Risk detection method and device for cross-border payment transaction, equipment and medium

Abstract

The invention discloses a risk detection method and device for cross-border payment transaction, equipment and a medium, and relates to the technical field of cross-border payment. The method comprises the steps of obtaining to-be-detected cross-border payment transaction data and extracting multi-dimensional features; sequentially inputting the transactions to a preset progressive mixed detection hierarchy for processing, comprising: a first hierarchy used for quickly filtering the transactions based on a preset rule; the second level is used for performing fraud probability prediction on the transaction based on a supervised learning model; the third level is used for carrying out unknown risk capture on the transaction based on an unsupervised learning model; dynamically adjusting model parameters according to regional attributes or data distribution changes of transactions to adapt to different data distributions; and carrying out weighted fusion on the basis of the detection results output by each level and the corresponding uncertainty quantification results to generate a final risk score, and generating anti-fraud judgment. According to the technical scheme of the invention, the safety and reliability of a cross-border payment system can be improved.

Description

Technical Field

[0001] This invention relates to the field of cross-border payment technology, and in particular to a risk detection method, apparatus, equipment and medium for cross-border payment transactions. Background Technology

[0002] With the globalization of fintech, cross-border payments, with their immediacy and cross-regional characteristics, have become a core support for international trade and personal consumption. However, the anonymity of transactions, the complexity of cross-border data flows, and the intelligent upgrading of fraud methods have led to a significant increase in fraud risks. Typical fraud types include account hijacking, synthetic identity fraud, cross-border money laundering, and zero-day attacks (new undefined fraud patterns). These behaviors not only cause huge financial losses to financial institutions but also seriously undermine consumer trust and the stability of the cross-border financial system. Current cross-border payment anti-fraud technologies have significant shortcomings:

[0003] (1) Disadvantages of traditional rule-based detection systems: the static nature of rules makes them unable to adapt to new fraud types; rigid thresholds lead to high false alarm rates; rule maintenance costs are high; and they cannot handle fraud involving multiple features.

[0004] (2) Disadvantages of pure supervised learning detection scheme: It relies on sufficient labeled fraud data and cannot detect "zero-day attacks"; the model has weak generalization ability, and the detection accuracy of a model trained for a certain region will decrease in another region due to differences in user behavior distribution; the features depend on historical distribution, and the model will fail due to feature distribution drift when cross-border transaction patterns change.

[0005] (3) Disadvantages of pure unsupervised learning detection schemes: They cannot distinguish between "abnormal but legitimate" transactions and "abnormal and fraudulent" transactions, resulting in a high false alarm rate; they are sensitive to feature quality, and noise in cross-border data can lead to deviations in anomaly judgment; they lack the utilization of known fraud patterns, and their detection accuracy is lower than that of supervised learning schemes.

[0006] (4) Disadvantages of the hybrid AI detection scheme: The unique features of cross-border transactions are not fully utilized. No exclusive features are designed for "multi-currency exchange rate fluctuations", "cross-time zone transaction time difference" and "cross-border device fingerprint heterogeneity", resulting in insufficient feature expression; the real-time performance is insufficient and cannot meet the millisecond-level processing requirements of cross-border payments; the model has weak drift adaptability. Cross-border user behavior is subject to regional / holiday differences, which cause data distribution to drift quickly and cannot be adapted to the drift in time; the decision fusion does not take into account the uncertainty of cross-border data and the fixed weighting / voting mechanism has poor robustness.

[0007] Based on the above similar technical solutions, existing cross-border payment anti-fraud technologies have core technical bottlenecks in terms of real-time performance, generalizability, and adaptability. Summary of the Invention

[0008] In view of this, the purpose of this invention is to provide a risk detection method, apparatus, device, and medium for cross-border payment transactions, which has the following advantages: First, it provides more accurate characterization of cross-border features, completely eliminating detection blind spots; second, it offers both superior real-time performance and detection accuracy, meeting the millisecond-level requirements of cross-border payments; third, it has strong cross-regional generalization capabilities, with no regional adaptation limitations; fourth, it has fast dynamic adaptation speed and is resistant to transaction pattern drift; and fifth, it has high robustness in decision fusion, with low false positives and low false negatives. The specific solution is as follows:

[0009] Firstly, this application discloses a risk detection method for cross-border payment transactions, including:

[0010] Obtain cross-border payment transaction data to be detected, and extract multi-dimensional features from the cross-border payment transaction data to specifically reflect the cross-border payment scenario;

[0011] The multi-dimensional features are sequentially input into a preset progressive hybrid detection layer for processing; the progressive hybrid detection layer includes: a first layer for quickly filtering transactions based on preset rules; a second layer for predicting the fraud probability of the transactions based on a supervised learning model; and a third layer for capturing unknown risks of the transactions based on an unsupervised learning model.

[0012] Based on the geographical attributes or data distribution changes of the transactions, the parameters of the supervised learning model and / or the unsupervised learning model are dynamically adjusted to adapt to different data distributions;

[0013] The detection results output from the first level, the second level, and the third level, along with their respective uncertainty quantification results, are weighted and fused to generate a final risk score. Based on the final risk score, an anti-fraud determination for the transaction is generated.

[0014] Optionally, the multi-dimensional features include: exchange rate fluctuation features, cross-time zone transaction time difference features, unified feature vector of device fingerprint, and multi-feature association features.

[0015] Optionally, the exchange rate fluctuation characteristics are extracted, including:

[0016] Historical exchange rate data of the trading currency is collected according to a preset sampling interval, and the historical exchange rate data is decomposed into trend, seasonal and residual terms using a time series decomposition algorithm.

[0017] Determine the ratio of the absolute value of the residual term at the current transaction time to the mean value of the residual term in the target historical period, and determine whether the ratio exceeds a first preset threshold.

[0018] If the ratio exceeds the first preset threshold, the exchange rate fluctuation characteristic of the current transaction is marked as abnormal; if the ratio does not exceed the first preset threshold, the exchange rate fluctuation characteristic of the current transaction is marked as normal.

[0019] Optionally, extracting the cross-time zone transaction time difference features includes:

[0020] Convert transaction timestamps to a unified standard time;

[0021] Obtain the first time zone corresponding to the registered region of the transaction initiator and the second time zone corresponding to the region to which the transaction initiator's IP belongs;

[0022] Based on the unified standard time, the first time zone, and the second time zone, determine the cross-time zone time difference corresponding to the current transaction;

[0023] A reference time difference interval is determined based on the historical transaction sample size of the transaction initiator; wherein, if the historical transaction sample size reaches a second preset threshold, the reference time difference interval is determined based on the interquartile range of the time zone difference data of the transaction initiator; if the historical transaction sample size does not reach the second preset threshold, the reference time difference interval is determined based on the statistical characteristics of the time zone difference data of users in the same region as the registration region.

[0024] If the cross-time zone time difference value exceeds the reference time difference range, the cross-time zone transaction time difference feature of the current transaction is marked as abnormal; if the cross-time zone time difference value does not exceed the reference time difference range, the cross-time zone transaction time difference feature of the current transaction is marked as normal.

