Data transaction tracking early warning method and system based on artificial intelligence

Abstract

The invention discloses a data transaction tracking early warning method and system based on artificial intelligence, and relates to the field of artificial intelligence data transaction tracking. The method comprises the following steps: recording and acquiring data transaction information through an HTTP request header of a user, a client SDK, a proxy server and a database; processing and analyzing the collected data transaction information, and extracting data transaction features; analyzing the data transaction characteristics by adopting an isolated forest algorithm, and identifying normal data transaction information and abnormal data transaction information; and when the abnormal data transaction information is identified, generating an alarm, and recording data transaction characteristics of the abnormal data transaction information. Through comprehensive analysis of multi-dimensional features and an isolated forest algorithm, the security, accuracy and automation level of data transaction monitoring are improved, potential abnormal modes in data transactions can be comprehensively mined, and risks are effectively reduced.

Description

Technical Field

[0001] This invention relates to the field of data transaction tracking and early warning, specifically to a data transaction tracking and early warning method and system based on artificial intelligence. Background Technology

[0002] With the continuous development of information technology and the increasing popularity of data transactions, data transactions, as an important component of modern network applications, have become a core element in the global economy and internet operations. Whether it's an online service platform or an e-commerce website, the security and stability of data transactions are directly related to system reliability, user privacy protection, and overall information security. Therefore, how to monitor and prevent abnormal data transaction behavior in real time to ensure the normal operation of online transactions has become an important research topic in the field of information security.

[0003] To improve the security of data transactions, artificial intelligence-based anomaly detection methods have become a research hotspot in recent years. However, existing detection methods mostly rely on simple parametric features, such as transaction frequency and transaction size. These features often fail to fully reflect the potential risks in data transactions. Many more complex features involved in data transactions have not yet been fully explored, limiting the accuracy of detection.

[0004] Therefore, AI-based data transaction tracking and early warning methods can effectively combine multi-dimensional features during anomaly detection, improving data transaction security. By introducing the Isolation Forest algorithm, it adaptively identifies abnormal transactions in large-scale data, avoiding manual intervention and fixed pattern limitations in traditional rule-based methods. This allows for rapid response to changing transaction patterns, improving the real-time performance and accuracy of detection. Furthermore, by introducing more complex features, such as device or network switching frequency and deviations from active time periods, it can more comprehensively reflect the risks of transaction behavior, providing stronger protection for data transaction security.

[0005] The method of this invention not only improves the security of data transactions, but also has good versatility, can adapt to the actual needs of different business scenarios, and can realize automated early warning response, effectively reducing the probability of human error and missed detection. Summary of the Invention

[0006] In view of the shortcomings of the prior art described above, the purpose of this invention is to provide a data transaction tracking and early warning method and system based on artificial intelligence to solve the above-mentioned technical problems.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a data transaction tracking and early warning method based on artificial intelligence, comprising: Data transaction information is collected through user HTTP request headers, client SDKs, proxy servers, and database records; The collected data transaction information is processed and analyzed to extract data transaction characteristics; The isolated forest algorithm is used to analyze data transaction characteristics and identify normal and abnormal data transaction information. When abnormal data transaction information is identified, an alarm is generated, and the data transaction characteristics of the abnormal data transaction information are recorded.

[0008] The present invention is further configured to collect data transaction information including: the frequency of device or network switching during the data transaction process, the total number of data transactions by the user, the time delay of the data transaction, the active period of the data transaction, and the size and frequency of the data transaction.

[0009] The present invention is further configured to process and analyze the collected data transaction information and extract data transaction features, including: The collected data transaction information is filled with missing values, removed outliers, and standardized and normalized. Data transaction stability characteristics are extracted based on the frequency of device or network switching and the time delay of data transactions within a certain time range. Extract the active period deviation feature based on the active time period and the total number of data transactions by users; Data frequency features are extracted based on the data size and transaction frequency of users.

