According to one aspect of the embodiments of this application, a method for detecting abnormal objects is provided.

[0031] Optionally, in this embodiment, the above-mentioned method for detecting abnormal objects can be implemented as follows: Figure 1 The above-described method for detecting abnormal objects is applied in the hardware environment consisting of server 101 and terminal device 103.

[0032] It should be noted that the aforementioned server 101 is connected to the terminal device 103 via a network and can be used to provide services to the terminal device or the application 107 installed on the terminal device to implement the aforementioned abnormal object detection method. A database 105 can also be set up on or independently of the server 101 to provide data storage services for implementing the aforementioned abnormal object detection method. Specifically:

[0033] The aforementioned server 101 and terminal device 103 can be any node in a distributed system, such as a blockchain system. This blockchain system can be formed by connecting multiple nodes through network communication. The nodes can form any type of network, and any type of computing device, such as any electronic device, can become a node in this distributed system by joining the network formed between the nodes.

[0034] The aforementioned server 101 can be a single server, a server cluster consisting of multiple servers, or a cloud server.

[0035] The aforementioned networks may include, but are not limited to, wired networks and wireless networks. The wired networks include local area networks (LANs), metropolitan area networks (MANs), and wide area networks (WANs). The wireless networks include Bluetooth, Wi-Fi, and other networks that enable wireless communication.

[0036] The aforementioned terminal device 103 may be a terminal configured with an application, and may include, but is not limited to, at least one of the following: mobile phones (such as Android phones, iOS phones, etc.), laptops, tablets, handheld computers, MID (Mobile Internet Devices), PADs, desktop computers, smart TVs, smart voice interaction devices, smart home appliances, vehicle terminals, aircraft, virtual reality (VR) terminals, augmented reality (AR) terminals, mixed reality (MR) terminals, and other computer devices.

[0037] Alternatively, as an alternative implementation method, such as Figure 2 As shown, the above-mentioned abnormal object detection method can realize a bank customer abnormal transaction identification system based on behavior patterns, including a multi-dimensional customer behavior profile construction module, a behavior pattern baseline establishment module, a multi-level anomaly monitoring module, and an adaptive feature selection optimization module.

[0038] The aforementioned multi-dimensional customer behavior profile building module is used to collect, process, and analyze multi-dimensional customer behavior data, i.e., the aforementioned object operation data, to build customer behavior profiles. This module includes a data acquisition submodule and a feature extraction submodule. The aforementioned behavior pattern baseline establishment module is used to establish a unique behavior pattern baseline for each object, serving as a personalized reference standard for abnormal transaction detection. This module includes a baseline model construction submodule and a baseline parameter adaptive adjustment submodule. The aforementioned multi-level anomaly monitoring module is used to monitor transaction behavior in real time and identify potential abnormal patterns and fraud risks. This module includes a rule engine monitoring submodule, a baseline deviation detection submodule, and a result fusion submodule. The aforementioned adaptive feature selection optimization module is used to dynamically adjust the feature importance weights to improve recognition accuracy. This module includes a feature importance evaluation unit and a feature weight adjustment unit.

[0039] Furthermore, the methods for detecting the aforementioned abnormal objects include, but are not limited to:

[0040] S202, Obtain object operation data of the target object, wherein the object operation data comes from multiple data sources;

[0041] Optionally, in this embodiment, the object operation data includes, but is not limited to: transaction data (transaction amount, transaction type, transaction channel, transaction object, transaction time, transaction relationship network, etc.); account operation logs (login time, operation sequence, operation dwell time, etc.); device and network information (device type, device unique identifier, IP address, sensor data, geographical location, etc.); basic object information (age, education level, occupational background, customer value level, risk preference, etc.); and object management compliance information (blacklist of known fraudulent accounts, blacklist of high-risk merchants, blacklist of suspicious IPs / devices, risk warning information, etc.).

[0042] The data acquisition submodule of the aforementioned multi-dimensional customer behavior profiling module obtains object operation data from multiple data sources. Specifically, it uses the distributed log collection framework Flume to collect structured and semi-structured logs generated by the transaction system, uses the JavaScript SDK to collect user operation behavior data from mobile and web terminals, uses the ETL tool Kettle for data cleaning and preprocessing, and employs the Kafka message queue to achieve real-time transmission of the data stream.

[0043] To ensure the security and compliance of data collection, this invention employs data de-identification processing, de-identifying sensitive personal information to ensure that data use complies with privacy protection requirements.

[0044] S204, Perform time-domain feature extraction and frequency-domain feature extraction operations on the object operation data to obtain the transaction pattern features of the object operation data, wherein the transaction pattern features include at least one of intraday transaction pattern features, weekly transaction pattern features and monthly transaction pattern features;

[0045] The aforementioned feature extraction submodule includes a time-domain feature extraction unit and a frequency-domain feature extraction unit, and uses principal component analysis (PCA) to perform feature dimensionality reduction on the feature set containing both time and frequency domain features.

[0046] The temporal feature extraction unit employs a multi-scale sliding window technique to perform aggregate analysis on the original data across different time spans. Window sizes are set to 1 hour, 1 day, 30 days, and 90 days to capture short-term, medium-term, and long-term behavioral characteristic changes. The features extracted by the temporal feature extraction unit include transaction amount distribution characteristics, transaction type preference characteristics, payment and receipt relationship network characteristics, and transaction channel characteristics.

[0047] The frequency domain feature extraction unit employs wavelet transform technology to convert time-series data into the frequency domain for analysis, effectively capturing periodic patterns in the data. This application's embodiments design targeted sampling frequencies for different feature types, extracting features including intraday trading pattern features, weekly trading pattern features, and monthly trading pattern features.

[0048] It should be noted that time-domain feature extraction covers multi-scale transaction amount distribution, transaction type preference, transaction object relationship network, and transaction channel characteristics, while frequency-domain feature extraction focuses on the periodic patterns of transaction behavior, aiming to capture regular changes in customer transaction patterns, such as the frequency and intensity of transactions within a day, week, and month. This application does not limit the specific steps and methods of feature extraction.

[0049] For example, in this embodiment of the application, a comprehensive customer behavior profile is formed by combining feature extraction in the time domain and frequency domain, including fluctuations in the transaction amount, preference trends in transaction types, network relationships of transaction objects, and usage habits of transaction channels.

[0050] S206, Obtain the model parameters output by the feature baseline model, wherein the model parameters include a first parameter and a second parameter. The first parameter is used to indicate the distribution range and shape of the numerical features corresponding to the target object, and the second parameter is used to indicate the time dependency of the time series features corresponding to the target object.

[0051] Optionally, in the embodiments of this application, the feature baseline model refers to a personalized behavior model established for each target object, used to quantify the baseline of its normal trading activities, including but not limited to the distribution range and form of numerical features and the time dependence of time series features.

[0052] Optionally, in the embodiments of this application, the first parameter is used to indicate the distribution range and shape of the numerical features corresponding to the target object. Specifically, it may be historical statistical data of numerical features such as transaction amount and transaction frequency, such as average, standard deviation, median or skewness. These parameters together depict the typical distribution of the numerical features of the target object's transaction activities.

[0053] Optionally, in this embodiment, the second parameter is used to indicate the time dependency of the time series characteristics corresponding to the target object, mainly involving the characteristics of the transaction time series, such as the time interval of the transaction, the trend of frequency change, or the transaction preference in a specific time period. The second parameter quantifies the dynamic characteristics of its time series behavior by analyzing the regularity of the transaction pattern of the target object in time.

[0054] It should be noted that the specific calculation methods for the first and second parameters may vary depending on the model type and customer needs. For example, the first parameter can be obtained through statistical analysis of historical data, while the second parameter may be obtained based on the training results of time series models such as LSTM or Transformer. This application does not limit this.

[0055] The baseline model construction submodule of the aforementioned behavior pattern baseline establishment module is responsible for building a multi-dimensional behavior baseline model (i.e., the aforementioned feature baseline model) for each customer, serving as a reference standard for judging whether their behavior is abnormal. Appropriate modeling techniques are selected based on feature type: LightGBM is used for numerical features, and Transformer self-attention model is used for time-series features. Through a multi-model fusion mechanism, the model results from different feature dimensions are weighted and fused to form a unified customer behavior baseline representation (the aforementioned model parameters).

