Abnormal transaction detection method, apparatus, device, medium and program product

Abstract

This invention provides an abnormal transaction detection method, apparatus, device, medium, and program product, which can be applied to the fields of artificial intelligence, big data, and information security. The method includes: extracting information about the payee, payer, and transaction characteristics of a first transaction, with user authorization; obtaining a first subgraph where the payee is located and a second subgraph where the payer is located, wherein the first subgraph consists of a first type of user confirmed to have initiated the abnormal transaction and their similar first type of potential users, and the second subgraph consists of a second type of user confirmed to be affected by the abnormal transaction and their similar second type of potential users; using the first subgraph, the second subgraph, and the transaction characteristics of the first transaction as input to a trained abnormal transaction detection model, and using the abnormal transaction detection model to detect whether the first transaction is an abnormal transaction or a normal transaction.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence, big data, and information security, and specifically to an abnormal transaction detection method, apparatus, equipment, medium, and program product. Background Technology

[0002] Abnormal transactions deviate from normal trading patterns and are usually aimed at obtaining illicit profits. If successfully executed, they often result in financial losses for the unwittingly involved parties. Therefore, accurate and efficient detection of abnormal transactions is crucial for transaction security. Currently, many transaction detection methods primarily rely on analyzing information about the transaction itself (such as the trading time) and the behavioral characteristics of the trading parties. However, as the methods used to commit abnormal transactions become increasingly covert, these detection methods struggle to capture complex abnormal transaction patterns, leading to frequent missed detections. Summary of the Invention

[0003] In view of the above problems, the present invention provides an abnormal transaction detection method, apparatus, equipment, medium and program products that can reduce the false negative rate and improve the detection accuracy.

[0004] A first aspect of this invention provides an abnormal transaction detection method, comprising: upon obtaining authorization from the payee and payer of a first transaction, extracting information about the payee, payer, and transaction characteristics of the first transaction; when the payee of the first transaction belongs to a user in a first subgraph and the payer of the first transaction belongs to a user in a second subgraph, acquiring the first subgraph and the second subgraph, wherein the first subgraph is composed of a first type of user confirmed to have initiated the abnormal transaction and a first type of potential user who meets a first similarity condition with the first type of user, and the second subgraph is composed of a second type of user confirmed to be affected by the abnormal transaction and a second type of potential user who meets a second similarity condition with the second type of user; using the first subgraph, the second subgraph, and the transaction characteristics of the first transaction as input to a trained abnormal transaction detection model, and using the abnormal transaction detection model to detect whether the first transaction is an abnormal transaction or a normal transaction.

[0005] According to an embodiment of the present invention, detecting whether the first transaction is an abnormal transaction or a normal transaction using the abnormal transaction detection model includes: processing the first subgraph using a first self-attention module to extract features of the payee; processing the second subgraph using a second self-attention module to extract features of the payer; and classifying the first transaction using a classification module based on the features of the payee, the features of the payer, and the transaction features of the first transaction to detect whether the first transaction is an abnormal transaction or a normal transaction. The abnormal transaction detection model includes the first self-attention module, the second self-attention module, and the classification module.

[0006] According to an embodiment of the present invention, classifying the first transaction based on the features of the payee, the features of the payer, and the transaction features of the first transaction using a classification module includes: fusing the features of the payer and the features of the payee using a cross-attention module to obtain fused features; processing the fused features and the transaction features of the first transaction using a classifier, and outputting the classification result of the first transaction; wherein the classification module includes the cross-attention module and the classifier.

[0007] According to an embodiment of the present invention, obtaining the first subgraph and the second subgraph includes: when the recipient of the first transaction belongs to one or more first subgraphs and the payer of the first transaction belongs to one or more second subgraphs, filtering out the first subgraph and the second subgraph where there is a transaction relationship between the users.

[0008] According to an embodiment of the present invention, the step of filtering out the first subgraph and the second subgraph that have a transaction relationship between users includes: when multiple sets of first subgraphs and second subgraphs are filtered out, evaluating the estimated probability that an abnormal transaction occurs between users in the second subgraph and users in the first subgraph in each set; and filtering out at least one set of first subgraphs and second subgraphs based on the estimated probability.

[0009] According to an embodiment of the present invention, the method further includes: obtaining user authorization for the use of their related data; and, upon obtaining user authorization, constructing a first subgraph and a second subgraph based on the authorized user's related data, specifically including: filtering data of a first type of user confirmed to have initiated abnormal transactions and a second type of user confirmed to have been affected by abnormal transactions based on historical risk monitoring data; filtering a first type of potential user who meets the first similarity condition with the first type of user, and filtering a second type of potential user who meets the second similarity condition with the second type of user; constructing the first subgraph based on the data of the first type of user and the first type of potential user in the banking system; and constructing the second subgraph based on the data of the second type of user and the second type of potential user in the banking system.

[0010] According to an embodiment of the present invention, the training process of the abnormal transaction detection model includes: acquiring at least one first subgraph and at least one second subgraph; acquiring historical transaction data between users in at least one first subgraph and at least one second subgraph, wherein the historical transaction data includes transaction tags, which are used to characterize whether a transaction is a normal transaction or an abnormal transaction; and constructing training data using at least one first subgraph, at least one second subgraph, and the historical transaction data to train the abnormal transaction detection model.

