Method and device for determining risk level of transaction behavior, and computer storage medium

Abstract

The invention discloses a risk level determination method and device of a transaction behavior, and a computer storage medium, and relates to the field of artificial intelligence. The method comprises the following steps: acquiring risk scores of a plurality of transaction behaviors, and forming a score set; determining a score threshold value from the score set; dividing the score set into a low diversity and a high diversity according to the score threshold; an abnormal index is calculated for the high-risk score in the high-diversity set through a pre-trained random forest model, and the abnormal index represents the abnormal degree of the transaction behavior corresponding to the high-risk score; and determining a risk level of a transaction behavior corresponding to the high-risk score according to a comparison result of the abnormal index of the high-risk score and a dynamic threshold. The technical problem that abnormal transaction behavior recognition is not accurate enough due to the fact that a fixed threshold value is used and abnormal transaction deep analysis is lacked in a traditional risk assessment method is solved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and more specifically, to a method, apparatus, and computer storage medium for determining the risk level of a transaction. Background Technology

[0002] Traditional risk assessment methods primarily rely on rule-based static evaluation and single-model prediction, using fixed thresholds for risk scoring. While simple and intuitive, this approach struggles to adapt to the frequent updates in trading patterns and the continuous evolution of fraudulent methods in a dynamically changing market environment. As a result, abnormal transactions are often not identified in a timely manner, or normal transactions are mistakenly identified as abnormal, thus impacting trading efficiency and user experience.

[0003] Furthermore, traditional methods for identifying abnormal trading behavior often remain at the level of matching surface features, lacking in-depth analysis of the underlying structure and dynamic anomaly patterns of trading behavior. This leads to situations where even some seemingly abnormal trading behaviors with high risk scores may be overlooked or misjudged because the complex relationships and trends behind the behavior have not been adequately considered.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This application provides a method, apparatus, and computer storage medium for determining the risk level of transaction behavior, in order to at least solve the technical problem that traditional risk assessment methods are not accurate enough in identifying abnormal transaction behavior due to the use of fixed thresholds and the lack of in-depth analysis of abnormal transactions.

[0006] According to one aspect of the embodiments of this application, a method for determining the risk level of a transaction behavior is provided, comprising: acquiring risk scores for multiple transaction behaviors and forming a score set, wherein the risk score represents the probability that the transaction behavior belongs to an abnormal transaction behavior; determining a scoring threshold from the score set; dividing the score set into a low set and a high set according to the scoring threshold, wherein the low set consists of low-risk scores less than the scoring threshold, and the high set consists of high-risk scores greater than or equal to the scoring threshold; calculating an anomaly index for the high-risk scores in the high set using a pre-trained random forest model, wherein the anomaly index represents the degree of abnormality of the transaction behavior corresponding to the high-risk score; and determining the risk level of the transaction behavior corresponding to the high-risk score based on the comparison result of the anomaly index of the high-risk score and a dynamic threshold.

[0007] Optionally, before obtaining risk scores for multiple transaction behaviors and forming a score set, the method further includes: obtaining a raw dataset, wherein the raw dataset includes structured data, semi-structured data, and unstructured data; performing data preprocessing operations on the raw dataset to obtain a target dataset, wherein the data preprocessing operations include data standardization and normalization.

[0008] Optionally, after performing data preprocessing on the original dataset to obtain the target dataset, the method further includes: extracting numerical and categorical features for each data item in the target dataset, and combining the numerical and categorical features of each data item to obtain a comprehensive feature vector for each data item; aggregating all comprehensive feature vectors obtained from the target dataset to obtain an initial feature set; selecting at least one comprehensive feature vector from the initial feature set as a candidate feature vector, and dividing the initial feature set into multiple feature subsets according to the numerical features of each candidate feature vector, wherein each feature subset consists of comprehensive feature vectors with the same numerical features; calculating the entropy of the initial feature set and multiple feature subsets, wherein the entropy is used to quantify the uncertainty of classification according to categorical features in the initial feature set and multiple feature subsets; determining the information gain of each candidate feature vector based on the entropy of the initial feature set and multiple feature subsets, wherein the information gain is determined based on the change in entropy before and after the feature set is divided; selecting candidate feature vectors with information gain greater than a preset threshold as target feature vectors, and converting the categorical features in the target feature vectors into numerical features through encoding processing, and after the conversion, aggregating them to form a feature vector set.

[0009] Optionally, after selecting candidate feature vectors with information gain greater than a preset threshold as target feature quantities, and converting categorical features in the target feature vectors into numerical features through encoding processing, and after the conversion is completed and aggregated to form a feature vector set, the method further includes: training the target model using an ensemble learning algorithm based on the feature vector set and the historical feature vector set to obtain a training file, wherein the training file is used to store the complete parameter configuration and learning weights in the model training; and performing model prediction on multiple transaction behaviors based on the training file.