[0025] Optionally, the unified feature vector of the device fingerprint is extracted, including:

[0026] Obtain the original device fingerprint characteristics of the device initiating the transaction;

[0027] If the dimension of the original device fingerprint feature is lower than the preset dimension, the original device fingerprint feature is mapped to the preset dimension through an embedding layer;

[0028] If the dimension of the original device fingerprint feature is higher than the preset dimension, then the original device fingerprint feature is converted to the preset dimension through dimensionality reduction processing.

[0029] The processed feature vector of the preset dimension is used as the unified feature vector of the device fingerprint.

[0030] Optionally, the multi-feature association features are extracted, including:

[0031] The association rule mining algorithm is used to mine association rules from historical transaction data according to a preset period. The association rules are generated based on at least two of the following dimensions: device type, transaction amount, time zone difference, and exchange rate fluctuation characteristics, and are generated according to preset support and confidence levels.

[0032] Determine whether the current transaction conforms to the association rules;

[0033] If the current transaction conforms to the association rule, then the multi-feature association feature of the current transaction is marked as abnormal; if the current transaction does not conform to the association rule, then the multi-feature association feature of the current transaction is marked as normal.

[0034] Optionally, the step of sequentially inputting the multi-dimensional features into a preset progressive hybrid detection layer for processing includes:

[0035] The multi-dimensional features are matched according to the preset rules through the first level;

[0036] If a match is found, the transaction is determined to be a low-risk transaction and the result is output. If a match fails, the transaction is input into the second level.

[0037] Through the second level, the gradient boosting decision tree model is used to reason about the feature vector composed of the multi-dimensional features and the basic transaction features to output the transaction fraud probability; the basic transaction features include transaction amount, device identifier, and user registration duration.

[0038] If the transaction fraud probability is lower than the third preset threshold, the transaction is determined to be a low-to-medium risk transaction and the result is output. If the transaction fraud probability is not lower than the third preset threshold, the transaction is determined to be a medium-to-high risk transaction and the transaction is input into the third level.

[0039] Through the third level, the variational autoencoder model is used to identify anomalies in the multi-dimensional features in order to determine the target reconstruction error corresponding to the transaction.

[0040] When the target reconstruction error exceeds the fourth preset threshold, the transaction is determined to be a high-risk transaction; the fourth preset threshold is determined based on the reconstruction error of transaction samples that have been determined to be normal.

[0041] Optionally, the parameters of the supervised learning model and / or the unsupervised learning model are dynamically adjusted based on the geographical attributes or data distribution changes of the transactions to adapt to different data distributions, including:

[0042] When the difference in feature distribution between the source domain and the target domain exceeds a fifth preset threshold based on the multi-dimensional features, the supervised learning model and / or the unsupervised learning model are trained using samples containing the source domain and the target domain in a domain-adaptive manner.

[0043] Based on the sliding window mechanism, when the number of transactions of the identified type accumulated within the sliding window reaches a preset number, the supervised learning model and / or the unsupervised learning model are incrementally updated.

[0044] Optionally, the step of weightedly fusing the detection results output from the first level, the second level, and the third level, respectively, along with their corresponding uncertainty quantification results, to generate a final risk score includes:

[0045] The uncertainty of the detection results output by the first level, the second level and the third level are quantified respectively, and dynamic weights are assigned to each level according to the level of uncertainty quantification results.

[0046] The final risk score is obtained by multiplying the detection results output by the first level, the second level, and the third level by their respective dynamic weights and summing the results.

[0047] Secondly, this application discloses a risk detection device for cross-border payment transactions, comprising:

[0048] The feature extraction module is used to acquire cross-border payment transaction data to be detected, and extract multi-dimensional features from the cross-border payment transaction data that specifically reflect the cross-border payment scenario;

[0049] The hybrid detection module is used to sequentially input the multi-dimensional features into a preset progressive hybrid detection layer for processing; the progressive hybrid detection layer includes: a first layer for quickly filtering transactions based on preset rules; a second layer for predicting the fraud probability of the transactions based on a supervised learning model; and a third layer for capturing unknown risks of the transactions based on an unsupervised learning model.

[0050] The model adaptation module is used to dynamically adjust the parameters of the supervised learning model and / or the unsupervised learning model according to the geographical attributes or data distribution changes of the transaction, so as to adapt to different data distributions.

[0051] The anti-fraud determination module is used to perform weighted fusion based on the detection results output by the first level, the second level and the third level respectively, as well as the corresponding uncertainty quantification results, to generate a final risk score, and to generate an anti-fraud determination for the transaction based on the final risk score.

[0052] Thirdly, this application discloses an electronic device including a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the risk detection method for cross-border payment transactions as described above.

[0053] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the risk detection method for cross-border payment transactions as described above.

[0054] The beneficial effects of this application are as follows: by extracting multiple dimensions of features reflecting the unique risks of cross-border payments, the application systematically mines and utilizes risk signals unique to cross-border scenarios such as exchange rate fluctuations, cross-time zone behavior, and device fingerprint heterogeneity. This provides high-quality and highly discriminative input features for all subsequent detection levels, fundamentally solving the problem of insufficient expression and inaccurate characterization of general anti-fraud features in cross-border scenarios, and laying a solid foundation for improving overall detection performance. Furthermore, (1) Improve detection efficiency and real-time performance: through the design of a three-level progressive hybrid detection, the first level with minimal computational cost quickly filters most obviously legitimate transactions, the second level uses a highly accurate supervised learning model to process known fraud patterns, and the final level uses an unsupervised learning model to capture new unknown risks. This division of labor and relay mechanism, which is "from fast to accurate, from known to unknown", ensures the ability to detect complex and new types of fraud while concentrating overall computational resources on a few suspicious transactions, significantly reducing computation time and solving the problem of insufficient real-time performance. (2) Enhanced generalization and adaptability: By dynamically adjusting model parameters to adapt to different data distributions, a targeted adaptive mechanism is introduced. This enables the detection model to proactively perceive and adapt to data distribution drift caused by changes in the target user's geographic location, holiday effects, or normal business evolution, solving the pain points of "weak model generalization ability" and "feature distribution drift failure," and ensuring the long-term, stable effectiveness of the detection system. (3) Reduced false positive and false negative rates: Through uncertainty-aware fusion, the mechanical fusion method of simple voting or fixed weight addition is changed. This mechanism eliminates the interference of cross-border data noise, solves the problems of "high false positive rate" and "inability to distinguish abnormal but legitimate transactions," and improves user experience and system availability.

[0055] In addition, the risk detection device, equipment and storage medium for cross-border payment transactions provided in this application correspond to the aforementioned risk detection method for cross-border payment transactions and have the same effect. Attached Figure Description

[0056] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0057] Figure 1 This application discloses a flowchart of a risk detection method for cross-border payment transactions.

[0058] Figure 2 This is a schematic diagram illustrating the principle of cross-border proprietary feature engineering disclosed in this application;

[0059] Figure 3 This application discloses a flowchart of a three-level progressive hybrid model.

