Transaction risk detection method and device, storage medium and electronic equipment

Abstract

The invention discloses a transaction risk detection method and device, a storage medium and electronic equipment. Relates to the technical field of artificial intelligence, and the method comprises the steps: obtaining a target transaction flow which at least comprises basic transaction information, transaction environment information and user behavior sequence information; performing risk detection on the target transaction stream to obtain a first risk value; obtaining a second risk value according to environment feature information in the threat intelligence and the transaction environment information; and obtaining a target risk value of the target transaction flow according to the first risk value, the second risk value and a third risk value of a target object corresponding to the target transaction flow. Through the method and the device, the problem of relatively low risk detection accuracy caused by static risk detection based on a rule engine in related technologies is solved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and more specifically, to an apparatus, storage medium, and electronic device for a transaction risk detection method. Background Technology

[0002] In the field of financial risk control, static risk detection systems based on rule engines are the primary approach. While rule engine systems can respond quickly, their rigid rule framework makes them unable to effectively identify evolving abnormal behaviors not covered by pre-defined rules, thus limiting the accuracy of risk detection. Furthermore, these systems are costly to maintain, requiring frequent manual intervention to update rules and address new threats.

[0003] There is currently no effective solution to the problem that static risk detection based on rule engines in related technologies has relatively low accuracy. Summary of the Invention

[0004] The main objective of this application is to provide an apparatus, storage medium, and electronic device for a transaction risk detection method, in order to solve the problem that static risk detection based on rule engines in related technologies results in relatively low accuracy of risk detection.

[0005] To achieve the above objectives, according to one aspect of this application, a transaction risk detection method is provided. The method includes: acquiring a target transaction flow, wherein the target transaction flow includes at least basic transaction information, transaction environment information, and user behavior sequence information; performing risk detection on the target transaction flow to obtain a first risk value; obtaining a second risk value based on environmental feature information in threat intelligence and the transaction environment information; and obtaining a target risk value for the target transaction flow based on the first risk value, the second risk value, and a third risk value of a target object corresponding to the target transaction flow.

[0006] Further, performing risk detection on the target transaction flow to obtain a first risk value includes: performing risk detection on continuous parameters in the target transaction flow using a first network model to obtain a first initial risk value; performing risk detection on the target transaction flow using a second network model to obtain a second initial risk value; and calculating the first risk value based on the first initial risk value and the second initial risk value.

[0007] Further, the calculation based on the first initial risk value and the second initial risk value to obtain the first risk value includes: obtaining a first performance evaluation value of the first network model; obtaining a second performance evaluation value of the second network model; and calculating based on the first initial risk value, the second initial risk value, the first performance evaluation value, and the second performance evaluation value to obtain the first risk value.

[0008] Further, the risk detection of continuous parameters in the target transaction flow using the first network model to obtain a first initial risk value includes: determining multiple continuous parameters in the target transaction flow and obtaining the fuzzy center value and fuzzy width value corresponding to each continuous parameter; calculating the continuous parameters based on the fuzzy center value and the fuzzy width value to obtain discrete semantic variables; and calculating the first initial risk value based on the discrete semantic variables and the weight parameters in the first network model.

[0009] Further, the calculation of the first initial risk value based on the discrete semantic variables and the weight parameters in the first network model includes: acquiring multiple expert rules and determining the target expert rule to be triggered based on the discrete semantic variables; acquiring the target discrete semantic variables corresponding to the target expert rules and calculating the rule activation intensity value based on the target discrete semantic variables; and obtaining the first initial risk value based on the rule activation intensity value, the weight parameters, and the number of target expert rules.

[0010] Furthermore, the second initial risk value is obtained by performing risk detection on the target transaction flow through the second network model, which includes: obtaining a transaction feature vector based on the target transaction flow; and processing the transaction feature vector through the self-attention mechanism of the second network model to obtain the second initial risk value.

[0011] Further, obtaining the transaction feature vector based on the target transaction flow includes: performing semantic recognition on the target transaction flow to obtain an embedding vector of a preset dimension; obtaining amount feature information based on the transaction amount in the target transaction flow; obtaining a position deviation vector based on the transaction environment information in the target transaction flow; obtaining a transaction interval vector based on the user behavior sequence information in the target transaction flow; and obtaining the transaction feature vector based on the embedding vector, the amount feature information, the position deviation vector, and the transaction interval vector.

[0012] To achieve the above objectives, according to another aspect of this application, a transaction risk detection device is provided. The device includes: an acquisition unit for acquiring a target transaction flow, wherein the target transaction flow includes at least basic transaction information, transaction environment information, and user behavior sequence information; a processing unit for performing risk detection on the target transaction flow to obtain a first risk value; a first determination unit for obtaining a second risk value based on environmental feature information in threat intelligence and the transaction environment information; and a second determination unit for obtaining a target risk value for the target transaction flow based on the first risk value, the second risk value, and a third risk value of a target object corresponding to the target transaction flow.

[0013] Further, the processing unit includes: a first processing subunit, used to perform risk detection on continuous parameters in the target transaction flow through a first network model to obtain a first initial risk value; a second processing subunit, used to perform risk detection on the target transaction flow through a second network model to obtain a second initial risk value; and a calculation subunit, used to calculate based on the first initial risk value and the second initial risk value to obtain the first risk value.