[0010] Optionally, the model predicts multiple trading behaviors based on the training file, including: inputting multiple trading behaviors and the training file into the target model, and obtaining a risk score by predicting the behavioral characteristics of the training file and the trading behaviors through the target model.

[0011] Optionally, an anomaly index is calculated for high-risk scores in the high-score set using a pre-trained random forest model. This includes: calculating the path lengths from each high-risk score to one of the N decision tree sub-models in the random forest model, resulting in N path lengths. The path length represents the total number of branch nodes from the root node to the leaf node, starting from the input of the high-risk score to one of the N decision tree sub-models in the random forest model. The random forest model is a comprehensive model composed of N decision tree sub-models. The training process for the N decision tree sub-models includes: generating N subsets by random sampling with replacement from the original dataset; recursively training each of the N subsets to obtain N decision tree sub-models; calculating the average of the N path lengths to obtain the average path length; and determining the anomaly index based on the average path length and a preset average path length benchmark.

[0012] Optionally, after determining the risk level of the trading behavior corresponding to each risk score based on the comparison between the anomaly index of each risk score and the dynamic threshold, the method further includes: integrating multiple trading behaviors with determined risk levels into a feedback dataset; and retraining the target model based on the feedback dataset.

[0013] According to another aspect of the embodiments of this application, a risk level determination device for transaction behavior is also provided, comprising: an acquisition unit, configured to acquire risk scores of multiple transaction behaviors and form a score set, wherein the risk score represents the probability that a transaction behavior belongs to an abnormal transaction behavior; a first determination unit, configured to determine a score threshold from the score set; a first processing unit, configured to divide the score set into a low set and a high set according to the score threshold, wherein the low set consists of low-risk scores less than the score threshold, and the high set consists of high-risk scores greater than or equal to the score threshold; a second processing unit, configured to calculate an anomaly index for the high-risk scores in the high set using a pre-trained random forest model, wherein the anomaly index represents the degree of abnormality of the transaction behavior corresponding to the high-risk score; and a second determination unit, configured to determine the risk level of the transaction behavior corresponding to the high-risk score based on the comparison result of the anomaly index of the high-risk score and a dynamic threshold.

[0014] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein when the computer program is executed, it causes the device where the computer-readable storage medium is located to perform the above-described risk level determination method for the transaction.

[0015] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors perform the risk level determination method for the aforementioned transaction behavior.

[0016] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program or instructions, which, when executed by a processor, implement the risk level determination method for the above-described transaction behavior.

[0017] In this application, the method for determining the risk level of a trading behavior first obtains risk scores for multiple trading behaviors and forms a score set, where the risk score represents the probability that the trading behavior belongs to an abnormal trading behavior; a scoring threshold is determined from the score set; based on the scoring threshold, the score set is divided into a low set and a high set, where the low set consists of low-risk scores less than the scoring threshold, and the high set consists of high-risk scores greater than or equal to the scoring threshold; an anomaly index is calculated for the high-risk scores in the high set using a pre-trained random forest model, where the anomaly index represents the degree of abnormality of the trading behavior corresponding to the high-risk score; based on the comparison between the anomaly index of the high-risk score and the dynamic threshold, the risk level of the trading behavior corresponding to the high-risk score is determined.

[0018] In this embodiment, a combination of dynamic threshold determination and random forest deep analysis is adopted. By evaluating the distribution of risk scores and using the random forest model to calculate the anomaly index, the purpose of refined risk identification of trading behavior is achieved. This improves the accuracy of abnormal transaction identification and reduces the false alarm rate, thereby solving the technical problem that traditional risk assessment methods are not accurate enough in identifying abnormal trading behavior due to the use of fixed thresholds and the lack of in-depth analysis of abnormal transactions. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0020] Figure 1 This is a flowchart of an optional method for determining the risk level of a transaction according to an embodiment of this application;

[0021] Figure 2 This is a schematic diagram of a risk level determination system for an optional transaction behavior according to an embodiment of this application;

[0022] Figure 3 This is a schematic diagram of an optional risk level determination device for a transaction behavior according to an embodiment of this application. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] According to an embodiment of this application, a method embodiment for determining the risk level of a transaction is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0026] According to the embodiments of this application, a risk level determination system for transaction behavior (hereinafter referred to as the system) can be used as the execution subject of the risk level determination method for transaction behavior in the embodiments of this application. The risk level determination system for transaction behavior can be a software system or an embedded system combining software and hardware. Of course, the execution subject of the method in the embodiments of this application can also be other forms of execution subject, such as devices or equipment. Those skilled in the art should know that this application does not particularly limit the specific form of the execution subject.

[0027] Figure 1 This is a flowchart of an optional method for determining the risk level of a transaction according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0028] Step S101: Obtain risk scores for multiple trading behaviors and form a score set, wherein the risk score represents the probability that the trading behavior belongs to abnormal trading behavior.