[0060] Figure 4 This is a schematic diagram of the device layout and data interaction structure disclosed in this application;

[0061] Figure 5 This is a schematic diagram of the structure of a risk detection device for cross-border payment transactions disclosed in this application;

[0062] Figure 6 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0063] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0064] In the context of fintech globalization, cross-border payments, as a core support for international trade and personal consumption, are facing escalating fraud risks due to transaction anonymity, complex cross-border data flows, and increasingly sophisticated fraud methods. Typical frauds include account hijacking, synthetic identity fraud, cross-border money laundering, and zero-day attacks, causing financial institution losses and undermining consumer trust and the stability of the cross-border financial system. Existing cross-border payment anti-fraud technologies have significant shortcomings: traditional rule-based detection is static and rigid, has a high false positive rate, high maintenance costs, and cannot handle multi-feature-related fraud; pure supervised learning relies on labeled data, making it difficult to detect zero-day attacks, has weak generalization ability, and is susceptible to feature distribution drift; pure unsupervised learning has a high false positive rate, is sensitive to feature quality, and does not utilize known fraud patterns; existing hybrid AI detection does not fully exploit cross-border specific features, lacks real-time performance, has weak adaptability to data drift, and has poor robustness in decision fusion. In summary, existing technologies have core bottlenecks in real-time performance, generalization, and adaptability.

[0065] To address these issues, this application provides a risk detection scheme for cross-border payment transactions. This scheme addresses the problems of existing technologies, such as the inability to accurately characterize the essence of cross-border transactions, the inability to balance real-time performance and accuracy, weak cross-regional generalization, slow adaptation drift, low robustness of decision fusion, and high false alarm rate. These problems are solved through cross-border specific feature extraction, three-level progressive hybrid detection, dual-mechanism dynamic adaptation, and uncertainty-weighted fusion.

[0066] This invention discloses a risk detection method for cross-border payment transactions. See [link to relevant documentation]. Figure 1 As shown, the method includes:

[0067] Step S11: Obtain the cross-border payment transaction data to be detected, and extract multi-dimensional features from the cross-border payment transaction data to specifically reflect the cross-border payment scenario.

[0068] First, basic data on cross-border payment transactions is collected, and this collected data serves as the cross-border payment transaction data to be tested. This data may include transaction amount, currency type, user registration region, transaction initiation IP, device fingerprint, and transaction timestamp, etc.

[0069] Furthermore, current hybrid solutions fail to fully utilize the unique attributes of cross-border transactions, resulting in limited detection accuracy. Therefore, in this embodiment, based on the characteristics of cross-border payment scenarios, specific quantitative features for cross-border transactions are extracted. These features are multi-dimensional features constructed specifically for the attributes of cross-border transactions, used to accurately characterize the essence of cross-border transactions. These include multi-currency exchange rate fluctuation features extracted using time series processing technology, cross-time zone transaction time difference features extracted using time zone conversion and statistical analysis technology, unified device fingerprint feature vectors extracted using dimensionality unification technology, and multi-feature association features extracted using association rule mining technology. The specific extraction process will be described in detail in the following embodiments of the invention, and will not be repeated here.

[0070] By extracting cross-border specific quantitative features, we can accurately capture the unique attributes of cross-border transactions, making up for the shortcomings of traditional features in describing cross-border scenarios and eliminating detection blind spots.

[0071] Step S12: The multi-dimensional features are sequentially input into a preset progressive hybrid detection layer for processing; the progressive hybrid detection layer includes: a first layer for quickly filtering transactions based on preset rules; a second layer for predicting the fraud probability of the transactions based on a supervised learning model; and a third layer for capturing unknown risks of the transactions based on an unsupervised learning model.

[0072] Traditional solutions either fail to meet millisecond-level requirements due to long computational chains or lack sufficient accuracy due to a single detection mode. Therefore, in this embodiment, a progressive process of "rapid filtering - accurate detection - unknown capture" is used to complete single-transaction detection within a set time, taking into account both known and unknown fraud.

[0073] The pre-defined progressive hybrid detection layer consists of three levels. The first level is filtered by a lightweight rule engine, which performs positive matching on the detected feature vectors based on pre-defined rules. Successful matches are judged as low-risk transactions and output as results, while unmatched transactions proceed to the next level. In this way, by quickly filtering out most obviously normal transactions first, the amount of computation is reduced and efficiency is improved.

[0074] The second layer involves precise detection based on a supervised learning model. For transactions rejected in the first layer, a supervised learning model is used for in-depth analysis to specifically identify past fraud patterns. Specifically, by reasoning from multi-dimensional features, the probability of transaction fraud is output. Based on a preset probability threshold, the transaction is classified as low-to-medium risk or medium-to-high risk. Low-to-medium risk transactions are directly output as results, while medium-to-high risk transactions proceed to the next layer. It is evident that supervised learning can accurately identify known fraud.

[0075] The third level is the detection of unknowns based on an unsupervised learning model. For transactions deemed suspicious in the first two levels, an unsupervised learning model is used to identify anomalies in multi-dimensional features and detect unknown fraud. Specifically, by comparing the reconstruction error with a preset threshold, the transaction is determined to be high-risk or medium-low-risk, and the result is output.

[0076] Through the aforementioned progressive, hybrid detection layers, legitimate transactions can be processed quickly, suspicious transactions can be thoroughly examined, and new types of fraud can be completely detected. This approach addresses both known and unknown fraud, thereby improving detection speed.

[0077] Step S13: Dynamically adjust the parameters of the supervised learning model and / or the unsupervised learning model according to the geographical attributes or data distribution changes of the transaction to adapt to different data distributions.

[0078] In this step, a dual-mechanism dynamic adaptation is used to enable the detection model to quickly adapt to data differences in different regions and changes in transaction patterns, preventing the detection model from failing.

[0079] The dynamic adjustment of model parameters based on the geographical attributes of the transaction mainly includes calculating the feature distribution differences between the source and target domains through a domain adaptive network. When the difference exceeds a preset threshold, domain adaptive training is triggered to enable the detection model to adapt to cross-regional user behavior differences.

[0080] The dynamic adjustment of model parameters based on changes in data distribution mainly involves adopting a sliding window model. When a certain amount of newly labeled transaction data (including both legitimate and fraudulent transactions) is accumulated, incremental training of the model is triggered. During this process, the extraction rules for multi-dimensional features specifically extracted for cross-border transaction scenarios are updated simultaneously to adapt to the dynamic changes in transaction patterns and achieve real-time incremental training of the detection model.

[0081] As can be seen, in this embodiment, cross-regional domain adaptation triggers training through feature distribution differences, reducing the decline in cross-regional detection accuracy; real-time incremental training is based on a sliding window to quickly adapt to changes in transaction patterns, avoiding model lag due to data drift, and significantly improving the model's adaptability and robustness.

[0082] Step S14: Based on the detection results output by the first level, the second level and the third level respectively, and their corresponding uncertainty quantification results, perform weighted fusion to generate a final risk score, and generate an anti-fraud determination for the transaction based on the final risk score.

[0083] Finally, the results of the three-layer detection are integrated, the uncertainty of each detection layer is quantified, weights are assigned according to the uncertainty quantification results, the final risk score of the transaction is calculated by weighted summation, and the determination of whether the transaction is fraudulent is achieved by setting a judgment threshold.

