Bank abnormal transaction detection method and device based on data enhancement and electronic equipment

Abstract

The invention provides a bank abnormal transaction detection method and device based on data enhancement and electronic equipment. The method comprises the steps that a transaction data set is acquired, a generative adversarial network model is adopted to learn time sequence feature distribution of abnormal transaction data in the abnormal transaction data set, so that the generative adversarial network model outputs a synthesized abnormal transaction data set, the synthesized abnormal transaction data set is screened through a pre-trained isolated forest model, and the abnormal transaction data set is obtained. Obtaining an enhanced abnormal transaction data set; constructing an initial abnormal transaction detection model, and training the initial abnormal transaction detection model by using a model training data set constructed by the enhanced abnormal transaction data set and the transaction data set to obtain a trained abnormal transaction detection model; and acquiring real-time transaction data, and detecting and processing the real-time transaction data by adopting the abnormal transaction detection model to obtain a transaction detection result. The problem that an existing abnormal transaction detection scheme is low in abnormal transaction recognition accuracy due to insufficient data or unbalanced samples is solved.

Description

Technical Field

[0001] This application relates to the field of abnormal bank transaction detection technology, and more specifically, to a data-enhanced method, apparatus, computer-readable storage medium, and electronic device for detecting abnormal bank transactions. Background Technology

[0002] The internet has permeated almost every aspect of our daily lives. At the individual and business levels, traditional transaction methods have been replaced by innovative internet applications and online systems. Banks in many countries have followed this trend, providing financial services to customers via the internet. However, with the widespread adoption of mobile finance, mobile banking has become a major target for fraudulent transactions. Malicious actors exploit social engineering, technological vulnerabilities, and user psychology to induce victims to disclose sensitive information or directly transfer funds. Therefore, protecting users' "wallets" at the last mile has become a top priority for bank transaction system technicians.

[0003] The temporal characteristics of abnormal bank transaction data: Abnormal bank transaction behaviors (such as fraudulent transactions and account takeover) are usually manifested as abnormal time patterns in transaction data, with the following key characteristics: suddenness: high-frequency transactions in a short period of time (such as multiple large transfers within 1 minute); temporal dependence: abnormal transactions differ from normal transactions in terms of time distribution (such as operations during inactive periods); multi-variable coordination: abnormal temporal linkage of multiple variables such as amount and geographical location.

[0004] Existing abnormal transaction detection solutions often fail to effectively identify abnormal transactions due to insufficient data or imbalanced samples (the proportion of abnormal transaction cases is extremely low). Summary of the Invention

[0005] The main objective of this application is to provide a data-enhanced method, apparatus, computer-readable storage medium, and electronic device for detecting abnormal bank transactions, so as to at least solve the problem that existing abnormal transaction detection schemes have low accuracy in identifying abnormal transactions due to insufficient data or imbalanced samples.

[0006] To achieve the above objectives, according to one aspect of this application, a data-augmented method for detecting abnormal bank transactions is provided, comprising: acquiring a transaction dataset, wherein the transaction dataset includes a normal transaction dataset and an abnormal transaction dataset; employing a time-series-based generative adversarial network (GAN) model to learn the temporal feature distribution of abnormal transaction data in the abnormal transaction dataset, so that the GAN model outputs a synthetic abnormal transaction dataset, and filtering the synthetic abnormal transaction dataset using a pre-trained isolated forest model to obtain an enhanced abnormal transaction dataset; constructing an initial abnormal transaction detection model, training the initial abnormal transaction detection model using the enhanced abnormal transaction dataset and the transaction dataset to obtain a trained abnormal transaction detection model; acquiring real-time transaction data, and using the abnormal transaction detection model to detect and process the real-time transaction data to obtain a transaction detection result.

[0007] Optionally, the initial abnormal transaction detection model is trained using the enhanced abnormal transaction dataset and the transaction dataset to obtain the trained abnormal transaction detection model. This includes: using multiple sets of transaction data from the training dataset as input to the initial abnormal transaction detection model and the labels of the multiple sets of transaction data as output to the initial abnormal transaction detection model, the initial abnormal transaction detection model is trained to obtain the trained abnormal transaction detection model, wherein the labels are used to characterize whether the transaction data is an abnormal transaction.

[0008] Optionally, the generative adversarial network model includes an embedding network, a recovery network, a sequence generator network, and a sequence discriminator network. The embedding network is used to convert the abnormal transaction data into a low-dimensional latent space. The latent space is used by the generative adversarial network model to learn the temporal feature distribution of the abnormal transaction data. The recovery network is used to convert the latent space into the abnormal transaction data.

[0009] Optionally, the synthetic abnormal transaction dataset is filtered and processed by a pre-trained isolated forest model to obtain an enhanced abnormal transaction dataset, including: inputting the synthetic abnormal transaction dataset into the isolated forest model to determine the abnormal score of each synthetic abnormal transaction data in the synthetic abnormal transaction dataset; removing the synthetic abnormal transaction data in the synthetic abnormal transaction dataset whose abnormal score is greater than the score threshold to obtain the enhanced abnormal transaction dataset.

[0010] Optionally, the abnormal transaction detection model includes a first input module, a second input module, an encoder module, a window encoder module, a first decoder module, a second decoder module, a first output module, and a second output module. The first output module is connected to the encoder module, the second input module is connected to the window encoder module, the encoder module is connected to the window encoder module, the window encoder module is connected to both the first decoder module and the second decoder module, the first decoder module is connected to the first output module, the second decoder module is connected to the second output module, and the first output module is connected to the first input module.

