Abnormality detection method and device for transaction flow data, and computer program product

Abstract

The invention discloses an anomaly detection method and device for transaction flow data and a computer program product. Relates to the field of financial science and technology. The method comprises the following steps: extracting time features, space features and business features from transaction flow data of a user; calculating a time fluctuation index value based on the time feature, calculating a spatial offset index value based on the spatial feature, and calculating a business conflict index value based on the business feature; inputting the time fluctuation index value, the spatial deviation index value and the business conflict index value into a preset activation function to obtain an abnormal probability that abnormal data exists in the transaction flow data; and when the abnormal probability is greater than or equal to a probability threshold value, determining that abnormal data exist in the transaction flow data. Through the method and the device, the problem of poor accuracy of anomaly detection on transaction flow data in related technologies is solved.

Description

Technical Field

[0001] This application relates to the field of financial technology, and more specifically, to a method, apparatus, and computer program product for detecting anomalies in transaction flow data. Background Technology

[0002] With the increasing complexity of business operations and the growing volume of data, financial institutions face increasing challenges in managing their financial data. One related technology uses rule engines for anomaly detection, based on predefined thresholds, such as triggering an alarm when a single transaction exceeds 1 million yuan. This method is simple, intuitive, and easy to implement, but it has poor adaptability to complex scenarios. Traditional threshold detection methods based on rule engines have a high false positive rate in specific scenarios, such as payday. For missing financial institution transaction data, related technologies use simple interpolation methods, averaging the values ​​of preceding and following transactions to fill in the missing data. This method works reasonably well when the data is relatively stable, but its accuracy drops significantly when dealing with data with significant fluctuations or sequence dependencies. The detection and completion methods in related technologies lack the ability to trace the root cause of anomalies. Once an anomaly is detected, it is difficult to determine whether it stems from system failure, human error, or illegal tampering, which complicates incident investigation and fault recovery.

[0003] There is currently no effective solution to the problem of poor accuracy in detecting anomalies in transaction log data in related technologies. Summary of the Invention

[0004] The main objective of this application is to provide a method, apparatus, and computer program product for detecting anomalies in transaction flow data, so as to solve the problem of poor accuracy in detecting anomalies in transaction flow data in related technologies.

[0005] To achieve the above objectives, according to one aspect of this application, an anomaly detection method for transaction log data is provided. The method includes: extracting time features, spatial features, and business features from a user's transaction log data, wherein the time features characterize the temporal regularity of transactions indicated by the transaction log data, the spatial features characterize the geographical correlation between multiple counterparties in the transactions indicated by the transaction log data, and the business features characterize the transaction type of the transactions indicated by the transaction log data; calculating a time fluctuation index value based on the time features, a spatial offset index value based on the spatial features, and a business conflict index value based on the business features; inputting the time fluctuation index value, spatial offset index value, and business conflict index value into a preset activation function to obtain the anomaly probability of abnormal data existing in the transaction log data; and determining that abnormal data exists in the transaction log data if the anomaly probability is greater than or equal to a probability threshold.

[0006] Optionally, calculating the time fluctuation index value based on time characteristics includes: extracting the time intervals between adjacent transactions in multiple transactions corresponding to transaction flow data within a preset period from the time characteristics to obtain a time interval sequence; determining the probability distribution of time intervals of different durations in the time interval sequence to obtain the probability distribution of time intervals of each duration; determining the date type of the transaction date to which each time interval belongs in the time interval sequence, and determining the preset weight of each date type, wherein the date type includes at least one of the following: weekday, holiday, and payday; for each time interval in the time interval sequence, calculating the product of the time interval probability distribution, the target logarithm, and the preset weight to obtain the entropy value of the time interval, wherein the target logarithm is the logarithm with base 2 and the time interval probability distribution as the argument; and determining the time fluctuation index value based on the cumulative value of the entropy values ​​of the time intervals in the time interval sequence.

[0007] Optionally, calculating the spatial offset index value based on spatial features includes: extracting the total number of transactions and the number of cross-border transactions corresponding to multiple transactions from the spatial features, and determining the geographical location information of each transaction; calculating the ratio of the number of cross-border transactions to the total number of transactions, and calculating the product of the ratio and the preset cross-border transaction weight to obtain the cross-border index value; for each transaction, clustering the N geographical location information of the N adjacent transactions to obtain clustered geographical location information, calculating the distance parameter between the geographical location information of the transaction and the clustered geographical location information, and calculating the product of the distance parameter and the preset offset weight to obtain the offset index value; and calculating the sum of the offset index value and the cross-border index value to obtain the spatial offset index value.

[0008] Optionally, calculating the business conflict indicator value based on business characteristics includes: extracting the first transaction amount and the second transaction amount for each transaction from the business characteristics, and determining whether there is a conflict between the first transaction amount and the second transaction amount, wherein the first transaction amount is the amount of income or expenditure of the user in the transaction, and the second transaction amount is the amount of income or expenditure of the user's counterparty in the transaction; if there is a conflict between the first transaction amount and the second transaction amount, the first preset value is determined as the business conflict indicator value; if there is no conflict between the first transaction amount and the second transaction amount, the second preset value is determined as the business conflict indicator value.

[0009] Optionally, after determining that abnormal data exists in the transaction log data, the method further includes: inputting temporal features, spatial features, and business features into the target model to obtain the cause of the abnormal data in the transaction log data. The target model includes an input layer, a feature concatenation layer, a fully connected layer, and an output layer. The feature concatenation layer concatenates the temporal features, spatial features, and business features to obtain fused features. The fully connected layer classifies the fused features for abnormal causes and outputs the probability that the abnormal data belongs to each type of abnormal cause. The output layer outputs the abnormal cause with the highest probability in the fully connected layer. If the abnormal cause indicates that the transaction log data contains missing data, a federated completion strategy is used to complete the transaction log data to obtain the completed transaction log data. If the abnormal cause indicates that the transaction log data contains risky transaction data, a warning message is issued, which alerts the user to the existence of risky transactions.

[0010] Optionally, the transaction log data is completed using a federated completion strategy. The completed transaction log data includes: sending an encrypted query request to the federated coordination node, wherein the federated coordination node forwards the encrypted query request to the user's counterparty. The encrypted query request contains an encrypted value for the transaction date range and a fuzzy range ciphertext for the transaction amount. The encrypted query request is encrypted using a homomorphic encryption algorithm. The encrypted result set forwarded by the federated coordination node is received and aggregated to obtain an aggregated encrypted result. The encrypted result set is a collection of multiple encrypted data matched by the counterparty using the encrypted value for the transaction date range and the fuzzy range ciphertext for the transaction amount. The aggregated encrypted result is homomorphically decrypted to obtain the plaintext of the aggregated transaction data for the counterparty within the transaction date range. The transaction log data is then completed based on the aggregated plaintext transaction data to obtain the completed transaction log data.

