Abnormal transaction detection method and device, medium and product

Abstract

The invention discloses an abnormal transaction detection method and device, a medium and a product. The method relates to the field of financial transaction anomaly detection and can be applied to the technical field of finance. Performing first-order difference operation on the transaction time sequence data to obtain a change rate sequence; performing second-order difference operation on the transaction time sequence data to obtain a change acceleration sequence; and determining an abnormal transaction detection result according to the change rate sequence and the change acceleration sequence. Through the technical scheme of the invention, discrete mathematics and financial risk control are combined, the relationship between transaction data variables and the change condition are concrete through the difference equation, the instantaneous change rate and the acceleration of transaction characteristics are captured, then whether the user transaction condition is reasonable or not is evaluated, abnormal transactions are detected through analysis, and the user transaction risk control accuracy is improved. The adaptive defect of a traditional static rule is overcome, and mistaken interception of normal transactions of a user is avoided.

Description

Technical Field

[0001] The embodiments of the present invention relate to the fields of financial technology and difference equation calculation technology, and in particular to an abnormal transaction detection method, device, medium and product. Background Technology

[0002] With technological advancements, new financial attack surfaces are constantly emerging. Current abnormal transactions often manifest as sudden changes, accelerations, or deviations from expected trading trends within normal trading patterns. Traditional threshold rules, requiring fixed preset parameters, are ill-suited to diverse scenarios. Covering multiple scenarios necessitates layering multiple rules, leading to a surge in system complexity and a high false positive rate. Normal transactions are easily intercepted by triggering edge rules, and maintenance costs are high, requiring monthly manpower to update and maintain the rule base, making it difficult to handle new and complex abnormal transaction detection. Therefore, an effective abnormal transaction detection method is urgently needed, which is crucial for maintaining economic order. Summary of the Invention

[0003] This invention provides an abnormal transaction detection method, device, medium, and product, which can visualize the relationship and changes between transaction data variables through difference equations, thereby assessing whether the user's transaction situation is reasonable, and detecting abnormal transactions through analysis.

[0004] According to one aspect of the present invention, an abnormal transaction detection method is provided, comprising:

[0005] Obtain transaction time-series data;

[0006] Perform a first-order difference operation on the transaction time series data to obtain a rate of change sequence;

[0007] The transaction time series data is subjected to second-order difference operation to obtain the change acceleration sequence;

[0008] The abnormal transaction detection result is determined based on the rate of change sequence and the acceleration sequence.

[0009] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0010] At least one processor; and

[0011] A memory communicatively connected to the at least one processor; wherein,

[0012] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the abnormal transaction detection method according to any embodiment of the present invention.

[0013] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the abnormal transaction detection method according to any embodiment of the present invention.

[0014] According to another aspect of the present invention, embodiments of the present invention also provide a computer program product, the computer program product including a computer program, which, when executed by a processor, implements the abnormal transaction detection method described in any embodiment of the present invention.

[0015] This invention acquires transaction time-series data, first performs a first-order difference operation on the data to obtain a rate of change sequence, then performs a second-order difference operation to obtain a rate of change acceleration sequence, and finally determines the abnormal transaction detection result based on the rate of change sequence and the rate of change acceleration sequence. This invention combines discrete mathematics with financial risk control, using difference equations to visualize the relationships and changes between transaction data variables, capturing the instantaneous rate of change and acceleration of transaction characteristics, thereby assessing the rationality of user transactions and detecting abnormal transactions through analysis. This overcomes the adaptability limitations of traditional static rules and avoids falsely intercepting normal user transactions.