[0011] Optionally, the first input module is used to input a preset segment and focus score of the real-time transaction data, the second input module is used to input the real-time transaction data, the first output module is used to output the focus score of the real-time transaction data, the second output module is used to output the transaction detection result, the encoder module consists of a first multi-head attention layer, a first normalization layer, a feedforward network and a second normalization layer, and the window encoder module consists of a second multi-head attention layer, a third normalization layer, a third multi-head attention layer and a fourth normalization layer.

[0012] Optionally, after training the initial abnormal transaction detection model using the enhanced abnormal transaction dataset and the transaction dataset to construct a model training dataset, the method further includes: obtaining a model test dataset, testing the initial abnormal transaction detection model using the model test dataset, obtaining test results, and determining whether the initial abnormal transaction detection model has been trained successfully based on the test results, wherein the test results include detection accuracy, model recall rate, and F1 score.

[0013] According to another aspect of this application, a data-augmented bank abnormal transaction detection device is provided, comprising: an acquisition unit for acquiring a transaction dataset, wherein the transaction dataset includes a normal transaction dataset and an abnormal transaction dataset; a filtering and processing unit for learning the temporal feature distribution of abnormal transaction data in the abnormal transaction dataset using a time-series-based generative adversarial network model, so that the generative adversarial network model outputs a synthetic abnormal transaction dataset, and filtering and processing the synthetic abnormal transaction dataset using a pre-trained isolated forest model to obtain an enhanced abnormal transaction dataset; a construction unit for constructing an initial abnormal transaction detection model, training the initial abnormal transaction detection model using the enhanced abnormal transaction dataset and the transaction dataset to obtain a trained abnormal transaction detection model; and a detection and processing unit for acquiring real-time transaction data, using the abnormal transaction detection model to detect and process the real-time transaction data to obtain a transaction detection result.

[0014] According to another aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to execute any of the data-enhanced bank abnormal transaction detection methods described above.

[0015] According to another aspect of this application, an electronic device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including methods for performing any of the data augmentation-based abnormal bank transaction detection methods described above.

[0016] By employing the technical solution of this application, a synthetic abnormal transaction dataset is generated by learning the temporal feature distribution of abnormal transaction data using a time-series-based Generative Adversarial Network (TimeGAN) model. This step increases the quantity and diversity of abnormal transaction samples, allowing the model to encounter richer abnormal behavior patterns. Next, a pre-trained Isolation Forest model filters the synthetic abnormal transaction dataset, removing samples with conflicting features or low quality, and retaining high-confidence abnormal transaction data for model training, ensuring the quality and reliability of the augmented data. Finally, the augmented abnormal transaction dataset and the original transaction dataset are used together to train the abnormal transaction detection model, improving the model's generalization ability and accuracy in identifying abnormal transactions. By monitoring transaction data in real time and using the trained abnormal transaction detection model, potential abnormal transactions can be detected promptly, effectively improving the security and efficiency of the banking transaction system while also meeting privacy protection requirements. This solves the problem of low accuracy in identifying abnormal transactions in existing abnormal transaction detection schemes due to insufficient data or imbalanced samples. Attached Figure Description

[0017] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 A hardware structure block diagram of a mobile terminal for implementing a data-enhanced abnormal bank transaction detection method is shown in an embodiment of this application.

[0019] Figure 2 A flowchart illustrating a data-enhanced method for detecting abnormal bank transactions according to an embodiment of this application is shown.

[0020] Figure 3A structural diagram of the TranAD model provided according to an embodiment of this application is shown;

[0021] Figure 4 A block diagram of the TimeGAN model structure provided according to an embodiment of this application is shown;

[0022] Figure 5 A schematic diagram illustrating the isolation forest screening principle provided according to an embodiment of this application is shown;

[0023] Figure 6 A schematic diagram of a bank transaction anomaly detection framework provided according to an embodiment of this application is shown;

[0024] Figure 7 A structural block diagram of a data-enhanced bank abnormal transaction detection device provided according to an embodiment of this application is shown. Detailed Implementation

[0025] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0026] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] As described in the background section, existing abnormal transaction detection schemes suffer from low accuracy in identifying abnormal transactions due to insufficient data or imbalanced samples. To address this issue, embodiments of this application provide a data-enhanced method, apparatus, computer-readable storage medium, and electronic device for detecting abnormal bank transactions.

[0029] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0030] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a data-enhanced method for detecting abnormal bank transactions, according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0031] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the data-enhanced bank abnormal transaction detection method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0032] This embodiment provides a data-enhanced method for detecting abnormal bank transactions that runs on a mobile terminal, computer terminal, or similar computing device. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0033] Figure 2 This is a flowchart of a data-augmented abnormal bank transaction detection method according to an embodiment of this application. Figure 2 As shown, the method includes the following steps:

[0034] Step S201: Obtain the transaction dataset, wherein the transaction dataset includes a normal transaction dataset and an abnormal transaction dataset;

[0035] Abnormal transaction data refers to data records in financial transactions that do not conform to normal patterns or significantly deviate from normal behavior. This type of data may indicate fraudulent activities, system errors, or other types of abnormal activity. Abnormal transaction behavior (such as fraudulent transactions or account takeover) usually manifests as abnormal time patterns in transaction data, with the following key characteristics: suddenness: high-frequency transactions within a short period of time (such as multiple large transfers within one minute); time-series dependence: abnormal transactions differ from normal transactions in terms of time distribution (such as operations during inactive periods); multi-variable coordination: abnormal temporal linkage of multiple variables such as amount and geographical location.