[0011] In a second aspect, the present invention provides an abnormal transaction detection device, wherein the device includes: an information extraction module, a sub-graph acquisition module, and a transaction detection module.

[0012] The information extraction module is used to extract information about the payee, payer, and transaction characteristics of the first transaction, provided that authorization has been obtained from the payee and payer of the first transaction.

[0013] The subgraph acquisition module is used to acquire the first subgraph and the second subgraph when the payee of the first transaction belongs to a user in the first subgraph and the payer of the first transaction belongs to a user in the second subgraph. The first subgraph consists of a first type of user who has been confirmed to have initiated an abnormal transaction and a first type of potential user who meets the first type of user's first similarity condition. The second subgraph consists of a second type of user who has been confirmed to be affected by the abnormal transaction and a second type of potential user who meets the second type of user's second similarity condition.

[0014] The transaction detection module is used to take the transaction features of the first subgraph, the second subgraph, and the first transaction as input to a trained abnormal transaction detection model, and use the abnormal transaction detection model to detect whether the first transaction is an abnormal transaction or a normal transaction.

[0015] A third aspect of the present invention provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0016] A fourth aspect of the present invention also provides a computer-readable storage medium having a computer program or instructions stored thereon, wherein the computer program or instructions, when executed by a processor, implement the steps of the above-described method.

[0017] A fifth aspect of the present invention also provides a computer program product, including a computer program or instructions, which, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0018] The above-described features, other objects, and advantages of the present invention will become clearer from the following description of embodiments of the invention with reference to the accompanying drawings, in which:

[0019] Figure 1 The illustration shows an application scenario of the abnormal transaction detection method, apparatus, device, medium, and program product according to embodiments of the present invention;

[0020] Figure 2 A flowchart illustrating an abnormal transaction detection method according to an embodiment of the present invention is shown schematically.

[0021] Figure 3 This illustration schematically shows a flowchart of an abnormal transaction detection model according to an embodiment of the present invention;

[0022] Figure 4 This diagram illustrates the detection architecture of an abnormal transaction detection model according to another embodiment of the present invention.

[0023] Figure 5 This diagram illustrates the computational principle of the cross-attention module in an abnormal transaction detection model according to another embodiment of the present invention.

[0024] Figure 6 The flowchart illustrating a method for training an abnormal transaction detection model according to an embodiment of the present invention is shown in the illustration.

[0025] Figure 7 A block diagram of an abnormal transaction detection device according to an embodiment of the present invention is schematically shown; and

[0026] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing the abnormal transaction detection method according to an embodiment of the present invention. Detailed Implementation

[0027] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the invention. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the invention for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0028] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0029] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0030] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0031] In the technical solution of this invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0032] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this invention offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0033] The methods used to commit abnormal transactions are becoming increasingly diverse and covert. Simple business rule judgments are no longer sufficient for protection. With the development of artificial intelligence technology, using machine learning models to identify abnormal transactions has greatly improved robustness compared to manual rules, but it still relies heavily on feature selection, and the quality of feature engineering directly affects the model's performance. Currently, most solutions for identifying abnormal transactions using machine learning models are based on feature extraction and modeling of the transaction itself. This prioritizes selectable features and makes it easy for the initiator of the abnormal transaction to extract the features used by the model, thus making it easy for them to crack the model and resulting in a relatively high false negative rate.

[0034] The inventors discovered that the behavioral patterns of the two main entities in abnormal transactions—the initiator and the affected party—differ significantly within the relationship network. The affected party's account often engages in short-term, high-frequency transactions with the initiator's account, while the initiator's account exhibits abnormal characteristics such as dispersed fund transfers and frequent changes in associated devices. Therefore, the inventors considered that utilizing the behavioral patterns of the affected and initiators within the relationship network to extract features could effectively improve the quality of feature engineering. In particular, it would increase the difficulty for the initiator of abnormal transactions to extract accurate features for the model, as they typically lack access to information about the entire relationship network.

[0035] Furthermore, the inventors considered that when extracting features using the behavioral patterns of the affected parties and initiators of abnormal transactions in a relationship network, if feature extraction is performed from any relationship network that does not distinguish between the affected parties and initiators of abnormal transactions, the relationship network may contain information about both the affected parties and initiators of abnormal transactions simultaneously, and may also have other complex characteristics. This may lead to the dilution of features related to abnormal transaction detection, and it may be difficult to clearly highlight the abnormal transaction-related features of the affected parties and initiators, thus reducing the targeting effectiveness. In view of this, the inventors considered learning the features of these two types of subjects separately from the subgraphs containing the affected party and the initiator of the abnormal transaction. These subgraphs, depending on their construction method, can only include either the party affected by the abnormal transaction or the party that initiated it. For example, a subgraph can be constructed from users historically proven to have initiated abnormal transactions and their similar users, and another subgraph can be constructed from users historically proven to have been affected by abnormal transactions and their similar users. By extracting features from the heterogeneous subgraphs of the affected party and the initiator of the abnormal transaction for the payee and payer respectively, the accuracy of the features of both parties required for modeling can be improved. Combined with the characteristics of the transaction itself, the accuracy of abnormal transaction identification can be enhanced.