[0011] Optionally, after obtaining the completed transaction flow data, the method further includes: calculating the cumulative value of the completed transaction flow data to obtain the user's first total flow value; obtaining the second total flow value of the counterparty corresponding to the completed transaction flow data; calculating the difference between the first total flow value and the second total flow value; if the difference is less than or equal to a difference threshold, determining that the completed transaction flow data is normal; if the difference is greater than the difference threshold, determining that the completed transaction flow data is abnormal, and repeating the step of performing data completion processing on the transaction flow data through a federated completion strategy to obtain the completed transaction flow data, until the difference is less than or equal to the difference threshold.

[0012] To achieve the above objectives, according to another aspect of this application, an anomaly detection device for transaction log data is provided. The device includes: an extraction unit, configured to extract time features, spatial features, and business features from a user's transaction log data, wherein the time features characterize the time regularity of transactions indicated by the transaction log data, the spatial features characterize the geographical correlation between multiple counterparties in the transactions indicated by the transaction log data, and the business features characterize the transaction type of the transactions indicated by the transaction log data; a calculation unit, configured to calculate a time fluctuation index value based on the time features, a spatial offset index value based on the spatial features, and a business conflict index value based on the business features; an input unit, configured to input the time fluctuation index value, the spatial offset index value, and the business conflict index value into a preset activation function to obtain the anomaly probability of abnormal data existing in the transaction log data; and a first determination unit, configured to determine that abnormal data exists in the transaction log data when the anomaly probability is greater than or equal to a probability threshold.

[0013] In this embodiment, time features, spatial features, and business features are extracted from user transaction log data. Time features characterize the temporal regularity of transactions indicated by the transaction log data; spatial features characterize the geographical correlation between multiple counterparties in the transactions indicated by the transaction log data; and business features characterize the transaction type indicated by the transaction log data. A time fluctuation index is calculated based on the time features, a spatial offset index is calculated based on the spatial features, and a business conflict index is calculated based on the business features. These indices are then input into a preset activation function to obtain the probability of anomalies in the transaction log data. If the probability of anomalies is greater than or equal to a probability threshold, the presence of anomalies in the transaction log data is determined. This anomaly detection technology, which integrates spatiotemporal business features, can more accurately identify abnormal transaction patterns in complex scenarios. This achieves the goal of reducing the false alarm rate of abnormal transaction log data, thereby improving the accuracy of anomaly detection and solving the technical problem of poor accuracy in anomaly detection of transaction log data. Attached Figure Description

[0014] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0015] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing an anomaly detection method for transaction log data is shown.

[0016] Figure 2 This is a flowchart of an anomaly detection method for transaction log data provided in the embodiments of this application;

[0017] Figure 3 This is a flowchart illustrating the extraction of temporal features, spatial features, and business features according to embodiments of this application;

[0018] Figure 4 This is a schematic diagram illustrating the completion of transaction log data using a federated completion strategy, based on an embodiment of this application.

[0019] Figure 5 This is a schematic diagram of an anomaly detection system for transaction flow data provided in the embodiments of this application;

[0020] Figure 6 This is a schematic diagram of an anomaly detection device for transaction flow data provided in the embodiments of this application;

[0021] Figure 7 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0025] Example 1

[0026] According to an embodiment of this application, a method embodiment for detecting anomalies in transaction flow data is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0027] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing an anomaly detection method for transaction log data is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, processing devices such as MCU (Microcontroller Unit) or FPGA (Field-Programmable Gate Array), memory 104 for storing data, and transmission device 106 for communication functions. In addition, it may also include: a display, input / output interfaces (I / O interfaces), a USB (Universal Serial Bus) port (which may be included as one of the ports of a BUS (Business Bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0028] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0029] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the anomaly detection method for transaction flow data in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the above-mentioned anomaly detection method for transaction flow data. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0030] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0031] The display may be, for example, a touchscreen LCD display that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0032] Under the above operating environment, this application provides a method for detecting anomalies in transaction flow data. Figure 2 This is a flowchart of an anomaly detection method for transaction log data provided in the embodiments of this application, such as... Figure 2 As shown, the method includes:

[0033] Step S201: Extract time features, spatial features, and business features from the user's transaction log data. The time features are used to characterize the time pattern of the transactions indicated by the transaction log data, the spatial features are used to characterize the geographical correlation between multiple counterparties of the transactions indicated by the transaction log data, and the business features are used to characterize the transaction type of the transactions indicated by the transaction log data.

[0034] In step S201, the transaction log data can be structured fields, including: transaction timestamp, transaction amount, counterparty institution code, GPS (Global Positioning System) coordinates, business type code, transaction status code, etc. Temporal characteristics represent the sequential pattern of transactions, such as the concentrated transfer of salaries on paydays. Spatial characteristics represent the geographical correlation between counterparties, such as in high-frequency cross-border transactions where multiple counterparties are geographically located overseas. Business characteristics are transaction type labels under different transaction scenarios, such as salary / repayment / investment, etc.

[0035] #Feature Example (Single Transaction)

[0036] {

[0037] "time_feature": [seconds since the last transaction, total transaction amount for the day],

[0038] "space_feature": [Transaction party GPS cluster number, cross-border identifier],

[0039] "biz_feature": [Transaction scenario code, counterparty industry type]

[0040] }

[0041] For example, Figure 3 This is a flowchart illustrating the extraction of temporal, spatial, and business features according to embodiments of this application, such as... Figure 3 As shown, feature decomposition is performed on the original transaction data, including time feature extraction, which includes:

[0042] 1) Time series slices:

[0043] Input: The original sequence of transaction history for a single user, sorted by transaction time;

[0044] Operation: Divide into continuous subsequences using a sliding window (window size = 7 days, step size = 1 day);

[0045] Output: Set of subsequences (each subsequence contains multiple transactions).

[0046] 2) Temporal features are extracted using TCN (Temporal Convolutional Network), which includes causal convolutional layers, dilated convolutional layers, and residual connection layers.

[0047] Input: Transaction timestamps, transaction amounts, and time intervals (in seconds) for each subsequence;

[0048] Operation: One-dimensional causal convolution (kernel size = 3, number of channels = 32) → captures local temporal dependencies, temporal attention mechanism → weighted key time points (such as payday);

[0049] Output: Temporal feature vector (dimension=32).

[0050] Temporal protection of causal convolution: The convolution kernel only covers the current and historical moments (t-2, t-1, t), avoiding future information leakage and meeting the real-time requirements of risk control.

[0051] Spatial feature extraction includes:

[0052] Input: GPS code of the transacting party, institution code, and cross-border identification;

[0053] Operation: Construct a transaction location graph (nodes = transaction parties, edges = transaction frequency), aggregate neighborhood features through GCN (Graph Convolutional Network) → generate spatial embedding vectors;

[0054] Output: Spatial feature vector (dimension=16).

