Risk detection method and device for transaction payment request and electronic equipment

Abstract

The invention discloses a risk detection method and device for a transaction payment request and electronic equipment, and relates to the field of financial science and technology or other related technical fields, and the method comprises the steps: inputting the transaction information of a target transaction into a local target model after a payment request of the target transaction initiated by a target user is received; feature extraction is carried out on the transaction information of the target transaction through a local target model, L transaction features are obtained, and the L transaction features are at least used for representing equipment information of target equipment used by the target user for payment and behavior information of the target user; and based on the L transaction features, carrying out risk detection on the payment request of the target transaction to obtain a risk score of the target transaction. The technical problem of low accuracy of risk detection on a transaction payment request initiated by a user based on the prior art is solved.

Description

Technical Field

[0001] This application relates to the field of financial technology or other related technical fields, and more specifically, to a method, apparatus, and electronic device for risk detection of transaction payment requests. Background Technology

[0002] With the development of digital payment technology, ensuring the security of user transactions has become a common challenge for the financial industry and e-commerce platforms. Currently, risk detection of transaction payment requests mainly relies on traditional rule engines and single machine learning models. Existing methods have played a certain role in protecting the security of user transaction assets, but with the upgrading of attack techniques, existing risk detection technologies have gradually exposed the following limitations:

[0003] (1) Rule-based risk control systems cannot cope with increasingly complex and ever-changing risk trading patterns. Traditional rule bases are often formulated based on historical data and known risk behaviors, and have limited ability to identify new risk trading behaviors, especially for "white-hat" users or advanced automated attacks.

[0004] (2) Single machine learning models are limited by the amount and diversity of data, making it difficult to build a comprehensive risk assessment system. Financial institutions and e-commerce platforms each have rich user transaction data, but due to data privacy protection and compliance restrictions, these data are difficult to share across institutions, forming "data silos", which limits the training quality and generalization ability of the model.

[0005] Therefore, it is evident that using existing technology to detect risks in user-initiated transaction payment requests suffers from low accuracy, and no effective solution has yet been proposed to address this issue. Summary of the Invention

[0006] This application provides a method, apparatus, and electronic device for risk detection of transaction payment requests, in order to at least solve the technical problem of low accuracy in risk detection of user-initiated transaction payment requests based on existing technologies.

[0007] According to one aspect of this application, a risk detection method for transaction payment requests is provided, comprising: after receiving a payment request for a target transaction initiated by a target user, inputting the transaction information of the target transaction into a local target model, wherein the model parameters of the local target model and the global target model are the same, and the global target model is a federated model obtained by federated training on transaction information of historical transactions in financial institutions and product information of traded goods in e-commerce platforms; extracting features from the transaction information of the target transaction through the local target model to obtain L transaction features, wherein L is a positive integer, and the L transaction features are used to characterize at least the device information of the target device used by the target user for payment and the behavioral information of the target user; and performing risk detection on the payment request of the target transaction based on the L transaction features to obtain a risk score for the target transaction.

[0008] Optionally, feature extraction is performed on the transaction information of the target transaction to obtain L transaction features, including: parsing the transaction information of the target transaction to obtain the device information of the target device; extracting features from the device information of the target device to obtain X transaction device features, where X is a positive integer less than or equal to L, and the X transaction device features include at least one of the following: a first transaction device feature, used to characterize the processor model and screen resolution of the target device; a second transaction device feature, used to characterize the browser plugin information of the target device; a third transaction device feature, used to characterize the latency information of the target device in resolving network addresses; and the X transaction device features are used as the X transaction features in the L transaction features.

[0009] Optionally, feature extraction is performed on the transaction information of the target transaction to obtain L transaction features, including: parsing the transaction information of the target transaction to obtain the biological behavior information of the target user operating the target device; feature extraction is performed on the biological behavior information to obtain Y biological behavior features, where Y is a positive integer less than or equal to L, and the Y biological behavior features include at least one of the following: a first biological behavior feature, used to characterize the mouse button pressure information and acceleration information of the target user when operating the mouse of the target device; a second biological behavior feature, used to characterize the keyboard button pressure information and keystroke rhythm information of the target user when operating the keyboard of the target device; and the Y biological behavior features are used as the Y transaction features in the L transaction features.

[0010] Optionally, feature extraction is performed on the transaction information of the target transaction to obtain L transaction features, including: parsing the transaction information of the target transaction to obtain the decision-making behavior information of the target user in the payment process; extracting features from the decision-making behavior information to obtain decision-making behavior features, wherein the decision-making behavior features are used to characterize the product selection logic of the target user before initiating the target transaction; and using the decision-making behavior features as one of the L transaction features.

[0011] Optionally, risk detection is performed on the payment request of the target transaction based on L transaction features to obtain a risk score for the target transaction. This includes: determining a baseline feature corresponding to each of the L transaction features based on the user identifier of the target user, wherein the baseline feature is used to characterize the device information and historical behavior information of the historical device used by the target user when initiating historical transactions; determining a first risk sub-score for the target transaction based on the similarity between each transaction feature and the corresponding baseline feature, wherein the first risk sub-score is used to characterize the degree of deviation between each transaction feature and the corresponding baseline feature; querying M historical transactions in the historical feature database based on the device identifier of the target device, wherein M is a positive integer, and the historical devices corresponding to the M historical transactions have the same device identifier as the target device; determining a second risk sub-score for the target transaction based on the transaction features of the M historical transactions, wherein the second risk sub-score is used to characterize the correlation coefficient between the M historical transactions; and performing a weighted summation of the first risk sub-score and the second risk sub-score to obtain the risk score for the target transaction.

[0012] Optionally, after performing risk detection on the payment request of the target transaction based on L transaction features to obtain the risk score of the target transaction, the risk detection method for the transaction payment request further includes: if the risk score of the target transaction is greater than or equal to a preset score, intercepting the payment request of the target transaction and generating a prompt message; using the L transaction features of the target transaction corresponding to the intercepted payment request as new training samples, and updating the model parameters of the local target model based on the new training samples.

[0013] Optionally, the training steps of the global target model include: transmitting the model parameters of the global initial model to financial institutions and e-commerce platforms; controlling the financial institutions and e-commerce platforms to perform initialization operations based on the model parameters of the global initial model to obtain a local initial model; iteratively training the local initial model deployed in the financial institutions based on transaction information of historical transactions in the financial institutions to obtain a first training model; iteratively training the local initial model deployed in the e-commerce platforms based on product information of traded goods in the e-commerce platforms to obtain a second training model; encrypting and transmitting the gradients of the first training model and the gradients of the second training model to a central server; aggregating the gradients of the first training model and the gradients of the second training model through the central server to obtain a global gradient; and iteratively updating the model parameters of the global initial model based on the global gradient to obtain the global target model.

[0014] According to another aspect of this application, a risk detection device for transaction payment requests is also provided, comprising: an input unit, configured to input the transaction information of the target transaction into a local target model after receiving a payment request for a target transaction initiated by a target user, wherein the model parameters of the local target model and the global target model are the same, and the global target model is a federated model obtained by federated training on transaction information of historical transactions in financial institutions and product information of traded goods in e-commerce platforms; a feature extraction unit, configured to extract features from the transaction information of the target transaction through the local target model to obtain L transaction features, wherein L is a positive integer, and the L transaction features are used to characterize at least the device information of the target device used by the target user for payment and the behavioral information of the target user; and a risk detection unit, configured to perform risk detection on the payment request of the target transaction based on the L transaction features to obtain a risk score for the target transaction.