[0036] Therefore, this invention provides an abnormal transaction detection method. With authorization from both parties to the transaction to use their transaction data, when it is found that the payee of a transaction belongs to a first subgraph constructed by the user who initiated the abnormal transaction and their similar users, and the payer belongs to a second subgraph constructed by the user affected by the abnormal transaction and their similar users, abnormal transaction detection can be performed based on the features of the first and second subgraphs and the transaction itself. In this detection process, some of the detected features are extracted from the first and second subgraphs, making them difficult for external parties (such as the initiator of the abnormal transaction) to accurately extract, thus making it difficult for the initiator of the abnormal transaction to crack the model. Furthermore, by utilizing the features of users related to the payee in the first subgraph, the characteristics of the payee related to the implementation of the abnormal transaction can be enriched; similarly, by utilizing the features of users related to the payer in the second subgraph, the characteristics of the payer related to being affected by the abnormal transaction can be enriched, thereby improving the accuracy of abnormal transaction detection.

[0037] Figure 1 The illustration shows an application scenario of the abnormal transaction detection method, apparatus, device, medium, and program product according to embodiments of the present invention.

[0038] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0039] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, mobile banking applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0040] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0041] Server 105 can be a server that provides various services, such as a backend management server that processes transaction requests initiated by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process the received user requests and other data, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0042] It should be noted that the abnormal transaction detection method provided in this embodiment of the invention can generally be executed by server 105. Correspondingly, the abnormal transaction detection device provided in this embodiment of the invention can generally be located in server 105. The abnormal transaction detection method provided in this embodiment of the invention can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the abnormal transaction detection device provided in this embodiment of the invention can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0043] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0044] The following will be based on Figure 1 The described scene, through Figures 2-6 The abnormal transaction detection method according to embodiments of the present invention will be described in detail.

[0045] Figure 2 A flowchart illustrating an abnormal transaction detection method according to an embodiment of the present invention is shown.

[0046] like Figure 2 As shown, the abnormal transaction detection method according to this embodiment may include operations S210 to S230.

[0047] In operation S210, with the authorization of the payee and payer of the first transaction obtained, information about the payee, payer and transaction characteristics of the first transaction is extracted.

[0048] Information about the payee, such as the payee's account name or customer number. Information about the payer, such as the payer's account name and customer number. Transaction characteristics include, but are not limited to: transaction time, transaction amount, and payment method.

[0049] Then, in operation S220, when the recipient of the first transaction belongs to a user in the first subgraph and the payer of the first transaction belongs to a user in the second subgraph, the first subgraph and the second subgraph are obtained. The first subgraph consists of a first type of user who has been confirmed to have initiated an abnormal transaction and a first type of potential user who meets the first similarity condition with the first type of user. The second subgraph consists of a second type of user who has been confirmed to be affected by the abnormal transaction and a second type of potential user who meets the second similarity condition with the second type of user.

[0050] The first and second subgraphs are constructed based on the data of authorized users, with user authorization obtained. Specifically, user authorization to use their relevant data is obtained, and with user authorization, relevant graph data is constructed based on the authorized user's data. For example, based on historical risk monitoring data from the banking system, data of a first type of users confirmed to have initiated abnormal transactions and a second type of users confirmed to have been affected by abnormal transactions are filtered out; first type of potential users who meet the first similarity condition with the first type of users are filtered out, and second type of potential users who meet the second similarity condition with the second type of users are filtered out; the first subgraph is constructed based on the data of the first type of users and the first type of potential users in the banking system; and the second subgraph is constructed based on the data of the second type of users and the second type of potential users in the banking system.

[0051] Users who are confirmed as initiating abnormal transactions can include, but are not limited to, the following: users who have been identified as initiating abnormal transactions by authoritative security agencies, or users who have been reported by other users as initiating abnormal transactions and whose cases have been verified.

[0052] The second category of users who are confirmed to be affected by abnormal transactions include, but are not limited to, the following users: users who have uploaded their experience of being affected by abnormal transactions and have been confirmed by a trusted security institution, or users who have been automatically detected by the risk control system as being involved in abnormal transactions and have been verified.

[0053] The first and second similarity conditions can be the same or different. The first and / or second similarity conditions can be based on user behavior (such as social or transactional behavior) or attributes (such as age, occupation, or region). These conditions may include, but are not limited to: two users sharing one or more common features, or each user being described using a feature vector where the similarity (such as distance or cosine similarity) between the feature vectors of two users is greater than a certain similarity threshold.

[0054] For example, the initiators of abnormal transactions usually have abnormal characteristics such as decentralized fund transfers and frequent changes of associated devices. Therefore, the first similarity condition can be set based on media characteristics such as device fingerprints and IP addresses. For example, extract information such as device fingerprints or IP addresses, change information or frequency, etc., construct user characteristics, and then calculate the similarity between user characteristics. Users who meet the first similarity threshold are regarded as the first type of potential users.

[0055] For example, the target audience of those initiating abnormal transactions is often users with similar lifestyle habits. Based on this, the second similarity condition can be set according to social relationships, age range, occupation, shopping behavior data, etc. For instance, user characteristics can be constructed based on social relationships, age range, occupation, or shopping behavior data, and then the similarity between these user characteristics can be calculated. Users who meet the second similarity threshold are considered as the second category of potential users.