[0055] Business feature extraction includes: classifying transaction scenarios based on business tags in transaction log data, mapping the industry of the counterparty, and outputting business features that include transaction type and counterparty industry.

[0056] Step S202: Calculate the time fluctuation index value based on time characteristics, calculate the spatial offset index value based on spatial characteristics, and calculate the business conflict index value based on business characteristics.

[0057] In step S202, the time characteristics mainly focus on the time patterns of transactions, including transaction frequency, time distribution, and periodic changes. The time volatility index value can be calculated in several ways: First, a time series model can be used to model the transaction time series, predicting the frequency or amount of transactions, and then the difference or residual between the actual and predicted values ​​can be calculated as the time volatility index value. Second, methods such as Fourier transform or seasonal decomposition can be used to detect periodic patterns in the transaction data, assessing the degree of deviation between the current transactions and periodic expectations, and using the degree of deviation as the time volatility index value. Third, the entropy value of the transaction time distribution can be calculated; the larger the entropy value, the more random the transaction time distribution, potentially indicating anomalies. For example, time volatility entropy can be used as the time volatility index value.

[0058] Spatial features focus on the geographical location information of transactions, especially the regional correlation between counterparties. The spatial offset metric can be expressed as the spatial offset degree, and its calculation methods can include: clustering transaction GPS coordinates using clustering algorithms, analyzing the geographical distribution of counterparties, calculating the distance between new transactions and the cluster centers of historical transactions (the greater the distance, the higher the offset value); calculating the displacement vector of changes in the transaction parties' locations, and analyzing displacement patterns between consecutive transactions (abnormal displacement patterns may lead to higher spatial offset values); and if transactions suddenly begin to involve cross-border transactions, or if the frequency and patterns of cross-border transactions change significantly, this can be considered as part of the spatial offset metric.

[0059] Business characteristics focus on the type and scenario of transactions, as well as their relationship with the counterparty's industry type. A business conflict indicator value can be used, and its calculation may involve: analyzing the deviation between the current transaction scenario code (e.g., salary payment, credit card repayment, shopping, etc.) and historical transaction scenarios; sudden changes in scenario codes can indicate business conflicts. Calculating the match degree between the counterparty's industry type and the specific transaction type; mismatched industry types may lead to business conflicts. Based on predefined business rules, such as fixed amounts and date patterns for loan repayments, checking whether the current transaction conforms to the rules; the degree of non-compliance can be used as the business conflict indicator value.

[0060] Step S203: Input the time fluctuation index value, spatial offset index value, and business conflict index value into the preset activation function to obtain the probability of abnormal data in the transaction flow data.

[0061] In step S203, the choice of activation function depends on the specific anomaly detection model and application scenario. Activation functions can include Sigmoid, ReLU (Rectified Linear Unit), tanh (hyperbolic tangent function), etc. In anomaly detection, to obtain a probability value in the interval [0, 1], the Sigmoid function can be chosen. The Sigmoid function can map any real value to the interval 0 to 1, making it suitable for handling probability prediction problems. The time fluctuation index, spatial offset index, and business conflict index are input into the Sigmoid activation function. The Sigmoid activation function learns how to predict the anomaly probability based on the values ​​of these three indices using a weight matrix W trained by machine learning methods.

[0062] For example: Anomaly probability = Sigmoid(W·[Time fluctuation index value, Spatial offset index value, Business conflict index value]+b);

[0063] Where W is the weight matrix, obtained through machine learning training, and b is the bias term.

[0064] Step S204: If the probability of an anomaly is greater than or equal to the probability threshold, it is determined that there is abnormal data in the transaction log data.

[0065] In step S204, to transform the probability of an anomaly into an anomaly determination, a probability threshold needs to be set. If the anomaly probability is greater than or equal to this threshold, the transaction data is considered to contain anomaly data. The threshold can be set based on business needs, the distribution of anomalies in historical data, and the tolerance for false positives and false negatives. For example, if the business prefers to reduce false negatives (i.e., does not want to miss any possible anomalies), a lower threshold can be set, even if this may increase the number of false positives; conversely, if more attention is paid to reducing false positives (i.e., does not want to misjudge normal transactions as anomalies), a higher threshold can be chosen.

[0066] The anomaly detection method for transaction log data provided in this application extracts time features, spatial features, and business features from the user's transaction log data. Time features characterize the temporal regularity of transactions indicated by the transaction log data; spatial features characterize the geographical correlation between multiple counterparties in the transactions indicated by the transaction log data; and business features characterize the transaction type indicated by the transaction log data. Based on the time features, a time fluctuation index value is calculated; based on the spatial features, a spatial offset index value is calculated; and based on the business features, a business conflict index value is calculated. These three indices are then input into a preset activation function to obtain the anomaly probability of abnormal data in the transaction log data. If the anomaly probability is greater than or equal to a probability threshold, the existence of abnormal data in the transaction log data is determined. This anomaly detection technology, which fuses spatiotemporal business features, can more accurately identify abnormal transaction patterns in complex scenarios. This achieves the goal of reducing the false alarm rate of abnormal transaction log data, thereby improving the technical effect of improving the accuracy of anomaly detection for transaction log data and solving the technical problem of poor accuracy in anomaly detection of transaction log data.

[0067] The time fluctuation index value can be the time fluctuation entropy. Optionally, in the anomaly detection method for transaction flow data provided in this application embodiment, calculating the time fluctuation index value based on time features includes: extracting the time intervals between adjacent transactions in multiple transactions corresponding to transaction flow data within a preset period from the time features to obtain a time interval sequence; determining the distribution probability of time intervals of different durations in the time interval sequence to obtain the time interval distribution probability of each duration; determining the date type of the transaction date to which each time interval belongs in the time interval sequence, and determining the preset weight of each date type, wherein the date type includes at least one of the following: working day, holiday, and payday; for each time interval in the time interval sequence, calculating the product of the time interval distribution probability, the target logarithm, and the preset weight to obtain the entropy value of the time interval, wherein the target logarithm is the logarithm with base 2 and the time interval distribution probability as the argument; and determining the time fluctuation index value based on the cumulative value of the entropy values ​​of the time intervals in the time interval sequence.

[0068] In some embodiments, the formula for calculating time fluctuation entropy is as follows:

[0069] ;

[0070] Among them, H t This is the time fluctuation entropy, also known as the time fluctuation index value. The preset period can be 30 days, t. i It is a sequence of time intervals {Δt1, Δt2, ..., Δt} of the user's transactions over the past 30 days. n};p(t) iThis refers to the probability distribution of time intervals of each duration. The business unit *w* has a preset weight, for example, payday = 1.5, holiday = 2.0, weekday = 1.0. After calculating the cumulative entropy of the time intervals in the time interval sequence, the negative value is taken to obtain H. t A higher entropy value indicates that the transaction time is more random and the probability of anomalies is greater.