[0056] The aforementioned baseline parameter adaptive adjustment submodule calculates the time decay weights for behavioral data, ensuring that recent behavioral data receives a higher weight in the model. The calculation formula is: W(t) = e^(-λ) t), where t represents the time interval (in days) since the data was last recorded, and λ is the decay factor.

[0057] This submodule adaptively adjusts the attenuation factor λ based on the rate of change in customer behavior. The adjustment formula is: λ_adjusted = λ_base + α (DKL - DKL_threshold), where λ_base is the base decay factor, α is the adjustment coefficient, DKL is the relative entropy, and DKL_threshold is the relative entropy threshold. When a drastic change in customer behavior is detected, the value of λ is increased; when the change in customer behavior is gradual, the value of λ is decreased.

[0058] S208, Perform a first comparison operation on the transaction pattern features and the first parameter to determine the numerical feature deviation parameter, and perform a second comparison operation on the transaction pattern features and the second parameter to determine the time series feature deviation parameter;

[0059] Optionally, in this embodiment, the first comparison operation refers to comparing the pattern characteristics of real-time transactions with a first parameter of the target object's historical behavior to assess the degree to which the numerical characteristics deviate from their normal range. This includes calculating the difference between numerical characteristics such as transaction amount and type distribution and the first parameter output in the baseline model, and determining the numerical characteristic deviation parameter using statistical methods such as Z-Score and mean squared error.

[0060] Optionally, in this embodiment, the second comparison operation compares the pattern characteristics of real-time transactions with a second parameter of the target object's historical behavior to assess the degree to which the time series characteristics deviate from their normal time dependencies. This includes calculating the difference between the characteristics of the transaction time series and the second parameter output by the baseline model, for example, by determining the time series characteristic deviation parameter through autocorrelation function or prediction error.

[0061] It should be noted that the specific methods for the first and second comparison operations can vary depending on the business scenario, data type, or model selection. For example, for numerical feature deviation parameters, Z-Score, root mean square error (RMSE), or other statistical difference measures can be used; for time series feature deviation parameters, prediction error, significance tests of autocorrelation functions, or other time series analysis techniques can be used.

[0062] Furthermore, the execution order of the first and second comparison operations can be flexibly adjusted and does not necessarily need to be performed simultaneously; this application does not impose any restrictions on this.

[0063] The rule engine monitoring submodule of the aforementioned multi-level anomaly monitoring module serves as the first-level detection, used to quickly identify obvious abnormal transactions, including a blacklist matching unit, a threshold rule unit, and a rule combination unit.

[0064] The baseline deviation detection submodule of the aforementioned multi-level anomaly monitoring module serves as the second-level detection. It compares the current transaction characteristics with the personalized baseline established by the behavior pattern baseline establishment module to assess the degree of deviation. This submodule calculates numerical feature deviation parameters and time-series feature deviation parameters, and then integrates them into a comprehensive deviation score through adaptive weighting.

[0065] S210, determine the object detection result based on the numerical feature deviation parameter and the temporal feature deviation parameter, wherein the object detection result is used to indicate whether there is abnormal operation in the target object.

[0066] Optionally, in this embodiment, the object detection result refers to the assessment result of the abnormality of the target object's operational behavior after the system comprehensively judges the deviation parameters of numerical features and temporal features. This includes, but is not limited to, determining whether the transaction deviates from the customer's historical behavior pattern or whether it is an illegal or non-compliant behavior.

[0067] It should be noted that the fusion method of numerical feature deviation parameters and temporal feature deviation parameters can vary depending on the specific application scenario. For example, weighted average, logical combination, or other forms of data fusion can be used to generate a final decision score, and the detection result of the object is determined based on the comparison of this score with a preset threshold. This application does not limit this.

[0068] The above results are integrated by the rule engine and baseline deviation detection results from the fusion submodule, and the object detection result is generated through a weighted fusion method. The calculation formula is: Object Detection Result Final_Score = ×Rule_Score+ ×Deviation_Score; When the Final_Score exceeds the threshold, it is determined to be an abnormal transaction.

[0069] The feature importance evaluation unit of the aforementioned adaptive feature selection optimization module evaluates the contribution and timeliness of each feature to abnormal transaction identification based on multi-source feedback data (i.e., the aforementioned object operation data). This application embodiment employs three complementary calculation methods: feature evaluation based on information gain, feature importance evaluation based on the model, and feature evaluation based on the model's recognition accuracy. The object detection results are calculated using a weighted fusion method.

[0070] The aforementioned feature weight adjustment unit automatically adjusts the feature weights based on the feature importance evaluation results, thereby achieving continuous model optimization. The adjustment formula is: Wi_i_new = Wi_i_old (1 + α ΔI_i), where W_i_old is the current weight of feature i, W_i_new is the adjusted weight of feature i, α is the learning rate, and ΔI_i is the change in importance of feature i.

[0071] In an exemplary embodiment, based on the above-described method for detecting abnormal objects, a system for identifying abnormal bank customer transactions based on behavioral patterns can be implemented. The system block diagram is shown below. Figure 3As shown, this provides a method for constructing multi-dimensional customer behavior profiles that can accurately depict the differences in behavioral characteristics of different customer groups, thereby enabling personalized identification of abnormal transactions.

[0072] Furthermore, personalized customer behavior pattern baselines can be established based on feature baseline models. By capturing the temporal evolution of customer transaction behavior, the ability to identify progressive fraudulent behavior can be improved. Additionally, an adaptive adjustment mechanism for baseline parameters is designed to enable the model to dynamically update according to the natural evolution of customer behavior, maintaining the model's long-term effectiveness.

[0073] Furthermore, an adaptive feature selection optimization module is constructed to automatically adjust feature importance based on the evolution of different customer groups and abnormal operation methods, thereby optimizing model performance. A multi-level anomaly detection strategy is implemented, which, combined with the rapid response of the rule engine and the accurate detection of behavioral baseline deviation, constructs a multi-layered protection system to comprehensively improve the accuracy and real-time performance of abnormal transaction identification.

[0074] Specifically, the bank customer abnormal transaction identification system based on behavior patterns includes four key modules: multi-dimensional customer behavior profile construction, behavior pattern baseline establishment, multi-level anomaly monitoring, and adaptive feature selection optimization.

[0075] like Figure 4 As shown, the multi-dimensional customer behavior profile building module consists of a data acquisition submodule and a feature extraction submodule. This module is responsible for collecting, processing, and analyzing multi-dimensional customer behavior data to build a comprehensive customer behavior profile. The data acquisition submodule uses tools such as Flume, JavaScript SDK, Kettle, and Kafka to collect and transmit multi-source data in real time, while the feature extraction submodule extracts features through time-domain and frequency-domain feature extraction units, and performs feature dimensionality reduction using PCA.

[0076] In this embodiment, the data acquisition submodule adopts a multi-source heterogeneous data acquisition architecture, and its specific implementation is as follows: This embodiment uses Flume to build a distributed log acquisition system, configures the Source component to listen to transaction log files, the Channel component uses a composite structure of memory buffer and file channel to ensure data reliability, and the Sink component transmits data to the Kafka cluster.

[0077] In this embodiment, a lightweight JavaScript SDK is developed to collect user interaction data from mobile and web devices. This SDK captures the following interaction data through event listeners: touchscreen operation coordinate sequences, page dwell time, operation behavior sequences, and device sensor data (accelerometer and gyroscope data).

[0078] In this embodiment, the Kettle data integration platform is used to perform data cleaning and preprocessing. The main processing steps include:

[0079] 1. Unified data format conversion: Design a conversion process for data from different sources to convert the data into JSON format.

[0080] 2. Design specific null value filling strategies based on the business meaning of different fields: Numeric fields: fill with median or mean; Categorical fields: fill with mode.