[0016] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of an abnormal transaction detection method according to an embodiment of the present invention;

[0019] Figure 2 This is an overall flowchart of an application of difference equations in abnormal transaction detection in an embodiment of the present invention;

[0020] Figure 3 This is a schematic diagram of the structure of an abnormal transaction detection device according to an embodiment of the present invention;

[0021] Figure 4 This is a schematic diagram of the structure of an electronic device that implements the abnormal transaction detection method of this invention. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and their derivatives, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0025] Example 1

[0026] Figure 1 This is a flowchart of an abnormal transaction detection method according to an embodiment of the present invention. This embodiment is applicable to the detection of abnormal financial transactions. The method can be executed by the abnormal transaction detection device in this embodiment of the present invention, which can be implemented in software and / or hardware, such as... Figure 1 As shown, the method specifically includes the following steps:

[0027] S101. Obtain transaction time series data.

[0028] In this embodiment, the transaction time series data can be various time series data generated by the user during the transaction process, such as the transaction frequency, amount, time interval, geographical location changes, etc. of a single account.

[0029] In the specific implementation of this method, the first step is to establish a difference equation model. As a discrete dynamic modeling tool, difference equations can effectively characterize the temporal correlation features in financial transaction data, providing a quantitative analysis framework for anomaly transaction detection. By establishing a difference equation model, the nonlinear variation patterns in the transaction sequence can be accurately captured, thereby achieving dynamic early warning of anomaly patterns.

[0030] In anomaly detection, the construction of difference equation models relies on high-quality transaction data, and parameter estimation is used to characterize the dynamic features of anomaly transactions. Therefore, it is necessary to collect various types of data generated during transactions. For example, the required data mainly includes: transaction time-series data (such as transaction frequency, amount, time interval, and geographical location changes for a single account), user behavior characteristics (login device, operating habits, biometric authentication data), market environment variables (market fluctuations, transaction trends of similar products, blacklisted addresses / device information), and historical anomaly transaction cases. Then, depending on the different scenario types, methods such as least squares, maximum likelihood estimation, and recursive least squares can be selected for parameter estimation.

[0031] Specifically, difference equation models can provide early warnings of potential future anomalies based on historical trading data. By solving the difference equations, the evolutionary trend of trading behavior can be quantified, and potential abnormal trading patterns can be identified. For example, recursive solutions use low-order linear difference equations to iteratively calculate abnormal trading risk indicators for future time periods; eigenvalue methods are used to analyze system stability and determine whether abnormal trading patterns will continue to spread; numerical solutions handle nonlinear difference equations and are suitable for modeling complex abnormal trading patterns.

[0032] S102. Perform first-order difference operation on the transaction time series data to obtain the rate of change sequence.

[0033] In this embodiment, performing a first-order difference operation on the transaction time-series data can be represented as follows:

[0034] ;

[0035] The first-order difference equation reflects the instantaneous rate of change of the sequence through the perpendicular distance between adjacent data points. Among them, It represents the difference (change) at time point t. The observations of a time series at time t are generally composed of user basic consumption patterns, seasonal trends, random reasonable fluctuations, and abnormal transaction signals. This represents the observation value at time (t-1) preceding time t.

[0036] Specifically, first-order difference operations can be performed on transaction time-series data to obtain the time-series difference of transaction characteristics, i.e., the rate of change sequence.

[0037] S103. Perform second-order difference operation on the transaction time series data to obtain the changing acceleration sequence.

[0038] In this embodiment, performing a second-order difference operation on the transaction time-series data can be represented as follows:

[0039] ;

[0040] Second-order difference equations can measure the curvature changes of a trading sequence, reflecting the acceleration or deceleration of trends in time-series data such as trading amounts. This represents the second difference value at time point t (i.e., the acceleration of the change in trading). Indicates the current time value; This represents the value of the previous unit of time. This represents the value of the two units preceding the current time.

[0041] Specifically, the rate of change sequence can be differentially analyzed again to obtain the change acceleration sequence corresponding to the transaction time series data.

[0042] S104. Determine the abnormal transaction detection results based on the rate of change sequence and the acceleration sequence.

[0043] It should be noted that the abnormal transaction detection result can be the result of detecting whether a transaction is abnormal. For example, the abnormal transaction detection result can be either that the transaction is abnormal or that it is not abnormal.