[0071] This embodiment calculates a time fluctuation index value to reflect the degree of fluctuation in transaction time patterns within a preset period. The time fluctuation index value, along with the spatial offset index value and the business conflict index value, is used as one of the inputs to calculate the probability of anomalies in the transaction data through an activation function, providing a basis for anomaly detection decisions.

[0072] The spatial offset index value can be a spatial offset degree. Optionally, in the anomaly detection method for transaction flow data provided in this application embodiment, calculating the spatial offset index value based on spatial features includes: extracting the total number of transactions and the number of cross-border transactions corresponding to multiple transactions from the spatial features, and determining the geographical location information of each transaction; calculating the ratio of the number of cross-border transactions to the total number of transactions, and calculating the product of the ratio and the preset cross-border transaction weight to obtain the cross-border index value; for each transaction, clustering the N geographical location information of the N adjacent transactions to obtain clustered geographical location information, calculating the distance parameter between the geographical location information of the transaction and the clustered geographical location information, and calculating the product of the distance parameter and the preset offset weight to obtain the offset index value; and calculating the sum of the offset index value and the cross-border index value to obtain the spatial offset index value.

[0073] In some embodiments, the formula for calculating spatial offset is as follows:

[0074] ;

[0075] Among them, D s This refers to spatial offset, also known as the spatial offset index value. α is the preset cross-border transaction weight, which can be set to 0.7, and β is the preset offset weight, which can be set to 0.3. Frequently used locations (i.e., clustered geographic location information) = the GPS cluster center of the user's 10 most recent transactions; GPS is the geographic location information of the current transaction. When cross-border transactions suddenly increase or the location deviates from the usual pattern, D... s An increase indicates a greater probability of an anomaly.

[0076] This embodiment calculates a spatial offset index value based on spatial characteristics. This index comprehensively reflects the frequency of cross-border transactions and the degree of deviation from commonly used transaction locations. The spatial offset index value, along with the time fluctuation index value and the business conflict index value, serves as an important basis for determining whether there are anomalies in transaction log data.

[0077] The business conflict indicator value can be obtained by comparing the transaction amounts of the user and the counterparty. Optionally, in the anomaly detection method for transaction flow data provided in this application embodiment, calculating the business conflict indicator value based on business characteristics includes: extracting the first transaction amount and the second transaction amount of each transaction from the business characteristics, and determining whether there is a conflict between the first transaction amount and the second transaction amount, wherein the first transaction amount is the user's income or expenditure amount in the transaction, and the second transaction amount is the user's counterparty's income or expenditure amount in the transaction; if there is a conflict between the first transaction amount and the second transaction amount, the first preset value is determined as the business conflict indicator value; if there is no conflict between the first transaction amount and the second transaction amount, the second preset value is determined as the business conflict indicator value.

[0078] In some embodiments, a first transaction amount and a second transaction amount are extracted from the transaction log data for each transaction. The first transaction amount is the user's income or expenditure amount in the transaction, and the second transaction amount is the counterparty's income or expenditure amount in the same transaction. It is ensured that the extracted amounts correspond to the same transaction; that is, the user's and counterparty's amounts are for the same transaction. The user's first transaction amount and the counterparty's second transaction amount are compared to check for conflicts. Conflicts may stem from data recording errors, system malfunctions, or human error. If the first transaction amount and the second transaction amount are not equal, this may indicate an inconsistency in the amount records, requiring further investigation. Based on the conflict determination results, a business conflict indicator value is determined. In the case of a conflict (i.e., the first transaction amount and the second transaction amount are inconsistent), a higher preset value (the first preset value) is determined as the business conflict indicator value, reflecting a potential anomaly in the transaction that requires close attention. In the case of no conflict (i.e., the first transaction amount and the second transaction amount are consistent), a lower preset value (the second preset value) is determined as the business conflict indicator value. This value will be close to 0, meaning that the transaction data matches in the amount records and there are no anomalies.

[0079] For example, the formula for calculating the business conflict indicator value for lending business is as follows:

[0080] ;

[0081] Among them, C b This is a business conflict indicator value for lending operations. The account imbalance value is calculated as: |∑Debit Amount - ∑Credit Amount| / (∑Debit Amount + ε), where ε is a preset error. If abnormal data is found in the transaction log data, an interest conflict determination is performed after the transaction log data is repaired: the interest is recalculated using the repaired log data vs. the original interest from the user's previous transaction log data. If the error is >0.05%, an interest calculation conflict is determined.

[0082] This embodiment quantifies the degree of conflict in transaction transaction data by calculating a business conflict index value based on business characteristics. Together with the time fluctuation index value and the spatial offset index value, the business conflict index value provides a multi-dimensional basis for determining whether anomalies exist in transaction transaction data, helping financial institutions to more comprehensively monitor and prevent risks.

[0083] If abnormal data is determined in the transaction log data, it is also necessary to locate the cause of the abnormality. Optionally, in the transaction log data anomaly detection method provided in this application embodiment, after determining that abnormal data exists in the transaction log data, the method further includes: inputting time features, spatial features, and business features into a target model to obtain the cause of the abnormal data in the transaction log data. The target model includes an input layer, a feature concatenation layer, a fully connected layer, and an output layer. The feature concatenation layer is used to concatenate time features, spatial features, and business features to obtain fused features. The fully connected layer is used to classify the abnormal causes of the fused features and output the probability that the abnormal data belongs to each abnormal cause. The output layer is used to output the abnormal cause with the highest probability in the fully connected layer. If the abnormal cause indicates that there is missing data in the transaction log data, the transaction log data is completed using a federated completion strategy to obtain the completed transaction log data. If the abnormal cause indicates that there is risky transaction data in the transaction log data, a warning message is issued. The warning message is used to alert users to the existence of risky transactions.

[0084] In some embodiments, spatiotemporal feature fusion is a method of jointly modeling temporal and spatial features using specific techniques. It aims to capture the joint dependencies between temporal and spatial dimensions in data, thereby improving the performance of downstream tasks (such as data repair and anomaly detection). The target model can be a deep learning model. First, temporal, spatial, and business features are input into the input layer of the deep learning model. In the feature concatenation layer, the model concatenates these three features to form a fused feature vector. The fully connected layer receives the fused features and classifies the abnormal data through a series of linear transformations and activation functions. The output of this layer is the probability that the transaction data belongs to each type of anomaly, such as "missing data anomaly," "abnormally large transaction," or "suspicious transaction pattern." The output layer selects the anomaly cause with the highest probability in the fully connected layer as the final anomaly cause. If the model determines the anomaly cause to be "missing data anomaly," it enters the data completion process; if it is "risky transaction data," it triggers an early warning mechanism.

[0085] This embodiment combines temporal, spatial, and business characteristics, and utilizes a deep learning model for anomaly detection, enabling more accurate identification of anomalies and their causes in transaction log data. For "missing data anomalies," the federated completion strategy provides a safe and efficient way to complete data, ensuring the integrity of transaction log data; for "risky transaction data," the early warning mechanism helps strengthen risk prevention and control, reducing potential economic losses.