[0010] The present invention further specifies that the data transaction stability characteristic is calculated using the following logic: ,in, For the stability characteristics of data transactions, Switching frequencies for devices or networks For the time delay of data transactions, This represents the expected time threshold for normal transactions. A parameter used to control the intensity of the effect of time delay on features. The parameter is used to control the periodic effect of the switching frequency of the control equipment on the features. and This is a non-linear adjustment coefficient.

[0011] The present invention is further configured such that the calculation logic for the deviation feature during active periods is as follows: ,in, This indicates a deviation from the active period characteristics. For the first The time of this data transaction The average time point during which users actively conduct data transactions. The total number of user data transactions. This is an adjustment factor used to control the weight of deviation during active periods.

[0012] The present invention is further configured such that the calculation logic for the frequency characteristics is as follows: ,in, For frequency characteristics, For data size, This represents the maximum value of the data size. For trading frequency, and To adjust the parameters.

[0013] The present invention is further configured to use the Isolation Forest algorithm to analyze data transaction characteristics and identify normal and abnormal data transaction information, including: Min-Max standardization is used to standardize the characteristics of data transactions; Standardized data transaction stability characteristics Deviation characteristics during active periods Sum of frequency characteristics Combined into a three-dimensional feature matrix; The Isolation Forest model is trained using a 3D feature matrix. During the training process, the Isolation Forest builds trees multiple times on randomly selected feature subsets and data subsets to separate normal data from abnormal data. After training, each sample will receive an anomaly score. Based on the anomaly score output by the Isolation Forest, a preset threshold is used to determine whether a data transaction is abnormal. If the anomaly score is higher than the preset threshold, it is considered abnormal; if the anomaly score is lower than or equal to the preset threshold, it is considered normal.

[0014] The present invention further specifies that the calculation logic for the anomaly score is as follows: ,in, For anomaly scoring of the sample, It is a standardized constant. It is a sample The path length required to be isolated It is a sample The expected path length, The calculation formula is , It refers to the number of trees in an isolated forest. It is a sample In the The path length in the tree, TS is the mutation value of the sample node, and its calculation logic is as follows: , The subset of data corresponding to the feature subset when the sample is the root node. root node The data subset corresponding to the feature subset of the left child node. root node The data subset corresponding to the feature subset of the right child node.

[0015] The present invention also provides a data transaction tracking and early warning system based on artificial intelligence, the system comprising: Data acquisition module: Collects data transaction information through user HTTP request headers, client SDK, proxy server, and database records; Data processing module: processes and analyzes the collected data transaction information and extracts data transaction characteristics; Data Analysis Module: Employs the Isolation Forest algorithm to analyze data transaction characteristics and identify normal and abnormal data transaction information; Early warning module: When abnormal data transaction information is identified, an alarm is generated and the data transaction characteristics of the abnormal data transaction information are recorded.

[0016] This invention provides a data transaction tracking and early warning method and system based on artificial intelligence. The method collects data transaction information through user HTTP request headers, client SDKs, proxy servers, and database records; processes and analyzes the collected data transaction information to extract data transaction features; uses the isolated forest algorithm to analyze the data transaction features and identify normal and abnormal data transaction information; when abnormal data transaction information is identified, an alarm is generated, and the data transaction features of the abnormal data transaction information are recorded. The beneficial effects include: 1. Improve the security and accuracy of data transactions: By comprehensively analyzing multi-dimensional characteristics such as device or network switching frequency, data transaction time latency, deviation during active periods, data size, and transaction frequency, this invention can more comprehensively characterize data transaction behavior. Compared to the limitations of traditional methods that rely on simple features, this invention captures more potential abnormal transaction patterns through non-linear feature combinations, thereby significantly improving the security and accuracy of data transactions. 2. Enhanced System Automation and Intelligence: This invention can automatically monitor and alert on abnormal transaction behavior without relying on manual intervention, greatly improving the automation level of the data transaction monitoring system. Through a preset threshold mechanism, when the anomaly score output by the isolated forest model exceeds the set threshold, the system can immediately generate an alarm and record the detailed characteristics of the abnormal data, ensuring timely measures are taken to reduce potential risks. 3. Comprehensive Data Feature Mining: Compared to traditional methods that rely solely on single features such as transaction frequency or amount, this invention combines multi-dimensional features, such as device switching frequency and deviations from active periods, to analyze data transaction behavior from multiple angles and in all aspects. This comprehensive feature extraction method can effectively identify complex abnormal transaction patterns that are difficult to detect using traditional methods, further enhancing the capabilities of the detection system.