[0044] Specifically, this embodiment replaces the traditional absolute value detection by calculating the first-order difference (rate of change) and second-order difference (acceleration of change) of transaction features. The first-order difference equation reflects the rate of change of transaction features, and the second-order difference equation describes the acceleration of change. This multi-order difference combination can more sensitively capture the more diverse abnormal patterns of current abnormal transactions, and finally jointly determine the abnormal transaction detection result.

[0045] This invention acquires transaction time-series data, first performs a first-order difference operation on the data to obtain a rate of change sequence, then performs a second-order difference operation to obtain a rate of change acceleration sequence, and finally determines the abnormal transaction detection result based on the rate of change sequence and the rate of change acceleration sequence. This invention combines discrete mathematics with financial risk control, using difference equations to visualize the relationships and changes between transaction data variables, capturing the instantaneous rate of change and acceleration of transaction characteristics, thereby assessing the rationality of user transactions and detecting abnormal transactions through analysis. This overcomes the adaptability limitations of traditional static rules and avoids falsely intercepting normal user transactions.

[0046] Optionally, the abnormal transaction detection results are determined based on the rate of change sequence and the acceleration of change sequence, including:

[0047] The first detection result is determined based on the rate of change sequence.

[0048] In this embodiment, the first detection result can be the abnormal transaction detection result obtained by performing a first-order difference operation on the transaction time series data to obtain a rate of change sequence and analyzing the rate of change sequence.

[0049] In the specific implementation process, the following abnormal transaction situations can be detected based on the rate of change sequence:

[0050] A) Sudden Change in Single Transaction Amount: Calculate the difference between the current transaction amount and the previous transaction amount. A fluctuation range far exceeding the user's historical normal range. This may indicate an abnormal transaction.

[0051] B) Transaction frequency mutation: Calculate the time interval between two consecutive transactions. An unusually short (For example, a value much smaller than the historical normal interval over a period of time) may indicate a dense concentration of abnormal transactions.

[0052] C) Cumulative Amount / Frequency Changes: By performing first-order differencing on the cumulative transaction amount or transaction frequency sequence, sudden surges in consumption amount or transaction frequency within a specific time window (such as 1 hour or 1 day) can be detected.

[0053] For example, suppose transaction sequence A: each user's transaction is [100, 150, 80, 120], corresponding to a first-order difference ΔX = [50, -70, 40]. Transaction sequence B: each user's transaction is [100, 150, 5000, 5100], corresponding to a first-order difference ΔX = [50, 4850, 100]. It is evident that the abnormal difference value of transaction sequence B is significantly higher than the normal value, thus indicating that transaction sequence B may contain abnormal transactions.

[0054] The second detection result is determined based on the changing acceleration sequence.

[0055] In this embodiment, the second detection result can be the abnormal transaction detection result obtained by performing a second-order difference operation on the transaction time series data to obtain a changing acceleration sequence and analyzing the changing acceleration sequence.

[0056] In practical implementation, the second-order difference equation can identify abnormal trading behavior through abnormal acceleration trends, while the first-order difference equation... It is highly likely to be a one-time, large, abnormal transaction, if the second difference is used. A sudden large difference indicates a dramatic change in the rate of change itself. Specifically, the following abnormal trading patterns can be detected based on the acceleration sequence of changes:

[0057] a) The beginning of abnormal transaction behavior: from normal small consumption to continuous large abnormal transactions (the first difference jumps from near 0 to a very large positive value, causing the second difference to have a large positive value).

[0058] b) Switching from abnormal transaction patterns: from attempting small transactions (smaller positive...) Suddenly it turned into a flurry of large-volume transactions (very positive) This leads to large positive values ​​in the second-order difference.

[0059] c) The "aggregation" or "distribution" phase in abnormal transactions: The speed at which funds flow into or out of the card suddenly accelerates.