[0014] Further, the calculation subunit includes: a first acquisition module for acquiring a first performance evaluation value of the first network model; a second acquisition module for acquiring a second performance evaluation value of the second network model; and a first calculation module for calculating the first risk value based on the first initial risk value, the second initial risk value, the first performance evaluation value, and the second performance evaluation value.

[0015] Further, the first processing subunit includes: a determination module, used to determine multiple continuous parameters in the target transaction flow and obtain the fuzzy center value and fuzzy width value corresponding to each continuous parameter; a second calculation module, used to calculate the continuous parameters based on the fuzzy center value and the fuzzy width value to obtain discrete semantic variables; and a third calculation module, used to calculate the first initial risk value based on the discrete semantic variables and the weight parameters in the first network model.

[0016] Furthermore, the third calculation module includes: a first acquisition submodule, used to acquire multiple expert rules and determine the target expert rule to be triggered based on the discrete semantic variables; a second acquisition submodule, used to acquire the target discrete semantic variables corresponding to the target expert rule and calculate the rule activation intensity value based on the target discrete semantic variables; and a determination submodule, used to obtain the first initial risk value based on the rule activation intensity value, the weight parameters, and the number of target expert rules.

[0017] Furthermore, the second processing subunit includes: a determination module, used to obtain a transaction feature vector based on the target transaction flow; and a processing module, used to process the transaction feature vector through the self-attention mechanism of the second network model to obtain the second initial risk value.

[0018] Further, the determining module includes: an identification submodule, used to perform semantic recognition on the target transaction flow to obtain an embedding vector of a preset dimension; a first processing submodule, used to obtain amount feature information based on the transaction amount in the target transaction flow; a second processing submodule, used to obtain a position deviation vector based on the transaction environment information in the target transaction flow; a third processing submodule, used to obtain a transaction interval vector based on the user behavior sequence information in the target transaction flow; and a fourth processing submodule, used to obtain the transaction feature vector based on the embedding vector, the amount feature information, the position deviation vector, and the transaction interval vector.

[0019] According to another aspect of the present invention, an electronic device is also provided, comprising: a memory storing an executable program; and a processor for running the program, wherein the program executes the transaction risk detection method described above when it runs.

[0020] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein the storage medium stores a program, wherein the program controls the device where the storage medium is located to execute the transaction risk detection method described above during runtime.

[0021] In this embodiment, the following steps are employed: obtaining a target transaction flow, wherein the target transaction flow includes at least basic transaction information, transaction environment information, and user behavior sequence information; performing risk detection on the target transaction flow to obtain a first risk value; obtaining a second risk value based on environmental feature information and transaction environment information in threat intelligence; and obtaining a target risk value for the target transaction flow based on the first risk value, the second risk value, and a third risk value of the target object corresponding to the target transaction flow. This solves the technical problem in related technologies where static risk detection based on rule engines results in relatively low accuracy of risk detection.

[0022] This solution captures target transaction flows in real time, including basic transaction data, transaction environment information, and user behavior sequence information. The collected target transaction flows are verified to obtain a first risk value. Then, the transaction environment information in the received target transaction flows is compared with an external threat intelligence database to identify potential threats in the current transaction environment. By comprehensively considering the first risk value (risk assessment of basic transaction information), the second risk value (threat assessment of the transaction environment), and the third risk value calculated based on the user's historical transactions and behavior sequences, an accurate and comprehensive target risk value reflecting the overall transaction risk is obtained. This solution effectively compensates for the shortcomings of traditional rule-engine-based risk control systems in terms of flexibility and response speed, improving the real-time performance and accuracy of risk detection. Attached Figure Description

[0023] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0024] Figure 1 A hardware structure block diagram of a computer terminal for implementing a transaction risk detection method is shown.

[0025] Figure 2 This is a flowchart of a transaction risk detection method provided according to an embodiment of this application;

[0026] Figure 3 This is a schematic diagram of a transaction risk detection device provided according to an embodiment of this application;

[0027] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0031] Example 1

[0032] According to an embodiment of this application, a method embodiment for detecting transaction risks is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0033] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a transaction risk detection method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0034] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0035] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the transaction risk detection method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned transaction risk detection method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0036] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0037] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0038] Under the aforementioned operating environment, this application provides the following: Figure 2 The transaction risk detection method shown. Figure 2 This is a flowchart of a transaction risk detection method according to Embodiment 1 of this application. The transaction risk detection method includes:

[0039] Step S201: Obtain the target transaction flow, wherein the target transaction flow includes at least basic transaction information, transaction environment information, and user behavior sequence information.

[0040] Optionally, the target transaction flow can be collected in real time. This flow may include basic transaction information, transaction environment information, and user behavior sequence information. Basic transaction information covers fundamental transaction data, such as transaction amount, transaction time, and transaction type. This information is the most direct basis for assessing transaction risk and reflects the scale, frequency, and specific scenario of the transaction.