[0017] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 A flowchart illustrating an artificial intelligence-based data transaction tracking and early warning method is shown as an exemplary embodiment of the present invention. Figure 2 This is a schematic diagram illustrating the structure of an artificial intelligence-based data transaction tracking and early warning system, which is an exemplary embodiment of the present invention. Detailed Implementation

[0019] The embodiments of the present invention will be described below with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention and not for limiting the scope of protection of the present invention.

[0020] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0021] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the invention.

[0022] Example 1 An AI-based data transaction tracking and early warning method, such as Figure 1 As shown, it includes: Data transaction information is collected through user HTTP request headers, client SDKs, proxy servers, and database records; The collected data transaction information is processed and analyzed to extract data transaction characteristics; The isolated forest algorithm is used to analyze data transaction characteristics and identify normal and abnormal data transaction information. When abnormal data transaction information is identified, an alarm is generated, and the data transaction characteristics of the abnormal data transaction information are recorded.

[0023] The present invention further specifies that the data transaction information collected includes: the frequency of device or network switching during data transactions, the total number of data transactions, the time delay of data transactions, the active period of data transactions, and the size and frequency of data transactions. Specifically, the device or network switching frequency refers to the frequency with which a user's device switches to different networks or devices within a short period of time during a data transaction. For example, a user may use different Wi-Fi networks or switch from Wi-Fi to 4G / 5G networks at different times. Frequent device or network switching may indicate abnormal or unstable network behavior, affecting the stability of data transactions; the time delay of data transactions is often related to network congestion or malicious attacks. Longer transaction delays may reflect network instability or other potential risks; the size and frequency of data transactions can reflect the transaction load and frequency, helping the system identify unusual transaction behavior.

[0024] The present invention is further configured to process and analyze the collected data transaction information and extract data transaction features, including: The collected data transaction information undergoes processes such as missing value imputation, outlier removal, standardization, and normalization. Specifically, the data may contain some null or missing values. The process of imputing missing values ​​aims to fill these gaps with reasonable values ​​to avoid affecting subsequent analysis. Outliers are values ​​that are significantly different from most data points. These outliers are usually caused by input errors or certain extreme cases. Standardization and normalization help ensure that all data features are processed on the same scale, thereby avoiding the impact of certain features on model training due to scale differences. Data transaction stability characteristics are extracted based on the frequency of device or network switching and the time delay of data transactions within a certain time range. Specifically, the stability characteristics are calculated by analyzing the frequency of device or network switching and the time delay of data transactions within a certain time range. The frequency of device or network switching reflects the stability of the user's device during data transactions, and the time delay of data transactions represents the time required from when the user initiates a transaction request to when the transaction is completed. If the transaction delay is too long, it may indicate system processing delays or external interference, reflecting a problem with the reliability of data transactions. Based on the user's active trading periods and total number of data transactions, we extract the active period deviation feature. Specifically, the user's active trading periods (usually the periods when the user trades frequently) are crucial for determining whether the user has engaged in abnormal trading. The active period deviation measure is the degree of deviation between the current trading time and the user's normal active trading periods. If a user conducts a large number of transactions at unusual times, it may be an indication of account abuse or other abnormal behavior. Data frequency features are extracted based on the data size and transaction frequency of users' data transactions. Specifically, data size and transaction frequency are two important dimensions that can reflect the transaction load and transaction activity.