[0015] According to another aspect of this application, a computer program product is also provided, which stores a computer program, wherein a risk detection method controls the computer program product to execute any of the above-mentioned transaction payment requests when the computer program is running.

[0016] According to another aspect of this application, an electronic device is also provided, wherein the electronic device includes one or more processors and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the risk detection method for transaction payment requests of any of the above.

[0017] In this application, after receiving a payment request for a target transaction initiated by a target user, the transaction information of the target transaction is first input into a local target model. The local target model has the same model parameters as the global target model. The global target model is a federated model obtained by federated training on transaction information of historical transactions in financial institutions and product information of traded goods in e-commerce platforms. Then, the local target model extracts features from the transaction information of the target transaction to obtain L transaction features, where L is a positive integer. The L transaction features are used to characterize at least the device information of the target device used by the target user for payment and the behavioral information of the target user. Then, based on the L transaction features, risk detection is performed on the payment request of the target transaction to obtain a risk score for the target transaction.

[0018] As can be seen from the above, this application pre-trains a global target model on local data in multiple platforms (such as financial institutions and e-commerce platforms) based on federated learning technology. Then, this application synchronizes the model parameters of the global target model to the local model of the financial institution to obtain a local target model. Then, by performing multi-dimensional transaction feature analysis on the target transaction through the local target model, the application achieves the goal of improving the accuracy of risk detection of transaction payment requests without sharing the original local data between multiple platforms.

[0019] In other words, based on the extracted multidimensional transaction features, the local target model can independently complete risk assessment and calculate the risk score of the target transaction. This method not only improves the model's generalization ability and intelligent recognition accuracy, but also enhances the security of local transaction data and avoids the risk of privacy leakage caused by the direct exchange of local data on multiple platforms. Thus, it achieves the technical effect of effectively identifying potential transaction risks while protecting user privacy, thereby solving the technical problem of low accuracy in risk detection of user-initiated transaction payment requests based on existing technologies. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0021] Figure 1 This is a hardware structure block diagram of a computer terminal (or mobile device) for implementing a risk detection method for transaction payment requests, according to an embodiment of this application.

[0022] Figure 2 This is a flowchart of an optional risk detection method for transaction payment requests according to an embodiment of this application;

[0023] Figure 3 This is a schematic diagram of an optional payment risk control system based on multidimensional behavioral fingerprint features and federated learning technology according to an embodiment of this application;

[0024] Figure 4 This is a flowchart of an optional payment risk control method based on multidimensional behavioral fingerprint features and federated learning technology according to an embodiment of this application;

[0025] Figure 5 This is a flowchart of an optional model federated training method according to an embodiment of this application;

[0026] Figure 6 This is a schematic diagram of an optional risk detection device for transaction payment requests according to an embodiment of this application;

[0027] Figure 7 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] It should also be noted that all relevant information (including but not limited to transaction information and product information) and data (including but not limited to local data in financial institutions and e-commerce platforms, as well as user-initiated payment request data) involved in this application are information and data authorized by the user or fully authorized by all parties. For example, if there is an interface between this system and the relevant user or institution, before obtaining the relevant information, it is necessary to send an acquisition request to the aforementioned user or institution through the interface, and obtain the relevant information only after receiving consent from the aforementioned user or institution.

[0031] Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of relevant information and data involved in this application all comply with the relevant laws, regulations, and standards of the relevant regions, and necessary confidentiality measures have been taken. This application does not violate public order and good morals. In addition, this application provides a corresponding operation entry point for users to choose to agree to or refuse authorization. If the user chooses to refuse authorization, the corresponding expert decision-making process will be initiated.

[0032] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows:

[0033] Behavioral fingerprint: A unique identifier generated by collecting multi-dimensional data such as user device characteristics, operational behaviors (e.g., mouse trajectory, keyboard input rhythm), and decision-making paths. This identifier can distinguish real users from automated scripts or malicious behavior.

[0034] Federated learning: a distributed machine learning framework that allows multiple participants to jointly train a global model without sharing the original data. Its core idea is to achieve a balance between data privacy protection and model performance optimization through local model parameter updates and aggregation.

[0035] Real-time payment risk control: During the payment transaction process, real-time data analysis and model reasoning are used to assess and intercept transaction risks in real time, so as to reduce the probability of risk events.

[0036] Multi-dimensional feature acquisition: Extract user behavior features from three dimensions: device fingerprint (hardware / software features), biometric features (operation behavior patterns), and decision path (user selection logic), and convert them into quantitative indicators for model training and risk assessment.

[0037] The present invention will now be described in detail with reference to various embodiments.

[0038] Example 1

[0039] According to an embodiment of this application, an embodiment of a risk detection method for transaction payment requests is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0040] The methods and embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices. Figure 1 This is a hardware structure block diagram of a computer terminal (or mobile device) for implementing a risk detection method for transaction payment requests, according to an embodiment of this application. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0041] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0042] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the risk detection method for transaction payment requests in this embodiment of the application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned risk detection method for transaction payment requests. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0043] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0044] The display can be configured as a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0045] Under the aforementioned operating environment, this application provides a risk detection system for transaction payment requests (hereinafter referred to as the transaction payment request risk detection system) for executing the transaction payment request risk detection method in this application. Figure 2 This is a flowchart of an optional risk detection method for transaction payment requests according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0046] Step S201: After receiving the payment request for the target transaction initiated by the target user, the transaction information of the target transaction is input into the local target model. The local target model has the same model parameters as the global target model. The global target model is a federated model obtained by federated training of transaction information of historical transactions in financial institutions and product information of traded goods in e-commerce platforms.

[0047] Optionally, the target user refers to a user who initiates a payment transaction with a financial institution.

[0048] Optionally, a target transaction refers specifically to a financial transaction initiated by the target, including but not limited to the purchase of goods and payment of bills.

[0049] Optionally, a payment request refers to a signal used to characterize a user's payment behavior.

[0050] Optionally, the local target model refers to a local model deployed on the local end of the financial institution, whose model parameters are consistent with those of the global target model.

[0051] Optionally, the detection system can be pre-trained using federated learning techniques on historical transaction information from financial institutions and product information from e-commerce platforms. In this case, financial institutions and e-commerce platforms do not need to directly exchange user data, but only need to share their model parameter updates, thereby improving the security of local user data between financial institutions and e-commerce platforms. At the same time, since the trained global target model uses heterogeneous training samples from different institutions, the generalization ability of the trained global target model is improved, and the global target model's ability to identify unknown transaction risks is enhanced.

[0052] Step S202: Through the local target model, feature extraction is performed on the transaction information of the target transaction to obtain L transaction features, where L is a positive integer. The L transaction features are used to characterize at least the device information of the target device used by the target user for payment and the behavioral information of the target user.

[0053] Optionally, the L transaction characteristics include at least one of the following: transaction device characteristics, biological behavior characteristics, and decision-making behavior characteristics.

[0054] Optionally, the device information of the target device may include at least the target device's hardware configuration, operating system, and browser information.

[0055] Optionally, the target user's behavioral information includes at least the target user's operational behavior information on the target device and the target user's decision-making behavior information before selecting and paying for goods.