[0029] Optionally, the risk score analyzes transaction characteristics using machine learning models (such as logistic regression, support vector machines, etc.) to obtain the probability value of each transaction being an abnormal transaction. The set of risk scores for all transactions is an ordered data set, i.e., the score set. The system can use the score set for statistical analysis and threshold determination.

[0030] Optionally, through real-time scoring, the system can respond instantly, capture potential abnormal transactions, provide real-time data support for dynamic risk management, and enhance the system's response speed and risk perception capabilities.

[0031] Step S102: Determine the scoring threshold from the scoring set.

[0032] Optionally, the scoring threshold is a boundary value used to distinguish between low-risk and high-risk trading behaviors in the scoring set. It is not fixed but dynamically determined based on the statistical characteristics of the scoring set. The system can determine the dynamic threshold based on the distribution of the scoring set. A common practice is to use the median, mean, and several standard deviations of the scoring set, or the value of a specific percentile, as the scoring threshold.

[0033] Optionally, the determination of the scoring threshold takes into account the central tendency and dispersion of the scoring, aiming to balance risk coverage and false alarm rate, thereby improving the flexibility and accuracy of identifying abnormal transactions and reducing over-alarms or under-alarms caused by fixed thresholds.

[0034] Step S103: Based on the scoring threshold, the scoring set is divided into a low set and a high set. The low set consists of low-risk scores that are less than the scoring threshold, and the high set consists of high-risk scores that are greater than or equal to the scoring threshold.

[0035] Optionally, by dividing the score set, the system can concentrate resources on in-depth analysis of transactions with high scores, thereby improving system processing efficiency and helping abnormal transactions to receive timely attention and processing.

[0036] Step S104: Calculate the anomaly index for high-risk scores in the high-score set using a pre-trained random forest model. The anomaly index represents the degree of abnormality of the trading behavior corresponding to the high-risk score.

[0037] Optionally, the anomaly index can be calculated using a random forest model to reflect the degree of anomalousness of high-scoring concentrated trading behavior. Unlike risk scoring, the anomaly index focuses more on the structural position of the scored data points within the model; a higher anomaly index indicates more anomalous trading behavior.

[0038] Optionally, the calculation of the anomaly index can enable in-depth anomaly analysis of high-risk scores, avoid misinterpretations that may be caused by a single score, thereby enhancing the system's ability to identify abnormal trading behavior, reducing false alarms, and improving accuracy.

[0039] Step S105: Based on the comparison results between the abnormal index of the high-risk score and the dynamic threshold, determine the risk level of the transaction behavior corresponding to the high-risk score.

[0040] Optionally, the dynamic threshold is used to compare with the anomaly index to further refine the threshold for the risk level, and is also dynamically adjusted according to the system operation.

[0041] Optionally, the system can further categorize high-scoring trading behaviors into different risk levels based on the comparison between the anomaly index and a dynamic threshold. For example, trading behaviors with an anomaly index exceeding the dynamic threshold may be marked as the highest level of risk, triggering an immediate alert; while trading behaviors that do not exceed the threshold may be considered as medium-level risk, awaiting further manual review.

[0042] Optionally, the dynamic risk classification mechanism allows the system to adjust its response measures in a timely manner based on the actual risk situation, optimize resource allocation, reduce unnecessary interference, and help to handle abnormal situations promptly.

[0043] In an optional embodiment, before obtaining risk scores for multiple transaction behaviors and forming a score set, the method further includes: obtaining a raw dataset, wherein the raw dataset includes structured data, semi-structured data, and unstructured data; performing data preprocessing operations on the raw dataset to obtain a target dataset, wherein the data preprocessing operations include data standardization and normalization.

[0044] Optionally, the original dataset encompasses a collection of various data types, including structured data (such as transaction records and user information), semi-structured data (such as API responses in JSON and XML formats), and unstructured data (such as text, images, and audio).

[0045] Optionally, data standardization scales the data to a fixed range, such as [0,1], to facilitate comparison and model training; data normalization makes the data conform to a standard normal distribution, reduces the influence of units, and helps model learning.

[0046] Optionally, in this embodiment, for the heterogeneous original dataset from multiple sources, a data preprocessing operation is first performed. This is a crucial step before obtaining risk scores for multiple transaction behaviors. Data preprocessing includes data standardization and normalization, which aims to address issues such as missing values, outliers, differences in units, and inconsistent formats in the original data. This helps to compare all data on the same scale, reduces the influence of certain features on model decisions due to numerical size or units, and provides high-quality, standardized data input for subsequent risk score calculations.

[0047] Specifically, for structured data, operations such as filling in missing values, removing outliers, and standardizing streaming information help improve data integrity and consistency. For semi-structured and unstructured data, methods such as parsing, extracting key fields, and applying word frequency statistics or text embedding can transform it into a structured form, facilitating model analysis. Data standardization and normalization help ensure that the data has a good numerical range and statistical properties before entering the model, improving the model's training efficiency and prediction accuracy.