[0041] Transaction Environment Information: This section focuses more on the external environment in which the transaction takes place, including detailed information about the transaction device (device type, operating system, device fingerprint), network status (such as network latency, connection type), geographical location information, and any data that can reflect the security status of the environment in which the transaction took place. For example, whether the device is located in an unauthorized area, whether the network connection is stable, and whether there are high-risk device characteristics (such as being reported as a malicious device).

[0042] User behavior sequence information: This is sequence data of a user's historical transaction behavior, including transaction records, changes in transaction patterns, transaction frequency, and dynamic trends in transaction amount distribution over a period of time. By analyzing this sequence information, a baseline of user behavior can be established, determining whether current transactions deviate from normal behavioral patterns, thereby identifying potential abnormal behavior.

[0043] Step S202: Perform risk detection on the target transaction flow to obtain the first risk value.

[0044] Optionally, before performing risk detection on the target transaction flow, the validity of the data format and scope of each transaction in the flow can be checked to ensure that all transaction information conforms to the expected structure and logic, thereby eliminating false alarms caused by data errors. The movement speed of the transaction entity between two transactions can also be calculated based on the geographical location information of consecutive transactions involving the same object in the transaction flow. If the movement speed exceeds the corresponding physical limits (e.g., completing a transaction in two distant cities within a short period of time), then the transaction will be considered suspicious. Furthermore, the integrity and accuracy of transaction data during transmission can be checked to prevent biases in risk assessment caused by data tampering or loss.

[0045] After the above checks pass, risk detection is performed on the target transaction flow. For example, preprocessing and feature extraction are performed on various information items in the transaction flow, converting continuous variables such as transaction amount and geographical coordinates into fuzzy semantic variables to facilitate subsequent fuzzy logic reasoning. Dynamic fuzzification layers can better adapt to the fluctuating characteristics of data, reducing false alarms caused by minor data changes. A fuzzy neural network is used to perform in-depth analysis of the preprocessed transaction features to obtain the corresponding first risk value. Alternatively, the self-attention mechanism of the Transformer model can be applied to capture risk information in the target transaction flow to obtain the first risk value.

[0046] Step S203: Based on the environmental characteristics and transaction environment information in the threat intelligence, a second risk value is obtained.

[0047] Optionally, environmental characteristic information related to the transaction flow can be extracted from the threat intelligence database, including but not limited to network layer indicators (such as TCP latency and packet loss rate), device type, device fingerprint, IP address reputation, and geographical location risk score. Environmental characteristic information can be directly derived from transaction data or obtained from external data sources, such as IP reputation databases and malicious device databases.

[0048] Then, the environmental information of each transaction is analyzed in depth to assess its security and potential anomalies. For example, if the fingerprint of the transaction device matches a known malicious device, or if the geographical location of the transaction is in a high-risk area, these will directly increase the environmental risk score of the transaction. That is, by combining environmental information from the real-time transaction stream with data from the threat intelligence database, a second risk value for the transaction environment is calculated.

[0049] Step S204: Based on the first risk value, the second risk value, and the third risk value of the target object corresponding to the target transaction flow, the target risk value of the target transaction flow is obtained.

[0050] Optionally, the first risk value obtained in step S202, the second risk value obtained in step S203, and the third risk value generated by the analysis of the target object's historical behavior are synchronized and integrated to ensure that the information of each risk dimension can be compared and analyzed within the same time frame.

[0051] The three risk values ​​are weighted according to a pre-defined weighting strategy. For example, for certain types of abnormal behavior, transaction characteristics may be more important than environmental characteristics, thus leading to a bias in weighting. The weighted risk values ​​are then combined to obtain the target risk value. For example, Decision_Score = α R1 + β R2 + γ R3 and Decision_Score represent the target risk value, R1, R2, and R3 represent the first, second, and third risk values, respectively, and α, β, and γ are their respective weights. Based on a comparison between the target risk value and a preset decision threshold, a decision is made as to whether to block the transaction or mark it as high-risk.

[0052] In summary, this method involves real-time capture of target transaction flows, which include basic transaction data, transaction environment information, and user behavior sequence information. The collected target transaction flows are verified to obtain a first risk value. Then, the transaction environment information within the received target transaction flows is compared with an external threat intelligence database to identify potential threats in the current transaction environment. By comprehensively considering the first risk value (risk assessment of basic transaction information), the second risk value (threat assessment of the transaction environment), and the third risk value calculated based on users' historical transactions and behavior sequences, an accurate and comprehensive target risk value reflecting the overall transaction risk is obtained. This solution effectively compensates for the shortcomings of traditional rule-engine-based risk control systems in terms of flexibility and response speed, improving the real-time performance and accuracy of risk detection.

[0053] Optionally, in the transaction risk detection method provided in this application embodiment, the risk detection of the target transaction flow to obtain a first risk value includes: performing risk detection on the continuous parameters in the target transaction flow through a first network model to obtain a first initial risk value; performing risk detection on the target transaction flow through a second network model to obtain a second initial risk value; and calculating based on the first initial risk value and the second initial risk value to obtain the first risk value.