[0084] It is evident that the fixed weighting / voting mechanism of the current hybrid scheme does not consider the uncertainty of cross-border data and is susceptible to noise interference. The uncertainty-aware weighted fusion of the present invention effectively reduces the judgment bias caused by cross-border data noise by quantifying the reliability of each detection level and dynamically allocating weights, thereby achieving a dual reduction in false alarm rate and false negative rate and improving the credibility of decision results.

[0085] The beneficial effects of this application are as follows: by extracting multiple dimensions of features reflecting the unique risks of cross-border payments, the application systematically mines and utilizes risk signals unique to cross-border scenarios such as exchange rate fluctuations, cross-time zone behavior, and device fingerprint heterogeneity. This provides high-quality and highly discriminative input features for all subsequent detection levels, fundamentally solving the problem of insufficient expression and inaccurate characterization of general anti-fraud features in cross-border scenarios, and laying a solid foundation for improving overall detection performance. Furthermore, (1) Improve detection efficiency and real-time performance: through the design of a three-level progressive hybrid detection, the first level with minimal computational cost quickly filters most obviously legitimate transactions, the second level uses a highly accurate supervised learning model to process known fraud patterns, and the final level uses an unsupervised learning model to capture new unknown risks. This division of labor and relay mechanism, which is "from fast to accurate, from known to unknown", ensures the ability to detect complex and new types of fraud while concentrating overall computational resources on a few suspicious transactions, significantly reducing computation time and solving the problem of insufficient real-time performance. (2) Enhanced generalization and adaptability: By dynamically adjusting model parameters to adapt to different data distributions, a targeted adaptive mechanism is introduced. This enables the detection model to proactively perceive and adapt to data distribution drift caused by changes in the target user's geographic location, holiday effects, or normal business evolution, solving the pain points of "weak model generalization ability" and "feature distribution drift failure," and ensuring the long-term, stable effectiveness of the detection system. (3) Reduced false positive and false negative rates: Through uncertainty-aware fusion, the mechanical fusion method of simple voting or fixed weight addition is changed. This mechanism eliminates the interference of cross-border data noise, solves the problems of "high false positive rate" and "inability to distinguish abnormal but legitimate transactions," and improves user experience and system availability.

[0086] Based on the above embodiments, this application describes the process of extracting cross-border specific features. By mining the multi-dimensional quantitative features unique to cross-border payments, high-quality input is provided for subsequent detection. These multi-dimensional features specifically reflecting cross-border payment scenarios include: exchange rate fluctuation features, cross-time zone transaction time difference features, unified device fingerprint feature vectors, and multi-feature association features. The following section will combine these features with... Figure 2 Explanation:

[0087] (1) The process of extracting the exchange rate fluctuation characteristics includes the following steps:

[0088] Step 1: Collect historical exchange rate data of the trading currency according to the preset sampling interval, and use the time series decomposition algorithm to decompose the historical exchange rate data into trend, seasonal and residual terms;

[0089] Step 2: Determine the ratio of the absolute value of the residual term at the current transaction time to the mean value of the residual term in the target historical period, and determine whether the ratio exceeds the first preset threshold.

[0090] Step 3: If the ratio exceeds the first preset threshold, the exchange rate fluctuation characteristic of the current transaction is marked as abnormal; if the ratio does not exceed the first preset threshold, the exchange rate fluctuation characteristic of the current transaction is marked as normal.

[0091] In this embodiment, a time series decomposition algorithm is used to collect historical exchange rate data of the target currency at a set sampling interval, decomposing it into a trend term (reflecting long-term exchange rate trends), a seasonal term (reflecting cyclical exchange rate fluctuations), and a residual term (characterizing sudden exchange rate deviations). By setting the smoothing window parameter of the decomposition algorithm, the ratio of the absolute value of the residual term to the mean of the residual term within a specific historical period is calculated. If this ratio exceeds a first preset threshold, the exchange rate fluctuation characteristic of the transaction is marked as a specific anomaly; otherwise, it is marked as another normal characteristic. This feature can be used to capture patterns of specific fraudulent activities using short-term exchange rate fluctuations.

[0092] (2) The process of extracting the cross-time zone transaction time difference features includes the following steps:

[0093] Step 1: Convert the transaction timestamp to a unified standard time;

[0094] Step 2: Obtain the first time zone corresponding to the registered region of the transaction initiator and the second time zone corresponding to the region to which the transaction initiator IP belongs;

[0095] Step 3: Based on the unified standard time, the first time zone, and the second time zone, determine the cross-time zone time difference corresponding to the current transaction;

[0096] Step 4: Determine a reference time difference interval based on the historical transaction sample size of the transaction initiator; wherein, if the historical transaction sample size reaches a second preset threshold, the reference time difference interval is determined based on the interquartile range of the time zone difference data of the transaction initiator; if the historical transaction sample size does not reach the second preset threshold, the reference time difference interval is determined based on the statistical characteristics of the time zone difference data of users in the same region as the registration region.

[0097] Step 5: If the cross-time zone time difference value exceeds the reference time difference range, then mark the cross-time zone transaction time difference feature of the current transaction as abnormal; if the cross-time zone time difference value does not exceed the reference time difference range, then mark the cross-time zone transaction time difference feature of the current transaction as normal.

[0098] In this embodiment, all transaction timestamps are converted to a unified standard time. The time zone corresponding to the user's registered region and the time zone of the region to which the transaction initiating IP belongs are obtained, and the time difference between the two is calculated. Depending on whether the sample size of the user's historical transactions reaches a set threshold, different methods are used to determine the reference time difference interval: if the sample size meets the threshold requirement, the reference time difference interval is determined based on the interquartile range; if the sample size does not reach the threshold, the reference time difference interval is determined based on the statistical characteristics of the time zone difference between users in the same region; if the time difference value of the current transaction exceeds the above reference time difference interval, the cross-time zone transaction time difference feature of the transaction is marked as a specific abnormal identifier; otherwise, it is marked as another normal identifier. This feature can be used to identify fraudulent patterns of cross-time zone forged user behavior.

[0099] For example, consider a cross-border payment scenario: a user's registered location is France (UTC+1), but the transaction initiation IP is detected as being in Thailand (UTC+7). First, all transaction timestamps are converted to a unified standard time (e.g., UTC), and the time zone difference is calculated: the difference between France UTC+1 and Thailand UTC+7 is 6 hours. Since the interval determination method needs to be selected based on whether the user's historical transaction sample size reaches a second preset threshold, two scenarios are illustrated below:

[0100] Scenario 1: When a user's historical transaction sample size reaches a threshold (e.g., ≥100 transactions), the interquartile range (IQR) is used to determine the normal range. When a user has a sufficient number of historical transactions (e.g., 150 records), the system calculates statistical characteristics based on the user's own time zone difference data. It collects the time difference data of all transactions made by the user over a past period (e.g., a list of time difference values ​​for 150 transactions: such as [2 hours, 3 hours, 1 hour, 6 hours, ...]). It calculates the quartiles of these time difference data: the first quartile (Q1, 25th quartile) and the third quartile (Q3, 75th quartile). For example, assuming Q1 = 2 hours and Q3 = 4 hours, then IQR = Q3 - Q1 = 2 hours. Typically, the IQR method is used, with a range of [Q1 - 1.5 × IQR, Q3 + 1.5 × IQR]. In this example, the reference time difference range is [2 - 1.5 × 2, 4 + 1.5 × 2] = [-1 hour, 7 hours] (negative numbers represent the opposite time difference, but in practice, the absolute value is taken or the adjustment logic is adjusted; this is a simplification for the example). Judgment: If the current transaction's time difference (6 hours) falls within the range [-1, 7] hours, then mark "Cross-time zone transaction time difference characteristic = 0" (normal); if it exceeds this range (e.g., a time difference of 8 hours), then mark "Cross-time zone transaction time difference characteristic = 1" (abnormal).