[0025] The present invention further specifies that the data transaction stability characteristic is calculated using the following logic: ,in, For the stability characteristics of data transactions, Switching frequencies for devices or networks For the time delay of data transactions, This represents the expected time threshold for normal transactions. A parameter used to control the intensity of the effect of time delay on features. The parameter is used to control the periodic effect of the switching frequency of the control equipment on the features. and This is a non-linear adjustment coefficient, specifically... The description describes the device or network switching frequency. Time delays in data transactions Impact on the stability characteristics of data transactions Describes the device or network switching frequency The nonlinear effects, This has a significant impact on the stability of data transactions. Frequent switching implies network instability, which can disrupt transactions, causing delays or interruptions. The impact is through the second item To demonstrate this, a logarithmic function is used to smoothly switch the frequency of change, avoiding excessive amplification caused by frequent switching. This is another key factor affecting transaction stability. In the middle, through the exponential function To describe Regarding the impact on stability, this function ensures that when Much larger When the frequency of data switching decreases, stability drops rapidly; conversely, the impact is smaller. By combining the factors of device switching frequency and time latency, this invention can comprehensively assess the stability of data transactions. Various influencing factors are fully considered, thereby improving the ability to identify abnormal transaction behavior.

[0026] The present invention is further configured such that the calculation logic for the deviation feature during active periods is as follows: ,in, This indicates a deviation from the active period characteristics. For the first The time of this data transaction The average time point during which users actively conduct data transactions. The total number of user data transactions. This is a moderating factor used to control the weight of deviation during active periods. Specifically, The calculation covers all data transaction times. Average time of user activity The sum of deviations between these values. This value reflects the overall degree of deviation of a user's transaction time distribution from their normal active periods. For each transaction, the transaction time is calculated. and normal active time points absolute differences between If all transactions are concentrated around the normal active trading hours, this portion of the value will be smaller; if transactions occur outside of the active trading hours, this portion of the value will be larger. The calculation is the average of all transaction times, and then the reciprocal is taken. The power of 1. This value serves to adjust and standardize the deviation value. The deviation characteristic of active periods allows the system to identify abnormal trading time patterns, such as users frequently trading during uncommon times. This behavior may indicate potential anomalies, such as account theft or automated trading by bots.

[0027] The present invention is further configured such that the calculation logic for the frequency characteristics is as follows: ,in, For frequency characteristics, For data size, This represents the maximum value of the data size. For trading frequency, and To adjust the parameters, specifically, the frequency characteristics. By combining information from two dimensions—data size and transaction frequency—a comprehensive feature reflecting data transaction load and activity is constructed. This feature can be used to capture key patterns in user data transactions and to identify potential abnormal transactions. By data size Divide by the maximum data size of all transactions This standardizes data size. This makes data size... The value is between [0, 1], avoiding the impact of differences in data size on the model. The purpose of standardization is to control the influence of data size within a uniform scale so that it can be combined with other features. The standardized value of the data size is adjusted by exponential operations to create a non-linear relationship. Parameters Controlling the degree of this nonlinear adjustment, By introducing trading frequency and its adjustment parameters The combined nonlinear relationship enhances the expressive power of frequency features. This formula indicates that when the transaction frequency is high, the system assigns greater weight to the "activity" of that transaction. The calculation of frequency features combines data size and transaction frequency, comprehensively considering both the size of a single transaction and its frequency, thereby accurately assessing the load and activity of data transactions. This is crucial for detecting abnormal transactions; for example, frequent data exchanges or large-scale data transfers may indicate potential anomalies.