[0086] If the anomaly is due to missing data, data completion is performed using a federated completion strategy. Optionally, in the anomaly detection method for transaction log data provided in this application embodiment, data completion processing of the transaction log data using a federated completion strategy to obtain the completed transaction log data includes: sending an encrypted query request to a federated coordination node, wherein the federated coordination node is controlled to forward the encrypted query request to the user's counterparty, the encrypted query request containing encrypted values ​​of the transaction date range and fuzzy interval ciphertext of the transaction amount, and the encrypted query request being encrypted using a homomorphic encryption algorithm; receiving the encrypted result set forwarded by the federated coordination node, aggregating the encrypted result set to obtain an aggregated encrypted result, wherein the encrypted result set is a collection of multiple encrypted data matched by the counterparty using encrypted values ​​of the transaction date range and fuzzy interval ciphertext of the transaction amount; performing homomorphic decryption processing on the aggregated encrypted result to obtain the aggregated transaction data plaintext of the counterparty within the transaction date range, and completing the transaction log data based on the aggregated transaction data plaintext to obtain the completed transaction log data.

[0087] In some embodiments, the federated completion engine is a distributed data repair architecture based on privacy computing technology. Without sharing the original data, it coordinates the local model training and parameter aggregation of multiple participants (branches / affiliated institutions of financial institutions) to achieve collaborative repair and anomaly detection of missing bank transaction data. The core of the engine lies in building an encrypted federated learning workflow, enabling participants to exchange only encrypted model updates, not the original data.

[0088] For example, Figure 4 This is a schematic diagram illustrating the completion of transaction log data using a federated completion strategy, as provided in the embodiments of this application. Figure 4As shown, the initiating bank system sends an encrypted query request to the federated coordination node. The request includes an encrypted value for the transaction date range and a fuzzy range of ciphertext for the transaction amount. The federated coordination node forwards the encrypted query request directly to the data provider, such as the counterparty bank, without decryption. The counterparty performs encrypted data matching locally and returns an encrypted result set, HE_Ciphertext, to the federated coordination node. The federated coordination node then sends the aggregated encrypted result back to the initiating bank system. The initiating bank system performs homomorphic decryption and post-processing. If the match is successful, a completed transaction record is generated; if the match fails, the rule engine completes the transaction. The rule engine completes the transaction based on the business type, selecting the corresponding completion strategy. For example, interpolation is used for completion of business A, while mean completion is used for business B.

[0089] When data loss is detected: a fuzzy query is requested from the relevant institution (such as the counterparty bank) via homomorphic encryption. Candidate values ​​are generated based on business rules. For example, if the missing data is a loan repayment record, the completion strategy is to generate a value based on the contractually agreed amount plus the repayment date. If the missing data is an interrupted cross-border transfer, the completion strategy is to call a copy of the SWIFT message to repair it. Homomorphic encryption (transaction type = salary payment, fuzzy date range = 2025-12-01 to 2025-12-10), response decryption: obtain the average amount due encrypted by the data provider (without disclosing specific individual data).

[0090] This embodiment combines a federated completion strategy with homomorphic encryption algorithms, enabling financial institutions to securely and efficiently complete missing data in transaction logs while protecting sensitive information of users and counterparties and avoiding the risk of data leakage.

[0091] The completed transaction data still needs to undergo anomaly detection. Optionally, in the anomaly detection method for transaction data provided in this application embodiment, after obtaining the completed transaction data, the method further includes: calculating the cumulative value of the completed transaction data to obtain the user's first total transaction value; obtaining the second total transaction value of the counterparty corresponding to the completed transaction data; calculating the difference between the first total transaction value and the second total transaction value; if the difference is less than or equal to the difference threshold, determining that the completed transaction data is not abnormal; if the difference is greater than the difference threshold, determining that the completed transaction data is abnormal, and repeating the step of performing data completion processing on the transaction data through the federated completion strategy to obtain the completed transaction data, until the difference is less than or equal to the difference threshold.

[0092] In some embodiments, the completed transaction log data is summed to obtain the total transaction log value (including income and expenses) for all transactions (including income and expenses) of the user within a certain time period, denoted as the first total transaction log value. Simultaneously, the total transaction log value for the same time period is obtained from the counterparty. This value should reflect the total income or total expenses of all transactions between the counterparty and the user, denoted as the second total transaction log value. The first total transaction log value and the second total transaction log value are compared, and the difference between them is calculated. The calculation of the difference can reveal whether the data completion process affected the equivalence of the transaction logs between the two parties. A difference threshold is set as an allowable error range. If the difference is less than or equal to the difference threshold, it indicates that the completed transaction log data is consistent in accounting logic and there are no anomalies. If the difference is greater than the difference threshold, it may mean that an error occurred during the data completion process, and corrective measures need to be taken.

[0093] If the difference is greater than the difference threshold, the system will repeat the data completion process until the difference is less than or equal to the difference threshold. This cyclical process ensures that the completed data is logically correct and satisfies the principle of accounting balance.

[0094] This embodiment ensures the logical consistency of the completed data through accounting balance verification, avoiding the introduction of new errors due to data completion. This improves the accuracy and efficiency of data completion.

[0095] According to another embodiment of this application, an anomaly detection system for transaction flow data is also provided. Figure 5 This is a schematic diagram of an anomaly detection system for transaction flow data provided in the embodiments of this application, such as... Figure 5 As shown, the system includes: a spatiotemporal feature extractor, an anomaly detection engine, and a federated completion engine.

[0096] Specifically, the spatiotemporal feature extractor includes a temporal convolutional network and transaction geocoding. It extracts spatiotemporal features from multi-source transaction data. The anomaly detection engine includes a triplet anomaly classification model. The triplet anomaly classification model judges abnormal transactions based on time fluctuation index, spatial offset index, and business conflict index. If the transaction is judged to be normal, it is stored in compliance with regulations. If the transaction is judged to be abnormal, it is repaired by a federated completion engine. The federated completion engine includes homomorphic encrypted data interaction and a business logic verifier. The business logic verifier verifies whether there are any anomalies in the repaired transaction through accounting balance verification. If there are no anomalies, the repaired transaction is stored.

[0097] The anomaly detection system for transaction log data in this embodiment improves detection accuracy through spatiotemporal feature fusion, enhances the accuracy of data completion through a federated completion engine, and ensures data security through federated learning and homomorphic encryption strategies.

[0098] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0099] Example 2

[0100] This application also provides an anomaly detection device for transaction flow data. It should be noted that this anomaly detection device can be used to execute the anomaly detection method for transaction flow data provided in this application. The anomaly detection device for transaction flow data provided in this application is described below.