[0081] 3. Sensitive customer information is anonymized using data masking techniques. For example, for ID card numbers: retain the first 6 digits and the last 4 digits, and use quotation marks ("" in the middle"). "Alternative; Mobile number: Keep the first 3 and last 4 digits, use the middle part" "Alternative; Bank card number: Keep the first 6 digits and the last 4 digits, use the middle digits" "Replacement".

[0082] These preprocessing steps ensure data quality and privacy, laying the foundation for subsequent feature extraction.

[0083] In this embodiment, the feature extraction submodule extracts valuable behavioral features from the raw data, providing a data foundation for the subsequent behavioral pattern baseline establishment module. The feature extraction submodule of this invention includes a time-domain feature extraction unit and a frequency-domain feature extraction unit, and employs principal component analysis (PCA) to perform feature dimensionality reduction on the feature set containing both time and frequency domain features.

[0084] In this embodiment, the time-domain feature extraction unit employs a multi-scale sliding window technique to perform aggregated analysis of the raw data across different time spans. Specifically, the multi-scale sliding window sets four time scales: short-term window (1 hour, sliding step 10 minutes); intraday window (1 day, sliding step 1 hour); medium-term window (30 days, sliding step 1 day); and long-term window (90 days, sliding step 7 days). This multi-scale design can simultaneously capture both short-term fluctuations and long-term trends in customer behavior, providing a more comprehensive view of behavioral characteristics.

[0085] Within each time window, extract the distribution characteristics of transaction amounts and calculate the following statistical indicators: Mean (μ): the arithmetic mean of transaction amounts within the window; Median (Med): the median value after sorting by amount; Weighted Moving Average (WMA): calculated according to the formula WMA = ( w_i × x_i) / ( The value of transaction x_i is calculated using the time weighting formula (w_i), where x_i is the amount of the i-th transaction, and w_i is the time weight, with more recent transactions receiving higher weights. Variance (σ²) and standard deviation (σ) reflect the dispersion of transaction amounts. Interquartile range (IQR) is also calculated. - This reflects the concentration of the distribution; the 25th percentile ( ) and 75th percentile ( Skewness: reflects the shape of the distribution; symmetry: reflects the symmetry of the distribution; kurtosis: reflects the sharpness of the distribution.

[0086] Within each time window, extract transaction type preference features and calculate the following vector features: Transaction type frequency vector T_freq: the number of times each type of transaction occurs within the window period; Transaction type amount vector T_amount: the total amount of each type of transaction within the window period; Transaction type proportion vector T_ratio: the proportion of each type of transaction to the total number of transactions.

[0087] Within each time window, extract the relationship network features of payment and receipt objects and calculate the following vector features: Transaction object frequency matrix C_freq: the number of transactions of each type with each transaction object; Transaction object amount matrix C_amount: the total amount of transactions of each type with each transaction object; New transaction object rate C_new_rate: the ratio of the number of new transaction objects to the total number of transaction objects within the window period.

[0088] Within each time window, extract transaction channel features and calculate the following vector features: Channel usage frequency vector Ch_freq: the number of times each channel is used within the window period; Channel transaction amount vector Ch_amount: the total amount of transactions through each channel; Online-offline transaction ratio Ch_online_ratio: online transaction volume divided by total transaction volume; Channel switching frequency Ch_switch: the ratio of the number of consecutive transactions using different channels to the total number of transactions.

[0089] In this embodiment, the frequency domain feature extraction unit employs wavelet transform technology to convert time-series data into the frequency domain for analysis, effectively capturing periodic patterns in the data. The specific implementation is as follows:

[0090] The Daubechies wavelet (db4) is used to perform a 5-level decomposition of time-series data, extracting features from different frequency components. This effectively identifies periodic patterns and abnormal fluctuations in trading behavior. Different feature extraction strategies are employed for different time scales.

[0091] 1. Intraday trading mode (sampling frequency: once per hour, 24 times per day):

[0092] Intraday trading time distribution vector TD_day

[24] : records the trading frequency of each time period within 24 hours; High-frequency trading time period set TD_peak_hours: identifies time periods with a trading frequency higher than twice the average; Intraday trading time entropy TD_day_entropy: according to the formula TD_day_entropy = - (p(i)×lo The calculation is performed using p(i), where p(i) represents the proportion of trading frequency in the i-th hour, quantifying the uniformity of intraday trading time distribution.

[0093] 2. Weekly trading pattern (sampling frequency: once per hour, 168 times per week):

[0094] Weekly transaction distribution matrix TD_week[7]

[24] : records the transaction frequency of 7 days a week and 24 hours a day; weekday / weekend transaction ratio TD_workday_ratio: weekday transaction volume divided by total transaction volume; intraday volatility index TD_day_var: standard deviation of transaction volume for each day divided by the mean, reflecting the stability of transactions within a week.

[0095] 3. Monthly transaction pattern (sampling frequency: once a day, 30 times / month):

[0096] Monthly trading day distribution vector TD_month

[30] : records the trading frequency of each day within a month; Beginning-of-month / Mid-month / End-of-month trading ratio TD_month_stage[3]: calculates the trading percentage of the beginning of the month (1-10 days), the middle of the month (11-20 days), and the end of the month (21-30 / 31 days); Monthly periodicity intensity TD_month_period: quantifies the periodicity intensity of monthly trading through the autocorrelation function (ACF), and the calculation formula is ACF(k) = (x_t - μ)(x_{t+k} - μ) / (x_t - μ)², where x_t represents the value of the time series at time t, μ represents the mean of the time series, T represents the total length of the time series, and k represents the lag of k time units.

[0097] Through the above-mentioned time-domain and frequency-domain feature extraction, a comprehensive customer behavior feature system was constructed. These features can effectively characterize customer transaction behavior patterns, including key dimensions such as amount distribution characteristics, type preferences, relationship networks, channel selection, and time patterns.

[0098] The task of the behavior pattern baseline establishment module is to establish a behavior pattern baseline (the model parameters mentioned above) for each customer as a personalized reference for abnormal transaction detection. It includes a baseline model construction submodule and a baseline parameter adaptive adjustment submodule. The former uses LightGBM and Transformer self-attention models to construct numerical and time-series behavior baseline models respectively, while the latter optimizes the model's response to recent behavior data by calculating time decay weights and adaptively adjusting the decay factor through relative entropy.

[0099] like Figure 5 As shown, the behavior pattern baseline establishment module includes a baseline model construction submodule and a baseline parameter adaptive adjustment submodule.

[0100] In this embodiment, the behavior pattern baseline establishment module aims to establish a unique behavior pattern baseline for each customer, serving as a personalized reference standard for abnormal transaction detection.

[0101] For numerical features (such as transaction amount distribution, transaction type ratio, etc.), this embodiment uses LightGBM to build a baseline model. The initial core parameters of the model are: num_leaves=31: control the complexity of each tree; learning_rate=0.05: ensure model convergence and generalization ability; feature_fraction=0.8: reduce overfitting through feature subsampling; bagging_fraction=0.8 and bagging_freq=5: improve model robustness through data subsampling; lambda_l1=0.1 and lambda_l2=0.2: regularization parameters to prevent model overfitting. Bayesian optimization is employed for parameter tuning to maximize the cross-validation F1 score. The optimal parameter combination is efficiently searched within the parameter space, defined as: num_leaves [15, 127], learning_rate [0.01, 0.2], feature_fraction [0.5, 1.0], lambda_l1 [0, 1.0], and lambda_l2 [0, 1.0]. Initial points are randomly sampled from the parameter space to construct a Gaussian process regression model. The parameters are iteratively optimized, and the next set of parameters is selected for evaluation using a sampling function.

[0102] For time-series features (such as transaction time series, operational behavior sequences, etc.), this embodiment uses the Transformer self-attention model to effectively capture the long-term temporal dependencies of customer transaction behavior. The key configurations of the Transformer model are as follows: number of encoder layers: 4; hidden layer dimension: 256; number of attention heads: 8; activation function: GELU; positional encoding: sinusoidal positional encoding. The Transformer model uses a self-attention mechanism to calculate the correlation strength at different time points in the time series, thereby identifying key temporal patterns. The calculation formula is: Attention(Q, K, V) = softmax(QK^T / √d_k)V, where Q, K, and V are the query matrix, key matrix, and value matrix, respectively, and d_k is the dimension of the key vector. This mechanism can adaptively learn long-distance dependencies in time-series data, capture complex temporal patterns, and is suitable for processing temporal features in transaction behavior.