[0048] Optionally, by performing a preliminary data preprocessing step, the heterogeneous raw data from multiple sources can be transformed into the target dataset, reducing noise caused by data differences and creating favorable conditions for subsequent risk score calculation. Standardization and normalization not only simplify the difficulty of model training but also improve the model's generalization ability, making the system more robust when processing data of different types and sources, and reducing bias and uncertainty in the model training and prediction process.

[0049] In an optional embodiment, after performing data preprocessing operations on the original dataset to obtain the target dataset, the method further includes: extracting numerical and categorical features for each data item in the target dataset, and combining the numerical and categorical features of each data item to obtain a comprehensive feature vector for each data item; aggregating all comprehensive feature vectors obtained from the target dataset to obtain an initial feature set; selecting at least one comprehensive feature vector from the initial feature set as a candidate feature vector, and dividing the initial feature set into multiple feature subsets according to the numerical features of each candidate feature vector, wherein each feature subset consists of comprehensive feature vectors with the same numerical features; calculating the entropy of the initial feature set and multiple feature subsets, wherein the entropy is used to quantify the uncertainty of classification according to categorical features in the initial feature set and multiple feature subsets; determining the information gain of each candidate feature vector based on the entropy of the initial feature set and multiple feature subsets, wherein the information gain is determined based on the change in entropy before and after the feature set is divided; selecting candidate feature vectors with information gains greater than a preset threshold as target feature vectors, and converting the categorical features in the target feature vectors into numerical features through encoding processing, and after the conversion, aggregating them to form a feature vector set.

[0050] Optionally, numerical features are attributes that can be directly quantified, such as transaction amount and timestamp. Categorical features represent attributes of type or category, such as transaction type and user level, and usually need to be converted into numerical features before they can be input into the model.

[0051] Optionally, the composite feature vector is a data vector composed of numerical features and categorical features, which is used as input to a machine learning model.

[0052] Optionally, the initial feature set, which is a collection of all integrated feature vectors, is the starting point for feature selection.

[0053] Optionally, candidate feature vectors are feature vectors selected from the initial feature set that may contribute to the classification task, and are used for subsequent feature subset segmentation and information gain calculation.

[0054] Optionally, entropy is an indicator of the uncertainty of classification of samples in a set. The higher the entropy value, the more uniform the distribution of samples in the set, and the higher the uncertainty of classification. The formula for calculating entropy is formula (1):

[0055] (1)

[0056] in, Is it a category in the dataset? The proportion in It represents the total number of categories.

[0057] Optionally, information gain is used to evaluate the value of features for the classification task, representing the change in entropy before and after feature set segmentation. The formula for calculating information gain is formula (2):

[0058] (2)

[0059] in, It is a dataset entropy, It is based on the value of feature A. A subset of.

[0060] Optionally, the target feature vector represents a feature vector with an information gain higher than a preset threshold, which is an important feature vector for identifying abnormal transaction behavior.

[0061] Optionally, after completing the data preprocessing operations and obtaining the target dataset, the system continues to perform in-depth data analysis. First, numerical and categorical features are extracted from each data point in the target dataset, and a comprehensive feature vector is constructed. Then, all comprehensive feature vectors are aggregated into an initial feature set, serving as the first step in feature engineering. From the initial feature set, at least one comprehensive feature vector is selected as a candidate feature vector; this is the starting point for feature selection. By dividing the initial feature set into multiple feature subsets according to the numerical features of the candidate feature vectors, each subset contains comprehensive feature vectors with similar numerical features, features that can distinguish different categories (normal and abnormal transactions) are identified.

[0062] Optionally, after segmentation, the system needs to calculate the entropy of the initial feature set and multiple feature subsets. The magnitude of the entropy reflects the uncertainty of classification by categorical features in the initial feature set and subsets. The lower the entropy value, the higher the purity of the segmented subsets, i.e., the stronger the certainty of classification. Next, based on the entropy of the initial feature set and each feature subset, the system calculates the information gain of candidate feature vectors. Feature vectors with high information gain are more valuable for the classification task. Finally, according to a preset threshold, candidate feature vectors with information gain greater than the threshold are selected as target feature vectors, thereby filtering out features that contribute to the classification task. For categorical features in the target feature vectors, the system converts them into numerical features through encoding to meet the input requirements of subsequent machine learning models. After the conversion, all target feature vectors are aggregated to form a feature vector set.

[0063] Optionally, the system performs in-depth feature extraction on the data and selects features based on the information gain principle, which helps to ensure that the features used during model training are the most discriminative and valuable.

[0064] Optionally, feature engineering methods based on entropy and information gain can improve feature quality, reduce the impact of redundant features on model performance, and increase the model's prediction accuracy and generalization ability.