[0036] Step S202: A time-series-based generative adversarial network model is used to learn the temporal feature distribution of abnormal transaction data in the above-mentioned abnormal transaction dataset, so that the above-mentioned generative adversarial network model outputs a synthetic abnormal transaction dataset, and the above-mentioned synthetic abnormal transaction dataset is filtered and processed by a pre-trained isolated forest model to obtain an enhanced abnormal transaction dataset.

[0037] Among them, the time-series-based generative adversarial network model is the TimeGAN model;

[0038] Step S203: Construct an initial abnormal transaction detection model. Use the enhanced abnormal transaction dataset and the transaction dataset to construct a model training dataset to train the initial abnormal transaction detection model, and obtain the trained abnormal transaction detection model.

[0039] The abnormal transaction detection model is the TranAD model.

[0040] Step S204: Obtain real-time transaction data, and use the above-mentioned abnormal transaction detection model to detect and process the real-time transaction data to obtain transaction detection results.

[0041] In this embodiment, by applying steps S201, S202, S203, and S204, a synthetic abnormal transaction dataset is generated by learning the temporal feature distribution of abnormal transaction data using a time-series-based Generative Adversarial Network (TimeGAN) model. This step increases the quantity and diversity of abnormal transaction samples, allowing the model to encounter richer abnormal behavior patterns. Next, a pre-trained Isolation Forest model filters the synthetic abnormal transaction dataset, removing samples with conflicting features or low quality, and retaining high-confidence abnormal transaction data for model training, ensuring the quality and reliability of the augmented data. Finally, the augmented abnormal transaction dataset and the original transaction dataset are used together to train the abnormal transaction detection model, improving the model's generalization ability and accuracy in identifying abnormal transactions. By monitoring transaction data in real time and using the trained abnormal transaction detection model, potential abnormal transactions can be detected promptly, effectively improving the security and efficiency of the bank's transaction system while also meeting privacy protection requirements. This solves the problem of low accuracy in identifying abnormal transactions in existing abnormal transaction detection schemes due to insufficient data or imbalanced samples.

[0042] In the specific implementation process, the above-mentioned enhanced abnormal transaction dataset and the above-mentioned transaction dataset are used to construct a model training dataset to train the above-mentioned initial abnormal transaction detection model, thereby obtaining the trained abnormal transaction detection model. This includes: using multiple sets of transaction data in the above-mentioned training dataset as input to the above-mentioned initial abnormal transaction detection model and the labels of the multiple sets of the above-mentioned transaction data as output to the above-mentioned initial abnormal transaction detection model, and training the above-mentioned initial abnormal transaction detection model to obtain the trained abnormal transaction detection model. The above-mentioned labels are used to characterize whether the above-mentioned transaction data is an abnormal transaction.

[0043] This approach uses the TimeGAN model to learn and generate abnormal transaction samples. Then, the Isolation Forest algorithm is used to filter these synthetic samples, removing those with conflicting features or that do not conform to the true distribution, retaining only the high-confidence abnormal transaction data. This refined synthetic data is combined with the original dataset to form an enhanced training set for training the abnormal transaction detection model, TranAD. During model training, multiple sets of transaction data from the enhanced set serve as input, while the corresponding transaction labels serve as output. By continuously optimizing the model parameters, TranAD's ability to identify abnormal transactions is improved. This method significantly improves the generalization ability and accuracy of the anomaly detection model, especially in scenarios with extremely imbalanced samples. By increasing the diversity of abnormal transaction patterns, it enhances the model's sensitivity to rare abnormal transaction behaviors, thereby improving the overall anomaly detection performance. After model training, TranAD can effectively detect anomalies in real-time transaction data, promptly identifying potential fraudulent activities and ensuring the security and stability of the bank's transaction system.

[0044] Specifically, the aforementioned generative adversarial network model includes an embedding network, a recovery network, a sequence generator network, and a sequence discriminator network. The embedding network is used to convert the aforementioned abnormal transaction data into a low-dimensional latent space. The latent space is used by the generative adversarial network model to learn the aforementioned temporal feature distribution of the aforementioned abnormal transaction data. The recovery network is used to convert the aforementioned latent space into the aforementioned abnormal transaction data.

[0045] This generative adversarial network (GAN) model integrates an embedding network, a recovery network, a sequence generator network, and a sequence discriminator network. The embedding network transforms anomalous transaction data into a low-dimensional latent space, which becomes the foundation for the model to learn the temporal feature distribution. The recovery network is responsible for reconstructing the anomalous transaction data from the latent space, ensuring structural consistency between synthetic and real data. The sequence generator network generates synthetic anomalous transaction data based on the learned distribution, while the sequence discriminator network distinguishes between real and synthetic data, forming a feedback mechanism that drives continuous optimization of the generator. Through this comprehensive framework, the model can effectively capture and generate the temporal dependencies and behavioral patterns of anomalous transactions, thereby expanding the training set and improving the accuracy and robustness of the anomaly detection algorithm.

[0046] More specifically, the synthetic abnormal transaction dataset is filtered and processed by a pre-trained isolated forest model to obtain an enhanced abnormal transaction dataset, including: inputting the synthetic abnormal transaction dataset into the isolated forest model to determine the abnormal score of each synthetic abnormal transaction data in the synthetic abnormal transaction dataset; removing the synthetic abnormal transaction data in the synthetic abnormal transaction dataset whose abnormal score is greater than the score threshold to obtain the enhanced abnormal transaction dataset.