[0103] To fully leverage the strengths of different models, this embodiment employs a multi-model fusion mechanism, weighting and fusing the results from models with different feature dimensions to form a unified baseline representation of customer behavior. The fusion method uses a confidence-based weighted average, calculated as follows: F = ∑(w_i × f_i), where f_i is the output of the i-th sub-model, and w_i is the corresponding weight, satisfying ∑w_i = 1. The weight w_i is adaptively determined based on the performance of each sub-model on the validation set: w_i = performance_i / ∑performance_j, where performance_i is the F1 score of model i on the validation set. This fusion mechanism dynamically adjusts the contributions of different models, making the final behavioral baseline more accurate and reliable.

[0104] In this embodiment, the baseline parameter adaptive adjustment submodule adjusts the baseline model parameters in real time according to the dynamic changes in customer behavior patterns, ensuring that the baseline continuously matches the actual customer behavior patterns. It implements time decay weight calculation for behavioral data, giving recent behavioral data a higher weight in the model. The calculation formula is as follows: W(t) = e^(-λ) λ), where t represents the time interval (in days) since the data was first collected, and λ is the decay factor. The decay factor λ controls the rate at which the weights decay over time. The larger the value of λ, the higher the weight of recent data relative to historical data, and the more sensitive the model is to changes in behavior.

[0105] The attenuation factor λ is adaptively adjusted based on the rate of change in customer behavior. The adjustment formula is: λ_adjusted = λ_base + α (DKL - DKL_threshold). Where λ_base is the base decay factor, α is the adjustment coefficient, DKL is the relative entropy, and DKL_threshold is the relative entropy threshold. When drastic changes in customer behavior are detected (i.e., the relative entropy of behavioral features DKL > 0.5 in the past 30 days), the value of λ is increased to improve sensitivity to recent data; when changes in customer behavior are gradual (i.e., the relative entropy of behavioral features DKL < 0.2 in the past 30 days), the value of λ is decreased to maintain model stability. The formula for calculating the relative entropy DKL(P||Q) is: DKL(P||Q) = ∑P(i) log(P(i) / Q(i)), where P represents the feature distribution of the current time window and Q represents the feature distribution of the historical baseline.

[0106] The calculated time decay weight W(t_i) is applied to the loss value of each sample to calculate the weighted loss for each sample: L_weighted(y_i, _i) = W(t_i) L(y_i, _i), where L(y_i, _i) is the original loss value for the i-th sample, which depends on the model type: for binary classification problems (such as anomaly detection): L(y_i, _i) = -[y_i log( _i) + (1-y_i) log(1- For regression problems (such as monetary prediction): L(y_i, _i)]; For regression problems (such as monetary prediction): L(y_i, _i)]; _i) = (y_i- The total weighted loss is the normalized sum of the weighted losses of each sample: L_total = ∑L_weighted(y_i, _i)²; The normalization process, denoted as θ_i) / ∑W(t_i), ensures the comparability of loss values ​​across different batches. Finally, the gradient is calculated based on the weighted loss function, and the model parameters are updated: θ_new = θ_old - η L_weighted, where θ represents the model parameters and η represents the learning rate. L_weighted is the gradient of the weighted loss function.

[0107] The multi-level anomaly monitoring module is responsible for real-time monitoring of transaction behavior, identifying abnormal patterns and fraud risks. It consists of a rule engine monitoring submodule, a baseline deviation detection submodule, and a result fusion submodule. The rule engine monitoring submodule performs first-level rapid anomaly identification through blacklist matching and threshold rules. The baseline deviation detection submodule calculates the second-level feature deviation. The result fusion submodule integrates the detection results from both to generate the final decision.

[0108] like Figure 6 As shown, the multi-level anomaly monitoring module includes a rule engine monitoring submodule, a baseline deviation detection submodule, and a result fusion submodule. This module is responsible for real-time monitoring of transaction behavior and identifying potential anomaly patterns and fraud risks.

[0109] In this embodiment, the rule engine monitoring submodule serves as the first-level detection, used to quickly identify obvious abnormal transactions, including a blacklist matching unit, a threshold rule unit, and a rule combination unit.

[0110] The blacklist matching unit uses distributed caching technology (Redis) to store and update blacklist data, achieving efficient real-time matching. The blacklist includes, but is not limited to: a known fraudulent account blacklist: account information extracted from historical fraud cases; a high-risk merchant blacklist: a list of merchants marked with risk assessments; and a suspicious IP / device blacklist: network and device identifiers associated with fraudulent activities.

[0111] The threshold rule unit sets personalized threshold rules based on customers' historical behavioral characteristics, including but not limited to: transaction amount threshold rule: the amount of a single transaction exceeds 5 times the customer's historical maximum transaction amount; transaction frequency threshold rule: the number of transactions in 1 hour exceeds 5 times the customer's average daily transaction number; cumulative amount threshold rule: the total transaction amount in 24 hours exceeds 50% of the customer's average annual transaction amount.

[0112] The rule combination unit integrates the detection results of blacklist matching and threshold rules through logical combination and weighted scoring to calculate the risk score, as shown in the following formula: Rule_Score = min(1, Rule_Count) The rule engine uses a linear combination method, where Rule_Count is the sum of the number of blacklist matching rules triggered and the number of threshold rules triggered, and Base_Score is the base score for each rule trigger, set to 0.25 to ensure that the maximum value of Rule_Score is 1. This ensures the interpretability of the rule engine, while upper limit control prevents overestimation of risk due to multiple triggers in a single dimension.

[0113] In this embodiment, the baseline deviation detection submodule serves as the second-level detection, comparing the current transaction characteristics with the personalized baseline established by the behavior pattern baseline establishment module to assess the degree of deviation.

[0114] For numerical features, this embodiment uses the Z-score method to calculate the deviation of the numerical feature: Z_i = |(x_i - μ_i)| / σ_i, where x_i is the current observation, and μ_i and σ_i are the historical mean and standard deviation of the feature. Z_i represents the standard deviation multiple by which the current observation deviates from the historical mean. Normalizing Z_i yields the deviation score of the numerical feature: Numerical_Score_i = 1 - 1 / (1 + Z_i²).

[0115] For time-series features, this embodiment calculates the mean squared error (MSE) between the current time-series feature and the prediction result of the Transformer model: MSE_i = ∑(actual_i - predicted_i)² / n, where actual_i is the actual observed value, predicted_i is the model predicted value, and n is the feature dimension. Normalizing the MSE yields the deviation score of the time-series feature: Temporal_Score_j = 1 - e^(-MSE_i / μ_MSE), where μ_MSE is the average of historical MSE values.

[0116] The deviation scores of features from various dimensions are combined using adaptive weighting to obtain a comprehensive deviation score: Deviation_Score = w_num AVG(Numeric_Score_i) + w_temp AVG(Temporal_Score_j), where w_num and w_temp are the weights of numerical features and temporal features, which are dynamically adjusted based on historical detection results, with initial values ​​set to 0.7 and 0.3 respectively.

[0117] In this embodiment, the result fusion submodule integrates the detection results from the rule engine and baseline deviation, and generates the final decision through a weighted fusion method. The calculation formula is as follows: Final_Score = ×Rule_Score+ ×Deviation_Score; weight parameter and The selection of parameters is based on experimental analysis of real transaction data samples, and the optimal parameter range is determined through cross-validation analysis. When the Final_Score exceeds the threshold, it is judged as an abnormal transaction.

[0118] The adaptive feature selection optimization module ensures continuous model optimization by dynamically adjusting feature weights through a feature importance evaluation unit and a feature weight adjustment unit. The feature importance evaluation unit calculates the comprehensive importance of features based on three methods: information gain, model feature importance, and recognition accuracy, while the feature weight adjustment unit adjusts the weights based on changes in feature importance.