[0028] The present invention is further configured to use the Isolation Forest algorithm to analyze data transaction characteristics and identify normal and abnormal data transaction information, including: Min-Max standardization is used to standardize the data transaction features. Specifically, Min-Max standardization is a common standardization technique used to scale data to a certain range. Standardized data can eliminate the differences in the units of measurement of different features, making the contribution of each feature to the model relatively balanced. Standardized data transaction stability characteristics Deviation characteristics during active periods Sum of frequency characteristics Combined into a three-dimensional feature matrix; An Isolation Forest model is trained using a 3D feature matrix. The training process involves multiple tree constructions on randomly selected feature and data subsets, isolating normal and abnormal data. After training, each sample receives an anomaly score. Based on this score, a preset threshold is used to determine if a data transaction is abnormal. If the anomaly score is higher than the threshold, it's considered abnormal; otherwise, it's considered normal. Specifically, Isolation Forest is a tree-based unsupervised learning algorithm commonly used for anomaly detection. Its basic idea is to randomly select features and data subsets, partitioning the data into a tree structure to isolate abnormal data. Abnormal data points are easier to isolate than normal data, typically requiring fewer partitioning steps due to their characteristics, while normal data requires more. Therefore, Isolation Forest can distinguish between normal and abnormal data based on tree depth. Each data sample receives an anomaly score from the Isolation Forest model. This score reflects the ease with which data points are isolated. By employing the isolated forest algorithm, this invention can accurately identify abnormal behaviors in data transactions, ensuring the security and stability of the data transaction process and improving the level of data security protection.

[0029] The present invention further specifies that the calculation logic for the anomaly score is as follows: ,in, For anomaly scoring of the sample, It is a standardized constant. It is a sample The path length required to be isolated It is a sample The expected path length, The calculation formula is , It refers to the number of trees in an isolated forest. It is a sample In the The path length in the tree, TS is the mutation value of the sample node, and its calculation logic is as follows: , The subset of data corresponding to the feature subset when the sample is the root node. root node The data subset corresponding to the feature subset of the left child node. root node The data subset corresponding to the feature subset of the right child node, specifically, The anomaly score indicates the degree of a sample's anomalousness. A higher anomaly score indicates a sample is more likely to be anomalous. TS is an indicator of a sample's importance in node partitioning within an isolation forest, reflecting the degree of "mutation" in how a sample is partitioned within the isolation forest model—that is, how well the sample is distinguished from other samples by the tree structure. If a sample has a large node mutation value, it means it has a strong influence on the classification results within the tree structure and is likely an anomalous sample. When the root node has no left or right children, the node itself is already the smallest isolated unit; that is, it is isolated. This means the sample is completely separated from other samples, its path length can be calculated immediately, and it is considered anomalous.

[0030] Example 2 Please see Figure 2 This exemplary AI-based data transaction tracking and early warning system includes: Data acquisition module: Collects data transaction information through user HTTP request headers, client SDK, proxy server, and database records; Data processing module: processes and analyzes the collected data transaction information and extracts data transaction characteristics; Data Analysis Module: Employs the Isolation Forest algorithm to analyze data transaction characteristics and identify normal and abnormal data transaction information; Early warning module: When abnormal data transaction information is identified, an alarm is generated and the data transaction characteristics of the abnormal data transaction information are recorded.

[0031] It should be noted that the AI-based data transaction tracking and early warning system and the AI-based data transaction tracking and early warning method provided in the above embodiments belong to the same concept. The specific methods of operation of each module and unit have been described in detail in the method embodiments and will not be repeated here. In practical applications, the AI-based data transaction tracking and early warning system provided in the above embodiments can be assigned to different functional modules as needed, that is, the internal structure of the system can be divided into different functional modules to complete all or part of the functions described above. This is not a limitation here.

[0032] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0033] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0034] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or multiple items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0035] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0036] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0037] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0038] In the several embodiments provided in this application, it should be understood that the disclosed system can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0039] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0040] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0041] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0042] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data transaction tracking and early warning method based on artificial intelligence, characterized in that, include: Data transaction information is collected through user HTTP request headers, client SDKs, proxy servers, and database records; The collected data transaction information is processed and analyzed to extract data transaction characteristics; The isolated forest algorithm is used to analyze data transaction characteristics and identify normal and abnormal data transaction information. When abnormal data transaction information is identified, an alarm is generated, and the data transaction characteristics of the abnormal data transaction information are recorded.