[0047] This approach first inputs the synthetic abnormal transaction dataset into an Isolation Forest model. The model calculates an anomaly score for each synthetic sample based on a random binary tree strategy, with the score reflecting the degree of deviation of the sample from the overall data distribution. Then, a score threshold is set, and synthetic abnormal transaction data with scores higher than this threshold are removed. These high-scoring samples often represent feature mutations or synthetic results significantly different from normal transaction behavior. Finally, the synthetic data with scores below the threshold constitute the augmented abnormal transaction dataset, used to further train the anomaly detection model. This selection process ensures that the augmented dataset is not only sufficient in quantity but also reliable in quality, effectively avoiding model misleading and performance degradation that may be caused by low-quality synthetic samples, thereby significantly improving the accuracy and robustness of the anomaly detection model in practical applications.

[0048] Furthermore, the aforementioned abnormal transaction detection model includes a first input module, a second input module, an encoder module, a window encoder module, a first decoder module, a second decoder module, a first output module, and a second output module. The first output module is connected to the encoder module, the second input module is connected to the window encoder module, the encoder module is connected to the window encoder module, the window encoder module is connected to both the first decoder module and the second decoder module, the first decoder module is connected to the first output module, the second decoder module is connected to the second output module, and the first output module is connected to the first input module.

[0049] like Figure 3 As shown, the real-time transaction data segment C and the focus score (0 for the first input) are input into the first input module, passed through the encoder module to the third multi-head attention layer of the window encoder module, and then to the first decoder module and the first output module to obtain the focus score. At the same time, the focus score and the segment transaction data are input into the first input module, passed through the encoder module to the window encoder module, and the real-time transaction data is input into the second input module, passed through the window encoder module and the second decoder module, and the transaction detection result is output by the second output module.

[0050] Furthermore, the first input module is used to input the preset segment and focus score of the real-time transaction data, the second input module is used to input the real-time transaction data, the first output module is used to output the focus score of the real-time transaction data, the second output module is used to output the transaction detection result, the encoder module consists of a first multi-head attention layer, a first normalization layer, a feedforward network and a second normalization layer, and the window encoder module consists of a second multi-head attention layer, a third normalization layer, a third multi-head attention layer and a fourth normalization layer.

[0051] In this embodiment, the bank anomaly transaction detection system achieves effective supplementation and quality control of anomaly transaction samples by integrating TimeGAN and Isolation Forest algorithms for data augmentation. Specifically, the TimeGAN module first performs deep learning on historical anomaly transaction data to generate high-fidelity anomaly transaction time series. These series are highly consistent with real anomaly data in terms of time dependence and multivariate collaboration. Subsequently, the Isolation Forest module performs anomaly scoring on a large number of synthetic samples generated by TimeGAN, selecting high-quality anomaly transaction samples based on their scores. This ensures that these samples not only enrich the patterns of anomaly transactions but also maintain consistency with actual anomaly transactions in terms of temporal features, avoiding the negative impact of low-quality or feature-conflicting samples on model training. Finally, the selected augmented dataset is merged with the original dataset and used as the training input for the TranAD classifier, significantly improving the generalization ability and accuracy of the anomaly detection model. Furthermore, by dynamically adjusting the parameters of the TimeGAN generation module and the Isolation Forest selection module, the system can adapt to the feature evolution of different types of bank anomaly transactions, maintaining the stability and reliability of detection performance. This embodiment effectively solves the small sample size problem and enhances the model's ability to learn and identify abnormal trading patterns. In particular, it can adapt and respond more quickly when faced with newly emerging abnormal trading strategies, thereby improving the overall system's anomaly detection efficiency.

[0052] Specifically, after training the initial abnormal transaction detection model using the model training dataset constructed with the enhanced abnormal transaction dataset and the transaction dataset, the method further includes: obtaining a model test dataset, testing the initial abnormal transaction detection model using the model test dataset, obtaining test results, and determining whether the initial abnormal transaction detection model has been trained based on the test results, wherein the test results include detection accuracy, model recall rate, and F1 score.

[0053] After obtaining the model test dataset, this solution uses this dataset to test the initial abnormal transaction detection model, which has been trained using data augmentation techniques. Test results are obtained, including detection accuracy, model recall, and F1 score. This testing step is crucial, as it verifies the model's generalization ability on unknown data, especially its accuracy in identifying abnormal transaction cases. Based on the test results, it is determined whether the initial model has met the predetermined performance metrics, such as the set minimum detection accuracy threshold or the F1 score standard for abnormal transaction identification. If the test results fail to meet the requirements, the model must return to the training phase, adjust parameters or optimize the algorithm, and then be tested again until the model performance meets the standards. This closed-loop testing process ensures the maturity and reliability of the abnormal transaction detection model, enabling it to complete the necessary performance verification and optimization before actual deployment.

[0054] To enable those skilled in the art to better understand the technical solution of this application, the implementation process of the data-enhanced bank abnormal transaction detection method of this application will be described in detail below with reference to specific embodiments.

[0055] This embodiment relates to a specific data augmentation-based method for detecting abnormal bank transactions. To address industry-wide issues such as missing abnormal transaction samples, incomplete labels, and low abnormal sample ratios in the detection process, a data augmentation method combining isolated forests and time-series-based generative adversarial networks is used. It includes the following:

[0056] 1.1 Generation of Time-Series Anomaly Transaction Data Based on TimeGAN;

[0057] 1.2 This solution takes into account the time dependence of abnormal bank transaction behavior in the generation of abnormal transaction data. The core challenge in modeling time series data is to maintain time dynamics—the inherent relationship and dependence between variables as time unfolds.