[0056] Optionally, the detection system uses a local target model to extract features from the transaction information of the target transaction, obtaining multi-dimensional transaction features. Subsequently, the transaction risk is assessed from multiple perspectives corresponding to the multi-dimensional transaction features, thereby improving the accuracy of transaction payment risk assessment.

[0057] Step S203: Based on L transaction features, perform risk detection on the payment request of the target transaction to obtain the risk score of the target transaction.

[0058] Optionally, risk scoring refers to the local target model's quantitative assessment of the risk level of a single transaction payment request, used to determine whether to intercept the transaction for risk.

[0059] Optionally, the detection system performs real-time risk detection on the payment request of the target transaction based on L transaction features to obtain a risk score, thereby improving the response speed of risk detection. This technical solution is suitable for high-frequency trading scenarios. At the same time, by quantifying the risk score, the detection system can automatically identify high-risk transactions and take timely interception measures, thereby reducing the occurrence rate of risky transactions.

[0060] As can be seen from the above, this application pre-trains a global target model on local data in multiple platforms (such as financial institutions and e-commerce platforms) based on federated learning technology. Then, this application synchronizes the model parameters of the global target model to the local model of the financial institution to obtain a local target model. Then, by performing multi-dimensional transaction feature analysis on the target transaction through the local target model, the application achieves the goal of improving the accuracy of risk detection of transaction payment requests without sharing the original local data between multiple platforms.

[0061] In other words, based on the extracted multidimensional transaction features, the local target model can independently complete risk assessment and calculate the risk score of the target transaction. This method not only improves the model's generalization ability and intelligent recognition accuracy, but also enhances the security of local transaction data and avoids the risk of privacy leakage caused by the direct exchange of local data on multiple platforms. Thus, it achieves the technical effect of effectively identifying potential transaction risks while protecting user privacy, thereby solving the technical problem of low accuracy in risk detection of user-initiated transaction payment requests based on existing technologies.

[0062] In one optional embodiment, the detection system first parses the transaction information of the target transaction to obtain the device information of the target device. Then, the detection system extracts features from the device information of the target device to obtain X transaction device features, where X is a positive integer less than or equal to L. Then, the detection system uses the X transaction device features as X transaction features out of L transaction features.

[0063] Optionally, the X trading device features refer to a set of features extracted from device information for risk assessment, wherein the X trading device features include at least one of the following:

[0064] The first transaction device characteristic is used to characterize the processor model and screen resolution of the target device;

[0065] The second transaction device feature is used to characterize the browser plugin information of the target device;

[0066] The third transaction device feature is used to characterize the latency information of the target device in resolving network addresses.

[0067] Optionally, the detection system obtains the device information of the target device by parsing the transaction information of the target transaction, and has the following functions:

[0068] (1) Accurately locate the transaction environment: By analyzing the equipment information in the transaction information, the equipment environment in which the transaction occurred can be accurately identified, providing key data points for subsequent feature analysis and risk assessment.

[0069] (2) Enhance device identification capabilities: The collection and analysis of device information helps to build device fingerprints, thereby identifying abnormal devices or devices that do not match the user's historical payment behavior, thus improving the ability to defend against transaction attacks.

[0070] Optionally, the detection system extracts features from the device information of the target device to obtain X transaction device features, which have the following functions:

[0071] (1) Refine equipment risk indicators: Through feature extraction, abstract equipment information is transformed into specific quantitative indicators, such as processor model, screen resolution, number of browser plugins, etc., which facilitates the model to identify potential risks.

[0072] (2) Improve the quality of model input: The selected X trading device features are key inputs for model training and decision-making, which helps the model to focus more on device-level information that is directly related to risk assessment, thereby improving model training efficiency and assessment accuracy.

[0073] Optionally, the detection system uses X transaction device features as X transaction features out of L transaction features to ensure that the model input includes key information from the device information. Subsequently, the detection system integrates the transaction device features with features from other dimensions (e.g., biological behavior features, decision-making behavior features) to construct a comprehensive transaction risk assessment framework, thereby enhancing the model's ability to identify complex risk patterns.

[0074] In summary, by meticulously extracting device information features from target transaction information and integrating them into a multi-dimensional transaction feature set, the detection system enhances the ability to identify risks associated with transaction devices, provides data support for real-time risk assessment and detection, and ultimately improves the payment risk control capabilities of financial institutions.

[0075] In one optional embodiment, the detection system first parses the transaction information of the target transaction to obtain the biometric behavior information of the target user operating the target device. Then, the detection system extracts features from the biometric behavior information to obtain Y biometric behavior features, where Y is a positive integer less than or equal to L. Then, the detection system uses the Y biometric behavior features as the Y transaction features in the L transaction features.

[0076] Optionally, the Y biological behavioral features refer to a set of features extracted from transaction information for risk assessment, and the Y biological behavioral features include at least one of the following:

[0077] The first biological behavioral characteristic is used to characterize the mouse button pressure and acceleration information of the target user when operating the mouse of the target device.

[0078] The second biological behavioral characteristic is used to characterize the keyboard pressure and keystroke rhythm information of the target user when operating the keyboard of the target device.

[0079] Optionally, the detection system analyzes the transaction information of the target transaction to obtain the biometric behavior information of the target user operating the target device, which has the following functions:

[0080] (1) Enhance user identity authentication: Biometric behavioral information can reflect the unique pattern of user interaction with the device, and as an auxiliary authentication method, it improves the accuracy and security of user identity recognition.

[0081] (2) Capturing subtle behavioral differences: By analyzing the biological behavioral data in the transaction information, the system can identify subtle differences between automated scripts or malicious operations and real user behavior, effectively distinguishing abnormal transactions.

[0082] Optionally, the detection system extracts Y biological behavioral features from the biological behavioral information, which have the following functions:

[0083] (1) Accurately depict user behavior patterns: Y biological behavioral features can accurately describe user operating habits, such as mouse button force, acceleration and keyboard keying rhythm. These features are often difficult to imitate by automated attacks. By identifying Y biological behavioral features, the accuracy of subsequent risk detection of target transactions is improved.

[0084] (2) Enhance real-time risk control capabilities: The extraction and analysis of biological behavioral characteristics can provide key risk assessment information at the moment a transaction occurs, thereby enhancing the response speed and efficiency of the real-time risk control system.

[0085] Optionally, the detection system uses Y biological behavioral features as Y of the L transaction features to ensure that the model input includes key information from biological behavior. Subsequently, the detection system integrates biological behavioral features with features from other dimensions (e.g., transaction device features, decision-making behavior features) to ensure that the local target model can assess transaction risks from more perspectives, thereby reducing misjudgments caused by risk assessment from a single dimension. The addition of biological behavioral features enables the local target model to make more accurate judgments when facing new or complex risk transaction patterns, thereby improving the robustness and adaptability of the local target model.

[0086] In summary, by parsing and extracting biometric behavioral information features, the detection system not only enhances the accuracy of user identity verification but also improves the comprehensiveness and efficiency of the real-time payment risk control system. Furthermore, by effectively integrating biometric behavioral features into the overall transaction feature analysis framework, the system can more accurately assess transaction risks and effectively address security threats such as automated attacks and identity theft.