[0101] It is evident that utilizing user behavior data offers strong personalization, accurately reflects user habits, and avoids false alarms caused by individual differences. This solves the problem of "rigid thresholds leading to misjudgments when legitimate users are using new devices for the first time."

[0102] Scenario 2: If the number of historical transactions for a user does not reach the threshold (e.g., <100), the statistical characteristics of users in the same region are used to determine the normal range. When a user is a new user or has insufficient transaction records (e.g., only 50 historical transactions), the system refers to the statistical data of users in the same region (i.e., the user group with the same registration region). This ensures the generalization of the detection and avoids misjudgment due to data sparsity. The specific process is as follows: Obtain the historical transaction time difference data of users in the same region (e.g., all users registered in France) and calculate the statistical characteristics (e.g., mean, standard deviation). Assume that the mean time difference for French users is 3 hours and the standard deviation is 1.5 hours. Determine the normal time difference range: The commonly used method is mean ± 2 standard deviations, and the range is [mean - 2 × standard deviation, mean + 2 × standard deviation]. In this example, the range is [3 - 2 × 1.5, 3 + 2 × 1.5] = [0 hours, 6 hours]. Judgment: If the time difference of the current transaction (6 hours) falls within the range [0,6] hours, then the "cross-time zone transaction time difference feature = 0" (normal); if it exceeds the range (e.g., the time difference is 7 hours), then the "cross-time zone transaction time difference feature = 1" (abnormal).

[0103] As can be seen, this method compensates for the lack of data and improves the reliability of detection in scenarios involving new users or low-frequency transactions. This helps to solve the problem of "weak model generalization ability" and ensures stability when promoted across regions.

[0104] (3) The process of extracting the unified feature vector of the device fingerprint includes the following steps:

[0105] Step 1: Obtain the original device fingerprint characteristics of the device initiating the transaction;

[0106] Step 2: If the dimension of the original device fingerprint feature is lower than the preset dimension, then the original device fingerprint feature is mapped to the preset dimension through the embedding layer;

[0107] Step 3: If the dimension of the original device fingerprint feature is higher than the preset dimension, then the original device fingerprint feature is converted to the preset dimension through dimensionality reduction processing;

[0108] Step 4: Use the processed feature vector of the preset dimension as the unified feature vector of the device fingerprint.

[0109] In this embodiment, for devices with low-dimensional features (such as feature phones), the embedding layer maps them to a preset dimension vector; for devices with high-dimensional features (such as smartphones), PCA (Principal Component Analysis) is used to reduce the dimensionality and transform them to a preset dimension vector; thus, the dimensions of fingerprints from different devices are unified and labeled as a unified feature vector of device fingerprints.

[0110] (4) The process of extracting the multi-feature association features includes the following steps:

[0111] Step 1: Using an association rule mining algorithm, association rules are mined from historical transaction data according to a preset period; wherein, the association rules are generated based on at least two of the following dimensions: device type, transaction amount, time zone difference, and exchange rate fluctuation characteristics, and are generated according to preset support and confidence levels.

[0112] Step 2: Determine whether the current transaction conforms to the association rules;

[0113] Step 3: If the current transaction conforms to the association rule, then mark the multi-feature association feature of the current transaction as abnormal; if the current transaction does not conform to the association rule, then mark the multi-feature association feature of the current transaction as normal.

[0114] In this embodiment, an association rule mining algorithm (such as the Apriori algorithm) is used, with device type, transaction amount, time zone difference, and exchange rate fluctuation characteristics as association dimensions, and relevant parameter thresholds for association rules are set. If a transaction matches a preset combination of association rules, the multi-feature association characteristics of the transaction are marked as a specific anomaly identifier; otherwise, they are marked as another normal identifier. This feature can be used to capture fraud patterns combining multiple dimensions. Furthermore, when the detection model is subsequently updated using a dual-mechanism dynamic adaptation, association rules are regenerated at a set period.

[0115] Based on the above embodiments, the processing steps of the progressive hybrid detection layers in this application embodiment are combined with... Figure 3 The explanation includes the following steps:

[0116] Step 1: Match the multi-dimensional features according to preset rules through the first level;

[0117] Step 2: If the match is successful, the transaction is determined to be a low-risk transaction and the result is output. If the match fails, the transaction is input into the second level.

[0118] In this embodiment, the first level uses a lightweight rule engine for filtering. Based on multi-dimensional features generated through dedicated feature engineering, a certain number of preset rules are constructed. A forward matching algorithm is used to match the multi-dimensional features with each rule. Transactions that match successfully are judged as low-risk and the result is output directly. Unmatched transactions proceed to the next level. This method quickly filters out most legitimate transactions, reducing subsequent computation. It also completes single-transaction matching within a set time limit, achieving a filtering rate of ≥80% and a processing time of ≤10ms, ensuring efficient filtering of legitimate transactions.

[0119] Step 3: Through the second level, the gradient boosting decision tree model is used to reason about the feature vector composed of the multi-dimensional features and the basic transaction features to output the transaction fraud probability; the basic transaction features include transaction amount, device identifier, and user registration duration;

[0120] Step 4: If the transaction fraud probability is lower than the third preset threshold, the transaction is determined to be a low-to-medium risk transaction and the result is output. If the transaction fraud probability is not lower than the third preset threshold, the transaction is determined to be a medium-to-high risk transaction and the transaction is input into the third level.

[0121] In this embodiment, the second layer employs supervised learning to achieve accurate detection. An eXtreme Gradient Boosting (XGBoost) model is selected, and corresponding model parameter configurations are set. In the data preprocessing stage, a combination of synthetic minority class oversampling and edit-nearest neighbor methods is used. Oversampling adjusts the proportion of minority class samples, and the edit-nearest neighbor method removes abnormal samples overlapping with majority class samples to address data imbalance. Feature input consists of multi-dimensional features (such as abnormal exchange rates, abnormal time zones, device fingerprint vectors, and abnormal associations) and traditional basic transaction features (such as transaction amount, device identifier, and user registration duration). The output is the transaction fraud probability, and transactions are classified as medium-high risk or medium-low risk based on a third preset threshold. Medium-high risk transactions proceed to the next layer, while medium-low risk transactions are directly output. Single-transaction inference is completed within a set timeframe to ensure the accuracy of known fraud detection.

[0122] Step 5: Through the third level, use the variational autoencoder model to perform anomaly identification on the multi-dimensional features in order to determine the target reconstruction error corresponding to the transaction;

[0123] Step 6: When the target reconstruction error exceeds the fourth preset threshold, the transaction is determined to be a high-risk transaction; the fourth preset threshold is determined based on the reconstruction error of transaction samples that have been determined to be normal.