[0058] 1.3 Time Series Generative Adversarial Networks (TimeGANs) are a natural framework for generating realistic time series data across various domains. First, in addition to unsupervised adversarial losses on both real and synthetic sequences, the model introduces a progressively supervised loss, using the original data as supervision, thus explicitly encouraging the model to capture the progressive conditional distributions in the data. Second, the model introduces an embedding network to provide an invertible mapping between features and latent representations, thereby reducing the high dimensionality of the adversarial learning space. This leverages the fact that even the temporal dynamics of complex systems are often driven by fewer and lower-dimensional variability factors.

[0059] The TimeGAN model comprises four core network components: an embedding function, a recovery function, a sequence generator, and a sequence discriminator. Its overall framework is as follows: Figure 4 As shown, the first two are the most important. The embedding function is responsible for transforming the original time-series data into a low-dimensional latent space. This latent space is where the model learns the intrinsic features of the time series; the embedding function helps the model capture the core dynamics and structure of the data. In this way, the time-series data is abstracted into a form that is easier for generative models to process. The role of the recovery function is to transform the latent representations in the embedding space back into a form corresponding to the original time-series data. This ensures that the data recovered from the latent space is as similar as possible to the original data.

[0060] 1.4. Enhanced data filtering based on isolated forests;

[0061] 1.5. When using TimeGAN to generate time series data on abnormal bank transaction behavior, although the goal of this solution is to replicate the temporal statistical characteristics of real data, the generation process may produce anomalous samples that do not conform to the distribution of real data. This is because generative models based on GANs, due to the complexity of high-dimensional space and the introduction of randomness, may generate some low-quality synthetic data. This will lead to a decrease in the detection performance of the augmented dataset input into the anomaly detection model. However, the generated data and the training data generally have a high degree of distributional consistency, so low-quality points are a minority and far from the majority of normal generated points.

[0062] Due to the high-dimensionality of bank datasets and the need for rapid response in bank transaction systems, this solution uses the Isolation Forest algorithm to filter the multivariate time series generated by TimeGAN. This algorithm exhibits excellent performance in handling high-dimensional datasets and big data environments, and is particularly suitable for identifying rare events or outliers. It can quickly filter out anomalous samples in the augmented high-dimensional bank transaction dataset that do not conform to the real data distribution, ensuring the quality of the generated data.

[0063] 1.6 In an isolation forest, each sample is "isolated" by constructing multiple binary decision trees (isolation trees). This is because the splitting of instances within an isolation tree is recursively repeated until all instances are isolated. This random splitting results in significantly shorter paths for anomalous instances. Because anomalous instances have attribute values ​​that are significantly different from most normal instances, they are easier to distinguish at a shallow level in a binary decision tree. The principle is as follows: Figure 5 As shown, in an isolated forest, the isolation of data points is achieved by constructing multiple decision trees. Each tree is built based on randomly selected features and split points, thus recursively splitting the data. The degree of isolation of each point is measured by the path length required to reach the terminal node from the root node. The shorter the path length, the more likely the point is to be isolated, and therefore more likely to be an outlier.

[0064] TranAD-based time-series anomaly detection includes the following:

[0065] 1) Multivariate time series classification:

[0066] Bank transaction systems involve multiple dimensions, and simply integrating a univariate classifier into a multivariate system for classification becomes challenging due to the interactions between these dimensions. Therefore, it is necessary to develop multivariate time series classification models. In multivariate time series classification, data is typically organized in matrix form, containing multiple time series, each corresponding to a specific dimension. A data matrix X contains D different time series, each with T observations at different time points. The entire dataset can be represented as a T... The matrix of D.

[0067] 2) TranAD, an anomaly detection and diagnosis model based on deep transformer networks:

[0068] Simple transformer-based encoder-decoder networks often miss anomalies when the anomaly bias is too small, i.e., close to normal data. TranAD mitigates this problem by amplifying reconstruction errors through adversarial training. Furthermore, the model's self-adjusting approach for powerful multimodal feature extraction enhances training stability and model generalization. Combined with MAML, it maintains good performance even with limited data. TranAD's workflow consists of two parts: data preprocessing and two-stage inference. The overall process is as follows: Figure 3 As shown.

[0069] This embodiment also relates to a bank abnormal transaction detection system, the framework of which is as follows: Figure 6 As shown, the system is divided into four modules: data preprocessing, data augmentation, data filtering, and intrusion detection. Addressing the characteristics of the transaction dataset—its wide range and high sparsity—the system first performs max-min normalization and fills in missing values. Next, to address the insufficient normal traffic in the training set, TimeGAN-based augmentation is used. To address the issue that data generated by the GAN model may not conform to the distribution, the Isolation Forest algorithm is used for filtering, merging the new dataset with the original dataset to form a new dataset, which is then visualized using T-SNE in two dimensions. Finally, in the intrusion detection module, the new dataset is used as the training set to train a TranAD-based anomaly detection module, improving the detection efficiency of the abnormal transaction detection system.