[0056] Existing subgraph assets can be constructed or utilized. For example, banks can build various graph structures based on data from historical risk control efforts, such as user profiles and user behavior. For instance, for abnormal transaction initiators exhibiting anomalous characteristics like decentralized fund transfers and frequent changes in associated devices, edges can be constructed using device fingerprints, IP addresses, and fund flows to form an abnormal transaction initiator subgraph (i.e., the first subgraph). Similarly, for users affected by abnormal transactions, edges can be constructed using similarities in characteristics such as age, income, and occupation, as well as social relationships and fund flows to form a vulnerable population subgraph (i.e., the second subgraph).

[0057] When constructing a subgraph, users involved in historically known abnormal transactions can be categorized into two types: Type 1 users and Type 2 users. Then, based on Type 1 users, potential users of Type 1 are collected according to the first similarity condition, and the first subgraph is constructed. Similarly, based on Type 2 users, potential users of Type 2 are collected according to the second similarity condition, and the second subgraph is constructed. The graph construction methods are diverse, and it can be a heterogeneous graph. For example, a graph may have two types of nodes: user nodes and device nodes. Edges can be constructed between users and their logged-in devices, between users based on fund flow, and between devices based on certain factors (such as installing the same Trojan software to form an abnormal transaction initiator subgraph).

[0058] When utilizing existing subgraph assets, in some cases, these subgraph assets might have been constructed after a department handled an event involving a particular abnormal transaction or a type of abnormal transaction. Based on this abnormal transaction event, corresponding first and second subgraphs were built and stored in the database. Sometimes, each abnormal transaction event or each new abnormal transaction method can identify a group of abnormal transaction initiators and a group of vulnerable individuals. These data can then be used to construct first and second subgraphs. Over time, this can result in more than one first and second subgraph. The construction time of these subgraphs may differ, or the events causing them may differ, and there may be overlap in the users. In this case, when the recipient of the first transaction belongs to one or more first subgraphs, and the payer of the first transaction belongs to one or more second subgraphs, operation S220 can filter out first and second subgraphs where users have transaction relationships. If there are no transaction relationships between users in a first subgraph and a second subgraph, it indicates that the users (affected parties) in the second subgraph are likely not the target group of the users (abnormal transaction initiators) in the first subgraph. Therefore, only the first and second subgraphs with transaction relationships are selected for further analysis to improve the focus of the analysis.

[0059] In some embodiments, if multiple sets of first subgraphs and second subgraphs are filtered out based on whether there is a transaction relationship between users, the estimated probability of an abnormal transaction occurring between users in the second subgraph and users in the first subgraph in each set can be evaluated, and then at least one set of first subgraphs and second subgraphs can be filtered out based on the estimated probability.

[0060] For example, the estimated probability can be obtained based on the proportion (or number) of abnormal transactions in the historical transactions between users in the second subgraph and users in the first subgraph of each group. Alternatively, it can be obtained based on the proportion or number of users in the second subgraph who have historically encountered abnormal transactions initiated by users in the first subgraph. Then, select a group of first and second subgraphs with an estimated probability greater than a probability threshold (e.g., 20%), or sort multiple groups of first and second subgraphs by estimated probability and select the top N (e.g., the group with the highest estimated probability).

[0061] The advantage of selecting the first and second subgraphs based on estimated probabilities is that these two subgraphs represent areas where the payee and payer are most likely to experience abnormal transactions. This allows for richer and more significant extraction of features related to abnormal transactions from these two subgraphs, leading to more accurate identification through subsequent model detection. Furthermore, it avoids processing irrelevant graph data, reducing wasted computational resources.

[0062] Next, in operation S230, the transaction features of the first subgraph, the second subgraph, and the first transaction are used as inputs to the trained abnormal transaction detection model, and the abnormal transaction detection model is used to detect whether the first transaction is an abnormal transaction or a normal transaction.

[0063] In this embodiment of the invention, for the first subgraph and the second subgraph, a portion of abnormal transactions can be clearly identified based on historical customer complaints and verified abnormal transactions or external data. When a certain number / proportion of abnormal transactions occur between the two known subgraphs, the two subgraphs are fused to predict the probability that each transaction between the two groups of people on the graph is also an abnormal transaction.

[0064] For example, if Graph A represents the subgraph of those affected by abnormal transactions (i.e., the second subgraph), and Graph B represents the subgraph of those initiating abnormal transactions (i.e., the first subgraph), when a large number of users in Graph A transferring money to users in Graph B are clearly identified as abnormal transactions, according to an embodiment of the present invention, other transactions between these two graphs that are not clearly defined can be classified and detected. After all, in reality, only a portion of the users affected by abnormal transactions may file complaints, and the absence of customer complaints for other transactions does not necessarily mean that the transaction is safe. This is because a group that initiates abnormal transactions may continuously initiate abnormal transactions against a specific target group. According to the solution of the embodiment of the present invention, when abnormal transactions occur between users in two subgraphs, other undefined transactions between users in the subgraphs can be detected. This allows for a more comprehensive investigation of potential abnormal transactions, effectively protecting the legitimate interests of users, and establishing a more comprehensive prevention and control system for those initiating abnormal transactions.

[0065] Alternatively, when it is discovered that a group of users in the first subgraph initiates an abnormal transaction to a group of users in the second subgraph, the method according to the embodiments of the present invention can be used to classify and detect the new transaction when a new transaction occurs between users in these two graphs, so as to predict the possibility that the new transaction is an abnormal transaction in a timely manner.