[0060] d) Detecting a sudden increase in trading volatility: When monitoring fluctuations in trading frequency or login behavior, large second-order differences indicate that the stability of the behavior has been suddenly broken.

[0061] For example, consider transaction sequence A: each user's transaction [100, 150, 80, 120] corresponds to a first-order difference ΔX = [50, -70, 40] and a second-order difference Δ²X = [-120, 110]. Transaction sequence B: each user's transaction [100, 150, 5000, 5100] corresponds to a first-order difference ΔX = [50, 4850, 100] and a second-order difference Δ²X = [4800, -4750]. It is evident that transaction sequence B exhibits abnormal acceleration and deceleration, suggesting an abnormal transaction risk.

[0062] The abnormal transaction detection results are determined based on the first and second detection results.

[0063] Specifically, the detection results obtained by analyzing the first-order difference (rate of change) and the second-order difference (acceleration of change) of the transaction characteristics are finally used to jointly determine the abnormal transaction detection results.

[0064] The technical solution of this invention calculates the first-order difference (rate of change) and the second-order difference (acceleration of change) of trading characteristics. The first-order difference equation reflects the rate of change of trading characteristics, and the second-order difference equation describes the acceleration of change. By combining multiple differences (first-order + second-order), diverse abnormal patterns are covered, long-term trend interference of trading is removed, and short-term mutation signals are amplified. This enables more sensitive capture of more diverse abnormal patterns of current abnormal trading, significantly improves the sensitivity to new and complex abnormal trading patterns, and reduces the cost of manual rule maintenance.

[0065] Optionally, the first detection result is determined based on the rate of change sequence, including:

[0066] The first autoregressive model is constructed based on the rate of change sequence.

[0067] It should be noted that the first autoregressive model can be a difference-based autoregressive anomaly detection model constructed from the results of the first-order difference equation.

[0068] In the specific implementation process, the differencing sequence (such as...) can be used to... Model it as an autoregressive process, for example (in (This is the error term).

[0069] Predicted rate of change values ​​corresponding to the rate of change sequence based on the first autoregressive model.

[0070] Among them, the predicted rate of change can be the next value predicted based on the first autoregressive model. .

[0071] Specifically, after the model is fitted, the next... .

[0072] Obtain the measured values ​​of the rate of change corresponding to the rate of change sequence.

[0073] It should be noted that the measured value of the rate of change can be the actual observed value. .

[0074] Specifically, obtaining actual observations .

[0075] If the absolute value of the residual between the measured value and the predicted value of the rate of change exceeds the first confidence interval, then the first detection result is determined to be an abnormal transaction.

[0076] The first confidence interval can be a pre-set confidence interval predicted by the first autoregressive anomaly detection model.

[0077] Specifically, if actually observed Residual between the predicted value and the predicted value If the absolute value (or square) of a point is abnormally large (exceeding the confidence interval predicted by the model), then the point is marked as an anomaly.

[0078] In practical applications of anti-abnormal transactions, the predictive performance of difference equation models can be evaluated through accuracy, false positive rate, coverage, and timeliness: when the model's prediction results deviate significantly from the actual observed values ​​(e.g., That is, the model prediction value If the deviation from the actual observed value y exceeds 3 times the standard deviation, it is necessary to analyze the possible causes of the deviation and take corresponding adjustment measures based on the evaluation results: such as for the second-order autoregressive model. Perform rolling estimation. Among them, This represents the observed value at the current moment (such as transaction risk score, probability of abnormal transactions, etc.). and These represent the historical observations at the two previous moments, reflecting the short-term memory nature of time series. , These are autoregressive coefficients, reflecting the weight of the influence of historical values ​​on the current value; This is the random error term, representing fluctuations that the model cannot explain (usually assumed to be white noise with a mean of 0 and constant variance). Alternatively, the model structure can be adjusted by increasing the order of the difference equations to capture longer dependencies, establishing a variable coefficient model to adapt to non-stationary characteristics, and periodically conducting adversarial tests to evaluate the model's robustness.