[0070] This embodiment proposes a method for detecting abnormal bank transactions by combining Time Generative Adversarial Networks (TimeGAN) and Isolation Forest. First, TimeGAN learns the temporal behavior patterns of real transaction time-series data and generates a large number of synthetic transaction sequences based on the learned distribution to expand the abnormal transaction sample space. After generation, the Isolation Forest algorithm is used to evaluate the anomaly of the synthetic samples, filtering out data whose distribution significantly deviates from normal behavior and retaining high-quality, reliable synthetic samples for subsequent model training. By introducing an unsupervised quality assessment mechanism in the generation stage, this method achieves a high-fidelity and controllable data augmentation process, effectively improving the performance and stability of the abnormal transaction detection model under imbalanced sample and behavioral variation environments.

[0071] Furthermore, the information collected in this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant countries and regions, necessary confidentiality measures have been taken, and it does not violate public order and good morals. Corresponding operation portals are provided for users to choose to authorize or refuse.

[0072] This application also provides a data-enhanced bank abnormal transaction detection device. It should be noted that this data-enhanced bank abnormal transaction detection device can be used to execute the data-enhanced bank abnormal transaction detection method provided in this application. This device is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0073] The following describes the data-enhanced bank abnormal transaction detection device provided in the embodiments of this application.

[0074] Figure 7 This is a schematic diagram of a data-enhanced bank abnormal transaction detection device according to an embodiment of this application. Figure 7 As shown, the device includes:

[0075] The acquisition unit 71 is used to acquire a transaction dataset, wherein the transaction dataset includes a normal transaction dataset and an abnormal transaction dataset;

[0076] The filtering and processing unit 72 is used to learn the temporal feature distribution of abnormal transaction data in the above-mentioned abnormal transaction dataset using a time series-based generative adversarial network model, so that the above-mentioned generative adversarial network model outputs a synthetic abnormal transaction dataset, and the above-mentioned synthetic abnormal transaction dataset is filtered and processed by a pre-trained isolated forest model to obtain an enhanced abnormal transaction dataset.

[0077] The construction unit 73 is used to construct an initial abnormal transaction detection model. The model training dataset is constructed using the enhanced abnormal transaction dataset and the transaction dataset to train the initial abnormal transaction detection model, thereby obtaining the trained abnormal transaction detection model.

[0078] The detection and processing unit 74 is used to acquire real-time transaction data, and to process the real-time transaction data using the above-mentioned abnormal transaction detection model to obtain transaction detection results.

[0079] In this embodiment, the acquisition unit acquires a transaction dataset, which includes a normal transaction dataset and an abnormal transaction dataset. The filtering and processing unit uses a time-series-based generative adversarial network (GAN) model to learn the temporal feature distribution of abnormal transaction data in the abnormal transaction dataset, enabling the GAN model to output a synthetic abnormal transaction dataset. A pre-trained isolated forest model is then used to filter the synthetic abnormal transaction dataset to obtain an enhanced abnormal transaction dataset. The construction unit constructs an initial abnormal transaction detection model, using the enhanced abnormal transaction dataset and the transaction dataset to train the initial abnormal transaction detection model, resulting in a trained abnormal transaction detection model. The detection and processing unit acquires real-time transaction data and uses the abnormal transaction detection model to process the real-time transaction data, obtaining transaction detection results. By using a time-series-based generative adversarial network (TimeGAN) model to learn the temporal feature distribution of abnormal transaction data and generate a synthetic abnormal transaction dataset, this step increases the number and diversity of abnormal transaction samples, allowing the model to encounter richer abnormal behavior patterns. Next, the pre-trained Isolation Forest model filters the synthetic abnormal transaction dataset, removing samples with conflicting features or low quality, and retaining high-confidence abnormal transaction data for model training, ensuring the quality and reliability of the augmented data. Finally, the augmented abnormal transaction dataset and the original transaction dataset are used together to train the abnormal transaction detection model, improving the model's generalization ability and accuracy in identifying abnormal transactions. By monitoring transaction data in real time and using the trained abnormal transaction detection model, potential abnormal transactions can be detected promptly, effectively improving the security and efficiency of the bank's transaction system while also meeting privacy protection requirements. This solves the problem of low accuracy in identifying abnormal transactions in existing abnormal transaction detection schemes due to insufficient data or imbalanced samples.

[0080] As an optional approach, the construction unit includes a training module, which is used to train the initial abnormal transaction detection model by using multiple sets of transaction data from the training dataset as input to the initial abnormal transaction detection model and the labels of the multiple sets of transaction data as output to the initial abnormal transaction detection model, thereby obtaining the trained abnormal transaction detection model, wherein the labels are used to characterize whether the transaction data is an abnormal transaction.

[0081] In one alternative approach, the aforementioned generative adversarial network model includes an embedding network, a recovery network, a sequence generator network, and a sequence discriminator network. The embedding network is used to convert the aforementioned abnormal transaction data into a low-dimensional latent space. The latent space is used by the generative adversarial network model to learn the aforementioned temporal feature distribution of the aforementioned abnormal transaction data. The recovery network is used to convert the aforementioned latent space into the aforementioned abnormal transaction data.

[0082] In one optional scheme, the filtering processing unit includes an input module and a removal module; the input module is used to input the above-mentioned synthetic abnormal transaction dataset into the above-mentioned isolated forest model to determine the abnormal score of each synthetic abnormal transaction data in the above-mentioned synthetic abnormal transaction dataset; the removal module is used to remove the above-mentioned synthetic abnormal transaction data in the above-mentioned synthetic abnormal transaction dataset whose abnormal score is greater than the score threshold, so as to obtain the above-mentioned enhanced abnormal transaction dataset.