[0066] According to an embodiment of the present invention, the abnormal transaction detection model can learn and process historical abnormal transactions between the first subgraph where the payee is located and the second subgraph where the payer is located, and then combine the characteristics of the current transaction to predict and control the current transaction.

[0067] Figure 3 The diagram illustrates the detection flowchart of an abnormal transaction detection model according to an embodiment of the present invention.

[0068] like Figure 3As shown, according to this embodiment, operation S230 may include operations S231 to S233. The abnormal transaction detection model includes the first self-attention module, the second self-attention module, and the classification module.

[0069] In operation S231, the first subgraph is processed using the first self-attention module to extract features of the payee.

[0070] In operation S232, the second self-attention module is used to process the second subgraph to extract the features of the payer.

[0071] In operation S233, the classification module classifies the first transaction based on the characteristics of the payee, the characteristics of the payer, and the transaction characteristics of the first transaction, in order to detect whether the first transaction is an abnormal transaction or a normal transaction.

[0072] According to embodiments of the present invention, the abnormal transaction detection model can process the first and second subgraphs to extract features of the payee and payer, and combine these features to predict the transaction type. Thus, the features of the payee and payer not only come from their individual information, but can also be enhanced by features of similar users and relationships between related users, thereby improving the accuracy of abnormal transaction detection and reducing the probability of missed detections.

[0073] In some embodiments, the abnormal transaction detection model can process the first subgraph and the second subgraph to extract features of the payee and the payer. It can also fuse the features of the payee and the payer to strengthen the features related to abnormal transactions among the extracted features and improve the significance of the features related to abnormal transactions.

[0074] Figure 4 The diagram illustrates the detection architecture of an abnormal transaction detection model according to another embodiment of the present invention.

[0075] like Figure 4 As shown, the abnormal transaction detection model according to this embodiment may include a first self-attention module, a second self-attention module, a cross-attention module, and a multilayer perceptron used as a classifier.

[0076] In this embodiment, the first self-attention module and the second self-attention module independently process the first subgraph and the second subgraph, respectively, to output the features of the payee and the payer. Then, in this embodiment, the features of the payer and the payee are fused using a cross-attention module to obtain fused features. Finally, a multilayer perceptron is used to process the fused features and the transaction features of the first transaction, and the classification result of the first transaction is output.

[0077] This embodiment designs a relational data fusion algorithm with a cross-attention mechanism at its core. First, subgraph feature extraction is performed. Firstly, a self-attention module based on a graph attention network is applied to both the first and second subgraphs to generate node embedding representations. The graph attention network dynamically allocates the influence weights of neighboring nodes on the current node by calculating the attention coefficients between nodes. Next, cross-subgraph attention fusion is performed through the cross-attention module to align features and map the node embeddings of the two subgraphs to the same vector space; through cross-attention calculation, the correlation features between the first and second subgraphs are captured. For example, the abnormal transfer behavior of an account affected by an abnormal transaction may be highly correlated with the fund collection pattern of its associated initiating account. Finally, weight optimization: the attention scores are used to dynamically adjust the weights of key nodes and edges in both subgraphs to enhance the salience of abnormal transaction behavior patterns.

[0078] Combination Figure 4 and Figure 5 The calculation principle of the abnormal transaction detection model is explained in detail below.

[0079] Based on the flow of funds, the following symbolic language can be defined:

[0080] The graph structure of the second subgraph is represented as follows:

[0081]

[0082] in, Represents the set of payer nodes;

[0083] Represents the set of payment side edges;

[0084] This represents the node feature matrix in the second subgraph;

[0085] This indicates the number of nodes in the second subgraph;

[0086] Represents the feature dimension of each node;

[0087] Let represent the edge feature matrix in the second subgraph, where Represents the dimension of edge features.

[0088] The graph structure of the first subgraph is represented as follows:

[0089]

[0090] The expressions for each parameter are as follows Similar to that in China, among which This indicates the number of nodes in the first subgraph.

[0091] The transaction type label vector is represented as follows:

[0092]

[0093] in, This indicates the number of transactions (i.e., the number of transactions that occurred between the first and second subgraphs), with 0 representing normal transactions and 1 representing risky transactions.

[0094] Combined Figure 5 Symbols related to cross-attention mechanisms include: These are the query, key, and value matrices in the attention mechanism, respectively. Q, K, and V are three vectors obtained by transforming the input features using the three weight matrices. The weight matrices are adjusted by the model itself during training based on the loss function, and are adjusted with each training iteration, as specified by the transformer framework.

[0095] Used for calculation The learnable weight matrix;

[0096] : Output weight matrix of the multi-head attention mechanism;

[0097] The weights and biases of the first layer of a feedforward neural network;

[0098] The weights and biases of the second layer of the feedforward neural network;

[0099] The set of all learnable parameters of the model;

[0100] Multilayer perceptron;

[0101] The weight matrix of the last layer in a multilayer perceptron;

[0102] The bias vector of the last layer in a multilayer perceptron;

[0103] The probability that the model predicts a transaction to be a risky transaction.

[0104] Cross-entropy loss function;

[0105] Learning rate.