[0119] like Figure 7 As shown, the adaptive feature selection optimization module consists of two core sub-units: a feature importance evaluation unit and a feature weight adjustment unit.

[0120] The feature importance assessment unit comprehensively evaluates the feature contribution. This embodiment employs three complementary calculation methods:

[0121] 1. Based on information gain feature evaluation, calculate the information gain of each feature Fi to quantify the contribution of the feature to reducing the uncertainty of the target variable: IG(Y, Fi) = H(Y) - H(Y|Fi), where Y is the transaction label (normal / abnormal), H(Y) is the entropy of Y, H(Y) = -∑p(y)lo p(y), H(Y|Fi) = -∑p(fi)∑p(y|fi)lo p(y|fi) is the conditional entropy of Y given feature Fi. Information gain reflects the contribution of feature Fi to reducing the uncertainty of label Y; a higher value indicates that the feature is more important. To achieve fair comparison among features, this embodiment normalizes the calculated information gain: IG_Score_i = IG(Y, Fi) / max(IG(Y, F_all)).

[0122] 2. Based on model-based feature importance evaluation, feature importance is extracted from the LightGBM model, calculated using the following formula: Model_Importance_i = Split_Count_i / Total_Splits, where Split_Count_i is the number of times feature i is selected as a splitting feature across all trees, and Total_Splits is the total number of splits. For temporal features, attention weights are extracted from the Transformer model, and the importance distribution of features at different time points is analyzed, calculated using the following formula: Attention_Importance_i = ∑(Attention_Weight_i) / ∑(All_Attention_Weights).

[0123] 3. Based on feature evaluation of misjudged samples, the feature contribution of misjudged samples (false positives and false negatives) is analyzed to identify key features leading to misjudgments: Error_Contribution_i = ∑(|x_i - μ_i| / σ_i) / n_error, where x_i is the value of the misjudged sample on feature i, μ_i and σ_i are the historical mean and standard deviation of the feature, respectively, and n_error is the number of misjudged samples. By analyzing misjudged samples, it is possible to identify which features play a major role in incorrect judgments, providing a targeted basis for feature adjustment. Finally, this embodiment calculates the comprehensive importance score of features using a weighted fusion method: Final_Importance_i = α×IG_Score_i + β×Model_Score_i + γ×Error_Score_i, where α, β, and γ are weight parameters, satisfying α + β + γ = 1, with initial values ​​set to 0.2, 0.2, and 0.6, respectively.

[0124] The feature weight adjustment unit automatically adjusts the feature weights based on the feature importance assessment results, thereby achieving continuous model optimization. This embodiment employs a weight adjustment method based on importance changes. The adjustment formula is: W_i_new = W_i_old × (1 + α × ΔI_i), where: W_i_old is the current weight of feature i, W_i_new is the adjusted weight of feature i, α is the learning rate controlling the adjustment magnitude, and ΔI_i is the change in the importance of feature i, calculated as: ΔI_i = (Time_Adjusted_Importance_i - Historical_Importance_i) / Historical_Importance_i. When feature importance increases, the weight increases; when feature importance decreases, the weight decreases. The overall adjustment speed is controlled by the learning rate α parameter.

[0125] The system acquires the aforementioned object operation data of the target object and extracts its features in the time and frequency domains to obtain transaction pattern features. Subsequently, it obtains a first parameter indicating the distribution range of numerical features and a second parameter indicating the time dependence of time-series features from the baseline model. By comparing the transaction pattern features with the first parameter, the deviation of numerical features is determined; by comparing the transaction pattern features with the second parameter, the deviation of time-series features is calculated. Finally, combining the deviations of numerical and time features, it determines whether to mark the target object's operations as abnormal.

[0126] By constructing multi-dimensional behavioral profiles, dynamic and personalized behavioral baselines, multi-level anomaly detection strategies, and adaptive feature optimization mechanisms, highly accurate identification of abnormal transactions by bank customers has been achieved, solving the problem of low accuracy in abnormal behavior detection. This design not only improves identification speed and accuracy but also enhances the understanding of personalized customer behavior, performing particularly well in handling high-risk transactions and progressive fraud scenarios.

[0127] Through the embodiments of this application, object operation data of a target object is obtained, wherein the object operation data originates from multiple data sources; time-domain feature extraction and frequency-domain feature extraction operations are performed on the object operation data to obtain transaction pattern features of the object operation data, wherein the transaction pattern features include at least one of intraday transaction pattern features, weekly transaction pattern features, and monthly transaction pattern features; model parameters output by the feature baseline model are obtained, wherein the model parameters include a first parameter and a second parameter, the first parameter being used to indicate the distribution range and form of the numerical features corresponding to the target object, and the second parameter being used to indicate the time dependency of the time series features corresponding to the target object; a first... The comparison operation determines the numerical feature deviation parameter, and a second comparison operation is performed on the transaction pattern feature and the second parameter to determine the time-series feature deviation parameter. Based on the numerical and time-series feature deviation parameters, the object detection result is determined. This result indicates whether the target object has abnormal operations. Through comprehensive feature extraction in both the time and frequency domains, combined with comparative analysis of real-time transaction data and a feature baseline model, the transaction patterns of the target object are comprehensively detected. The Z-Score method is used to evaluate the numerical feature deviation, and the MSE of the actual and predicted sequences is calculated to quantify the time-series feature deviation, enabling accurate capture of abnormal fluctuations in transaction amounts and abnormal patterns in the time series. Threshold comparison by the rule engine further enhances the rapid response to significant anomalies. Finally, by weighted fusion of numerical and time deviations, the probability of abnormal operations of the target object is comprehensively judged, improving the accuracy and real-time performance of abnormal object detection. This solves the technical problem of low accuracy in abnormal object detection.

[0128] As an optional approach, the above-mentioned determination of object detection results based on the numerical feature deviation parameter and the temporal feature deviation parameter includes: performing a merging operation on the numerical feature deviation parameter and the temporal feature deviation parameter to obtain a first transaction deviation parameter; performing a comparison operation on the object operation data and the preset transaction threshold data to obtain a second transaction deviation parameter; and determining the object detection result of the target object based on the first transaction deviation parameter and the second transaction deviation parameter.

[0129] The above-mentioned merging operation on the numerical feature deviation parameter and the time series feature deviation parameter to obtain the first transaction deviation parameter includes: determining the first weight value of the numerical feature deviation parameter and the second weight value of the time series feature deviation parameter based on historical operation data; and performing a weighted summation operation on the numerical feature deviation parameter and the time series feature deviation parameter using the first weight value and the second weight value to obtain the first transaction deviation parameter.

[0130] Optionally, in this embodiment, the numerical feature deviation parameter refers to the degree of deviation obtained by comparing the real-time operation data of the target object with the first parameter of historical behavior characteristics, quantifying the deviation of numerical features such as transaction amount and type from the normal distribution. The time series feature deviation parameter quantifies the deviation between the time series characteristics of real-time operation and the second parameter of historical time series characteristics, reflecting the degree of anomaly of the transaction sequence in time. These two deviation parameters together constitute a comprehensive assessment of the anomaly of the target object's operation behavior.

[0131] Optionally, in the embodiments of this application, the above-mentioned merging operation, namely the weighted summation of the numerical feature deviation parameter and the time series feature deviation parameter, uses historical operation data to determine the first weight value and the second weight value, which are used to adjust the numerical feature and time series feature deviation parameters respectively. This ensures that the relative importance of the two deviation parameters can be dynamically adjusted according to historical data, thereby obtaining a more accurate first transaction deviation parameter.

[0132] It should be noted that the determination of the first and second weight values ​​can be based on various strategies, including but not limited to the anomaly detection effect in historical operation data, specific attributes of the target object, or real-time feedback information, and this application does not limit these. For example, for a target object with a high transaction frequency, it may be necessary to assign a higher second weight value to the time series feature deviation parameter in order to more sensitively capture the temporal pattern changes of its operation behavior.