[0087] In one optional embodiment, the detection system first parses the transaction information of the target transaction to obtain the decision-making behavior information of the target user in the payment process. Then, the detection system extracts features from the decision-making behavior information to obtain decision-making behavior features, which are used to characterize the product selection logic of the target user before initiating the target transaction. Then, the detection system uses the decision-making behavior features as one of the L transaction features.

[0088] Optionally, decision-making behavior information specifically refers to user behavior data when browsing, selecting, and comparing products before payment, including user preferences for products, selection paths, and decision-making time.

[0089] Optionally, the detection system analyzes the transaction information of the target transaction to obtain the decision-making behavior information of the target user in the payment process. This allows the system to gain insights into the user's decision-making patterns. The decision-making behavior information extracted from the transaction information can reveal the user's behavior patterns before payment, such as the decision-making behavior habits of choosing payment products. Abnormal changes in the user's decision-making behavior (such as a sudden change in purchasing habits) may indicate that there is a risk in the transaction. Therefore, by analyzing the decision-making behavior information, the detection system provides a data foundation for more accurate transaction risk identification in the future.

[0090] Optionally, the detection system extracts features from decision-making behavior information to obtain decision-making behavior characteristics. This transforms key points in the decision-making behavior information into quantifiable indicators, which can then be understood and analyzed by the local target model. By determining the decision-making behavior characteristics, the detection system further refines the risk assessment indicators. These characteristics provide the local target model with more detailed behavioral pattern data, enabling the model to identify risks based on changes in user decision-making behavior. In this case, the model can more accurately determine whether a transaction conforms to the user's historical behavior pattern, thereby improving the model's ability to detect abnormal transactions.

[0091] Optionally, the detection system ensures that the model input includes key information from decision-making behavior by incorporating decision-making behavior characteristics as one of the L transaction characteristics. Subsequently, the detection system integrates decision-making behavior characteristics with other dimensions of characteristics (e.g., transaction device characteristics, biometric behavior characteristics) to construct a comprehensive user risk behavior profile that covers the entire user behavior process from decision-making to payment. By analyzing user decision-making behavior characteristics in real time, the local target model can quickly identify potential risky transaction behaviors and take timely measures to protect the asset security of the target user.

[0092] In summary, by deeply analyzing user decision-making behavior information, extracting key decision-making behavior features, and integrating them into a multi-dimensional transaction feature evaluation system, the detection system not only enhances the understanding of user payment behavior patterns but also improves the efficiency of the real-time payment risk control system, effectively reducing the incidence of risky transactions and increasing transaction security.

[0093] In one optional embodiment, the detection system first determines a baseline feature corresponding to each of L transaction features based on the user identifier of the target user. The baseline feature characterizes the device information and historical behavior information of the historical device used by the target user when initiating historical transactions. Then, based on the similarity between each transaction feature and its corresponding baseline feature, the detection system determines a first risk sub-score for the target transaction. The first risk sub-score characterizes the degree of deviation between each transaction feature and its corresponding baseline feature. Next, based on the device identifier of the target device, the detection system retrieves M historical transactions from the historical feature database, where M is a positive integer and the historical devices corresponding to the M historical transactions have the same device identifier as the target device. Subsequently, based on the transaction features of the M historical transactions, the detection system determines a second risk sub-score for the target transaction. The second risk sub-score characterizes the correlation coefficient between the M historical transactions. Finally, the detection system performs a weighted sum of the first and second risk sub-scores to obtain the risk score of the target transaction.

[0094] Optionally, a user identifier refers to an identifier that can uniquely identify a target user.

[0095] Optionally, baseline characteristics, which reflect a series of behaviors and normal device statuses of the target user in historical transactions, are used to compare with current transaction characteristics to identify potential risks.

[0096] Optionally, the detection system determines the baseline features corresponding to each transaction feature based on the user identifier of the target user. Then, by comparing the current transaction features with the baseline features of the user's personal historical behavior, it can perform personalized risk assessment, thereby improving the accuracy of risk identification. At the same time, by comparing the current transaction features with the baseline features of the user's personal historical behavior, the detection system can detect the degree of deviation between the current transaction features and the baseline features in real time, thereby making a rapid response to abnormal transaction behavior.

[0097] Optionally, similarity is used to measure the degree of matching between transaction features and user baseline features. The lower the value, the greater the difference between real-time transaction features and user baseline features, and the higher the probability of risk.

[0098] Optionally, the first risk sub-score is a quantitative assessment of the deviation of each transaction feature from the baseline feature. The detection system determines the first risk sub-score of the target transaction based on the similarity between each transaction feature and the corresponding baseline feature, and has the following functions:

[0099] (1) Dynamic risk identification: By calculating the degree of deviation of each transaction feature, the transaction risk can be dynamically and in real time, improving the immediacy and effectiveness of risk identification.

[0100] (2) Refined risk assessment: The first risk sub-score refines the risk assessment process, allowing the detection system to conduct independent assessments for different transaction characteristics, thus increasing the comprehensiveness of risk assessment.

[0101] Optionally, device identifier refers to a unique identifier used to identify the target device, such as the device MAC address.

[0102] Optionally, based on the device identifier of the target device, M historical transactions are retrieved from the historical feature database, which has the following functions:

[0103] (1) Device behavior history analysis: By querying M historical transactions, the detection system can analyze the behavior pattern of the target device within a preset historical time period (for example, if the same transaction device initiates transactions through multiple proxy domains in the past 5 minutes), thereby identifying the spatiotemporal correlation risks corresponding to M historical transactions.

[0104] (2) Equipment consistency check: Based on the identification query of the target equipment, it is ensured that the detection system can evaluate the continuous behavior of specific equipment, thereby improving the pertinence and effectiveness of risk assessment.

[0105] Optionally, the correlation coefficient is used to measure the correlation between M historical transaction features and the correlation between these features and the target transaction features.

[0106] Optionally, the second risk sub-score refers to a quantitative indicator of the correlation between the historical transaction characteristics of the target device, reflecting the level of consistency between the target transaction and the device's past behavior.

[0107] Optionally, the detection system determines a second risk sub-score for the target transaction based on the transaction characteristics of M historical transactions, which has the following functions:

[0108] (1) Equipment behavior pattern assessment: The second risk sub-score provides a consistency assessment of the equipment behavior pattern, helping the detection system to determine whether the current transaction conforms to the normal behavior pattern of the equipment.

[0109] (2) Cross-validation risk: By combining the historical transaction data of the equipment, the detection system can perform cross-validation to further confirm the level of transaction risk.

[0110] Optionally, the detection system can obtain a comprehensive risk assessment result by weighted summation of the first and second risk sub-scores, thereby improving the reliability of risk decisions. Based on the final risk score, the detection system can more intelligently formulate transaction interception or release strategies, effectively balancing the needs of user experience and risk control.

[0111] In summary, through the above steps, the detection system can comprehensively consider the user's personalized behavioral characteristics and the device's consistent behavioral patterns to conduct multi-level and multi-dimensional risk assessments, thereby achieving more accurate real-time payment risk control, effectively avoiding risky transactions, and ensuring the smooth progress of compliant transactions.

[0112] In one optional embodiment, after performing risk detection on the payment request of the target transaction based on L transaction features to obtain a risk score for the target transaction, if the risk score of the target transaction is greater than or equal to a preset score, the detection system intercepts the payment request of the target transaction and generates a prompt message. Then, the detection system uses the L transaction features of the target transaction corresponding to the intercepted payment request as new training samples, and updates the model parameters of the local target model based on the new training samples.