[0106] Figure 4 The core design of the abnormal transaction detection model framework lies in utilizing the self-attention and cross-attention mechanisms of graph structures to fuse relational data, thereby fully exploring the potential connections between the first and second subgraphs. Simultaneously, by combining node and edge features, the accuracy of transaction risk prediction is improved. The algorithm mainly consists of the following modules: first, a second self-attention module, used to learn the relationships between nodes and edge features of the second subgraph; second, a first self-attention module, used to learn the relationships between nodes and edge features of the first subgraph; third, a cross-subgraph attention module, used to fuse the features of the first and second subgraphs and explore the connections between them; and fourth, a multilayer perceptron classifier, used to predict the transaction type based on the fused features and transaction features.

[0107] Figure 4 The algorithm inference and prediction process of the abnormal transaction detection model shown is as follows:

[0108] (1) Implement self-attention encoding of the first and second subgraphs using self-attention modules: For the second subgraph and the first subgraph The inputs are fed into two independent self-attention modules. Each self-attention module can capture the complex relationships between nodes and their neighbors (including edge features).

[0109] This combination Figure 5 The processing procedure of the second self-attention module is illustrated as follows:

[0110] For the node features of the second subgraph They are mapped to respectively through linear transformation. Space, obtained: ;in It is a learnable weight matrix.

[0111] For the payment side features of the second subgraph They are mapped to respectively through linear transformation. space: ,in It is a learnable weight matrix.

[0112] The attention score between nodes is determined by both node features and edge features, and is calculated as follows:

[0113]

[0114] in, is the symbol for the transpose of a matrix.

[0115] Next, multi-head attention computation is performed. To capture information from different subspaces, a multi-head attention mechanism is adopted, dividing the features into multiple encoding paths, calculating attention scores for each path, and then concatenating them:

[0116]

[0117] in This represents the output weight matrix. After calculating the multi-head attention, it passes through two more feedforward neural network layers:

[0118] ;

[0119] in These are learnable parameters.

[0120] After passing through the self-attention module above, the encoded user characteristics of the payer are obtained. .

[0121] The process by which the first self-attention module processes the node and edge features of the first subgraph is similar to that of the second self-attention module, resulting in the encoded user features of the payee. .

[0122] (2) Implement cross-subgraph cross-attention fusion using the cross-attention module:

[0123] Next, and The input is fed into the cross-attention module to learn the association between the payer and payee user characteristics. The calculation of cross-attention is similar to that of the self-attention module, but the query comes from one modality, while the key and value come from another modality.

[0124]

[0125]

[0126] Similarly, cross-attention can also employ a multi-head mechanism, and after attention, it also needs to pass through a feedforward neural network layer, layer normalization, and residual connections. The final result is the fused feature representation. .

[0127] (3) Classification using multilayer perceptron: merging the features and extracted transaction features The input is fed into a multilayer perceptron (MLP) classifier to predict the transaction type. The structure of the MLP can be adjusted according to the specific requirements; for example, it can contain multiple fully connected layers and a single layer based on... Normalization layer:

[0128]

[0129] Among them, the output This indicates the probability that the model predicts a risky transaction.

[0130] (4) Loss function calculation and gradient backpropagation: The model is trained using the following cross-entropy loss function:

[0131]

[0132] in, It is the true label of the i-th transaction type. This is the probability that the model predicts for this transaction type. The loss function is calculated with respect to the model parameters. gradient And update the parameters using an optimizer based on the stochastic gradient descent algorithm:

[0133]

[0134] in, This refers to the learning rate. This model employs a cosine annealing strategy to adjust the learning rate, maintaining a high learning rate in the early stages of training to accelerate convergence, and gradually reducing the learning rate in the later stages of training to improve the model's generalization ability.

[0135] This invention can utilize heterogeneous subgraphs (a first subgraph and a second subgraph) of the transacting parties and introduce a cross-attention mechanism to achieve dynamic information fusion between subgraphs. By combining this with a graph attention network to optimize the weights of key features and relational edges, abnormal transactions can be accurately identified. By leveraging existing subgraphs of the transacting parties and designing a cross-attention mechanism for cross-subgraph feature fusion, the invention can accurately identify the implementation of covert abnormal transactions while reducing the false positive rate.

[0136] This invention can identify abnormal transactions based on a cross-attention mechanism. Compared to traditional schemes that rely solely on single-sided account features or homogeneous graph networks, this invention integrates heterogeneous subgraph information of the affected party and the initiator of the abnormal transaction. By dynamically allocating the weights of key features across subgraphs through the cross-attention mechanism, it can accurately identify the abnormal behavior of the initiator account masquerading as a normal transaction. Simultaneously, by combining graph attention networks (GAT) to deeply mine the topological relationships between the two parties in the transaction, it can significantly improve the detection efficiency of complex abnormal transaction behavior patterns. Moreover, risk assessment based on the transaction dimension can effectively reduce the false positive rate while intercepting high-risk transactions in real time. Furthermore, the model is highly robust to the dynamic masquerading behavior of the initiator account of the abnormal transaction and can adapt to various abnormal transaction adversarial scenarios.

[0137] According to an embodiment of the present invention, for the first subgraph and the second subgraph, a portion of abnormal transactions can be clearly identified based on historical customer complaints and verified abnormal transactions or external data. When a certain number / proportion of abnormal transactions occur between the two known subgraphs, the two subgraphs are fused to predict the probability that each transaction between the two groups of people on the graph is also an abnormal transaction.