[0079] Similarly, the same method can be used to determine the second detection result for changing acceleration sequences. For example, a second autoregressive model can be constructed based on the changing acceleration sequence. It should be noted that the second autoregressive model can be a difference-based autoregressive anomaly detection model constructed using the results of a second-order difference equation. The predicted value of the changing acceleration corresponding to the changing acceleration sequence is predicted based on the second autoregressive model. The measured value of the changing acceleration corresponding to the changing acceleration sequence is obtained. If the absolute value of the residual between the measured value and the predicted value of the changing acceleration exceeds the second confidence interval, the second detection result is determined to be the presence of an abnormal transaction. The second confidence interval can be a pre-set confidence interval predicted by the second autoregressive anomaly detection model.

[0080] The technical solution of this invention directly captures the short-term autocorrelation (such as momentum effect or mean regression) of the differencing sequence through an autoregressive model. This better considers the short-term dependencies of the changing sequence itself, avoids false interception caused by fixed threshold rules, and avoids ignoring the dynamic relationship between adjacent time points. Difference operations amplify the local changes in the sequence, making the model more sensitive to sudden fluctuations. Simultaneously, the residual size directly reflects the degree of anomaly in the prediction error, facilitating the analysis of the causes of anomalies. This is particularly suitable for high-net-worth individuals or seasonal trading scenarios.

[0081] Optionally, a second detection result is determined based on the changing acceleration sequence, including:

[0082] Each value in the changing acceleration sequence is compared with a preset threshold.

[0083] The preset threshold can be a threshold set for a first-order difference sequence.

[0084] Specifically, a threshold is set directly for the first-order difference sequence, and each value in the changing acceleration sequence is compared with the preset threshold.

[0085] If there is a value in the changing acceleration sequence that exceeds a preset threshold, then the second detection result is determined to be an abnormal transaction.

[0086] Specifically, differential values ​​in the changing acceleration sequence that exceed the historical statistical range can be marked as potential anomalies.

[0087] Similarly, the same method can be used to determine the first detection result for a rate of change sequence. For example, each value in the rate of change sequence can be compared with a set threshold. This set threshold can be a threshold set for a second-order difference sequence. If any value in the rate of change sequence exceeds the set threshold, the first detection result is determined to be an abnormal transaction.

[0088] The technical solution of this invention sets a threshold directly on the first-order or second-order difference sequence using a simple threshold method, marking difference values ​​that exceed the historical statistical range as potential anomalies. The method is simple to implement and highly operable; the computational complexity of difference operations is low, making it suitable for real-time transaction monitoring. Compared with traditional detection models, it supports rolling updates and can quickly adapt to new abnormal transaction methods.

[0089] Optionally, the abnormal transaction detection result is determined based on the first detection result and the second detection result, including:

[0090] When the first detection result and / or the second detection result indicate the existence of abnormal transactions, the abnormal transaction detection result is determined to be the existence of abnormal transactions.

[0091] In actual operation, if abnormal transactions are found in the first-order or second-order difference detection results, the abnormal transaction detection results can be determined to indicate the presence of abnormal transactions.

[0092] The technical solution of this invention determines the abnormal transaction detection result by analyzing the time series differences (rate of change) and higher-order differences (acceleration of change) of transaction features, replacing absolute value detection, thereby significantly improving the identification accuracy of abnormal transactions. Abnormal transactions are essentially manifested as abnormal changes in feature values ​​rather than the absolute values ​​themselves. Difference operations can strip away the long-term trend of data and amplify short-term abrupt change signals.

[0093] Optionally, the transaction time series data includes at least one of the following: transaction amount sequence, transaction time interval, cumulative transaction amount, cumulative number of transactions, login device identifier, and geographic location sequence.