[0133] In one exemplary embodiment, taking the application scenario of real-time abnormal transaction monitoring as an example:

[0134] S1, calculate the deviation parameter of the real-time transaction value characteristics of the target object, for example, evaluate the degree of deviation of the transaction amount from the historical average by using the Z-score method.

[0135] S2, determine the deviation of real-time transaction time series characteristics from the time series characteristic baseline, for example, by analyzing the difference between the periodicity intensity of the transaction series and historical patterns through the autocorrelation function (ACF).

[0136] S3. By analyzing the contribution of different deviation parameters in historical data to the identification of abnormal transactions, the first weight value of the numerical feature deviation parameter and the second weight value of the time series feature deviation parameter are determined.

[0137] S4. The obtained first weight value and second weight value are used to perform a weighted summation of the numerical feature deviation parameter and the time series feature deviation parameter to generate the first transaction deviation parameter.

[0138] S5 compares the real-time operation data of the target object with the preset transaction threshold. For example, it detects whether the amount of a single transaction exceeds a certain percentage of the historical maximum transaction amount to obtain the second transaction deviation parameter. This step provides a fast detection of abnormal numerical characteristics.

[0139] S6 integrates the first transaction deviation parameter and the second transaction deviation parameter, and determines whether the target object's operation is abnormal through the set comprehensive judgment rules. For example, if both the first transaction deviation parameter and the second transaction deviation parameter exceed the preset threshold, it is determined that the target object has abnormal operation.

[0140] Through the embodiments of this application, the weighted fusion of numerical features and time-series feature deviation parameters and threshold comparison analysis are used to accurately identify the abnormality of the real-time operation behavior of the target object, overcome the risk of misjudgment that may be caused by a single deviation parameter, improve the comprehensiveness and accuracy of anomaly detection, and achieve the purpose of effectively warning of abnormal transactions in complex financial environments.

[0141] As an optional approach, the above-mentioned time-domain feature extraction operation and frequency-domain feature extraction operation on the object operation data to obtain the transaction pattern features of the object operation data includes: performing the above-mentioned time-domain feature extraction operation on the object operation data to obtain first sub-features with multiple time spans; performing feature aggregation operation on the multiple first sub-features to obtain object time-domain features; performing wavelet transform operation on the above-mentioned object operation data to convert the object operation data from the time domain to the frequency domain; performing the above-mentioned frequency-domain feature extraction operation on the above-mentioned object operation data to obtain object frequency-domain features; and determining the above-mentioned transaction pattern features based on the above-mentioned object time-domain features and the above-mentioned object frequency-domain features.

[0142] Optionally, in this embodiment, time-domain feature extraction refers to extracting features from time-series data that reflect changes in behavior at different time scales, including but not limited to the first sub-features of short-term, medium-term, and long-term trading patterns, such as the statistical characteristics of trading frequency and trading amount. Frequency-domain feature extraction, on the other hand, uses wavelet transform to convert time-domain data to the frequency domain to capture the periodicity and long-term trends in the data, such as the periodic strength of trading patterns and the stability characteristics of capital flows.

[0143] The first sub-features across the aforementioned multiple time spans are integrated through feature aggregation operations to form a comprehensive time-domain feature reflecting the changes in the target object's operational behavior over time, i.e., the object's time-domain feature. Wavelet transform then converts the object's operational data from the time domain to the frequency domain, enabling the identification of periodic patterns in the trading pattern and extracting the object's frequency-domain features that reflect the periodicity and long-term trend of the trading pattern.

[0144] It should be noted that feature aggregation operations can be performed in various ways, including but not limited to mean calculation, standard deviation evaluation, trend line fitting, or feature importance weighting, and this application does not limit these methods. The wavelet basis functions (such as Haar wavelets, Daubechies wavelets, etc.) and decomposition scales used in wavelet transform operations can also be flexibly adjusted according to specific needs and data characteristics to achieve the best frequency domain feature extraction results.

[0145] For example, time-domain feature extraction operations may include sliding analysis of the target object's operational data across different time windows, while frequency-domain feature extraction operations may involve the calculation of wavelet coefficients and the construction of frequency-domain feature vectors. The specific implementation details depend on the specific application scenario and data characteristics. For example, for high-frequency trading data, a shorter time scale sliding window may be used to capture faster trading fluctuations, while for trading data with obvious periodicity, a wavelet basis function more suitable for periodic signal analysis may be selected.

[0146] In one exemplary embodiment, taking the application scenario of identifying abnormal transactions by bank customers as an example:

[0147] S1 collects object operation data of target customers over a period of time, including information such as transaction time, transaction amount, and transaction type.

[0148] S2 utilizes multi-scale sliding window technology to perform time-domain feature extraction on the collected transaction data, obtaining the first sub-features reflecting short-term, medium-term, and long-term transaction patterns, such as the mean, variance, and median of transaction amounts, and transaction frequency.

[0149] S3 performs feature aggregation on the multiple first sub-features obtained, and integrates them into object time-domain features that can reflect the overall transaction behavior pattern of the target customer by calculating the mean, weighted average or other statistical methods.

[0150] S4 uses wavelet transform technology to convert the collected transaction data from the time domain to the frequency domain. By decomposing the transaction time series data, it identifies and extracts the periodic patterns and long-term trends in the data to obtain the frequency domain features of the object.

[0151] S5 combines the object's time-domain features and frequency-domain features, and uses a feature fusion algorithm to determine the transaction pattern features.

[0152] Through the embodiments of this application, a technical solution is adopted to extract and fuse time-domain and frequency-domain features of object operation data to determine transaction pattern features. This achieves accurate capture of time-series and periodic patterns in target object operation data, and can more accurately identify abnormal transaction patterns in target object operation data, thereby improving the accuracy and real-time response capability of the abnormal transaction identification system.

[0153] As an optional approach, the above-mentioned method for obtaining the model parameters output by the feature baseline model includes: inputting the numerical features corresponding to the historical operation data into a decision tree model to obtain the first model parameters; inputting the numerical features corresponding to the historical operation data into a neural network self-attention model to obtain the second model parameters; and performing a feature fusion operation on the first model parameters and the first model parameters to obtain the above-mentioned model parameters.

[0154] Optionally, in this embodiment, the decision tree model is a machine learning model based on numerical features, used to establish behavioral baselines for numerical features, including but not limited to constructing feature importance and weight distribution, and classification boundaries. The neural network self-attention model is a deep learning model for processing time-series data, mainly used to establish behavioral baselines for time-series features, including but not limited to the attention weight distribution in the time series, and the predictive ability for time-series features. The model parameters include first model parameters and second model parameters, which correspond to the parameter sets output by the decision tree model and the neural network self-attention model, respectively, used to characterize the behavioral baselines.

[0155] It should be noted that the construction of decision tree models can rely on various strategies, including but not limited to ID3, C4.5, CART, etc., while neural network self-attention models can be based on the Transformer architecture or its derivatives. This application does not limit the specific strategies used in this regard.

[0156] In addition, the method of feature fusion may be adjusted according to specific needs and model characteristics. For example, weighted averaging, feature concatenation or other data fusion techniques may be used to ensure that the output parameters of the decision tree and the self-attention model can be effectively integrated to form a unified behavioral baseline model parameter.

[0157] For example, the feature fusion operation can be to integrate the first model parameters output by the decision tree model and the second model parameters output by the neural network self-attention model through weighted fusion, wherein the weights can be dynamically adjusted based on factors such as historical detection results, feature type or model characteristics.

[0158] In one exemplary embodiment, the application scenario of a bank customer abnormal transaction identification system is taken as an example:

[0159] S1 collects historical operational data of bank customers over a period of time, including numerical features such as transaction amount and transaction frequency, and time-series features such as transaction time series and operational behavior series.

[0160] S2, the collected historical data of numerical features are input into the decision tree model. Through training and parameter adjustment, the first model parameters are obtained. These parameters include the splitting nodes of numerical features in the decision tree, the splitting criteria, and the feature weights.

[0161] S3 inputs historical data of time-series features into the neural network self-attention model, and obtains the second model parameters through training and parameter adjustment. These parameters include the attention weight distribution under the self-attention mechanism, the prediction error of time-series features, etc.