[0138] Figure 6 The flowchart illustrating a method for training an abnormal transaction detection model according to an embodiment of the present invention is shown.

[0139] like Figure 6 The training method for the abnormal transaction detection model according to this embodiment includes operations S601 to S603.

[0140] In operation S601, at least one first subgraph and at least one second subgraph are acquired.

[0141] In operation S602, historical transaction data between users in at least one first subgraph and at least one second subgraph is obtained. The historical transaction data includes transaction tags, which are used to characterize whether a transaction is a normal transaction or an abnormal transaction.

[0142] In operation S603, training data is constructed using at least one first subgraph, at least one second subgraph, and the historical transaction data to train the abnormal transaction detection model.

[0143] by Figure 4 Taking the abnormal transaction detection model shown as an example, in one embodiment, the training process of the model may include the following steps.

[0144] (1) Data Preparation: Obtain the first subgraph, the second subgraph, and the historical transaction type label y. Specifically, transactions between the two subgraphs are labeled: abnormal transactions are labeled 1, and normal transactions are labeled 0. Additionally, users are also labeled; any user who has participated in an abnormal transaction is labeled 1, thus identifying the initiator or the affected party of a historical abnormal transaction. If a user is the initiator of an abnormal transaction in one transaction but not in another, they should still be labeled 1.

[0145] (2) Model initialization: Initialize the parameters of the self-attention module, cross-attention module and multilayer perceptron classifier.

[0146] The first self-attention module's task is to determine whether each payee is the initiator of an abnormal transaction; the second self-attention module's task is to determine whether each payer is the party affected by the abnormal transaction; and the cross-attention module's task is to determine whether the situation is one where "the payee is the initiator of the abnormal transaction and the payer is their target group".

[0147] Before entering the multilayer perceptron, the output of the cross-attention module is further concatenated with the transaction characteristics of the transaction to be predicted, such as time and amount. After learning, the probability of whether the transaction is an abnormal transaction is output.

[0148] (3) Iterative training: The overall model iterates on the training set for multiple rounds (e.g., 50 rounds). First, it predicts the type probability of each transaction by calculating the probability of the transaction. ; Calculate the cross-entropy loss L based on the predicted value and the true type of the transaction y; then calculate the gradient of the loss function with respect to the model parameters, update the model parameters using a stochastic gradient descent optimizer, and adjust the learning rate according to the cosine annealing strategy during training until the specified number of iterations is reached and then stop.

[0149] (4) Model evaluation:

[0150] First, a 5-fold cross-validation method is used: the dataset is divided into 5 parts, and each time one part is selected as the validation set, while the remaining 4 parts are used as the training set. This is repeated 5 times, with a different subset selected as the validation set each time.

[0151] Secondly, evaluation metrics were set: On the test set, accuracy, recall, and F1-Score were used to comprehensively evaluate the model's predictive ability. Each metric was defined as follows: Accuracy: measures the proportion of samples correctly predicted by the model; Recall: measures the proportion of risky transactions correctly identified by the model; F1-Score: the harmonic mean of accuracy and recall, taking both into account. Precision was defined as TP / (TP+FP), where TP (True Positive) represents true positives, TN (True Negative) represents true negatives, FP (False Positive) represents false positives, and FN (False Negative) represents false negatives. These evaluation methods provide a comprehensive understanding of the model's performance in the abnormal transaction detection task and offer a basis for further model optimization.

[0152] Based on the abnormal transaction detection methods of the above embodiments, the present invention also provides an abnormal transaction detection device. The following will be combined with... Figure 7 The device is described in detail.

[0153] Figure 7 A block diagram of an abnormal transaction detection device 700 according to an embodiment of the present invention is shown schematically.

[0154] like Figure 7As shown, the abnormal transaction detection device 700 includes an information extraction module 710, a subgraph acquisition module 720, and a transaction detection module 730. The abnormal transaction detection device 700 can perform reference... Figures 2-6 The methods described.

[0155] The information extraction module 710 is used to extract information about the payee, payer, and transaction characteristics of the first transaction, provided that authorization has been obtained from the payee and payer of the first transaction. In one embodiment, the information extraction module 710 can perform the operation S210 described above.

[0156] The subgraph acquisition module 720 is used to acquire the first subgraph and the second subgraph when the payee of the first transaction belongs to a user in the first subgraph and the payer of the first transaction belongs to a user in the second subgraph. The first subgraph consists of a first type of user confirmed to have initiated an abnormal transaction and a first type of potential user who meets a first similarity condition with the first type of user. The second subgraph consists of a second type of user confirmed to be affected by an abnormal transaction and a second type of potential user who meets a second similarity condition with the second type of user. In one embodiment, the subgraph acquisition module 720 can perform the operation S220 described above.

[0157] The transaction detection module 730 is used to take the transaction features of the first subgraph, the second subgraph, and the first transaction as input to a trained abnormal transaction detection model, and use the abnormal transaction detection model to detect whether the first transaction is an abnormal transaction or a normal transaction. In one embodiment, the transaction detection module 730 can perform the operation S230 described above. In one embodiment, the abnormal transaction detection model can be as follows: Figure 4 As shown.