[0065] Optionally, the encoding process addresses the compatibility issue between categorical and numerical features, enabling the model to process heterogeneous datasets and achieve more accurate identification of abnormal transaction behaviors.

[0066] In an optional embodiment, after selecting candidate feature vectors with information gain greater than a preset threshold as target feature quantities, and converting categorical features in the target feature vectors into numerical features through encoding processing, and after the conversion is completed and aggregated to form a feature vector set, the method further includes: training the target model using an ensemble learning algorithm based on the feature vector set and the historical feature vector set to obtain a training file, wherein the training file is used to store the complete parameter configuration and learning weights in the model training; and performing model prediction on multiple transaction behaviors based on the training file.

[0067] Optionally, the feature vector set contains a set of all target feature vectors, where each vector represents a numerical and categorical feature of a transaction behavior.

[0068] Optionally, the historical feature vector set is a set of feature vectors of past trading behaviors used for model training. It contains instances of normal and abnormal transactions, which helps the model learn to distinguish between normal and abnormal transactions.

[0069] Optionally, ensemble learning algorithms are machine learning strategies that combine the prediction results of multiple base learners to improve overall prediction performance, including algorithms such as random forests, gradient boosting decision trees, and continuous gradient boosting models.

[0070] Alternatively, logistic regression represents the probability that a sample belongs to a certain category by mapping the output value of linear regression to the [0,1] interval.

[0071] Optionally, logistic regression predicts the probability p that a sample belongs to the positive class. If p > 0.5, the sample is considered to belong to the positive class; otherwise, it belongs to the negative class. The logistic regression expression is formula (3):

[0072] (3)

[0073] Here, x is a vector containing multiple features x1, x2, ..., xn. n And Z= + + +……+ It is a linear combination of the feature vector x and the model parameter β, where β i Is with feature x i The corresponding weights.

[0074] Alternatively, random forests can improve the accuracy and robustness of the model by constructing multiple decision trees and combining the prediction results; support vector machines can find the optimal classification hyperplane by minimizing structural risk.

[0075] Optionally, the random forest building process includes:

[0076] (1) Bootstrap sampling method: random sampling with replacement is performed on the original dataset to generate multiple subsets, each of which is used to train a decision tree.

[0077] (2) Randomly select features. When constructing each tree, randomly select a portion of features from all features as the basis for splitting the current node, thereby increasing the diversity of the model and avoiding excessive influence of features on the model.

[0078] (3) Training of decision trees: Each tree is split using randomly selected samples and features during the training process until the preset termination condition is reached.

[0079] (4) Integration of prediction results: During the prediction phase, each tree classifies or regresses the new samples, and the final result is determined by majority vote or average.

[0080] Optionally, gradient boosting decision trees iteratively train multiple weak learners to gradually reduce the model's prediction error, ultimately constructing a powerful prediction model. The process of minimizing the loss function in gradient boosting decision trees can be expressed as formula (4):

[0081] (4)

[0082] in, It is the first The model after rounds of iterations, It's the previous model. It's the learning rate. It is the first The output of each decision tree aims to minimize the loss function. The formula for minimizing the loss function is formula (5):

[0083] (5)

[0084] Where n is the total number of samples, y i For the true value, y j These are the predicted values ​​from the model.

[0085] Optionally, the continuous gradient boosting model gradually reduces prediction error by constructing multiple weak learners, eventually forming a strong learner. A regularization term is introduced into the objective function to control model complexity and prevent overfitting. The objective function of the continuous gradient boosting model consists of a loss function and a regularization term. The objective function can be expressed as formula (6):

[0086] (6)

[0087] in, Represents the loss function. Let represent the regularization term for the k-th tree.

[0088] Optionally, the target model is a model trained using an ensemble learning algorithm to predict the risk level of trading behavior.

[0089] Optionally, the training file is the output after the model has been trained. It contains the complete parameter configuration and learned weights of the model and is the basis for model deployment and prediction.

[0090] Optionally, after completing feature selection and encoding to form a feature vector set, the system begins model training using an ensemble learning algorithm. This involves constructing the target model using the feature vector set and historical feature vector sets. The historical feature vector set provides rich training samples, covering various types of trading behaviors and fraud cases, which helps the model learn complex trading patterns and fraud signals.

[0091] Optionally, ensemble learning algorithms combine the predictions of multiple base models through voting or weighted averaging to improve the model's predictive stability and accuracy. In the embodiments of this application, the system may choose random forest, gradient boosting decision tree, or continuous gradient boosting model algorithm for training, thereby processing a large number of feature vectors and exhibiting high predictive power and model generalization ability, especially suitable for scenarios with high-dimensional and heterogeneous datasets.

[0092] Optionally, during model training, a training file will be generated, saving all parameter configurations and learning weights learned during model training. The training file not only carries the model but also serves as an execution guide for the subsequent prediction phase. It contains detailed information on how the model derives a risk score for trading behavior based on the input feature vector. The system can then deploy the target model to a real-time trading monitoring system to predict the risk of each ongoing trading activity.