[0124] In this embodiment, the third layer employs unsupervised learning to capture unknowns. A variational autoencoder is used, whose network structure consists of an encoder and a decoder. The encoder is a 3-layer fully connected network. The input layer dimension is consistent with the features of the previous layer. After processing through several intermediate-dimensional hidden layers, the final output is a latent vector layer containing the mean and variance. The decoder is also a multi-layer fully connected network. Starting from the latent vector layer, it is processed through several intermediate-dimensional hidden layers, and the final output is the same as the input layer dimension.

[0125] The training objective is to minimize the combination of reconstruction error and KL divergence to ensure that the latent vectors follow a Gaussian distribution. During inference, the reconstruction error of a transaction is calculated; if this error exceeds a threshold determined based on the reconstruction error of normal transaction samples, it is classified as "high-risk." Single-transaction inference is completed within a set timeframe to ensure effective detection of unknown fraud.

[0126] Based on the above embodiments, this application describes the process of dynamically adjusting the parameters of the supervised learning model and / or the unsupervised learning model according to the geographical attributes or data distribution changes of the transaction to adapt to different data distributions:

[0127] (1) When the difference in feature distribution between the source domain and the target domain exceeds a fifth preset threshold based on the multi-dimensional features, the supervised learning model and / or the unsupervised learning model are trained in a domain-adaptive manner using samples containing the source domain and the target domain.

[0128] In one specific implementation, a cross-regional domain adaptive mechanism is employed. At the technical implementation level, a three-module network structure comprising a "feature extractor, domain classifier, and task classifier" is constructed using a domain adaptive network. The feature extractor reuses the feature input from the previous step model and maps it to shared features of a specific dimension. The domain classifier employs a multi-layer fully connected network structure to output the probability of a sample belonging to the "source domain / target domain." The task classifier, which is the gradient boosting decision tree model from the previous layer, is responsible for outputting the probability of transaction fraud. The training trigger mechanism calculates the feature distribution difference between the source and target domains using the maximum mean difference (MMD). When the MMD calculation result exceeds a set threshold, a certain amount of samples from both the source and target domains are used to trigger domain adaptive training. This method can control the decrease in cross-regional detection accuracy to a low level, significantly lower than the accuracy decrease level of existing purely supervised models.

[0129] (2) Based on the sliding window mechanism, when the number of transactions of the determined type accumulated in the sliding window reaches a preset number, the supervised learning model and / or the unsupervised learning model are incrementally updated.

[0130] In another specific implementation, a real-time incremental training mechanism is adopted. At the technical implementation level, this solution uses a sliding window incremental training mode, setting a preset window size. When a set number of newly labeled transactions (including legitimate and fraudulent transactions) are accumulated, an incremental training is triggered.

[0131] For the supervised learning model XGBoost, the tree structure of the historical model is preserved, the weights of the leaf nodes corresponding to the new samples are updated only, and the learning rate of the new samples is set to a value lower than the initial learning rate to avoid overwriting the historical learning knowledge.

[0132] For unsupervised learning models (VAE), a "weight interpolation update" strategy is adopted, in which the new model weights are composed of the historical model weights and the new weights obtained from training on new samples in a preset ratio to ensure the stability of the model operation.

[0133] In the feature update stage, when new samples accumulate to a set number, the target parameters for extracting multi-dimensional features are updated. The update of the target parameters includes: recalculating the support and confidence of the association rule mining algorithm used to extract the multi-feature association anomaly features; and refitting the trend term in the time series decomposition algorithm used to extract the exchange rate fluctuation anomaly features according to a preset period.

[0134] In terms of technical parameters, the incremental training time is controlled within a short range, and the model adaptation lag time is maintained within a short duration, which is significantly better than the existing technical solution of "periodic full training".

[0135] Based on the above embodiments, this application describes the process of generating the final risk score. By fusing the results of three layers of detection, the judgment bias caused by cross-border data noise is eliminated, and false positives and false negatives are reduced.

[0136] The uncertainty of the detection results output by the first level, the second level and the third level are quantified respectively, and dynamic weights are assigned to each level according to the level of uncertainty quantification results.

[0137] The final risk score is obtained by multiplying the detection results output by the first level, the second level, and the third level by their respective dynamic weights and summing the results.

[0138] In this embodiment, the uncertainty of the detection results at each level is first quantified, wherein: the uncertainty of the first level is determined based on the dispersion of the number of rules for transaction matching; the higher the dispersion, the higher the uncertainty, and vice versa; the uncertainty of the second level is determined based on the information entropy calculated from the fraud probability output by the supervised learning model; the larger the entropy value, the higher the uncertainty, and the smaller the entropy value, the lower the uncertainty; the uncertainty of the third level is determined based on the fluctuation of the reconstruction error output by the unsupervised learning model; the larger the fluctuation, the higher the uncertainty, and the smaller the fluctuation, the lower the uncertainty.

[0139] Furthermore, in anti-fraud detection, the results of different detection layers are synthesized through weighting rules. Specifically, dynamic weights are assigned to each layer based on the level of uncertainty, with higher weights assigned to layers with lower uncertainty and lower weights assigned to layers with higher uncertainty, and the sum of the weights of the three layers is 1. The detection results output by each layer are multiplied by their corresponding dynamic weights and then summed to obtain the final risk score. By setting a judgment threshold, the determination of whether a transaction is fraudulent is achieved. This method performs excellently in controlling false positive and false negative rates, outperforming similar hybrid models.

[0140] like Figure 4The diagram illustrates a two-tier deployment architecture and data flow process related to cross-border payments: The cross-border payment gateway deployment includes a data acquisition unit (collecting transaction / device / IP data, sampling at 1000Hz, packet loss rate ≤0.1%), which transmits the collected data to the data center deployment via a data transmission link; the data center deployment sequentially includes a feature processing unit (outputting 512-dimensional features, time ≤5ms), an adaptation and update unit (responsible for updating Apriori rules / STL trend items and performing incremental training / domain adaptation, time ≤5 minutes), a detection and calculation unit (using a CPU+FPGA combination to implement a rule engine + XGBoost, VAE acceleration, time 12ms), and a decision output unit (outputting "intercept / allow" instructions, response ≤5ms, throughput ≥100,000 times / second), which finally transmits the instructions to the cross-border payment system. A specific example is provided below to illustrate the above. Taking "a European user (registered region: France, time zone UTC+1) initiating a $10,000 cross-border payment to Southeast Asia (Thailand, time zone UTC+7) via smartphone" as an example, the implementation process of this invention is explained in detail:

[0141] 1. Implementation of cross-border exclusive feature engineering.

[0142] 1.1. Multi-currency exchange rate fluctuation characteristics: Obtain the USD-THB exchange rate over the past 24 hours (5-minute sampling). After STL decomposition, the ratio of the absolute value of the residual term to the mean of the previous 7 days is 3.2 (>2.5), and mark "Exchange rate anomaly characteristic = 1".

[0143] 1.2. Cross-time zone time difference characteristics: After unifying the timestamp to UTC, the time difference between France UTC+1 and Thailand UTC+7 is 6 hours. The quartile range of the user's historical transaction time zone difference is 0-4 hours. If it exceeds the range, it is marked as "Time zone abnormality characteristic = 1".