[0101] According to an embodiment of this application, an apparatus for implementing the above-described method for detecting anomalies in transaction log data is also provided. Figure 6 This is a schematic diagram of an anomaly detection device for transaction flow data provided in the embodiments of this application, such as... Figure 6 As shown, the device includes:

[0102] Extraction unit 601 is used to extract time features, spatial features and business features from the user's transaction flow data. The time features are used to characterize the time pattern of the transactions indicated by the transaction flow data, the spatial features are used to characterize the geographical correlation between multiple counterparties of the transactions indicated by the transaction flow data, and the business features are used to characterize the transaction type of the transactions indicated by the transaction flow data.

[0103] The calculation unit 602 is used to calculate time fluctuation index value based on time characteristics, spatial offset index value based on spatial characteristics, and business conflict index value based on business characteristics.

[0104] Input unit 603 is used to input time fluctuation index value, spatial offset index value and business conflict index value into a preset activation function to obtain the probability of abnormal data in the transaction flow data.

[0105] The first determining unit 604 is used to determine that there is abnormal data in the transaction flow data when the abnormal probability is greater than or equal to the probability threshold.

[0106] The anomaly detection device for transaction flow data provided in this application embodiment extracts time features, spatial features, and business features from the user's transaction flow data through an extraction unit 601. The time features characterize the time regularity of transactions indicated by the transaction flow data, the spatial features characterize the geographical correlation between multiple counterparties in the transactions indicated by the transaction flow data, and the business features characterize the transaction type of the transactions indicated by the transaction flow data. A calculation unit 602 calculates a time fluctuation index value based on the time features, a spatial offset index value based on the spatial features, and a business conflict index value based on the business features. An input unit 603 inputs the time fluctuation index value, spatial offset index value, and business conflict index value into a preset activation function to obtain the anomaly probability of abnormal data in the transaction flow data. A first determination unit 604 determines that abnormal data exists in the transaction flow data when the anomaly probability is greater than or equal to a probability threshold. Through the anomaly detection technology that fuses spatiotemporal business features, abnormal transaction patterns in complex scenarios can be identified more accurately. This achieves the goal of reducing the false alarm rate of abnormal transaction data, thereby improving the technical effect of improving the accuracy of anomaly detection of transaction data and solving the technical problem of poor accuracy in anomaly detection of transaction data.

[0107] Optionally, in the anomaly detection device for transaction flow data provided in this application embodiment, the calculation unit 602 includes: a first extraction module, used to extract the time intervals between adjacent transactions in multiple transactions corresponding to transaction flow data within a preset period from time features, to obtain a time interval sequence; a first determination module, used to determine the distribution probability of time intervals of different durations in the time interval sequence, to obtain the time interval distribution probability of each duration; a second determination module, used to determine the date type of the transaction date to which each time interval belongs in the time interval sequence, and to determine the preset weight of each date type, wherein the date type includes at least one of the following: working day, holiday, and payday; a first calculation module, used to calculate the product of the time interval distribution probability, the target logarithm, and the preset weight for each time interval in the time interval sequence, to obtain the entropy value of the time interval, wherein the target logarithm is the logarithm with base 2 and the time interval distribution probability as the argument; and a third determination module, used to determine the time fluctuation index value based on the accumulated value of the entropy values ​​of the time intervals in the time interval sequence.

[0108] Optionally, in the anomaly detection device for transaction flow data provided in this application embodiment, the calculation unit 602 includes: a second extraction module, used to extract the total number of transactions and the number of cross-border transactions corresponding to multiple transactions from spatial features, and determine the geographical location information of each transaction; a second calculation module, used to calculate the ratio of the number of cross-border transactions to the total number of transactions, and calculate the product of the ratio and a preset cross-border transaction weight to obtain a cross-border index value; a clustering module, used to cluster the N geographical location information of the N adjacent transactions for each transaction to obtain clustered geographical location information, calculate the distance parameter between the geographical location information of the transaction and the clustered geographical location information, and calculate the product of the distance parameter and a preset offset weight to obtain an offset index value; and a third calculation module, used to calculate the sum of the offset index value and the cross-border index value to obtain a spatial offset index value.

[0109] Optionally, in the anomaly detection device for transaction flow data provided in this application embodiment, the calculation unit 602 includes: a third extraction module, used to extract the first transaction amount and the second transaction amount of each transaction from business characteristics, and determine whether there is a conflict between the first transaction amount and the second transaction amount, wherein the first transaction amount is the user's income or expenditure amount in the transaction, and the second transaction amount is the user's counterparty's income or expenditure amount in the transaction; a fourth determination module, used to determine a first preset value as a business conflict indicator value when there is a conflict between the first transaction amount and the second transaction amount; and a fifth determination module, used to determine a second preset value as a business conflict indicator value when there is no conflict between the first transaction amount and the second transaction amount.

[0110] Optionally, in the anomaly detection device for transaction log data provided in this application embodiment, the device further includes: an anomaly cause determination unit, used to input time features, spatial features, and business features into a target model to obtain the anomaly cause of the abnormal data in the transaction log data, wherein the target model includes an input layer, a feature concatenation layer, a fully connected layer, and an output layer, the feature concatenation layer is used to concatenate time features, spatial features, and business features to obtain fused features, the fully connected layer is used to classify the anomaly cause of the fused features and output the probability that the abnormal data belongs to each anomaly cause, and the output layer is used to output the anomaly cause with the highest probability in the fully connected layer; a completion unit, used to perform data completion processing on the transaction log data through a federated completion strategy when the anomaly cause indicates that there is missing data in the transaction log data to obtain the completed transaction log data; and an early warning unit, used to issue early warning information when the anomaly cause indicates that there is risky transaction data in the transaction log data, wherein the early warning information is used to warn users of the existence of risky transactions.

[0111] Optionally, in the anomaly detection device for transaction log data provided in this application embodiment, the completion unit includes: a request module, used to send an encrypted query request to a federated coordination node, wherein the federated coordination node is controlled to forward the encrypted query request to the user's counterparty, the encrypted query request includes an encrypted value for the transaction date range and a fuzzy range ciphertext for the transaction amount, and the encrypted query request is encrypted using a homomorphic encryption algorithm; a receiving module, used to receive the encrypted result set forwarded by the federated coordination node, aggregate the encrypted result set to obtain an aggregated encrypted result, wherein the encrypted result set is a collection of multiple encrypted data matched by the counterparty through the encrypted value for the transaction date range and the fuzzy range ciphertext for the transaction amount; and a decryption module, used to perform homomorphic decryption processing on the aggregated encrypted result to obtain the aggregated transaction data plaintext of the counterparty within the transaction date range, and complete the transaction log data based on the aggregated transaction data plaintext to obtain the completed transaction log data.