[0094] The technical solution of this invention analyzes transaction characteristics from multiple aspects and angles, such as transaction amount, transaction time, transaction frequency, user behavior characteristics (such as login device, operating habits, biometric authentication data, etc.), and geographical location changes. Compared with traditional methods that only focus on absolute indicators such as transaction amount and frequency, dynamic feature analysis can more accurately identify abnormal transaction behaviors disguised within the normal transaction value range.

[0095] Optionally, after determining the abnormal transaction detection results based on the rate of change sequence and the acceleration of change sequence, the method further includes:

[0096] If the abnormal transaction detection result indicates the existence of abnormal transactions, the risk level of the abnormal transactions is determined based on preset rules.

[0097] In this embodiment, the preset rule can be a rule used to determine the risk level of abnormal transactions. This embodiment does not limit the specific content of the preset rule, and it can be set according to the actual situation.

[0098] Specifically, once abnormal transactions are identified, their risk level can be determined based on preset rules. For example, risk levels could include: low risk, medium risk, and high risk.

[0099] If the abnormal transaction is deemed low-risk, the detection is considered successful.

[0100] Specifically, if the abnormal transaction is determined to be low-risk, it can be approved.

[0101] If the abnormal transaction is classified as medium risk, a second detection will be performed on the abnormal transaction.

[0102] Specifically, if an abnormal transaction is determined to be of medium risk, a second detection can be performed on the abnormal transaction.

[0103] If an abnormal transaction is considered high-risk, then the abnormal transaction will be blocked.

[0104] Specifically, if an abnormal transaction is determined to be high-risk, it can be blocked and submitted to manual review.

[0105] The technical solution of this invention classifies abnormal transactions into different risk levels and sets targeted handling measures for each level, which can achieve early monitoring and cutting off of criminal money chains, protect customer funds, reduce operating costs caused by false alarms, and improve the overall risk control efficiency of transactions.

[0106] Example 2

[0107] Figure 2 This is an overall flowchart illustrating an application of difference equations in abnormal transaction detection in an embodiment of the present invention. Figure 2 As shown, the overall process of applying difference equations to abnormal transaction detection can be described as follows:

[0108] Data sources include: real-time transaction data, user historical data, and third-party data (such as location data).

[0109] Real-time feature calculation: Perform differential calculations on various types of data, such as ΔX (amount), ΔT (time), and ΔD (geographical location);

[0110] Model Solving and Prediction: By analyzing the time series differencing (first-order differencing, rate of change) and higher-order differencing (second-order differencing, acceleration of change) of transaction characteristics, the abnormal transaction detection results are determined;

[0111] Decision: If the abnormal transaction is low-risk, it is approved; if the abnormal transaction is medium-risk, it is subject to a second inspection; if the abnormal transaction is high-risk, the transaction is intercepted and submitted to the higher level for review.

[0112] Results Feedback and Model Updates: The difference model is updated based on user feedback and manual review.

[0113] The technical solution of this invention is achieved through steps such as establishing a difference equation model, collecting data, solving and predicting the model, evaluating and adjusting it, and formulating strategies. It overcomes the core defects of existing technologies, such as the lag of static rules, missed detection of complex abnormal transaction patterns, and high false alarm rates. It provides a real-time abnormal transaction detection method based on high-order difference feature engineering of time series data. By quantifying the dynamic changes in transaction behavior, it independently calculates the first-order and second-order difference statistics of transaction characteristics (amount, frequency, and geographical location, etc.) for each user, constructing a personalized behavioral baseline. This solves the adaptability defects of traditional static rules and avoids false interception of normal user transactions.

[0114] Example 3

[0115] Figure 3 This is a schematic diagram of an abnormal transaction detection device according to an embodiment of the present invention. This embodiment is applicable to the detection of abnormal financial transactions. The device can be implemented using software and / or hardware, and can be integrated into any device that provides abnormal transaction detection functionality, such as... Figure 3 As shown, the abnormal transaction detection device specifically includes: an acquisition module 201, a first calculation module 202, a second calculation module 203, and a determination module 204.