[0162] S4. Based on historical detection results and specific business needs, determine the fusion weights of the first model parameters and the second model parameters, and perform feature fusion operations on the two model parameters, such as through weighted averaging or feature concatenation, to obtain the final model parameters. These parameters can comprehensively reflect the behavioral patterns of numerical and temporal features, providing a baseline for subsequent abnormal transaction identification.

[0163] Through the embodiments of this application, a technical solution is adopted to build a behavioral baseline of bank customers from different dimensions by using a decision tree model for numerical features and a neural network self-attention model for temporal features, combined with feature fusion operations to determine model parameters. This enhances the adaptability of the abnormal transaction identification system to complex and dynamic transaction behavior patterns.

[0164] As an optional approach, the above-mentioned first comparison operation on the trading pattern characteristics and the first parameter to determine the numerical feature deviation parameter, and the second comparison operation on the trading pattern characteristics and the second parameter to determine the time series feature deviation parameter, includes: determining the standard deviation parameter of historical daily average trading data based on the first parameter; determining the current trading parameter based on the trading pattern characteristics; determining the difference between the standard deviation parameter of the historical daily average trading data and the current trading parameter as the numerical feature deviation parameter; determining the trading data prediction parameter based on the second parameter; and determining the time series feature deviation parameter based on the mean square error of the trading data prediction parameter and the current trading parameter.

[0165] Optionally, in this embodiment of the application, the standard deviation parameter of the historical daily average transaction data refers to a statistical quantity that reflects the volatility of transaction data and is calculated based on historical operation data. It is used to measure the variation of numerical characteristics such as transaction amount and transaction frequency within a historical period, including but not limited to the fluctuation range of transaction amount and the distribution range of transaction frequency.

[0166] Optionally, in this embodiment, the current transaction parameters are transaction pattern features extracted from the real-time operation data of the target object, reflecting the transaction behavior of the target object at the current point in time or within a time period, such as the current transaction amount, transaction frequency, and transaction type.

[0167] Optionally, in the embodiments of this application, the numerical feature deviation parameter and the temporal feature deviation parameter together constitute a quantitative index of the degree of deviation between the real-time operation data and historical behavior features of the target object, which are used to evaluate the degree of anomaly of the numerical features and the temporal features, respectively.

[0168] It should be noted that the standard deviation parameter of historical daily average trading data can be calculated using various statistical methods, such as the variance, standard deviation, or other indicators that quantify volatility of historical data. This application does not limit this method. Similarly, the determination of trading data prediction parameters may also be based on various models, including but not limited to linear regression, time series models, or deep learning models. The specific model chosen depends on the characteristics of the historical data and business needs.

[0169] For example, determining the deviation parameter of numerical features includes calculating the Z-score between the standard deviation parameter of historical daily average transaction data and the current transaction parameter, while determining the deviation parameter of time series features includes calculating the mean squared error (MSE) between real-time operation data and the prediction results of time series models, and converting it into a more intuitive deviation index through normalization.

[0170] In one exemplary embodiment, taking the application scenario of identifying abnormal bank transactions as an example:

[0171] S1 collects transaction data of target customers over a period of time, including numerical characteristics such as transaction amount and transaction frequency. It uses statistical methods to calculate the standard deviation parameter of historical daily average transaction data, which can reflect the general level of historical transaction fluctuations of customers.

[0172] S2, acquires new transaction data of the target customer in real time (the above object operation data), and extracts the current transaction parameters from it, including real-time transaction amount, transaction frequency, etc.

[0173] S3 calculates the difference between the standard deviation parameter of historical daily average trading data and the current trading parameter, and evaluates the degree of deviation using the Z-score formula to obtain the numerical feature deviation parameter.

[0174] S4, based on historical data, uses time series forecasting models such as ARIMA or Prophet to predict future transaction data and obtain transaction data prediction parameters.

[0175] S5 calculates the mean square error (MSE) between the current trading parameters and the predicted parameters of the trading data, and further transforms the MSE into a time series feature deviation parameter through normalization.

[0176] Through the embodiments of this application, a technical solution is adopted to determine the deviation parameter of numerical features by comparing the standard deviation parameter of trading pattern features with the historical daily average trading data, and to determine the deviation parameter of time series features by comparing the mean square error of trading pattern features with the prediction parameters of trading data. This achieves a quantitative assessment of the degree of abnormality in the real-time operation data of the target object, and can effectively identify abnormal deviations in numerical features and time series features, so as to achieve the purpose of accurate early warning of abnormal objects.

[0177] It is understood that in the specific embodiments of this application, data such as user information are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0178] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0179] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0180] Based on this understanding, the technical solution of this application, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory (ROM) / random access memory (RAM), magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0181] According to another aspect of the embodiments of this application, an abnormal object detection apparatus for implementing the above-described abnormal object detection method is also provided. This abnormal object detection apparatus can be used to implement the abnormal object detection method provided in the above embodiments, and details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0182] Figure 8 This is a structural block diagram of an optional abnormal object detection device according to an embodiment of this application, such as... Figure 8 As shown, the detection device for the abnormal object includes:

[0183] The first acquisition module 802 is used to acquire object operation data of the target object, wherein the object operation data comes from multiple data sources;

[0184] The feature extraction module 804 is used to perform time-domain feature extraction and frequency-domain feature extraction operations on the object operation data to obtain the transaction pattern features of the object operation data, wherein the transaction pattern features include at least one of intraday transaction pattern features, weekly transaction pattern features and monthly transaction pattern features;

[0185] The second acquisition module 806 is used to acquire the model parameters output by the feature baseline model. The model parameters include a first parameter and a second parameter. The first parameter is used to indicate the distribution range and shape of the numerical features corresponding to the target object, and the second parameter is used to indicate the time dependency of the time series features corresponding to the target object.

[0186] The execution module 808 is used to perform a first comparison operation on the transaction pattern features and the first parameter to determine the numerical feature deviation parameter, and to perform a second comparison operation on the transaction pattern features and the second parameter to determine the time series feature deviation parameter.

[0187] The determination module 810 is used to determine the object detection result based on the numerical feature deviation parameter and the temporal feature deviation parameter, wherein the object detection result is used to indicate whether there is an abnormal operation in the target object.

[0188] As an optional embodiment, the device is used to determine the object detection result based on the numerical feature deviation parameter and the temporal feature deviation parameter in the following manner: performing a merging operation on the numerical feature deviation parameter and the temporal feature deviation parameter to obtain a first transaction deviation parameter; performing a comparison operation on the object operation data and the preset transaction threshold data to obtain a second transaction deviation parameter; and determining the object detection result of the target object based on the first transaction deviation parameter and the second transaction deviation parameter.

[0189] As an optional embodiment, the apparatus is used to perform a merging operation on the numerical feature deviation parameter and the time series feature deviation parameter to obtain a first transaction deviation parameter by: determining a first weight value of the numerical feature deviation parameter and a second weight value of the time series feature deviation parameter based on historical operation data; and performing a weighted summation operation on the numerical feature deviation parameter and the time series feature deviation parameter using the first weight value and the second weight value to obtain the first transaction deviation parameter.

[0190] As an optional embodiment, the apparatus is used to perform time-domain feature extraction and frequency-domain feature extraction operations on object operation data in the following manner to obtain transaction pattern features of the object operation data: performing time-domain feature extraction on the object operation data to obtain first sub-features with multiple time spans; performing feature aggregation on the multiple first sub-features to obtain object time-domain features; performing wavelet transform on the object operation data to convert the object operation data from the time domain to the frequency domain; performing frequency-domain feature extraction on the object operation data to obtain object frequency-domain features; and determining transaction pattern features based on the object time-domain features and object frequency-domain features.

[0191] As an optional embodiment, the device is used to obtain the model parameters output by the feature baseline model in the following manner: inputting the numerical features corresponding to the historical operation data into the decision tree model to obtain the first model parameters; inputting the numerical features corresponding to the historical operation data into the neural network self-attention model to obtain the second model parameters; and performing a feature fusion operation on the first model parameters and the first model parameters to obtain the model parameters.