[0113] Optionally, if the risk score of the target transaction is greater than or equal to a preset score, the detection system will intercept the payment request for the target transaction, preventing the payment process from continuing, in order to prevent potential economic losses or risky transactions. Furthermore, the detection system will promptly generate a prompt message, which will include at least the risk score and the reason for the risk interception. The detection system will then provide the prompt message to the user and the risk control personnel of the financial institution for subsequent review and retrospective analysis, thereby improving the transparency of the risk control process and user trust.

[0114] Optionally, the detection system uses L transaction features of the target transaction corresponding to the intercepted payment request as new training samples. Then, based on the new training samples, the local target model can optimize its parameters, thereby improving the accuracy of subsequent risk assessment. At the same time, the addition of new training samples can help the local target model better identify and respond to new risk transaction patterns, improve the stability of the model in complex scenarios, and reduce the probability of misjudgment and missed judgment.

[0115] In summary, through the above steps, the detection system not only achieves real-time interception of high-risk transactions, but also continuously optimizes the local target model by using the features of the intercepted transactions as training samples, thereby achieving more accurate risk control.

[0116] In one optional embodiment, to train a global target model, the detection system first transmits the model parameters of the global initial model to financial institutions and e-commerce platforms, and controls the financial institutions and e-commerce platforms to perform initialization operations based on the model parameters of the global initial model to obtain a local initial model. Then, the detection system iteratively trains the local initial model deployed in the financial institutions based on the transaction information of historical transactions in the financial institutions to obtain a first training model. Then, the detection system iteratively trains the local initial model deployed in the e-commerce platforms based on the product information of traded goods in the e-commerce platforms to obtain a second training model. Subsequently, the detection system encrypts and transmits the gradients of the first training model and the gradients of the second training model to a central server. The central server aggregates the gradients of the first training model and the gradients of the second training model to obtain a global gradient. Then, the detection system iteratively updates the model parameters of the global initial model based on the global gradient to obtain the global target model.

[0117] Optionally, a global initial model, which is the initial model set in the federated learning framework, will be used by all participants for local training based on the model parameters of this model.

[0118] Optionally, the local initial model refers to the local model obtained by financial institutions and e-commerce platforms by performing initialization operations based on the received global initial model parameters.

[0119] Optionally, the detection system controls financial institutions and e-commerce platforms to perform initialization operations based on the model parameters of the global initial model, enabling all participants to train on the same initial model and ensuring consistency in the starting point of model training.

[0120] Optionally, the detection system iteratively trains the initial local model deployed in financial institutions based on transaction information from historical transactions, enabling financial institutions to train models based on their own unique transaction data and obtain local models that are more adapted to their local data. Similarly, the detection system iteratively trains the initial local model deployed in e-commerce platforms based on product information from traded goods, enabling e-commerce platforms to train models based on their own unique product data and obtain local models that are more adapted to their local data.

[0121] Optionally, the detection system transmits the gradients of the first and second training models to the central server in encrypted form, avoiding the sharing of original local data and reducing the amount of network data transmitted. This improves the overall training efficiency of the model and the security of the participants' local data. Subsequently, the detection system aggregates the gradients of the first and second training models through the central server, enabling the model to be optimized globally. Even if each participant only has partial data, they can still collaboratively improve the model's performance.

[0122] Optionally, the detection system updates the model parameters of the global initial model iteratively based on the global gradient, thereby achieving collaborative optimization of the model parameters among all participants, which improves the accuracy and robustness of the model. At the same time, the global target model can cover more dimensions of risk characteristics, strengthening the collaborative risk control capabilities between financial institutions and e-commerce platforms.

[0123] In summary, through the above steps, the detection system achieves the goal of enabling financial institutions and e-commerce platforms to share model optimization results while protecting user privacy, thereby improving the accuracy of risk assessment using models trained based on federated learning technology.

[0124] As can be seen from the above, this application pre-trains a global target model on local data in multiple platforms (such as financial institutions and e-commerce platforms) based on federated learning technology. Then, this application synchronizes the model parameters of the global target model to the local model of the financial institution to obtain a local target model. Then, by performing multi-dimensional transaction feature analysis on the target transaction through the local target model, the application achieves the goal of improving the accuracy of risk detection of transaction payment requests without sharing the original local data between multiple platforms.

[0125] In other words, based on the extracted multidimensional transaction features, the local target model can independently complete risk assessment and calculate the risk score of the target transaction. This method not only improves the model's generalization ability and intelligent recognition accuracy, but also enhances the security of local transaction data and avoids the risk of privacy leakage caused by the direct exchange of local data on multiple platforms. Thus, it achieves the technical effect of effectively identifying potential transaction risks while protecting user privacy, thereby solving the technical problem of low accuracy in risk detection of user-initiated transaction payment requests based on existing technologies.

[0126] In one alternative embodiment, Figure 3 This is a schematic diagram of an optional payment risk control system based on multi-dimensional behavioral fingerprint features and federated learning technology according to an embodiment of this application, such as... Figure 3 As shown, the payment risk control system includes the following modules:

[0127] (1) Multi-dimensional behavioral fingerprint acquisition module:

[0128] A multi-dimensional behavioral fingerprint collection module is used to collect multi-dimensional behavioral fingerprint features of user-initiated transaction payment requests. This module includes:

[0129] a) Device fingerprint layer: used to collect transaction device characteristics corresponding to the target transaction, such as hardware characteristics (e.g., graphics processor model, screen DPI (Dots Per Inch)), software characteristics (e.g., browser plugin list), and network characteristics (e.g., DNS (Domain Name System) resolution latency).

[0130] b) Biometrics layer: This layer is used to analyze the mouse button pressure and mouse sliding acceleration of the user's operation of the target device, as well as the keyboard button pressure and keyboard input rhythm (keystroke interval entropy value) through the mouse trajectory dynamics model, to obtain biometric behavior characteristics. Furthermore, based on the user's historical transaction information, a user behavior baseline is constructed.

[0131] c) Decision path layer: used to record the user's selection logic (i.e. decision behavior characteristics) in the payment process. For example, before initiating payment, the user prioritizes comparing the "historical low price" product label.

[0132] (2) Federated Learning Modeling Module:

[0133] The federated learning modeling module is used to pre-train a risk assessment model (i.e., a global objective model) based on federated learning techniques. The module's functions are as follows:

[0134] a) Data privacy protection: Homomorphic encryption and differential privacy technologies are used to ensure that data is not leaked during transmission and model training.

[0135] b) Model training and aggregation: Based on the vertical federated learning framework, risk assessment models are trained by combining data from multiple sources, including financial institutions and e-commerce platforms.

[0136] c) Communication efficiency optimization: Through gradient compression and hierarchical aggregation techniques, the training time across institutions was reduced from 48 hours to 8 hours.

[0137] (3) Real-time risk assessment engine:

[0138] The real-time risk assessment engine (i.e., the local mapping of the risk assessment model trained above to the financial institution) is used to perform real-time risk detection on transaction payment requests initiated by target users. The engine's functions are as follows:

[0139] a) Dynamic weight allocation: Adjust feature weights based on the payment scenario (such as product details page, search results page).

[0140] b) Spatiotemporal anomaly detection: Combine the financial region data of the trading device with the trading domain name profile database to detect cross-regional abnormal behavior (such as the same device initiating transactions through proxy domains in multiple locations within 5 minutes).