2. The data transaction tracking and early warning method based on artificial intelligence according to claim 1, characterized in that, The data transaction information collected includes: the frequency of device or network switching during the data transaction process, the total number of data transactions by the user, the time delay of the data transaction, the active period of the data transaction, and the size and frequency of the data transaction.

3. The data transaction tracking and early warning method based on artificial intelligence according to claim 2, characterized in that, The collected data transaction information is processed and analyzed to extract data transaction characteristics, including: The collected data transaction information is filled with missing values, removed outliers, and standardized and normalized. Data transaction stability characteristics are extracted based on the frequency of device or network switching and the time delay of data transactions within a certain time range. Extract the active period deviation feature based on the active time period and the total number of data transactions by users; Data frequency features are extracted based on the data size and transaction frequency of users.

4. The data transaction tracking and early warning method based on artificial intelligence according to claim 3, characterized in that, The data transaction stability characteristics are calculated using the following logic: ,in, For the stability characteristics of data transactions, Switching frequencies for devices or networks For the time delay of data transactions, This represents the expected time threshold for normal transactions. A parameter used to control the intensity of the effect of time delay on features. The parameter is used to control the periodic effect of the switching frequency of the control equipment on the features. and This is a non-linear adjustment coefficient.

5. The data transaction tracking and early warning method based on artificial intelligence according to claim 3, characterized in that, The calculation logic for the deviation characteristics during active periods is as follows: ,in, This indicates a deviation from the active period characteristics. For the first The time of this data transaction The average time point during which users actively conduct data transactions. The total number of user data transactions. This is an adjustment factor used to control the weight of deviation during active periods.

6. The data transaction tracking and early warning method based on artificial intelligence according to claim 3, characterized in that, The calculation logic of frequency features is as follows: ,in, For frequency characteristics, For data size, This represents the maximum value of the data size. For trading frequency, and To adjust the parameters.

7. The data transaction tracking and early warning method based on artificial intelligence according to claim 3, characterized in that, The Isolation Forest algorithm is used to analyze data transaction characteristics and identify normal and abnormal data transaction information, including: Min-Max standardization is used to standardize the characteristics of data transactions; Standardized data transaction stability characteristics Deviation characteristics during active periods Sum of frequency characteristics Combined into a three-dimensional feature matrix; The Isolation Forest model is trained using a 3D feature matrix. During the training process, the Isolation Forest builds trees multiple times on randomly selected feature subsets and data subsets to separate normal data from abnormal data. After training, each sample will receive an anomaly score. Based on the anomaly score output by the Isolation Forest, a preset threshold is used to determine whether a data transaction is abnormal. If the anomaly score is higher than the preset threshold, it is considered abnormal; if the anomaly score is lower than or equal to the preset threshold, it is considered normal.

8. The data transaction tracking and early warning method based on artificial intelligence according to claim 7, characterized in that, The calculation logic for the anomaly score is as follows: ,in, For anomaly scoring of the sample, It is a standardized constant. It is a sample The path length required to be isolated It is a sample The expected path length, The calculation formula is , It refers to the number of trees in an isolated forest. It is a sample In the The path length in the tree, TS is the mutation value of the sample node, and its calculation logic is as follows: , The subset of data corresponding to the feature subset when the sample is the root node. root node The data subset corresponding to the feature subset of the left child node. root node The data subset corresponding to the feature subset of the right child node.

9. A data transaction tracking and early warning system based on artificial intelligence, used to implement the data transaction tracking and early warning method based on artificial intelligence as described in any one of claims 1-8, characterized in that, include: Data acquisition module: Collects data transaction information through user HTTP request headers, client SDK, proxy server, and database records; Data processing module: processes and analyzes the collected data transaction information and extracts data transaction characteristics; Data Analysis Module: Employs the Isolation Forest algorithm to analyze data transaction characteristics and identify normal and abnormal data transaction information; Early warning module: When abnormal data transaction information is identified, an alarm is generated and the data transaction characteristics of the abnormal data transaction information are recorded.

Images