[0144] 1.3. Heterogeneous features of device fingerprints: The high-dimensional features of smartphones were reduced to 64-dimensional vectors by PCA, and labeled "Unified feature vector of device fingerprint = [0.12, 0.35, ... 0.08]" (cumulative variance contribution rate 96%).

[0145] 1.4. Multi-feature association features: Transactions that satisfy the Apriori association rule "Smartphone + Amount > $5,000 + Time zone difference > 4 hours + Abnormal exchange rate = 1" (support 0.06, confidence 0.82) are marked as "Association anomaly feature = 1".

[0146] 2. Three-level progressive testing implementation.

[0147] 2.1. First-level rule engine: The transaction "Exchange rate anomaly = 1 + Time zone anomaly = 1 + Association anomaly = 1" did not match any valid rules, proceeding to the second level;

[0148] 2.2. Second layer XGBoost: Input a 512-dimensional feature vector (including the above multi-dimensional features + traditional features), output a fraud probability of 85 (≥70), determine "medium to high risk", and proceed to the third layer;

[0149] 2.3. Third-layer VAE: The calculated transaction reconstruction error is 0.85, which exceeds the 99th percentile (0.6) of 100,000 normal samples, and is judged as "high risk".

[0150] 3. Dynamic adaptation and implementation of dual mechanisms.

[0151] 3.1. Cross-regional domain adaptation: The MMD value between the source domain (Europe) and the target domain (Southeast Asia) is 0.08 (<0.1), so no domain adaptation training is required;

[0152] 3.2. Real-time incremental training: The current sliding window has accumulated 480 new samples, which has not yet reached the 500-sample trigger threshold. The model continues to use historical weights.

[0153] 4. Implementation of uncertainty perception fusion.

[0154] 4.1. Uncertainty Quantification: Variance of the number of matching rules in the rule engine = 1.2 (low uncertainty), XGBoost entropy = 0.35 (medium uncertainty), VAE standard deviation = 2.8 (medium uncertainty);

[0155] 4.2. Weight Allocation: Rule Engine weight 0.2, XGBoost weight 0.4, VAE weight 0.4;

[0156] 4.3. Final risk score = 1×0.2 + 85 / 100×0.4 + 1×0.4 = 0.2 + 0.34 + 0.4 = 0.94 (≥0.6), which is judged as "fraudulent transaction" and triggers payment interception.

[0157] In this embodiment, the total time for single transaction detection is 42ms (8ms for rule engine + 14ms for XGBoost + 20ms for VAE), successfully identifying cross-border fraud involving "high amount + cross-time zone + abnormal exchange rate", thus verifying the effectiveness of the present invention.

[0158] Accordingly, this application also discloses a risk detection device for cross-border payment transactions, see [link to relevant documentation]. Figure 5 As shown, the device includes:

[0159] The feature extraction module 11 is used to acquire the cross-border payment transaction data to be detected, and extract multi-dimensional features from the cross-border payment transaction data that specifically reflect the cross-border payment scenario;

[0160] The hybrid detection module 12 is used to sequentially input the multi-dimensional features into a preset progressive hybrid detection layer for processing; the progressive hybrid detection layer includes: a first layer, used to quickly filter transactions based on preset rules; a second layer, used to predict the fraud probability of the transactions based on a supervised learning model; and a third layer, used to capture unknown risks of the transactions based on an unsupervised learning model.

[0161] The model adaptation module 13 is used to dynamically adjust the parameters of the supervised learning model and / or the unsupervised learning model according to the geographical attributes or data distribution changes of the transaction, so as to adapt to different data distributions.

[0162] The anti-fraud determination module 14 is used to perform weighted fusion based on the detection results output by the first level, the second level and the third level respectively, and their corresponding uncertainty quantification results, to generate a final risk score, and generate an anti-fraud determination for the transaction based on the final risk score.

[0163] For more detailed information on the working process of each of the above modules, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0164] It can be seen that, through the above-mentioned scheme in this embodiment, by extracting multiple dimensions of features reflecting the unique risks of cross-border payments, the risk signals unique to cross-border scenarios such as exchange rate fluctuations, cross-time zone behavior, and device fingerprint heterogeneity are systematically mined and utilized. This provides high-quality and highly discriminative input features for all subsequent detection levels, fundamentally solving the problem of insufficient expression and inaccurate characterization of general anti-fraud features in cross-border scenarios, and laying a solid foundation for improving overall detection performance. Furthermore, (1) Improve detection efficiency and real-time performance: Through the design of a three-level progressive hybrid detection, the first level with minimal computational cost quickly filters most obviously legitimate transactions, the second level uses a highly accurate supervised learning model to process known fraud patterns, and finally the unsupervised learning model captures new unknown risks. This division of labor and relay mechanism of "from fast to accurate, from known to unknown" ensures the ability to detect complex and new frauds while concentrating overall computing resources on a few suspicious transactions, greatly reducing computation time and solving the problem of insufficient real-time performance. (2) Enhanced generalization and adaptability: By dynamically adjusting model parameters to adapt to different data distributions, a targeted adaptive mechanism is introduced. This enables the detection model to proactively perceive and adapt to data distribution drift caused by changes in the target user's geographic location, holiday effects, or normal business evolution, solving the pain points of "weak model generalization ability" and "feature distribution drift failure," and ensuring the long-term, stable effectiveness of the detection system. (3) Reduced false positive and false negative rates: Through uncertainty-aware fusion, the mechanical fusion method of simple voting or fixed weight addition is changed. This mechanism eliminates the interference of cross-border data noise, solves the problems of "high false positive rate" and "inability to distinguish abnormal but legitimate transactions," and improves user experience and system availability.

[0165] Furthermore, embodiments of this application also disclose an electronic device, Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0166] Figure 6 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the risk detection method for cross-border payment transactions disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be a computer.

[0167] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0168] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, etc. The resources stored on it can include an operating system 221, computer programs 222, and data 223, etc. The data 223 can include various types of data. The storage method can be temporary storage or permanent storage.

[0169] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the risk detection method for cross-border payment transactions executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0170] Furthermore, this application also discloses a computer-readable storage medium, which includes random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, magnetic disks, optical disks, or any other form of storage medium known in the art. The computer program, when executed by a processor, implements the aforementioned risk detection method for cross-border payment transactions. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0171] Furthermore, embodiments of this application also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements any of the above-described risk detection methods for cross-border payment transactions.

[0172] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0173] The steps of the risk detection method or algorithm for cross-border payment transactions described in conjunction with the embodiments disclosed herein can be implemented directly using hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0174] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0175] The above provides a detailed description of the risk detection method, apparatus, equipment, and medium for cross-border payment transactions provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only intended to help understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A risk detection method for cross-border payment transactions, characterized in that, include: Obtain cross-border payment transaction data to be detected, and extract multi-dimensional features from the cross-border payment transaction data to specifically reflect the cross-border payment scenario; The multi-dimensional features are sequentially input into a preset progressive hybrid detection layer for processing; The progressive hybrid detection hierarchy includes: a first level for quickly filtering transactions based on preset rules; a second level for predicting the fraud probability of the transactions based on a supervised learning model; and a third level for capturing unknown risks of the transactions based on an unsupervised learning model. Based on the geographical attributes or data distribution changes of the transactions, the parameters of the supervised learning model and / or the unsupervised learning model are dynamically adjusted to adapt to different data distributions; The detection results output from the first level, the second level, and the third level, along with their respective uncertainty quantification results, are weighted and fused to generate a final risk score. Based on the final risk score, an anti-fraud determination for the transaction is generated.