[0141] c) Adversarial learning module: Generates adversarial examples through GAN (Generative Adversarial Network) to continuously enhance the robustness of the model.

[0142] (4) Feedback and Optimization Module:

[0143] After the risk score is input into the real-time risk assessment engine, the feedback and optimization module compares the risk score output by the engine with a preset threshold to intercept high-risk transactions. Furthermore, through the distributed training mechanism of federated learning, the model parameters of the global model are continuously updated to optimize the risk assessment model iteratively.

[0144] In one alternative embodiment, Figure 4 This is a flowchart of an optional payment risk control method based on multi-dimensional behavioral fingerprint features and federated learning technology according to an embodiment of this application, such as... Figure 4 As shown, the payment risk control method includes the following steps:

[0145] (1) Data acquisition stage:

[0146] During the model application phase, multi-dimensional behavioral fingerprints are collected based on user payment requests; during the model training phase, various participants (such as financial institutions and e-commerce platforms) extract features from local data.

[0147] (2) Federal Learning and Training Phase:

[0148] Figure 5 This is a flowchart of an optional model federated training method according to an embodiment of this application, such as... Figure 5 As shown, the method includes the following steps:

[0149] a) The central server initializes the global model (θ_initial); the model parameters (θ_global) of the initialized global model are distributed to the bank and e-commerce platform; each participating party (i.e. Figure 5 (For example, banks and e-commerce platforms in China) create local models (θ_ec) based on the model parameters of the initialized global model.

[0150] b) Each participating party (i.e. Figure 5(For example, banks and e-commerce platforms in China) train local models (θ_ec) based on local data features obtained by feature extraction from local data, and obtain the gradients (θ_i) of the local models; then, the encrypted gradients (▽_ec) of the trained local models are uploaded to the central server through an encrypted channel.

[0151] c) The central server aggregates the gradient, and the aggregated gradient θ_new=∑w_i θ_i, where w_i is the weight value corresponding to the gradient. After obtaining the aggregated gradient (θ_new), the global model of the initial state is optimized based on the aggregated gradient to obtain the global target model.

[0152] (3) Real-time risk control stage:

[0153] After a payment request enters the real-time risk assessment engine, the risk assessment engine determines a risk score based on the model parameters of the latest global target model; if the score exceeds the threshold, it triggers interception and records the characteristics of high-risk transactions.

[0154] (4) Model feedback and iteration stage:

[0155] Summarize the characteristics of high-risk transactions and update the training set for federated learning; repeat the model training-gradient aggregation-risk assessment process to continuously optimize model performance.

[0156] Example 2

[0157] This application embodiment can also provide a risk detection device for transaction payment requests. It should be noted that the risk detection device for transaction payment requests in this application embodiment can be used to execute the risk detection method for transaction payment requests provided in this application embodiment. The risk detection device for transaction payment requests provided in this application embodiment is described below.

[0158] According to an embodiment of this application, an apparatus for implementing the risk detection method for the above-described transaction payment request is also provided. Figure 6 This is a schematic diagram of an optional risk detection device for transaction payment requests according to an embodiment of this application, such as... Figure 6 As shown, the device includes an input unit 601, a feature extraction unit 602, and a risk detection unit 603.

[0159] Optionally, input unit 601 is used to input the transaction information of the target transaction into the local target model after receiving the payment request of the target transaction initiated by the target user. The local target model has the same model parameters as the global target model. The global target model is a federated model obtained by federated training on the transaction information of historical transactions in financial institutions and the product information of traded goods in e-commerce platforms. Feature extraction unit 602 is used to extract features from the transaction information of the target transaction through the local target model to obtain L transaction features, where L is a positive integer. The L transaction features are used to characterize at least the device information of the target device used by the target user for payment and the behavioral information of the target user. Risk detection unit 603 is used to perform risk detection on the payment request of the target transaction based on the L transaction features to obtain a risk score for the target transaction.

[0160] In one optional embodiment, the feature extraction unit 602 includes: a first parsing subunit, a first feature extraction subunit, and a first feature determination subunit.

[0161] Optionally, the first parsing subunit is used to parse the transaction information of the target transaction to obtain the device information of the target device; the first feature extraction subunit is used to extract features from the device information of the target device to obtain X transaction device features, where X is a positive integer less than or equal to L, and the X transaction device features include at least one of the following: a first transaction device feature, used to characterize the processor model and screen resolution of the target device; a second transaction device feature, used to characterize the browser plugin information of the target device; a third transaction device feature, used to characterize the latency information of the target device in resolving network addresses; and a first feature determination subunit is used to select the X transaction device features as X transaction features from L transaction features.

[0162] In one optional embodiment, the feature extraction unit 602 includes: a second parsing subunit, a second feature extraction subunit, and a second feature determination subunit.

[0163] Optionally, the second parsing subunit is used to parse the transaction information of the target transaction to obtain the biometric behavior information of the target user operating the target device; the second feature extraction subunit is used to extract features from the biometric behavior information to obtain Y biometric behavior features, where Y is a positive integer less than or equal to L, and the Y biometric behavior features include at least one of the following: a first biometric behavior feature, used to characterize the mouse button pressure information and acceleration information of the target user when operating the mouse of the target device; a second biometric behavior feature, used to characterize the keyboard button pressure information and keystroke rhythm information of the target user when operating the keyboard of the target device; and a second feature determination subunit is used to use the Y biometric behavior features as Y transaction features in the L transaction features.

[0164] In one optional embodiment, the feature extraction unit 602 includes: a third parsing subunit, a third feature extraction subunit, and a third feature determination subunit.

[0165] Optionally, the third parsing subunit is used to parse the transaction information of the target transaction to obtain the decision behavior information of the target user in the payment process; the third feature extraction subunit is used to extract features from the decision behavior information to obtain decision behavior features, wherein the decision behavior features are used to characterize the product selection logic of the target user before initiating the target transaction; the third feature determination subunit is used to use the decision behavior features as one of the L transaction features.

[0166] In one optional embodiment, the risk detection unit 603 includes: a baseline feature determination subunit, a first scoring subunit, a historical transaction query subunit, a second scoring subunit, and a target scoring subunit.

[0167] Optionally, the baseline feature determination subunit is used to determine the baseline feature corresponding to each of the L transaction features based on the user identifier of the target user, wherein the baseline feature is used to characterize the device information and historical behavior information of the historical device used by the target user when initiating historical transactions; the first scoring subunit is used to determine the first risk sub-score of the target transaction based on the similarity between each transaction feature and the corresponding baseline feature, wherein the first risk sub-score is used to characterize the degree of deviation between each transaction feature and the corresponding baseline feature; the historical transaction query subunit is used to query M historical transactions in the historical feature database based on the device identifier of the target device, wherein M is a positive integer, and the historical devices corresponding to the M historical transactions have the same device identifier as the target device; the second scoring subunit is used to determine the second risk sub-score of the target transaction based on the transaction features of the M historical transactions, wherein the second risk sub-score is used to characterize the correlation coefficient between the M historical transactions; and the target scoring subunit is used to perform a weighted summation of the first risk sub-score and the second risk sub-score to obtain the risk score of the target transaction.

[0168] In an optional embodiment, the risk detection device for transaction payment requests further includes an interception unit and a parameter update unit.