[0112] Optionally, in the transaction flow data anomaly detection device provided in this application embodiment, the device further includes: a loss calculation unit, used to calculate the cumulative value of the completed transaction flow data to obtain the user's first total flow value; an acquisition unit, used to acquire the second total flow value of the counterparty corresponding to the completed transaction flow data; a second determination unit, used to calculate the difference between the first total flow value and the second total flow value, and determine that the completed transaction flow data is not abnormal if the difference is less than or equal to a difference threshold; and a third determination unit, used to determine that the completed transaction flow data is abnormal if the difference is greater than a difference threshold, and repeatedly execute the step of performing data completion processing on the transaction flow data through a federated completion strategy to obtain the completed transaction flow data, until the difference is less than or equal to a difference threshold.

[0113] It should be noted that the extraction unit 601, calculation unit 602, input unit 603, and first determination unit 604 mentioned above correspond to steps S201 to S204 in Embodiment 1. The four units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules or units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0114] Example 3

[0115] Embodiments of this application may provide an electronic device. Figure 7 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 7As shown, the electronic device may include: one or more ( Figure 7 (Only one is shown) processor 702, memory 704, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0116] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0117] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: extracting time features, spatial features, and business features from the user's transaction log data. The time features characterize the temporal regularity of transactions indicated by the transaction log data; the spatial features characterize the geographical correlation between multiple counterparties in the transactions indicated by the transaction log data; and the business features characterize the transaction type of the transactions indicated by the transaction log data. Based on the time features, a time fluctuation index value is calculated; based on the spatial features, a spatial offset index value is calculated; and based on the business features, a business conflict index value is calculated. The time fluctuation index value, spatial offset index value, and business conflict index value are input into a preset activation function to obtain the probability of abnormal data in the transaction log data. If the probability of abnormal data is greater than or equal to a probability threshold, it is determined that abnormal data exists in the transaction log data.

[0118] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: extracting the time intervals between adjacent transactions in multiple transactions corresponding to transaction flow data within a preset period from the time characteristics to obtain a time interval sequence; determining the probability distribution of time intervals of different durations in the time interval sequence to obtain the probability distribution of time intervals of each duration; determining the date type of the transaction date to which each time interval belongs in the time interval sequence, and determining the preset weight of each date type, wherein the date type includes at least one of the following: working day, holiday, and payday; for each time interval in the time interval sequence, calculating the product of the time interval probability distribution, the target logarithm, and the preset weight to obtain the entropy value of the time interval, wherein the target logarithm is the logarithm with base 2 and the time interval probability distribution as the argument; determining the time fluctuation index value based on the cumulative value of the entropy values ​​of the time intervals in the time interval sequence.

[0119] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: extract the total number of transactions and the number of cross-border transactions corresponding to the transaction flow data from the spatial features, and determine the geographical location information of each transaction; calculate the ratio of the number of cross-border transactions to the total number of transactions, and calculate the product of the ratio and the preset cross-border transaction weight to obtain the cross-border index value; for each transaction, cluster the N geographical location information of the N adjacent transactions to obtain the clustered geographical location information, calculate the distance parameter between the geographical location information of the transaction and the clustered geographical location information, and calculate the product of the distance parameter and the preset offset weight to obtain the offset index value; calculate the sum of the offset index value and the cross-border index value to obtain the spatial offset index value.

[0120] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: extracting the first transaction amount and the second transaction amount of each transaction from the business characteristics, and determining whether there is a conflict between the first transaction amount and the second transaction amount, wherein the first transaction amount is the amount of income or expenditure of the user in the transaction, and the second transaction amount is the amount of income or expenditure of the user's counterparty in the transaction; if there is a conflict between the first transaction amount and the second transaction amount, determining the first preset value as the business conflict indicator value; if there is no conflict between the first transaction amount and the second transaction amount, determining the second preset value as the business conflict indicator value.

[0121] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: inputting temporal, spatial, and business features into the target model to obtain the reasons for abnormal data in the transaction log data. The target model includes an input layer, a feature concatenation layer, a fully connected layer, and an output layer. The feature concatenation layer concatenates the temporal, spatial, and business features to obtain fused features. The fully connected layer classifies the fused features for abnormal reasons and outputs the probability that the abnormal data belongs to each type of abnormal reason. The output layer outputs the abnormal reason with the highest probability from the fully connected layer. If the abnormal reason indicates missing data in the transaction log data, a federated completion strategy is used to complete the transaction log data, resulting in completed transaction log data. If the abnormal reason indicates the presence of risky transaction data, a warning message is issued, alerting users to the existence of risky transactions.

[0122] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: sending an encrypted query request to the federated coordination node, wherein the federated coordination node forwards the encrypted query request to the user's counterparty, the encrypted query request containing encrypted values ​​for the transaction date range and fuzzy range ciphertext for the transaction amount, and the encrypted query request being encrypted using a homomorphic encryption algorithm; receiving the encrypted result set forwarded by the federated coordination node, aggregating the encrypted result set to obtain an aggregated encrypted result, wherein the encrypted result set is a collection of multiple encrypted data matched by the counterparty using encrypted values ​​for the transaction date range and fuzzy range ciphertext for the transaction amount; performing homomorphic decryption on the aggregated encrypted result to obtain the aggregated transaction data plaintext for the counterparty within the transaction date range, and completing the transaction log data based on the aggregated transaction data plaintext to obtain the completed transaction log data.

[0123] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: calculate the cumulative value of the completed transaction flow data to obtain the user's first total flow value; obtain the second total flow value of the counterparty corresponding to the completed transaction flow data; calculate the difference between the first total flow value and the second total flow value; if the difference is less than or equal to the difference threshold, determine that the completed transaction flow data is normal; if the difference is greater than the difference threshold, determine that the completed transaction flow data is abnormal, and repeat the steps of performing data completion processing on the transaction flow data through the federated completion strategy to obtain the completed transaction flow data until the difference is less than or equal to the difference threshold.

[0124] This application provides a method for extracting time features, spatial features, and business features from user transaction log data. Time features characterize the temporal regularity of transactions indicated by the transaction log data; spatial features characterize the geographical correlation between multiple counterparties in the transactions indicated by the transaction log data; and business features characterize the transaction type indicated by the transaction log data. A time fluctuation index is calculated based on the time features, a spatial offset index is calculated based on the spatial features, and a business conflict index is calculated based on the business features. The time fluctuation index, spatial offset index, and business conflict index are input into a preset activation function to obtain the probability of anomalies in the transaction log data. If the probability of anomalies is greater than or equal to a probability threshold, the existence of anomalies in the transaction log data is determined. This anomaly detection technology, which fuses spatiotemporal business features, can more accurately identify abnormal transaction patterns in complex scenarios. It achieves the goal of reducing the false alarm rate of abnormal transaction log data, thereby improving the accuracy of anomaly detection and solving the technical problem of poor accuracy in anomaly detection of transaction log data.

[0125] Those skilled in the art will understand that Figure 7 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 7 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 7 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 7 The different configurations shown.

[0126] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0127] Example 4

[0128] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the anomaly detection method for transaction flow data provided in Embodiment 1.