[0083] In one optional embodiment, the aforementioned abnormal transaction detection model includes a first input module, a second input module, an encoder module, a window encoder module, a first decoder module, a second decoder module, a first output module, and a second output module. The first output module is connected to the encoder module, the second input module is connected to the window encoder module, the encoder module is connected to the window encoder module, the window encoder module is connected to both the first decoder module and the second decoder module, the first decoder module is connected to the first output module, the second decoder module is connected to the second output module, and the first output module is connected to the first input module.

[0084] In one optional scheme, the first input module is used to input a preset segment and focus score of the real-time transaction data, the second input module is used to input the real-time transaction data, the first output module is used to output the focus score of the real-time transaction data, the second output module is used to output the transaction detection result, the encoder module is composed of a first multi-head attention layer, a first normalization layer, a feedforward network and a second normalization layer, and the window encoder module is composed of a second multi-head attention layer, a third normalization layer, a third multi-head attention layer and a fourth normalization layer.

[0085] In an optional embodiment, the apparatus further includes a testing unit, configured to, after training the initial abnormal transaction detection model using the model training dataset constructed with the enhanced abnormal transaction dataset and the transaction dataset, obtain a model test dataset, test the initial abnormal transaction detection model using the model test dataset, obtain test results, and determine whether the initial abnormal transaction detection model has been trained successfully based on the test results, wherein the test results include detection accuracy, model recall rate, and F1 score.

[0086] The aforementioned data-enhanced bank abnormal transaction detection device includes a processor and a memory. The acquisition unit, filtering unit, construction unit, and detection unit are all stored as program units in the memory, and the processor executes these program units to achieve their respective functions. All of the above modules reside in the same processor; alternatively, the modules may be located in different processors in any combination.

[0087] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured. By adjusting kernel parameters, the low accuracy of existing abnormal transaction detection schemes due to insufficient data or imbalanced samples can be addressed.

[0088] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0089] This invention provides a computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device containing the computer-readable storage medium to perform the data-enhanced abnormal bank transaction detection method.

[0090] Specifically, data-enhanced methods for detecting abnormal bank transactions include:

[0091] Step S201: Obtain the transaction dataset, wherein the transaction dataset includes a normal transaction dataset and an abnormal transaction dataset;

[0092] Step S202: A time-series-based generative adversarial network model is used to learn the temporal feature distribution of abnormal transaction data in the above-mentioned abnormal transaction dataset, so that the above-mentioned generative adversarial network model outputs a synthetic abnormal transaction dataset, and the above-mentioned synthetic abnormal transaction dataset is filtered and processed by a pre-trained isolated forest model to obtain an enhanced abnormal transaction dataset.

[0093] Step S203: Construct an initial abnormal transaction detection model. Use the enhanced abnormal transaction dataset and the transaction dataset to construct a model training dataset to train the initial abnormal transaction detection model, and obtain the trained abnormal transaction detection model.

[0094] Step S204: Obtain real-time transaction data, and use the above-mentioned abnormal transaction detection model to detect and process the real-time transaction data to obtain transaction detection results.

[0095] This invention provides a processor for running a program, wherein the program executes the aforementioned data-enhanced bank abnormal transaction detection method.

[0096] Specifically, data-enhanced methods for detecting abnormal bank transactions include:

[0097] Step S201: Obtain the transaction dataset, wherein the transaction dataset includes a normal transaction dataset and an abnormal transaction dataset;

[0098] Step S202: A time-series-based generative adversarial network model is used to learn the temporal feature distribution of abnormal transaction data in the above-mentioned abnormal transaction dataset, so that the above-mentioned generative adversarial network model outputs a synthetic abnormal transaction dataset, and the above-mentioned synthetic abnormal transaction dataset is filtered and processed by a pre-trained isolated forest model to obtain an enhanced abnormal transaction dataset.

[0099] Step S203: Construct an initial abnormal transaction detection model. Use the enhanced abnormal transaction dataset and the transaction dataset to construct a model training dataset to train the initial abnormal transaction detection model, and obtain the trained abnormal transaction detection model.

[0100] Step S204: Obtain real-time transaction data, and use the above-mentioned abnormal transaction detection model to detect and process the real-time transaction data to obtain transaction detection results.

[0101] This invention provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs at least the following steps:

[0102] Step S201: Obtain the transaction dataset, wherein the transaction dataset includes a normal transaction dataset and an abnormal transaction dataset;

[0103] Step S202: A time-series-based generative adversarial network model is used to learn the temporal feature distribution of abnormal transaction data in the above-mentioned abnormal transaction dataset, so that the above-mentioned generative adversarial network model outputs a synthetic abnormal transaction dataset, and the above-mentioned synthetic abnormal transaction dataset is filtered and processed by a pre-trained isolated forest model to obtain an enhanced abnormal transaction dataset.

[0104] Step S203: Construct an initial abnormal transaction detection model. Use the enhanced abnormal transaction dataset and the transaction dataset to construct a model training dataset to train the initial abnormal transaction detection model, and obtain the trained abnormal transaction detection model.

[0105] Step S204: Obtain real-time transaction data, and use the above-mentioned abnormal transaction detection model to detect and process the real-time transaction data to obtain transaction detection results.

[0106] The devices mentioned in this article can be servers, PCs, tablets, mobile phones, etc.

[0107] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having at least the following method steps:

[0108] Step S201: Obtain the transaction dataset, wherein the transaction dataset includes a normal transaction dataset and an abnormal transaction dataset;

[0109] Step S202: A time-series-based generative adversarial network model is used to learn the temporal feature distribution of abnormal transaction data in the above-mentioned abnormal transaction dataset, so that the above-mentioned generative adversarial network model outputs a synthetic abnormal transaction dataset, and the above-mentioned synthetic abnormal transaction dataset is filtered and processed by a pre-trained isolated forest model to obtain an enhanced abnormal transaction dataset.