[0054] In an optional embodiment, the first network model is designed for continuous parameters (such as transaction amount, time interval, geographic coordinates, etc.) and may be a structure similar to an FNN (fuzzy neural network) to capture the fuzziness and uncertainty in the continuous parameters and identify potential abnormal transaction patterns. The continuous parameters in the target transaction flow are input into the first network model, and through the model's reasoning and calculation, a first initial risk value reflecting the inherent risk of these parameters is obtained.

[0055] The second network model analyzes the entire target transaction flow. It encodes the features of each transaction in the flow, converting categorical features into a form understandable to the neural network (such as one-hot encoding or embedding vectors). This information, along with sequence features (such as timestamps), is then input into the second network model. Through its internal learning mechanism, the second network model detects and quantifies potential risks in the target transaction flow, generating a second initial risk value.

[0056] The first initial risk value generated by the first network model is merged with the second initial risk value generated by the second network model to generate a first risk value that fully reflects the risk of the target transaction flow. For example, the first initial risk value is obtained by weighted summation of the first initial risk value and the second initial risk value.

[0057] By combining the first network model and the second network model, the transaction risk detection method provided in this application embodiment can comprehensively cover the risk identification of continuous and non-continuous parameters, ensuring high sensitivity and responsiveness in the face of various potential transaction risks.

[0058] Optionally, in the transaction risk detection method provided in this application embodiment, calculating the first risk value based on the first initial risk value and the second initial risk value includes: obtaining the first performance evaluation value of the first network model; obtaining the second performance evaluation value of the second network model; and calculating the first risk value based on the first initial risk value, the second initial risk value, the first performance evaluation value, and the second performance evaluation value.

[0059] In an optional embodiment, a series of performance evaluation metrics for the first network model (e.g., FNN) need to be determined. These metrics may include model accuracy, recall, precision, F1 score, and features particularly important to the current business scenario, such as processing latency and resource consumption. For example, a first performance evaluation value for the first network model can be calculated based on the results of running the model on a validation or test set. The first performance evaluation value can be a comprehensive consideration of multiple metrics closely related to the business objectives to form an overall score that quantifies the model's performance.

[0060] Similarly, the second performance evaluation value of the second network model is obtained, and then the first initial risk value, the second initial risk value, and the first and second performance evaluation values ​​of their respective models are combined to calculate the first risk value through a dynamically adjusted fusion strategy.

[0061] In an optional embodiment, the ratio between the first performance evaluation value and the second performance evaluation value can be calculated. Then, based on the first initial risk value, the second initial risk value, and the ratio... The first risk value is calculated. For example,

[0062]

[0063] in, The first risk value, The first initial risk value, This is the second initial risk value.

[0064] By introducing a performance evaluation ratio between the two models, the system can automatically select the better-performing model for risk assessment under specific conditions, thereby improving the accuracy of risk detection when facing complex or specific types of transaction flows.

[0065] Optionally, in the transaction risk detection method provided in this application embodiment, the method of detecting the risk of continuous parameters in the target transaction flow through a first network model to obtain a first initial risk value includes: determining multiple continuous parameters in the target transaction flow and obtaining the fuzzy center value and fuzzy width value corresponding to each continuous parameter; calculating the continuous parameters based on the fuzzy center value and fuzzy width value to obtain discrete semantic variables; and calculating the first initial risk value based on the discrete semantic variables and the weight parameters in the first network model.

[0066] In an optional embodiment, continuous parameters to be analyzed, such as transaction amount, time interval, and geographic coordinates, are determined from the target transaction flow. These parameters, due to their continuously changing numerical values, are suitable for processing using fuzzy logic. Then, a fuzzy center value (c) and a fuzzy width value (σ) are assigned to each continuous parameter. The fuzzy center value represents the center point of a fuzzy set, while the fuzzy width value determines the breadth of the fuzzy set. Based on the determined fuzzy center value and width value, the continuous parameters are fuzzified, transforming them into a series of discrete semantic variables.

[0067] For example:

[0068]

[0069] Where c is the center point of the fuzzy set (e.g., "amount" = 10 yuan) and σ is the width of the fuzzy set (controlling the fuzzy boundary). These are continuous parameters.

[0070] In the first network model, each discrete semantic variable is associated with a set of weight parameters, which reflect the importance of each parameter to risk as learned by the model. After model inference, the first network model outputs a probability value representing the risk level of the target transaction flow, i.e., the first initial risk value.

[0071] Through the above process, the first network model can not only effectively process continuous parameters in the target transaction flow, but also calculate a preliminary risk assessment result based on fuzzy logic and neural networks, thereby improving the accuracy and timeliness of risk detection.

[0072] Optionally, in the transaction risk detection method provided in this application embodiment, the calculation of the first initial risk value based on discrete semantic variables and weight parameters in the first network model includes: acquiring multiple expert rules and determining the target expert rule to be triggered based on discrete semantic variables; acquiring the target discrete semantic variables corresponding to the target expert rule and calculating the rule activation intensity value based on the target discrete semantic variables; and obtaining the first initial risk value based on the rule activation intensity value, weight parameters, and the number of target expert rules.