[0116] Among them, the acquisition module 201 is used to acquire transaction time series data;

[0117] The first calculation module 202 is used to perform first-order difference operation on the transaction time series data to obtain a rate of change sequence;

[0118] The second calculation module 203 is used to perform second-order difference operation on the transaction time series data to obtain the change acceleration sequence;

[0119] The determination module 204 is used to determine the abnormal transaction detection result based on the rate of change sequence and the acceleration of change sequence.

[0120] Optionally, the determining module 204 includes:

[0121] The first determining unit is configured to determine a first detection result based on the rate of change sequence;

[0122] The second determining unit is used to determine the second detection result based on the changing acceleration sequence;

[0123] The third determining unit is used to determine the abnormal transaction detection result based on the first detection result and the second detection result.

[0124] Optionally, the first determining unit is specifically used for:

[0125] A first autoregressive model is constructed based on the rate of change sequence;

[0126] Based on the first autoregressive model, predict the predicted rate of change corresponding to the rate of change sequence;

[0127] Obtain the measured value of the rate of change corresponding to the rate of change sequence;

[0128] If the absolute value of the residual between the measured value of the rate of change and the predicted value of the rate of change exceeds the first confidence interval, then the first detection result is determined to be an abnormal transaction.

[0129] Optionally, the second determining unit is specifically used for:

[0130] Each value in the changing acceleration sequence is compared with a preset threshold.

[0131] If there is a value in the changing acceleration sequence that exceeds the preset threshold, then the second detection result is determined to be an abnormal transaction.

[0132] Optionally, the third determining unit is specifically used for:

[0133] When the first detection result and / or the second detection result indicate the existence of abnormal transactions, the abnormal transaction detection result is determined to indicate the existence of abnormal transactions.

[0134] Optionally, the transaction time series data includes at least one of the following: transaction amount sequence, transaction time interval, cumulative transaction amount, cumulative number of transactions, login device identifier, and geographical location sequence.

[0135] Optionally, the device is further specifically used for:

[0136] If the abnormal transaction detection result indicates the existence of an abnormal transaction, then the risk level of the abnormal transaction is determined based on preset rules;

[0137] If the abnormal transaction is low-risk, the detection is deemed successful.

[0138] If the abnormal transaction is classified as medium risk, a second detection will be performed on the abnormal transaction.

[0139] If the abnormal transaction is high-risk, then the abnormal transaction is blocked.

[0140] The above-mentioned products can execute the abnormal transaction detection method provided in any embodiment of the present invention, and have the corresponding functional modules and beneficial effects of the execution method.

[0141] Example 4

[0142] Figure 4 A schematic diagram of an electronic device 30 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0143] like Figure 4 As shown, the electronic device 30 includes at least one processor 31 and a memory, such as a read-only memory 32 or a random access memory 33, communicatively connected to the at least one processor 31. The memory stores computer programs executable by the at least one processor. The processor 31 can perform various appropriate actions and processes based on the computer program stored in the read-only memory 32 or loaded from storage unit 38 into the random access memory 33. The random access memory 33 can also store various programs and data required for the operation of the electronic device 30. The processor 31, read-only memory 32, and random access memory 33 are interconnected via a bus 34. An input / output interface 35 is also connected to the bus 34.

[0144] Multiple components in electronic device 30 are connected to input / output interface 35, including: input unit 36, such as keyboard, mouse, etc.; output unit 37, such as various types of monitors, speakers, etc.; storage unit 38, such as disk, optical disk, etc.; and communication unit 39, such as network card, modem, wireless transceiver, etc. Communication unit 39 allows electronic device 30 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0145] Processor 31 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 31 include, but are not limited to, central processing units, graphics processing units, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any suitable processor, controller, microcontroller, etc. Processor 31 performs the various methods and processes described above, such as abnormal transaction detection methods:

[0146] Obtain transaction time-series data;

[0147] Perform a first-order difference operation on the transaction time series data to obtain a rate of change sequence;

[0148] The transaction time series data is subjected to second-order difference operation to obtain the change acceleration sequence;

[0149] The abnormal transaction detection result is determined based on the rate of change sequence and the acceleration sequence.