[0110] Step S203: Construct an initial abnormal transaction detection model. Use the enhanced abnormal transaction dataset and the transaction dataset to construct a model training dataset to train the initial abnormal transaction detection model, and obtain the trained abnormal transaction detection model.

[0111] Step S204: Obtain real-time transaction data, and use the above-mentioned abnormal transaction detection model to detect and process the real-time transaction data to obtain transaction detection results.

[0112] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0113] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0114] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0115] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0116] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0117] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0118] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0119] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0120] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0121] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0122] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A data-augmented method for detecting abnormal bank transactions, characterized in that, include: Obtain a transaction dataset, wherein the transaction dataset includes a normal transaction dataset and an abnormal transaction dataset; A time-series-based generative adversarial network model is used to learn the temporal feature distribution of abnormal transaction data in the abnormal transaction dataset, so that the generative adversarial network model outputs a synthetic abnormal transaction dataset. The synthetic abnormal transaction dataset is then filtered and processed by a pre-trained isolated forest model to obtain an enhanced abnormal transaction dataset. An initial abnormal transaction detection model is constructed. The model training dataset is constructed using the enhanced abnormal transaction dataset and the transaction dataset to train the initial abnormal transaction detection model, thereby obtaining the trained abnormal transaction detection model. Real-time transaction data is acquired, and the abnormal transaction detection model is used to detect and process the real-time transaction data to obtain transaction detection results.

2. The method according to claim 1, characterized in that, The initial abnormal transaction detection model is trained using the enhanced abnormal transaction dataset and the transaction dataset to obtain the trained abnormal transaction detection model, including: The initial abnormal transaction detection model is trained by using multiple sets of transaction data from the training dataset as input and the labels of the multiple sets of transaction data as output, thereby obtaining the trained abnormal transaction detection model. The labels are used to characterize whether the transaction data is an abnormal transaction.

3. The method according to claim 1, characterized in that, The generative adversarial network model includes an embedding network, a recovery network, a sequence generator network, and a sequence discriminator network. The embedding network is used to convert the abnormal transaction data into a low-dimensional latent space. The latent space is used by the generative adversarial network model to learn the temporal feature distribution of the abnormal transaction data. The recovery network is used to convert the latent space into the abnormal transaction data.

4. The method according to claim 1, characterized in that, The synthetic abnormal transaction dataset is filtered and processed using a pre-trained isolated forest model to obtain an enhanced abnormal transaction dataset, including: The synthetic abnormal transaction dataset is input into the isolated forest model to determine the abnormality score of each synthetic abnormal transaction in the synthetic abnormal transaction dataset; The enhanced abnormal transaction dataset is obtained by removing synthetic abnormal transaction data whose abnormal scores are greater than the score threshold from the synthetic abnormal transaction dataset.

5. The method according to claim 1, characterized in that, The abnormal transaction detection model includes a first input module, a second input module, an encoder module, a window encoder module, a first decoder module, a second decoder module, a first output module, and a second output module. The first output module is connected to the encoder module, the second input module is connected to the window encoder module, the encoder module is connected to the window encoder module, the window encoder module is connected to both the first decoder module and the second decoder module, the first decoder module is connected to the first output module, the second decoder module is connected to the second output module, and the first output module is connected to the first input module.

6. The method according to claim 5, characterized in that, The first input module is used to input a preset segment and focus score of the real-time transaction data; the second input module is used to input the real-time transaction data; the first output module is used to output the focus score of the real-time transaction data; the second output module is used to output the transaction detection result; the encoder module consists of a first multi-head attention layer, a first normalization layer, a feedforward network, and a second normalization layer; the window encoder module consists of a second multi-head attention layer, a third normalization layer, a third multi-head attention layer, and a fourth normalization layer.

7. The method according to claim 1, characterized in that, After training the initial abnormal transaction detection model using the enhanced abnormal transaction dataset and the transaction dataset to construct a model training dataset, the method further includes: Obtain a model test dataset, use the model test dataset to test the initial abnormal transaction detection model, obtain test results, and determine whether the initial abnormal transaction detection model has been trained successfully based on the test results. The test results include detection accuracy, model recall rate, and F1 score.

8. A data-augmented bank anomaly transaction detection device, characterized in that, include: An acquisition unit is used to acquire a transaction dataset, wherein the transaction dataset includes a normal transaction dataset and an abnormal transaction dataset; The filtering and processing unit is used to learn the temporal feature distribution of abnormal transaction data in the abnormal transaction dataset using a time series-based generative adversarial network model, so that the generative adversarial network model outputs a synthetic abnormal transaction dataset, and the synthetic abnormal transaction dataset is filtered and processed by a pre-trained isolated forest model to obtain an enhanced abnormal transaction dataset. The construction unit is used to construct an initial abnormal transaction detection model. The initial abnormal transaction detection model is trained using the enhanced abnormal transaction dataset and the transaction dataset to obtain the trained abnormal transaction detection model. The detection and processing unit is used to acquire real-time transaction data, and to detect and process the real-time transaction data using the abnormal transaction detection model to obtain transaction detection results.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device containing the computer-readable storage medium to perform the data-enhanced bank abnormal transaction detection method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including methods for performing the data-enhanced bank anomaly transaction detection method according to any one of claims 1 to 7.

Images