[0073] In an optional embodiment, an expert rule base is acquired, where the rules are designed based on experience and historical data in a professional field to identify potential risky transaction patterns. For example, a rule could be "If the transaction amount > 10,000 yuan and the geographical location deviates from the user's usual location, then there is a risk." Discrete semantic variables are used to detect which expert rules are triggered by the current target transaction flow. These discrete semantic variables are obtained by fuzzifying continuous parameters in the transaction flow, with each variable representing the semantic state of a certain parameter.

[0074] For each triggered expert rule, calculate the rule activation strength value. For example, the main structure of an expert rule is [Condition 1] AND [Condition 2] THEN [Risk Level]. The formula for calculating the activation strength of each rule is:

[0075]

[0076] For example, given the inputs u(45k)=0.8 (condition 1) and u(0.3)=0.9 (condition 2), the rule activation strength R_i=0.8×0.9=0.72.

[0077] Finally, the first initial risk value is calculated based on the number of triggered expert rules m, the activation intensity value Ri of each rule, and the associated weight parameter wi. The weight parameter wi reflects the degree of contribution of the rule to the overall risk assessment and can be obtained through model training or expert setting.

[0078] In an optional embodiment, the final risk probability is calculated using a weighted method. The predicted risk value for the rule is calculated through gradient descent, where m is the number of rule activations.

[0079]

[0080] In an optional embodiment, the first network model can be an intelligent computing model combining the advantages of fuzzy logic and artificial neural networks, primarily used to handle complex problems with uncertainties, fuzziness, and nonlinear relationships. The first network model includes: an input layer that receives raw transaction data, including but not limited to transaction amount, transaction time, device type, and geographical location; a fuzzification layer that converts the continuous data from the input layer into fuzzy sets; for example, transaction amount can be fuzzified into semantic variables such as "small," "medium," and "large," while transaction time can be converted into "weekday," "weekend," and "nighttime"; the fuzzification layer can be implemented using membership functions, which define the membership degree of input values ​​in different fuzzy sets; a fuzzy rule base that stores fuzzy rules formulated by experts, such as: "If the transaction amount is large and the transaction time is nighttime, the risk level is high." These rules capture expert experience and are optimized and adjusted through the training process of the neural network; and an inference layer that infers from the fuzzy sets of input data by applying fuzzy rules. The inference layer calculates the activation strength of each rule and then performs a weighted average based on the activation strength and weight parameters to obtain the final risk score. Output layer: Provides the final risk score or risk level.

[0081] Through the above steps, the first network model can not only identify and quantify the risks in the target transaction flow, but also integrate expert knowledge to ensure the intelligence and comprehensiveness of risk assessment.

[0082] Optionally, in the transaction risk detection method provided in this application embodiment, the second initial risk value is obtained by performing risk detection on the target transaction flow through the second network model, which includes: obtaining a transaction feature vector based on the target transaction flow; and processing the transaction feature vector through the self-attention mechanism of the second network model to obtain the second initial risk value.

[0083] In an optional embodiment, the second network model (e.g., employing a Transformer architecture) obtains a second initial risk value by processing the transaction feature vectors of the target transaction flow and utilizing its self-attention mechanism. Specifically, this includes: first, extracting transaction feature vectors from the target transaction flow, which may include transaction type, transaction time, transaction amount, geographical location, device fingerprint, etc. Each transaction is transformed into a vector representation containing all selected features. The core of the Transformer model lies in its multi-head self-attention mechanism. This mechanism helps the model focus on the correlations between each transaction feature vector when processing long sequence data, particularly excelling in capturing long-distance dependencies within the sequence.

[0084] In the self-attention mechanism, each trading feature vector interacts with other trading feature vectors. By calculating the attention weights among the various trading feature vectors, their relative importance in risk assessment is determined. After processing the trading feature vector sequence through the self-attention mechanism, the second network model generates a risk score output, which reflects the inherent risk level of the entire trading sequence, i.e., the second initial risk value.

[0085] For example:

[0086]

[0087] in, This is the second initial risk value. This can be a sigmoid function, tanh function, or other similar function, used to ensure that the output value (i.e., the risk score) is within a reasonable range, facilitating subsequent decision-making and analysis. T is the length of the transaction feature vector. It is the weight matrix of the model. It is the vector representation after being processed by the encoder, that is, using the self-attention mechanism to transform the features of each transaction into a potential representation that includes the features of other transactions.

[0088] Through the above steps, the second network model can effectively capture the complex relationships of transaction feature vectors in the target transaction flow, thereby obtaining a second initial risk value that can reflect the overall risk and improve the accuracy of risk detection.

[0089] Optionally, in the transaction risk detection method provided in this application embodiment, obtaining the transaction feature vector based on the target transaction flow includes: performing semantic recognition on the target transaction flow to obtain an embedding vector of a preset dimension; obtaining amount feature information based on the transaction amount in the target transaction flow; obtaining a position deviation vector based on the transaction environment information in the target transaction flow; obtaining a transaction interval vector based on the user behavior sequence information in the target transaction flow; and obtaining the transaction feature vector based on the embedding vector, amount feature information, position deviation vector, and transaction interval vector.