[0093] In one optional embodiment, performing model prediction on multiple trading behaviors based on training files includes: inputting multiple trading behaviors and training files into a target model, and obtaining a risk score by predicting the behavioral characteristics of the trading behaviors based on the training files and trading behaviors through the target model.

[0094] Optionally, once feature selection and encoding are complete, and training files are generated during the model training phase, the target model already possesses real-time prediction capabilities. During the model prediction phase, the system extracts multiple transaction behaviors from the real-time transaction stream and inputs them into the target model along with the training files. The target model receives the feature vectors of the transaction behaviors and, using the parameter configurations and learning weights stored in the training files, performs calculations through an internal learning mechanism (such as the decision tree algorithm in random forests). The model comprehensively evaluates whether the transaction behavior deviates from the normal transaction pattern based on the numerical and categorical features of each feature vector, thereby providing a numerical risk score.

[0095] Optionally, by performing model predictions on real-time trading behavior based on training files, the real-time nature and automation of detection can be achieved. The generation of risk scores is based on the powerful predictive capabilities of ensemble learning algorithms and historical knowledge accumulated during the model training phase, enabling the system to quickly and accurately identify potentially abnormal transactions in complex and ever-changing data environments, thereby improving the efficiency and accuracy of detection work.

[0096] In one optional embodiment, an anomaly index is calculated for high-risk scores in a high-score set using a pre-trained random forest model. This includes: calculating the path lengths from each high-risk score to one of the N decision tree sub-models in the random forest model, resulting in N path lengths. Each path length represents the total number of branch nodes from the root node to a leaf node, starting from the input of the high-risk score to one of the N decision tree sub-models in the random forest model. The random forest model is a composite model composed of N decision tree models. The training process for the N decision tree models includes: generating N subsets by random sampling with replacement from the original dataset; recursively training each of the N subsets to obtain N decision tree sub-models; calculating the average of the N path lengths to obtain the average path length; and determining the anomaly index based on the average path length and a preset average path length benchmark.

[0097] Optionally, after the risk score is determined, for high-risk scores located in the high-score set, the system uses a pre-trained random forest model to calculate an anomaly index, thereby further refining the degree of anomaly of the high-risk scores to more accurately identify truly abnormal trading behaviors.

[0098] Optionally, the system first inputs the high-risk score into N decision tree sub-models in the random forest model. For each decision tree sub-model, the path length from the root node to a certain leaf node of the high-risk score is calculated. This path length reflects the uniqueness of the score on the model's decision path. The more anomalous the score, the shorter its path length may be, because outliers tend to be isolated earlier in a random forest.

[0099] Optionally, the system then calculates the path length of each rating across the N decision tree sub-models, resulting in a set of path lengths. The average path length of the rating is obtained by averaging this set.

[0100] Optionally, the calculated average path length is then compared with a preset average path length benchmark to determine the anomaly index. The anomaly index reflects the degree of deviation between the score and the internal structure of the model. If the average path length is much lower than the benchmark, it indicates that the probability of the transaction behavior being abnormal in the model is extremely high, and the anomaly index will be correspondingly high. The formula for calculating the anomaly index is formula (7):

[0101] (7)

[0102] in, It is the average path length required for the samples to be isolated. It is the average path length in a binary search tree with n nodes. The closer the score is to 1, the more likely it is to be an outlier.

[0103] In an optional embodiment, after determining the risk level of the trading behavior corresponding to each risk score based on the comparison result of the anomaly index of each risk score and the dynamic threshold, the method further includes: integrating multiple trading behaviors with determined risk levels into a feedback dataset; and retraining the target model based on the feedback dataset.

[0104] Optionally, the feedback dataset is a dataset that integrates multiple trading behaviors with determined risk levels, containing actual validation information of the model's prediction results, and is used for continuous optimization and retraining of the model.

[0105] Optionally, after determining the risk level based on the anomaly index and dynamic threshold, the system enters the model retraining stage under the feedback mechanism. By integrating the transaction behavior data with the determined risk level, a feedback dataset is formed. The target model is then optimized using the feedback dataset to improve the long-term performance and adaptability of the model.

[0106] Figure 2 This is a schematic diagram of a risk level determination system for an optional transaction behavior according to an embodiment of this application. Figure 2 As shown, the risk level determination system for transaction behavior includes a data acquisition module, a data preprocessing module, a feature engineering module, a model training and preprocessing module, and a real-time monitoring and feedback module.

[0107] Figure 3 This is a schematic diagram of an optional risk level determination device for a transaction behavior according to an embodiment of this application. According to another embodiment of this application, a risk level determination device for a transaction behavior is also provided, including: an acquisition unit 301, a first determination unit 302, a first processing unit 303, a second processing unit 304, and a second determination unit 305.