[0150] In some embodiments, the abnormal transaction detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 38. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 30 via read-only memory 32 and / or communication unit 39. When the computer program is loaded into random access memory 33 and executed by processor 31, one or more steps of the abnormal transaction detection method described above may be performed. Alternatively, in other embodiments, processor 31 may be configured to perform the abnormal transaction detection method by any other suitable means (e.g., by means of firmware).

[0151] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays, application-specific integrated circuits (ASICs), application-specific standard products (ASICs), systems-on-a-chip (SoCs), payload programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0152] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0153] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory (flash memory), optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0154] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a cathode ray tube or liquid crystal display monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0155] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0156] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to address the shortcomings of traditional physical hosts and virtual private servers, such as high management difficulty and weak business scalability.

[0157] In one embodiment, the present invention further includes a computer program product, which includes a computer program that, when executed by a processor, implements the abnormal transaction detection method of any embodiment of the present invention.

[0158] In the implementation of a computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​as well as conventional procedural programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including local area networks (LANs) or wide area networks (WANs), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0159] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0160] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. An abnormal transaction detection method, characterized in that, include: Obtain transaction time-series data; Perform a first-order difference operation on the transaction time series data to obtain a rate of change sequence; The transaction time series data is subjected to second-order difference operation to obtain the change acceleration sequence; The abnormal transaction detection result is determined based on the rate of change sequence and the acceleration sequence.

2. The method according to claim 1, characterized in that, Determining abnormal transaction detection results based on the rate of change sequence and the acceleration of change sequence includes: The first detection result is determined based on the rate of change sequence; The second detection result is determined based on the changed acceleration sequence; The abnormal transaction detection result is determined based on the first detection result and the second detection result.

3. The method according to claim 2, characterized in that, Determining the first detection result based on the rate of change sequence includes: A first autoregressive model is constructed based on the rate of change sequence; Based on the first autoregressive model, predict the predicted rate of change corresponding to the rate of change sequence; Obtain the measured value of the rate of change corresponding to the rate of change sequence; If the absolute value of the residual between the measured value of the rate of change and the predicted value of the rate of change exceeds the first confidence interval, then the first detection result is determined to be an abnormal transaction.

4. The method according to claim 2, characterized in that, The second detection result is determined based on the changed acceleration sequence, including: Each value in the changing acceleration sequence is compared with a preset threshold. If there is a value in the changing acceleration sequence that exceeds the preset threshold, then the second detection result is determined to be an abnormal transaction.

5. The method according to claim 2, characterized in that, The abnormal transaction detection result is determined based on the first detection result and the second detection result, including: When the first detection result and / or the second detection result indicate the existence of abnormal transactions, the abnormal transaction detection result is determined to indicate the existence of abnormal transactions.

6. The method according to claim 1, characterized in that, The transaction time-series data includes at least one of the following: transaction amount sequence, transaction time interval, cumulative transaction amount, cumulative number of transactions, login device identifier, and geographical location sequence.

7. The method according to claim 1, characterized in that, After determining the abnormal transaction detection result based on the rate of change sequence and the acceleration sequence, the method further includes: If the abnormal transaction detection result indicates the existence of an abnormal transaction, then the risk level of the abnormal transaction is determined based on preset rules; If the abnormal transaction is low-risk, the detection is deemed successful. If the abnormal transaction is classified as medium risk, a second detection will be performed on the abnormal transaction. If the abnormal transaction is high-risk, then the abnormal transaction is blocked.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the abnormal transaction detection method according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the abnormal transaction detection method according to any one of claims 1-7.

10. A computer program product comprising a computer program that, when executed by a processor, implements the abnormal transaction detection method according to any one of claims 1-7.

Images