[0090] In an optional embodiment, semantically meaningful fields such as transaction type, product category, and merchant name are embedded using natural language processing techniques to obtain a vector representation of a preset dimension. The amount of each transaction is normalized to eliminate the impact of magnitude differences on model performance. Generally, a logarithmic transformation of the transaction amount can be used to map the monetary features to a fixed range to obtain monetary feature information.

[0091] Based on the user's frequently used and current transaction locations, the location deviation of the transaction location is calculated. This can be achieved using geolocation coding and deviation measurement to obtain a location deviation vector. Based on the transaction timestamp, the transaction interval is calculated and converted into a transaction interval vector mapped to the range [-1, 1]. Finally, the various vectors obtained above are combined to form the transaction feature vector of the target transaction flow.

[0092] For example, transaction feature vector:

[0093]

[0094] in, For embedding vectors; The amount after normalization; The time interval before and after the transaction is mapped to [-1, 1]. Location deviation from commonly used locations Standard deviation This refers to the transaction amount.

[0095] In an optional embodiment, the second network model includes an embedding layer that converts information such as transaction type, timestamp, and geographic location into numerical vectors for the neural network to process. Each feature is converted into a fixed-length vector, which is then concatenated to form a complete transaction feature vector. A location encoding layer adds location information to each transaction feature vector, ensuring the model understands the relative position of the features in the sequence, which is crucial for capturing the dynamics of the time series.

[0096] Encoder Layer: The encoder consists of multiple layers, each containing two sub-layers: a multi-head self-attention mechanism and a feedforward network. Multi-head self-attention: This allows the model to focus on the relationship between any two transactions in a sequence and assign attention weights to each transaction. "Multi-head" means decomposing the self-attention mechanism into multiple parallel, small-scale attention heads, each computing independently, and then merging the results. This captures dependencies at different levels. Feedforward Network: This layer further processes and transforms the vectors obtained from the self-attention mechanism, increasing the model's learning ability.

[0097] Output layer: The last layer integrates the encoder's output and converts it into a probability value or risk score using an activation function (such as sigmoid or tanh).

[0098] The transaction risk detection method provided in this application embodiment obtains a target transaction flow, wherein the target transaction flow includes at least basic transaction information, transaction environment information, and user behavior sequence information; performs risk detection on the target transaction flow to obtain a first risk value; obtains a second risk value based on environmental feature information and transaction environment information in threat intelligence; and obtains a target risk value for the target transaction flow based on the first risk value, the second risk value, and a third risk value of the target object corresponding to the target transaction flow. This method solves the technical problem in related technologies where static risk detection based on rule engines results in relatively low accuracy of risk detection.

[0099] This solution captures target transaction flows in real time, including basic transaction data, transaction environment information, and user behavior sequence information. The collected target transaction flows are verified to obtain a first risk value. Then, the transaction environment information in the received target transaction flows is compared with an external threat intelligence database to identify potential threats in the current transaction environment. By comprehensively considering the first risk value (risk assessment of basic transaction information), the second risk value (threat assessment of the transaction environment), and the third risk value calculated based on the user's historical transactions and behavior sequences, an accurate and comprehensive target risk value reflecting the overall transaction risk is obtained. This solution effectively compensates for the shortcomings of traditional rule-engine-based risk control systems in terms of flexibility and response speed, improving the real-time performance and accuracy of risk detection.

[0100] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0101] Example 2

[0102] This application also provides a transaction risk detection device. It should be noted that the transaction risk detection device of this application can be used to execute the transaction risk detection method provided in this application. The transaction risk detection device provided in this application is described below.

[0103] According to an embodiment of this application, a transaction risk detection device for implementing the above-described transaction risk detection method is also provided, such as... Figure 3 As shown, the device includes: an acquisition unit 301, a processing unit 302, a first determination unit 303, and a second determination unit 304.

[0104] The acquisition unit 301 is used to acquire the target transaction flow, wherein the target transaction flow includes at least basic transaction information, transaction environment information and user behavior sequence information;

[0105] Processing unit 302 is used to perform risk detection on the target transaction flow and obtain a first risk value;

[0106] The first determining unit 303 is used to obtain a second risk value based on the environmental feature information and transaction environment information in the threat intelligence;

[0107] The second determining unit 304 is used to obtain the target risk value of the target transaction flow based on the first risk value, the second risk value and the third risk value of the target object corresponding to the target transaction flow.

[0108] The transaction risk detection device provided in this application embodiment acquires a target transaction flow through an acquisition unit 301, wherein the target transaction flow includes at least basic transaction information, transaction environment information, and user behavior sequence information; a processing unit 302 performs risk detection on the target transaction flow to obtain a first risk value; a first determination unit 303 obtains a second risk value based on environmental feature information and transaction environment information in threat intelligence; and a second determination unit 304 obtains a target risk value for the target transaction flow based on the first risk value, the second risk value, and a third risk value of the target object corresponding to the target transaction flow. This solves the technical problem in related technologies where static risk detection based on rule engines results in relatively low accuracy of risk detection.