[0129] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0130] This application also provides a computer program product, which, when executed on a data processing device, is suitable for performing steps of an anomaly detection method for transaction flow data.

[0131] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0132] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0133] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0134] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0135] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0136] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0137] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting anomalies in transaction log data, characterized in that, include: The user's transaction log data is used to extract time features, spatial features, and business features. The time features are used to characterize the time pattern of the transactions indicated by the transaction log data. The spatial features are used to characterize the geographical correlation between multiple counterparties of the transactions indicated by the transaction log data. The business features are used to characterize the transaction type of the transactions indicated by the transaction log data. Calculate time fluctuation index value based on the time characteristics, calculate spatial offset index value based on the spatial characteristics, and calculate business conflict index value based on business characteristics; Input the time fluctuation index value, the spatial offset index value, and the business conflict index value into a preset activation function to obtain the probability of abnormal data in the transaction flow data. If the probability of anomaly is greater than or equal to the probability threshold, it is determined that there is abnormal data in the transaction log data.

2. The method according to claim 1, characterized in that, Calculating the time fluctuation index value based on the aforementioned time characteristics includes: Extract the time intervals between adjacent transactions from multiple transactions corresponding to the transaction flow data within a preset period from the time features to obtain a time interval sequence; Determine the probability distribution of time intervals of different durations in the time interval sequence to obtain the probability distribution of time intervals of each duration; Determine the date type of the transaction date to which each time interval belongs in the time interval sequence, and determine the preset weight of each date type, wherein the date type includes at least one of the following: weekday, holiday, and payday; For each time interval in the time interval sequence, the entropy value of the time interval is obtained by calculating the product of the time interval distribution probability, the target logarithm, and the preset weight, wherein the target logarithm is the logarithm with base 2 and the time interval distribution probability as the argument. The time fluctuation index value is determined based on the cumulative entropy values ​​of the time intervals in the time interval sequence.

3. The method according to claim 1, characterized in that, Calculating the spatial offset index value based on the aforementioned spatial characteristics includes: Extract the total number of transactions and the number of cross-border transactions corresponding to the transaction flow data from the spatial features, and determine the geographical location information of each transaction; Calculate the ratio of the number of cross-border transactions to the total number of transactions, and then calculate the product of the ratio and the preset cross-border transaction weights to obtain the cross-border indicator value; For each transaction, the N geographical locations of the N preceding transactions adjacent to the transaction are clustered to obtain clustered geographical location information. The distance parameter between the geographical location information of the transaction and the clustered geographical location information is calculated, and the product of the distance parameter and the preset offset weight is calculated to obtain the offset index value. The spatial offset index value is obtained by summing the offset index value and the cross-border index value.

4. The method according to claim 1, characterized in that, Calculating the business conflict index value based on the aforementioned business characteristics includes: Extract the first transaction amount and the second transaction amount of each transaction from the business characteristics, and determine whether there is a conflict between the first transaction amount and the second transaction amount, wherein the first transaction amount is the amount of income or expenditure of the user in the transaction, and the second transaction amount is the amount of income or expenditure of the user's counterparty in the transaction; In the event of a conflict between the first transaction amount and the second transaction amount, the first preset value will be determined as the business conflict indicator value. If there is no conflict between the first transaction amount and the second transaction amount, the second preset value will be determined as the business conflict indicator value.

5. The method according to claim 1, characterized in that, After determining that the transaction log data contains abnormal data, the method further includes: The time features, spatial features, and business features are input into the target model to obtain the reasons for the abnormal data in the transaction flow data. The target model includes an input layer, a feature concatenation layer, a fully connected layer, and an output layer. The feature concatenation layer is used to concatenate the time features, spatial features, and business features to obtain fused features. The fully connected layer is used to classify the abnormal causes of the fused features and output the probability that the abnormal data belongs to each abnormal cause. The output layer is used to output the abnormal cause with the highest probability in the fully connected layer. When the anomaly indicates that the transaction log data contains missing data, the transaction log data is completed using a federated completion strategy to obtain the completed transaction log data. If the anomaly indicates the presence of risky transactions in the transaction log data, an early warning message is issued, wherein the early warning message is used to alert the user to the existence of risky transactions.

6. The method according to claim 5, characterized in that, The transaction log data is completed using a federated completion strategy, resulting in the following completed transaction log data: Send an encrypted query request to the federated coordination node, wherein the federated coordination node is controlled to forward the encrypted query request to the user's counterparty, the encrypted query request contains an encrypted value of the transaction date range and a fuzzy range ciphertext of the transaction amount, and the encrypted query request is encrypted using a homomorphic encryption algorithm; The system receives a set of encrypted results forwarded by the federated coordination node, aggregates the set of encrypted results to obtain an aggregated encrypted result, wherein the set of encrypted results is a collection of multiple encrypted data obtained by the counterparty through ciphertext matching of the encrypted value of the transaction date range and the fuzzy interval ciphertext of the transaction amount; The aggregated encryption result is homomorphically decrypted to obtain the plaintext of the aggregated transaction data of the counterparty within the transaction date range. The transaction flow data is then completed based on the plaintext of the aggregated transaction data to obtain the completed transaction flow data.

7. The method according to claim 5 or 6, characterized in that, After obtaining the completed transaction log data, the method further includes: Calculate the cumulative value of the completed transaction data to obtain the user's first total transaction value; Obtain the second total transaction value of the counterparty corresponding to the completed transaction transaction data; Calculate the difference between the first total transaction value and the second total transaction value. If the difference is less than or equal to the difference threshold, it is determined that the completed transaction data is normal. If the difference is greater than the difference threshold, it is determined that the completed transaction data is abnormal. The step of performing data completion processing on the transaction data using the federated completion strategy to obtain the completed transaction data is repeated until the difference is less than or equal to the difference threshold.

8. An anomaly detection device for transaction flow data, characterized in that, include: The extraction unit is used to extract time features, spatial features, and business features from the user's transaction flow data. The time features are used to characterize the time pattern of the transactions indicated by the transaction flow data, the spatial features are used to characterize the geographical correlation between multiple counterparties of the transactions indicated by the transaction flow data, and the business features are used to characterize the transaction type of the transactions indicated by the transaction flow data. The calculation unit is used to calculate the time fluctuation index value based on the time characteristics, the spatial offset index value based on the spatial characteristics, and the business conflict index value based on the business characteristics. The input unit is used to input the time fluctuation index value, the spatial offset index value and the business conflict index value into a preset activation function to obtain the probability of abnormal data in the transaction flow data. The first determining unit is used to determine that there is abnormal data in the transaction flow data when the abnormal probability is greater than or equal to the probability threshold.

9. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program executes the anomaly detection method for transaction flow data according to any one of claims 1 to 7.

10. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the anomaly detection method for transaction flow data as described in any one of claims 1 to 7.

Images