[0169] Optionally, the interception unit is used to intercept the payment request of the target transaction when the risk score of the target transaction is greater than or equal to the preset score, and generate a prompt message; the parameter update unit is used to use the L transaction features of the target transaction corresponding to the intercepted payment request as new training samples, and update the model parameters of the local target model based on the new training samples.

[0170] In an optional embodiment, the risk detection device for transaction payment requests further includes: an initialization unit, a first training unit, a second training unit, a gradient aggregation unit, and a model update unit.

[0171] Optionally, the initialization unit is used to transmit the model parameters of the global initial model to the financial institution and the e-commerce platform, and control the financial institution and the e-commerce platform to perform initialization operations based on the model parameters of the global initial model to obtain the local initial model; the first training unit is used to iteratively train the local initial model deployed in the financial institution based on the transaction information of historical transactions in the financial institution to obtain the first training model; the second training unit is used to iteratively train the local initial model deployed in the e-commerce platform based on the product information of the traded products in the e-commerce platform to obtain the second training model; the gradient aggregation unit is used to encrypt and transmit the gradients of the first training model and the gradients of the second training model to the central server, and the central server aggregates the gradients of the first training model and the gradients of the second training model to obtain the global gradient; the model update unit is used to iteratively update the model parameters of the global initial model based on the global gradient to obtain the global target model.

[0172] As described above, this device pre-trains local data from multiple platforms (such as financial institutions and e-commerce platforms) using federated learning technology to obtain a global target model. Then, the device synchronizes the model parameters of the global target model to the local model of the financial institution to obtain a local target model. Finally, by performing multi-dimensional transaction feature analysis on the target transaction through the local target model, the device achieves the goal of improving the accuracy of risk detection of transaction payment requests without sharing the original local data between multiple platforms.

[0173] In other words, based on the extracted multidimensional transaction features, the local target model can independently complete risk assessment and calculate the risk score of the target transaction. This method not only improves the model's generalization ability and intelligent recognition accuracy, but also enhances the security of local transaction data and avoids the risk of privacy leakage caused by the direct exchange of local data on multiple platforms. Thus, it achieves the technical effect of effectively identifying potential transaction risks while protecting user privacy, thereby solving the technical problem of low accuracy in risk detection of user-initiated transaction payment requests based on existing technologies.

[0174] It should be noted that the input unit 601, feature extraction unit 602, and risk detection unit 603 mentioned above correspond to steps S201 to S203 in the method embodiment. The instances and application scenarios implemented by the above units and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be part of the device and run in the computer terminal 10 provided in the embodiment.

[0175] Example 3

[0176] Embodiments of this application can also provide an electronic device. Figure 7 This is a structural block diagram of an electronic device according to an embodiment of this application, such as... Figure 7 As shown, the electronic device includes: one or more ( Figure 7 (Only one is shown) processor 702, memory 704, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0177] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and devices in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the risk detection method for transaction payment requests described above.

[0178] The memory may include high-speed random access memory (RAM), and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, which can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks (LANs), mobile communication networks, and combinations thereof.

[0179] The processor can access information and applications stored in memory via a transmission device to execute the following steps: After receiving a payment request for a target transaction initiated by the target user, the transaction information of the target transaction is input into the local target model. The local target model has the same model parameters as the global target model, which is a federated model obtained by federated training on transaction information from historical transactions in financial institutions and product information from e-commerce platforms. Through the local target model, features are extracted from the transaction information of the target transaction to obtain L transaction features, where L is a positive integer. The L transaction features are used to characterize at least the device information of the target device used by the target user for payment and the behavioral information of the target user. Based on the L transaction features, risk detection is performed on the payment request of the target transaction to obtain a risk score for the target transaction.

[0180] The processor can access information and applications stored in memory via a transmission device to perform the following steps: parse the transaction information of the target transaction to obtain the device information of the target device; extract features from the device information of the target device to obtain X transaction device features, where X is a positive integer less than or equal to L, and the X transaction device features include at least one of the following: a first transaction device feature, used to characterize the processor model and screen resolution of the target device; a second transaction device feature, used to characterize the browser plugin information of the target device; a third transaction device feature, used to characterize the latency information of the target device in resolving network addresses; and use the X transaction device features as the X transaction features in the L transaction features.

[0181] The processor can access the information and application programs stored in the memory via the transmission device to perform the following steps: parse the transaction information of the target transaction to obtain the biometric behavior information of the target user operating the target device; extract features from the biometric behavior information to obtain Y biometric behavior features, where Y is a positive integer less than or equal to L, and the Y biometric behavior features include at least one of the following: a first biometric behavior feature, used to characterize the mouse button pressure information and acceleration information of the target user when operating the mouse of the target device; a second biometric behavior feature, used to characterize the keyboard button pressure information and keystroke rhythm information of the target user when operating the keyboard of the target device; and use the Y biometric behavior features as the Y transaction features in the L transaction features.

[0182] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: parse the transaction information of the target transaction to obtain the decision behavior information of the target user in the payment process; extract features from the decision behavior information to obtain decision behavior features, wherein the decision behavior features are used to characterize the product selection logic of the target user before initiating the target transaction; and use the decision behavior features as one of the L transaction features.

[0183] The processor can invoke information and applications stored in the memory via a transmission device to perform the following steps: Based on the user identifier of the target user, determine the baseline feature corresponding to each of the L transaction features, wherein the baseline feature is used to characterize the device information and historical behavior information of the historical device used by the target user when initiating historical transactions; Based on the similarity between each transaction feature and the corresponding baseline feature, determine a first risk sub-score for the target transaction, wherein the first risk sub-score is used to characterize the degree of deviation between each transaction feature and the corresponding baseline feature; Based on the device identifier of the target device, query the historical feature database to obtain M historical transactions, wherein M is a positive integer, and the historical devices corresponding to the M historical transactions have the same device identifier as the target device; Based on the transaction features of the M historical transactions, determine a second risk sub-score for the target transaction, wherein the second risk sub-score is used to characterize the correlation coefficient between the M historical transactions; The first risk sub-score and the second risk sub-score are weighted and summed to obtain the risk score of the target transaction.

[0184] The processor can access the information and application stored in the memory via the transmission device to perform the following steps: if the risk score of the target transaction is greater than or equal to the preset score, intercept the payment request of the target transaction and generate a prompt message; use the L transaction features of the target transaction corresponding to the intercepted payment request as new training samples, and update the model parameters of the local target model based on the new training samples.

[0185] The processor can access information and applications stored in memory via a transmission device to perform the following steps: Transmit the model parameters of the global initial model to financial institutions and e-commerce platforms; control the financial institutions and e-commerce platforms to perform initialization operations based on the model parameters of the global initial model to obtain a local initial model; iteratively train the local initial model deployed in the financial institutions based on historical transaction information to obtain a first training model; iteratively train the local initial model deployed in the e-commerce platforms based on product information of traded goods to obtain a second training model; encrypt and transmit the gradients of the first and second training models to a central server; aggregate the gradients of the first and second training models through the central server to obtain a global gradient; iteratively update the model parameters of the global initial model based on the global gradient to obtain a global target model.