[0108] The system includes: an acquisition unit 301, used to acquire risk scores for multiple trading behaviors and form a score set, wherein the risk score represents the probability that a trading behavior belongs to an abnormal trading behavior; a first determination unit 302, used to determine a score threshold from the score set; a first processing unit 303, used to divide the score set into a low set and a high set according to the score threshold, wherein the low set consists of low-risk scores less than the score threshold, and the high set consists of high-risk scores greater than or equal to the score threshold; a second processing unit 304, used to calculate an anomaly index for the high-risk scores in the high set using a pre-trained random forest model, wherein the anomaly index represents the degree of abnormality of the trading behavior corresponding to the high-risk score; and a second determination unit 305, used to determine the risk level of the trading behavior corresponding to the high-risk score based on the comparison result between the anomaly index of the high-risk score and the dynamic threshold.

[0109] Optionally, the risk level determination device for transaction behavior further includes: a collection unit for acquiring a raw dataset, wherein the raw dataset includes structured data, semi-structured data, and unstructured data; and a preprocessing unit for performing data preprocessing operations on the raw dataset to obtain a target dataset, wherein the data preprocessing operations include data standardization and normalization.

[0110] Optionally, the risk level determination device for transaction behavior further includes: a feature extraction unit, used to extract numerical and categorical features for each data item in the target dataset, and combine the numerical and categorical features of each data item to obtain a comprehensive feature vector for each data item; a first aggregation unit, used to aggregate all comprehensive feature vectors obtained from the target dataset to obtain an initial feature set; and a segmentation unit, used to select at least one comprehensive feature vector from the initial feature set as a candidate feature vector, and segment the initial feature set into multiple feature subsets according to the numerical features of each candidate feature vector, wherein each feature subset consists of comprehensive feature vectors with the same numerical features. The system consists of two parts: a first calculation unit, which calculates the entropy of the initial feature set and multiple feature subsets, where entropy is used to quantify the uncertainty of classifying the initial feature set and multiple feature subsets according to categorical features; a second calculation unit, which determines the information gain of each candidate feature vector based on the entropy of the initial feature set and multiple feature subsets, where the information gain is determined based on the change in entropy before and after the feature set is segmented; and a second aggregation unit, which takes candidate feature vectors with information gain greater than a preset threshold as target feature vectors, and converts the categorical features in the target feature vectors into numerical features through encoding processing, and after the conversion, aggregates them to form a feature vector set.

[0111] Optionally, the risk level determination device for trading behavior further includes: a training unit, used to train the target model using an ensemble learning algorithm based on a set of feature vectors and a set of historical feature vectors to obtain a training file, wherein the training file is used to store the complete parameter configuration and learning weights in the model training; and a prediction unit, used to perform model prediction for multiple trading behaviors based on the training file.

[0112] Optionally, the prediction unit includes: a risk score generation subunit, used to input multiple trading behaviors and training files into the target model, and to predict a risk score by the target model based on the behavioral characteristics of the training files and trading behaviors.

[0113] Optionally, the second processing unit 304 includes: a first calculation subunit, used to calculate the path lengths of high-risk scores to N decision tree sub-models in the random forest model, obtaining N path lengths, wherein the path length is used to characterize the total number of branch nodes from the root node to the leaf node when the high-risk score starts from the input of the N decision tree sub-models in the random forest model, the random forest model is a comprehensive model composed of N decision tree sub-models, and the training process of the N decision tree sub-models includes: generating N subsets by random sampling with replacement on the original dataset, and recursively training the N decision tree sub-models according to the N subsets respectively; a second calculation subunit, used to calculate the average of the N path lengths, obtaining the average path length; and a third calculation subunit, used to determine the anomaly index based on the average path length and a preset average path length benchmark.

[0114] Optionally, the risk level determination device for trading behavior further includes: a feedback unit for integrating multiple trading behaviors with determined risk levels into a feedback dataset; and a retraining unit for retraining the target model based on the feedback dataset.

[0115] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein when the computer program is executed, it causes the device where the computer-readable storage medium is located to perform the above-described risk level determination method for the transaction.

[0116] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors perform the risk level determination method for the aforementioned transaction behavior.

[0117] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program or instructions, which, when executed by a processor, implement the risk level determination method for the above-described transaction behavior.

[0118] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0119] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0120] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0121] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0122] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0123] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0124] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for determining the risk level of a transaction, characterized in that, include: Obtain risk scores for multiple transaction behaviors and form a score set, wherein the risk score represents the probability that the transaction behavior belongs to abnormal transaction behavior; Determine the scoring threshold from the scoring set; Based on the scoring threshold, the scoring set is divided into a low set and a high set, wherein the low set consists of low-risk scores below the scoring threshold, and the high set consists of high-risk scores greater than or equal to the scoring threshold. An anomaly index is calculated for the high-risk scores in the high-score set using a pre-trained random forest model, wherein the anomaly index characterizes the degree of abnormality of the trading behavior corresponding to the high-risk scores. Based on the comparison between the abnormal index of the high-risk score and the dynamic threshold, the risk level of the transaction behavior corresponding to the high-risk score is determined.