[0192] As an optional embodiment, the apparatus is used to perform a first comparison operation on the trading pattern features and a first parameter to determine a numerical feature deviation parameter, and to perform a second comparison operation on the trading pattern features and a second parameter to determine a time series feature deviation parameter: determining the standard deviation parameter of historical daily average trading data based on the first parameter; determining the current trading parameter based on the trading pattern features; determining the difference between the standard deviation parameter of historical daily average trading data and the current trading parameter as the numerical feature deviation parameter; determining the trading data prediction parameter based on the second parameter; and determining the time series feature deviation parameter based on the mean square error of the trading data prediction parameter and the current trading parameter.

[0193] Regarding the apparatus in the above embodiments, the terms "module" or "unit" refer to a computer program or part of a computer program with a predetermined function, which works together with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit. The specific manner in which each module performs its operations has been described in detail in the embodiments relating to the method, and will not be elaborated upon here.

[0194] According to another aspect of the embodiments of this application, an electronic device is provided.

[0195] The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor is configured to perform the steps in any of the above method embodiments via the computer program. In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor. Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0196] According to one aspect of this application, a computer program product is also provided, which includes a computer program.

[0197] The computer program product includes a computer program / instructions containing program code for performing the methods shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via communication section 909, and / or installed from removable medium 911. When the computer program is executed by central processing unit 901, it performs various functions provided in the embodiments of this application. The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0198] Figure 9 A schematic block diagram of a computer system architecture for implementing embodiments of the present application is shown. Figure 9As shown, the computer system 900 includes a Central Processing Unit (CPU) 901, which performs various appropriate actions and processes based on programs stored in ROM 902 or loaded into RAM 903 from storage section 908. Random Access Memory 903 also stores various programs and data required for system operation. The CPU 901, ROM 902, and RAM 903 are interconnected via bus 904. Input / Output (I / O) interface 905 is also connected to bus 904.

[0199] The following components are connected to I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), and speakers, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card, such as a local area network card or modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to I / O interface 905 as needed. Removable media 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 910 as needed so that computer programs read from them can be installed into storage section 908 as needed.

[0200] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0201] Specifically, according to embodiments of this application, the processes described in the various method flowcharts can be implemented as computer programs / instructions. For example, embodiments of this application include a computer program / instruction comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication portion, and / or installed from a removable medium. When the computer program is executed by a central processing unit, it performs various functions defined in the system of this application. In such embodiments, the computer program / instruction can be downloaded and installed from a network via a communication portion, and / or installed from a removable medium. When the computer program / instruction is executed by a central processing unit, it performs the aforementioned method for detecting abnormal objects.

[0202] According to one aspect of this application, a computer-readable storage medium is also provided.

[0203] The processor of the aforementioned electronic device can read the computer instructions from a computer-readable storage medium, and the processor executes the computer instructions, causing the electronic device to perform the abnormal object detection method provided in the various optional implementations of the abnormal object detection aspect.

[0204] Optionally, in this embodiment, the computer-readable storage medium described above may be configured to store methods for performing the embodiments of this application.

[0205] Optionally, in this embodiment, those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0206] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0207] If the integrated units in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause one or more electronic devices to execute all or part of the steps of the methods described in the various embodiments of this application.

[0208] In the several embodiments provided in this application, it should be understood that the disclosed application can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0209] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0210] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0211] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting abnormal objects, characterized in that, include: Obtain object operation data of the target object, wherein the object operation data comes from multiple data sources; Perform time-domain feature extraction and frequency-domain feature extraction operations on the object operation data to obtain the transaction pattern features of the object operation data, wherein the transaction pattern features include at least one of intraday transaction pattern features, weekly transaction pattern features, and monthly transaction pattern features; Obtain the model parameters output by the feature baseline model, wherein the model parameters include a first parameter and a second parameter, the first parameter being used to indicate the distribution range and shape of the numerical features corresponding to the target object, and the second parameter being used to indicate the temporal dependency of the temporal features corresponding to the target object; A first comparison operation is performed on the transaction pattern feature and the first parameter to determine the numerical feature deviation parameter, and a second comparison operation is performed on the transaction pattern feature and the second parameter to determine the time series feature deviation parameter; The object detection result is determined based on the numerical feature deviation parameter and the temporal feature deviation parameter, wherein the object detection result is used to indicate whether there is abnormal operation of the target object.

2. The method according to claim 1, characterized in that, The determination of the object detection result based on the numerical feature deviation parameter and the temporal feature deviation parameter includes: A merging operation is performed on the numerical feature deviation parameter and the time series feature deviation parameter to obtain the first transaction deviation parameter; A comparison operation is performed based on the object operation data and the preset transaction threshold data to obtain the second transaction deviation parameter; The object detection result of the target object is determined based on the first transaction deviation parameter and the second transaction deviation parameter.

3. The method according to claim 2, characterized in that, The step of merging the numerical feature deviation parameter and the time series feature deviation parameter to obtain the first transaction deviation parameter includes: The first weight value of the numerical feature deviation parameter and the second weight value of the time series feature deviation parameter are determined based on historical operation data. The first transaction deviation parameter is obtained by performing a weighted summation operation on the numerical feature deviation parameter and the time series feature deviation parameter using the first weight value and the second weight value.

4. The method according to claim 1, characterized in that, The step of performing time-domain feature extraction and frequency-domain feature extraction operations on the object operation data to obtain the transaction pattern features of the object operation data includes: The temporal feature extraction operation is performed on the object operation data to obtain first sub-features with multiple time spans; a feature aggregation operation is performed on the multiple first sub-features to obtain the object temporal features; A wavelet transform operation is performed on the object operation data to convert the object operation data from the time domain to the frequency domain; the frequency domain feature extraction operation is then performed on the object operation data to obtain the object frequency domain features. The transaction pattern features are determined based on the object's time-domain features and the object's frequency-domain features.

5. The method according to any one of claims 1 to 4, characterized in that, The model parameters obtained from the feature baseline model output include: Input the numerical features corresponding to the historical operation data into the decision tree model to obtain the first model parameters; The numerical features corresponding to the historical operation data are input into the neural network self-attention model to obtain the second model parameters; A feature fusion operation is performed on the first model parameters and the first model parameters to obtain the model parameters.

6. The method according to claim 1, characterized in that, The step of performing a first comparison operation on the transaction pattern features and the first parameter to determine the numerical feature deviation parameter, and performing a second comparison operation on the transaction pattern features and the second parameter to determine the time series feature deviation parameter, includes: The standard deviation parameter of the historical daily average trading data is determined based on the first parameter; the current trading parameter is determined based on the trading pattern characteristics; the difference between the standard deviation parameter of the historical daily average trading data and the current trading parameter is determined as the numerical feature deviation parameter. The transaction data prediction parameter is determined based on the second parameter; the time series feature deviation parameter is determined based on the mean square error of the transaction data prediction parameter and the current transaction parameter.

7. A device for identifying abnormal objects, characterized in that, include: The first acquisition module is used to acquire object operation data of the target object, wherein the object operation data comes from multiple data sources; The feature extraction module is used to perform time-domain feature extraction and frequency-domain feature extraction operations on the object operation data to obtain the transaction pattern features of the object operation data, wherein the transaction pattern features include at least one of intraday transaction pattern features, weekly transaction pattern features, and monthly transaction pattern features; The second acquisition module is used to acquire the model parameters output by the feature baseline model, wherein the model parameters include a first parameter and a second parameter. The first parameter is used to indicate the distribution range and shape of the numerical features corresponding to the target object, and the second parameter is used to indicate the time dependency of the time series features corresponding to the target object. The execution module is used to perform a first comparison operation on the transaction pattern feature and the first parameter to determine the numerical feature deviation parameter, and to perform a second comparison operation on the transaction pattern feature and the second parameter to determine the time series feature deviation parameter. The determination module is used to determine the object detection result based on the numerical feature deviation parameter and the temporal feature deviation parameter, wherein the object detection result is used to indicate whether there is abnormal operation of the target object.

8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the method according to any one of claims 1 to 6.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

Images