[0109] This solution captures target transaction flows in real time, including basic transaction data, transaction environment information, and user behavior sequence information. The collected target transaction flows are verified to obtain a first risk value. Then, the transaction environment information in the received target transaction flows is compared with an external threat intelligence database to identify potential threats in the current transaction environment. By comprehensively considering the first risk value (risk assessment of basic transaction information), the second risk value (threat assessment of the transaction environment), and the third risk value calculated based on the user's historical transactions and behavior sequences, an accurate and comprehensive target risk value reflecting the overall transaction risk is obtained. This solution effectively compensates for the shortcomings of traditional rule-engine-based risk control systems in terms of flexibility and response speed, improving the real-time performance and accuracy of risk detection.

[0110] Optionally, in the transaction risk detection device provided in this application embodiment, the processing unit includes: a first processing subunit, used to perform risk detection on continuous parameters in the target transaction flow through a first network model to obtain a first initial risk value; a second processing subunit, used to perform risk detection on the target transaction flow through a second network model to obtain a second initial risk value; and a calculation subunit, used to calculate based on the first initial risk value and the second initial risk value to obtain a first risk value.

[0111] Optionally, in the transaction risk detection device provided in this application embodiment, the calculation subunit includes: a first acquisition module, used to acquire a first performance evaluation value of a first network model; a second acquisition module, used to acquire a second performance evaluation value of a second network model; and a first calculation module, used to calculate a first risk value based on a first initial risk value, a second initial risk value, a first performance evaluation value, and a second performance evaluation value.

[0112] Optionally, in the transaction risk detection device provided in this application embodiment, the first processing subunit includes: a determination module, used to determine multiple continuous parameters in the target transaction flow and obtain the fuzzy center value and fuzzy width value corresponding to each continuous parameter; a second calculation module, used to calculate the continuous parameters based on the fuzzy center value and fuzzy width value to obtain discrete semantic variables; and a third calculation module, used to calculate based on the discrete semantic variables and the weight parameters in the first network model to obtain a first initial risk value.

[0113] Optionally, in the transaction risk detection device provided in this application embodiment, the third calculation module includes: a first acquisition submodule, used to acquire multiple expert rules and determine the target expert rule to be triggered based on discrete semantic variables; a second acquisition submodule, used to acquire the target discrete semantic variables corresponding to the target expert rule and calculate the rule activation intensity value based on the target discrete semantic variables; and a determination submodule, used to obtain a first initial risk value based on the rule activation intensity value, weight parameters and the number of target expert rules.

[0114] Optionally, in the transaction risk detection device provided in this application embodiment, the second processing subunit includes: a determination module, used to obtain a transaction feature vector based on the target transaction flow; and a processing module, used to process the transaction feature vector through the self-attention mechanism of the second network model to obtain a second initial risk value.

[0115] Optionally, in the transaction risk detection device provided in this application embodiment, the determining module includes: an identification submodule, used to perform semantic recognition on the target transaction flow to obtain an embedding vector of a preset dimension; a first processing submodule, used to obtain amount feature information based on the transaction amount in the target transaction flow; a second processing submodule, used to obtain a position deviation vector based on the transaction environment information in the target transaction flow; a third processing submodule, used to obtain a transaction interval vector based on the user behavior sequence information in the target transaction flow; and a fourth processing submodule, used to obtain a transaction feature vector based on the embedding vector, amount feature information, position deviation vector, and transaction interval vector.

[0116] It should be noted that the acquisition unit 301, processing unit 302, first determining unit 303, and second determining unit 304 mentioned above correspond to steps S201 to S204 in Embodiment 1. The four units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0117] Example 3

[0118] Embodiments of this application may provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (Only one is shown) Processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0119] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0120] The processor can invoke information and applications stored in the memory through the transmission device to perform the following steps: acquiring the target transaction flow, wherein the target transaction flow includes at least basic transaction information, transaction environment information, and user behavior sequence information; performing risk detection on the target transaction flow to obtain a first risk value; obtaining a second risk value based on the environmental feature information and transaction environment information in the threat intelligence; and obtaining a target risk value for the target transaction flow based on the first risk value, the second risk value, and a third risk value for the target object corresponding to the target transaction flow.

[0121] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: performing risk detection on the target transaction flow to obtain a first risk value, including: performing risk detection on the continuous parameters in the target transaction flow through a first network model to obtain a first initial risk value; performing risk detection on the target transaction flow through a second network model to obtain a second initial risk value; and calculating based on the first initial risk value and the second initial risk value to obtain the first risk value.

[0122] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: calculating the first risk value based on the first initial risk value and the second initial risk value, including: obtaining the first performance evaluation value of the first network model; obtaining the second performance evaluation value of the second network model; and calculating the first risk value based on the first initial risk value, the second initial risk value, the first performance evaluation value, and the second performance evaluation value.

[0123] The processor can call the information and application program stored in the memory through the transmission device to perform the following steps: performing risk detection on continuous parameters in the target transaction flow through the first network model to obtain a first initial risk value, including: determining multiple continuous parameters in the target transaction flow and obtaining the fuzzy center value and fuzzy width value corresponding to each continuous parameter; calculating the continuous parameters based on the fuzzy center value and fuzzy width value to obtain discrete semantic variables; and calculating the first initial risk value based on the discrete semantic variables and the weight parameters in the first network model.