2. The risk detection method for cross-border payment transactions according to claim 1, characterized in that, The multi-dimensional features include: exchange rate fluctuation features, cross-time zone transaction time difference features, unified feature vector of device fingerprint, and multi-feature association features.

3. The risk detection method for cross-border payment transactions according to claim 2, characterized in that, Extracting the exchange rate fluctuation characteristics includes: Historical exchange rate data of the trading currency is collected according to a preset sampling interval, and the historical exchange rate data is decomposed into trend, seasonal and residual terms using a time series decomposition algorithm. Determine the ratio of the absolute value of the residual term at the current transaction time to the mean value of the residual term in the target historical period, and determine whether the ratio exceeds a first preset threshold. If the ratio exceeds the first preset threshold, the exchange rate fluctuation characteristic of the current transaction is marked as abnormal; if the ratio does not exceed the first preset threshold, the exchange rate fluctuation characteristic of the current transaction is marked as normal.

4. The risk detection method for cross-border payment transactions according to claim 2, characterized in that, Extracting the cross-time zone transaction time difference features includes: Convert transaction timestamps to a unified standard time; Obtain the first time zone corresponding to the registered region of the transaction initiator and the second time zone corresponding to the region to which the transaction initiator's IP belongs; Based on the unified standard time, the first time zone, and the second time zone, determine the cross-time zone time difference corresponding to the current transaction; A reference time difference interval is determined based on the historical transaction sample size of the transaction initiator; wherein, if the historical transaction sample size reaches a second preset threshold, the reference time difference interval is determined based on the interquartile range of the time zone difference data of the transaction initiator; if the historical transaction sample size does not reach the second preset threshold, the reference time difference interval is determined based on the statistical characteristics of the time zone difference data of users in the same region as the registration region. If the cross-time zone time difference value exceeds the reference time difference range, the cross-time zone transaction time difference feature of the current transaction is marked as abnormal; if the cross-time zone time difference value does not exceed the reference time difference range, the cross-time zone transaction time difference feature of the current transaction is marked as normal.

5. The risk detection method for cross-border payment transactions according to claim 2, characterized in that, Extracting the unified feature vector of the device fingerprint, including: Obtain the original device fingerprint characteristics of the device initiating the transaction; If the dimension of the original device fingerprint feature is lower than the preset dimension, the original device fingerprint feature is mapped to the preset dimension through an embedding layer; If the dimension of the original device fingerprint feature is higher than the preset dimension, then the original device fingerprint feature is converted to the preset dimension through dimensionality reduction processing. The processed feature vector of the preset dimension is used as the unified feature vector of the device fingerprint.

6. The risk detection method for cross-border payment transactions according to claim 2, characterized in that, Extracting the multi-feature association features includes: The association rule mining algorithm is used to mine association rules from historical transaction data according to a preset period. The association rules are generated based on at least two of the following dimensions: device type, transaction amount, time zone difference, and exchange rate fluctuation characteristics, and are generated according to preset support and confidence levels. Determine whether the current transaction conforms to the association rules; If the current transaction conforms to the association rule, then the multi-feature association feature of the current transaction is marked as abnormal; if the current transaction does not conform to the association rule, then the multi-feature association feature of the current transaction is marked as normal.

7. The risk detection method for cross-border payment transactions according to claim 1, characterized in that, The step of sequentially inputting the multi-dimensional features into a preset progressive hybrid detection layer for processing includes: The multi-dimensional features are matched according to the preset rules through the first level; If a match is found, the transaction is determined to be a low-risk transaction and the result is output. If a match fails, the transaction is input into the second level. Through the second level, the gradient boosting decision tree model is used to reason about the feature vector composed of the multi-dimensional features and the basic transaction features to output the transaction fraud probability; the basic transaction features include transaction amount, device identifier, and user registration duration. If the transaction fraud probability is lower than the third preset threshold, the transaction is determined to be a low-to-medium risk transaction and the result is output. If the transaction fraud probability is not lower than the third preset threshold, the transaction is determined to be a medium-to-high risk transaction and the transaction is input into the third level. Through the third level, the variational autoencoder model is used to identify anomalies in the multi-dimensional features in order to determine the target reconstruction error corresponding to the transaction. When the target reconstruction error exceeds the fourth preset threshold, the transaction is determined to be a high-risk transaction; the fourth preset threshold is determined based on the reconstruction error of transaction samples that have been determined to be normal.

8. The risk detection method for cross-border payment transactions according to claim 1, characterized in that, Based on the geographical attributes or data distribution changes of the transactions, the parameters of the supervised learning model and / or the unsupervised learning model are dynamically adjusted to adapt to different data distributions, including: When the difference in feature distribution between the source domain and the target domain exceeds a fifth preset threshold based on the multi-dimensional features, the supervised learning model and / or the unsupervised learning model are trained using samples containing the source domain and the target domain in a domain-adaptive manner. Based on the sliding window mechanism, when the number of transactions of the identified type accumulated within the sliding window reaches a preset number, the supervised learning model and / or the unsupervised learning model are incrementally updated.

9. The risk detection method for cross-border payment transactions according to any one of claims 1 to 8, characterized in that, The detection results output from the first, second, and third levels, along with their corresponding uncertainty quantification results, are weighted and fused to generate a final risk score, including: The uncertainty of the detection results output by the first level, the second level and the third level are quantified respectively, and dynamic weights are assigned to each level according to the level of uncertainty quantification results. The final risk score is obtained by multiplying the detection results output by the first level, the second level, and the third level by their respective dynamic weights and summing the results.

10. A risk detection device for cross-border payment transactions, characterized in that, include: The feature extraction module is used to acquire cross-border payment transaction data to be detected, and extract multi-dimensional features from the cross-border payment transaction data that specifically reflect the cross-border payment scenario; The hybrid detection module is used to sequentially input the multi-dimensional features into a preset progressive hybrid detection layer for processing; The progressive hybrid detection hierarchy includes: a first level for quickly filtering transactions based on preset rules; a second level for predicting the fraud probability of the transactions based on a supervised learning model; and a third level for capturing unknown risks of the transactions based on an unsupervised learning model. The model adaptation module is used to dynamically adjust the parameters of the supervised learning model and / or the unsupervised learning model according to the geographical attributes or data distribution changes of the transaction, so as to adapt to different data distributions. The anti-fraud determination module is used to perform weighted fusion based on the detection results output by the first level, the second level and the third level respectively, as well as the corresponding uncertainty quantification results, to generate a final risk score, and to generate an anti-fraud determination for the transaction based on the final risk score.

11. An electronic device, characterized in that, The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the risk detection method for cross-border payment transactions as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein the computer programs, when executed by a processor, implement the risk detection method for cross-border payment transactions as described in any one of claims 1 to 9.

Images