2. The method for determining the risk level of a transaction according to claim 1, characterized in that, Before obtaining risk scores for multiple transaction behaviors and forming a score set, the method further includes: Obtain the original dataset, which includes structured data, semi-structured data, and unstructured data; Perform data preprocessing operations on the original dataset to obtain the target dataset, wherein the data preprocessing operations include data standardization and normalization.

3. The method for determining the risk level of a transaction according to claim 2, characterized in that, After performing data preprocessing operations on the original dataset to obtain the target dataset, the method further includes: Numerical and categorical features are extracted from each data item in the target dataset, and the numerical and categorical features of each data item are combined to obtain a comprehensive feature vector for each data item. The initial feature set is obtained by aggregating all the comprehensive feature vectors obtained based on the target dataset. At least one of the comprehensive feature vectors is selected from the initial feature set as candidate feature vectors, and the initial feature set is divided into multiple feature subsets according to the numerical features of each candidate feature vector, wherein each feature subset is composed of the comprehensive feature vectors having the same numerical features. Calculate the entropy of the initial feature set and the plurality of feature subsets, wherein the entropy is used to quantify the uncertainty of classification by categorical features in the initial feature set and the plurality of feature subsets; Based on the entropy of the initial feature set and multiple feature subsets, the information gain of each candidate feature vector is determined, wherein the information gain is determined based on the change in entropy before and after feature set segmentation; Candidate feature vectors with information gain greater than a preset threshold are used as target feature vectors. Categorical features in the target feature vectors are converted into numerical features through encoding. After the conversion is completed, they are aggregated to form a feature vector set.

4. The method for determining the risk level of a transaction according to claim 3, characterized in that, After selecting candidate feature vectors with information gain greater than a preset threshold as target feature quantities, and converting categorical features in the target feature vectors into numerical features through encoding processing, and then aggregating them to form a feature vector set after the conversion, the method further includes: Based on the aforementioned feature vector set and historical feature vector set, an ensemble learning algorithm is used to train the target model to obtain a training file, wherein the training file is used to store the complete parameter configuration and learning weights in the model training. The model is used to predict multiple transaction behaviors based on the training file.

5. The method for determining the risk level of a transaction according to claim 4, characterized in that, Based on the training file, the model performs predictions on multiple transaction behaviors, including: The target model is input into the multiple trading behaviors and the training file, and the target model predicts the risk score based on the behavioral characteristics of the training file and the trading behaviors.

6. The method for determining the risk level of a transaction according to claim 1, characterized in that... An anomaly index is calculated on the high-risk scores in the high-score set using a pre-trained random forest model, including: The path lengths from the high-risk score to each of the N decision tree sub-models in the random forest model are statistically analyzed to obtain N path lengths. The path lengths are used to represent the total number of branch nodes from the root node to the leaf node when the high-risk score starts from the input of the N decision tree sub-models in the random forest model. The random forest model is a comprehensive model composed of N decision tree models. The training process of the N decision tree models includes: generating N subsets by performing random sampling with replacement on the original dataset, and recursively training the N decision tree sub-models based on the N subsets respectively. Calculate the average of the N path lengths to obtain the average path length; The anomaly index is determined based on the average path length and a preset average path length benchmark.

7. The method for determining the risk level of a transaction according to claim 5, characterized in that, After determining the risk level of the trading behavior corresponding to each risk score based on the comparison result of the anomaly index and dynamic threshold of each risk score, the method further includes: The multiple transaction behaviors that have been determined to have the aforementioned risk level are integrated into a feedback dataset; The target model is retrained based on the feedback dataset.

8. A device for determining the risk level of a transaction, characterized in that, include: An acquisition unit is used to acquire risk scores for multiple transaction behaviors and form a score set, wherein the risk score represents the probability that the transaction behavior belongs to abnormal transaction behavior; The first determining unit is used to determine a scoring threshold from the scoring set; The first processing unit is configured to divide the score set into a low set and a high set according to the score threshold, wherein the low set consists of low-risk scores less than the score threshold, and the high set consists of high-risk scores greater than or equal to the score threshold. The second processing unit is used to calculate an anomaly index for the high-risk scores in the high-score set using a pre-trained random forest model, wherein the anomaly index characterizes the degree of abnormality of the trading behavior corresponding to the high-risk scores. The second determining unit is used to determine the risk level of the transaction behavior corresponding to the high-risk score based on the comparison result between the abnormal index of the high-risk score and the dynamic threshold.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device containing the computer-readable storage medium performs the risk level determination method for a transaction as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to perform the risk level determination method for a transaction as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, It includes a computer program or instructions that, when executed by a processor, implement the risk level determination method for any one of claims 1 to 7.

Images