[0186] This application provides a risk detection scheme for transaction payment requests. Based on federated learning technology, this application first performs federated training on local data across multiple platforms (such as financial institutions and e-commerce platforms) to obtain a global target model. Then, the model parameters of the global target model are synchronized to the local model of the financial institution to obtain a local target model. Finally, by using the local target model to perform multi-dimensional transaction feature analysis on the target transaction, this approach improves the accuracy of risk detection for transaction payment requests without sharing original local data across multiple platforms.

[0187] In other words, based on the extracted multidimensional transaction features, the local target model can independently complete risk assessment and calculate the risk score of the target transaction. This method not only improves the model's generalization ability and intelligent recognition accuracy, but also enhances the security of local transaction data and avoids the risk of privacy leakage caused by the direct exchange of local data on multiple platforms. Thus, it achieves the technical effect of effectively identifying potential transaction risks while protecting user privacy, thereby solving the technical problem of low accuracy in risk detection of user-initiated transaction payment requests based on existing technologies.

[0188] Those skilled in the art will understand that Figure 7 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, PDAs, mobile internet devices, PADs, and other terminal devices. Figure 7 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 7 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 7 The different configurations shown.

[0189] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0190] Example 4

[0191] Embodiments of this application may also provide a storage medium.

[0192] Optionally, in this embodiment of the application, the storage medium can be used to store the program code executed by the risk detection method for transaction payment requests provided in the above method embodiments.

[0193] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0194] This application also provides a computer program product, which, when executed on a data processing device, is adapted to perform risk detection method steps for a transaction payment request.

[0195] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0196] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0197] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0198] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0199] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0200] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0201] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for risk detection of transaction payment requests, characterized in that, include: After receiving a payment request for a target transaction initiated by a target user, the transaction information of the target transaction is input into the local target model. The local target model has the same model parameters as the global target model. The global target model is a federated model obtained by federated training of transaction information of historical transactions in financial institutions and product information of traded goods in e-commerce platforms. The local target model is used to extract features from the transaction information of the target transaction to obtain L transaction features, where L is a positive integer. The L transaction features are used to characterize at least the device information of the target device used by the target user for payment and the behavioral information of the target user. Based on the L transaction characteristics, risk detection is performed on the payment request of the target transaction to obtain a risk score for the target transaction.

2. The risk detection method for transaction payment requests according to claim 1, characterized in that, Feature extraction is performed on the transaction information of the target transaction to obtain L transaction features, including: The transaction information of the target transaction is parsed to obtain the device information of the target device; Feature extraction is performed on the device information of the target device to obtain X transaction device features, where X is a positive integer less than or equal to L, and the X transaction device features include at least one of the following: The first transaction device feature is used to characterize the processor model and screen resolution of the target device; The second transaction device feature is used to characterize the browser plugin information of the target device; The third transaction device feature is used to characterize the latency information of the target device in resolving network addresses; The X transaction device features are taken as X transaction features out of the L transaction features.

3. The risk detection method for transaction payment requests according to claim 1, characterized in that, Feature extraction is performed on the transaction information of the target transaction to obtain L transaction features, including: The transaction information of the target transaction is parsed to obtain the biometric behavior information of the target user operating the target device; Feature extraction is performed on the biological behavior information to obtain Y biological behavior features, where Y is a positive integer less than or equal to L, and the Y biological behavior features include at least one of the following: The first biological behavioral characteristic is used to characterize the mouse button pressure information and acceleration information of the target user when operating the mouse of the target device; The second biological behavioral characteristic is used to characterize the keyboard key pressure information and keystroke rhythm information of the target user when operating the keyboard of the target device. The Y biological behavioral characteristics are used as the Y transaction characteristics in the L transaction characteristics.

4. The risk detection method for transaction payment requests according to claim 1, characterized in that, Feature extraction is performed on the transaction information of the target transaction to obtain L transaction features, including: The transaction information of the target transaction is analyzed to obtain the decision-making behavior information of the target user in the payment process; Feature extraction is performed on the decision behavior information to obtain decision behavior features, wherein the decision behavior features are used to characterize the product selection logic of the target user before initiating the target transaction; The decision-making behavior feature is taken as one of the L transaction features.

5. The risk detection method for transaction payment requests according to claim 1, characterized in that, Based on the L transaction characteristics, risk detection is performed on the payment request of the target transaction to obtain a risk score for the target transaction, including: Based on the user identifier of the target user, a baseline feature is determined for each of the L transaction features, wherein the baseline feature is used to characterize the device information and historical behavior information of the historical device used by the target user when initiating historical transactions; Based on the similarity between each transaction feature and the corresponding baseline feature, a first risk sub-score for the target transaction is determined, wherein the first risk sub-score is used to characterize the degree of deviation between each transaction feature and the corresponding baseline feature; Based on the device identifier of the target device, M historical transactions are retrieved from the historical feature database, where M is a positive integer, and the historical devices corresponding to the M historical transactions are the same as the device identifier of the target device. Based on the transaction characteristics of the M historical transactions, a second risk sub-score is determined for the target transaction, wherein the second risk sub-score is used to characterize the correlation coefficient between the M historical transactions; The risk score of the target transaction is obtained by weighted summation of the first risk sub-score and the second risk sub-score.

6. The risk detection method for transaction payment requests according to claim 1, characterized in that, After performing risk detection on the payment request of the target transaction based on the L transaction characteristics to obtain a risk score for the target transaction, the risk detection method for the transaction payment request further includes: If the risk score of the target transaction is greater than or equal to a preset score, the payment request for the target transaction will be intercepted and a prompt message will be generated. The L transaction features of the target transaction corresponding to the intercepted payment request are used as new training samples, and the model parameters of the local target model are updated based on the new training samples.

7. The risk detection method for transaction payment requests according to claim 1, characterized in that, The training steps for the global objective model include: The model parameters of the global initial model are transmitted to the financial institution and the e-commerce platform, and the financial institution and the e-commerce platform are controlled to perform initialization operations based on the model parameters of the global initial model to obtain the local initial model; Based on the transaction information of historical transactions in the financial institution, the local initial model deployed in the financial institution is iteratively trained to obtain the first training model; Based on the product information of the traded goods in the e-commerce platform, the local initial model deployed in the e-commerce platform is iteratively trained to obtain the second training model; The gradients of the first training model and the gradients of the second training model are encrypted and transmitted to the central server. The central server then aggregates the gradients of the first training model and the gradients of the second training model to obtain the global gradient. The model parameters of the global initial model are iteratively updated based on the global gradient to obtain the global target model.

8. A risk detection device for transaction payment requests, characterized in that, include: The input unit is used to input the transaction information of the target transaction into the local target model after receiving the payment request of the target transaction initiated by the target user. The local target model has the same model parameters as the global target model. The global target model is a federated model obtained by federated training on the transaction information of historical transactions in financial institutions and the product information of traded goods in e-commerce platforms. The feature extraction unit is used to extract features from the transaction information of the target transaction through the local target model to obtain L transaction features, where L is a positive integer. The L transaction features are used to characterize at least the device information of the target device used by the target user for payment and the behavioral information of the target user. The risk detection unit is used to perform risk detection on the payment request of the target transaction based on the L transaction characteristics, and obtain the risk score of the target transaction.

9. A computer program product, characterized in that, The computer program product includes a computer program, wherein, when the computer program is executed, it controls the computer program product to perform the risk detection method for transaction payment requests as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the risk detection method for transaction payment requests as described in any one of claims 1 to 7.

Images