[0124] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: calculating the first initial risk value based on discrete semantic variables and weight parameters in the first network model, including: acquiring multiple expert rules and determining the target expert rule to be triggered based on discrete semantic variables; acquiring the target discrete semantic variables corresponding to the target expert rule and calculating the rule activation strength value based on the target discrete semantic variables; and obtaining the first initial risk value based on the rule activation strength value, weight parameters, and the number of target expert rules.

[0125] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: performing risk detection on the target transaction flow through the second network model to obtain a second initial risk value, including: obtaining a transaction feature vector based on the target transaction flow; and processing the transaction feature vector through the self-attention mechanism of the second network model to obtain a second initial risk value.

[0126] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: obtaining a transaction feature vector based on the target transaction flow, including: performing semantic recognition on the target transaction flow to obtain an embedding vector of a preset dimension; obtaining amount feature information based on the transaction amount in the target transaction flow; obtaining a position deviation vector based on the transaction environment information in the target transaction flow; obtaining a transaction interval vector based on the user behavior sequence information in the target transaction flow; and obtaining the transaction feature vector based on the embedding vector, amount feature information, position deviation vector, and transaction interval vector.

[0127] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0128] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0129] Example 4

[0130] Embodiments of this application also provide a computer-readable storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the transaction risk detection method provided in Embodiment 1.

[0131] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0132] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing steps of a transaction risk detection method.

[0133] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0134] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0135] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0136] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0137] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0138] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0139] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting transaction risk, characterized in that, include: Obtain the target transaction flow, wherein the target transaction flow includes at least basic transaction information, transaction environment information, and user behavior sequence information; A risk detection is performed on the target transaction flow to obtain a first risk value; Based on the environmental characteristics information in the threat intelligence and the transaction environment information, a second risk value is obtained; The target risk value of the target transaction flow is obtained based on the first risk value, the second risk value, and the third risk value of the target object corresponding to the target transaction flow.

2. The method according to claim 1, characterized in that, Risk detection is performed on the target transaction flow to obtain a first risk value, including: The first network model is used to detect the risk of continuous parameters in the target transaction flow to obtain a first initial risk value. The target transaction flow is subjected to risk detection using a second network model to obtain a second initial risk value. The first risk value is obtained by calculating based on the first initial risk value and the second initial risk value.

3. The method according to claim 2, characterized in that, The first risk value is calculated based on the first initial risk value and the second initial risk value, and includes: Obtain the first performance evaluation value of the first network model; Obtain the second performance evaluation value of the second network model; The first risk value is obtained by calculating based on the first initial risk value, the second initial risk value, the first performance evaluation value, and the second performance evaluation value.

4. The method according to claim 2, characterized in that, The first initial risk value is obtained by performing risk detection on the continuous parameters in the target transaction flow using a first network model, including: Determine multiple continuous parameters in the target transaction flow and obtain the fuzzy center value and fuzzy width value corresponding to each continuous parameter; The continuous parameters are calculated based on the fuzzy center value and the fuzzy width value to obtain discrete semantic variables; The first initial risk value is obtained by calculating based on the discrete semantic variables and the weight parameters in the first network model.

5. The method according to claim 4, characterized in that, The first initial risk value is calculated based on the discrete semantic variables and the weight parameters in the first network model, including: Obtain multiple expert rules and determine the target expert rule to be triggered based on the discrete semantic variables; Obtain the target discrete semantic variables corresponding to the target expert rule, and calculate the rule activation strength value based on the target discrete semantic variables; The first initial risk value is obtained based on the rule activation intensity value, the weight parameter, and the number of target expert rules.

6. The method according to claim 2, characterized in that, The target transaction flow is subjected to risk detection using a second network model to obtain a second initial risk value, including: Based on the target transaction flow, a transaction feature vector is obtained; The transaction feature vector is processed by the self-attention mechanism of the second network model to obtain the second initial risk value.

7. The method according to claim 6, characterized in that, Based on the target transaction flow, the transaction feature vector obtained includes: Semantic recognition is performed on the target transaction stream to obtain an embedding vector of a preset dimension; Based on the transaction amount in the target transaction stream, the amount feature information is obtained; Based on the transaction environment information in the target transaction flow, a position deviation vector is obtained; Based on the user behavior sequence information in the target transaction flow, a transaction interval vector is obtained; The transaction feature vector is obtained based on the embedding vector, the amount feature information, the position deviation vector, and the transaction interval vector.

8. A transaction risk detection device, characterized in that, include: An acquisition unit is used to acquire a target transaction flow, wherein the target transaction flow includes at least basic transaction information, transaction environment information, and user behavior sequence information; The processing unit is used to perform risk detection on the target transaction flow and obtain a first risk value; The first determining unit is used to obtain a second risk value based on the environmental feature information in the threat intelligence and the transaction environment information; The second determining unit is used to obtain the target risk value of the target transaction flow based on the first risk value, the second risk value, and the third risk value of the target object corresponding to the target transaction flow.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device containing the computer-readable storage medium to perform the transaction risk detection method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program executes the transaction risk detection method according to any one of claims 1 to 7 when it runs.

Images