[0158] According to some embodiments of the present invention, the abnormal transaction detection device 700 may further include a training module. The training module is configured to: acquire at least one first subgraph and at least one second subgraph; acquire historical transaction data between users in at least one first subgraph and at least one second subgraph, the historical transaction data including transaction tags, which are used to characterize whether a transaction is normal or abnormal; and construct training data using at least one first subgraph, at least one second subgraph, and the historical transaction data to train the abnormal transaction detection model. In one embodiment, the training module may perform operations S601 to S603 as described above.

[0159] According to embodiments of the present invention, any plurality of modules among the information extraction module 710, subgraph acquisition module 720, transaction detection module 730, and training module can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of the present invention, at least one of the information extraction module 710, subgraph acquisition module 720, transaction detection module 730, and training module can be at least partially implemented as hardware circuitry, such as field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits (ASICs), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the information extraction module 710, subgraph acquisition module 720, transaction detection module 730, and training module can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0160] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing the abnormal transaction detection method according to an embodiment of the present invention.

[0161] like Figure 8 As shown, an electronic device 900 according to an embodiment of the present invention includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0162] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 executes various operations of the method flow according to embodiments of the present invention by executing programs in ROM 902 and / or RAM 903. It should be noted that the programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also execute various operations of the method flow according to embodiments of the present invention by executing programs stored in said one or more memories.

[0163] According to an embodiment of the present invention, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the input / output (I / O) interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0164] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present invention.

[0165] According to embodiments of the present invention, a computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of the present invention, a computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0166] Embodiments of the present invention also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the abnormal transaction detection method provided in the embodiments of the present invention.

[0167] When the computer program is executed by the processor 901, it performs the functions defined in the system / apparatus of this invention. According to embodiments of the invention, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0168] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0169] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it performs the functions defined in the system of this embodiment of the invention. According to embodiments of the invention, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0170] According to embodiments of the present invention, program code for executing the computer programs provided in the embodiments of the present invention can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0171] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0172] Those skilled in the art will understand that the features described in the various embodiments of the present invention can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in the present invention. In particular, the features described in the various embodiments of the present invention can be combined and / or combined in various ways without departing from the spirit and teachings of the present invention. All such combinations and / or combinations fall within the scope of the present invention.

Claims

1. An abnormal transaction detection method, wherein, The method includes: With the authorization of the payee and payer of the first transaction, extract information about the payee, payer, and transaction characteristics of the first transaction; When the recipient of the first transaction belongs to a user in the first subgraph and the payer of the first transaction belongs to a user in the second subgraph, the first subgraph and the second subgraph are obtained. The first subgraph consists of a first type of user who has been confirmed to have initiated the abnormal transaction and a first type of potential user who meets the first similarity condition with the first type of user. The second subgraph consists of a second type of user who has been confirmed to be affected by the abnormal transaction and a second type of potential user who meets the second similarity condition with the second type of user. Using the transaction features of the first subgraph, the second subgraph, and the first transaction as input to a trained abnormal transaction detection model, the abnormal transaction detection model is used to detect whether the first transaction is an abnormal transaction or a normal transaction.

2. The method according to claim 1, wherein, The step of using the abnormal transaction detection model to detect whether the first transaction is abnormal or normal includes: The first subgraph is processed using a first self-attention module to extract features of the payee; The second subgraph is processed using a second self-attention module to extract features of the payer; The classification module uses the characteristics of the payee, the characteristics of the payer, and the transaction characteristics of the first transaction to classify the first transaction in order to detect whether the first transaction is an abnormal transaction or a normal transaction. The abnormal transaction detection model includes a first self-attention module, a second self-attention module, and a classification module.

3. The method according to claim 2, wherein, The classification module classifies the first transaction based on the characteristics of the payee, the characteristics of the payer, and the transaction characteristics of the first transaction, including: The features of the payer and the payee are fused using a cross-attention module to obtain fused features; The classifier is used to process the fused features and the transaction features of the first transaction, and the classification result of the first transaction is output. The classification module includes the cross-attention module and the classifier.

4. The method according to claim 1, wherein, The step of obtaining the first subgraph and the second subgraph includes: When the recipient of the first transaction belongs to one or more first subgraphs, and the payer of the first transaction belongs to one or more second subgraphs, the first and second subgraphs with transaction relationships between users are filtered out.

5. The method according to claim 4, wherein, The first and second subgraphs that identify transactional relationships between users include: When multiple groups of first and second subgraphs with transaction relationships are selected, the estimated probability of abnormal transactions occurring between users in the second and first subgraphs of each group is evaluated. Based on the estimated probabilities, at least one set of first subgraphs and second subgraphs are selected.

6. The method according to claim 1, wherein, The method further includes: Obtain user authorization to use their data; Upon obtaining user authorization, the first subgraph and the second subgraph are constructed based on the authorized user's relevant data, including: Based on historical risk monitoring data, data of the first category of users confirmed to have initiated abnormal transactions and the second category of users confirmed to have been affected by abnormal transactions were filtered out; Filter out a first type of potential users who meet the first similarity condition to the first type of users, and filter out a second type of potential users who meet the second similarity condition to the second type of users; Based on the data of the first type of users and the first type of potential users in the banking system, the first subgraph is constructed; and The second subgraph is constructed based on the data of the second type of users and the second type of potential users in the banking system.

7. The method according to claim 1 or 6, wherein, The training process of the abnormal transaction detection model includes: Obtain at least one first subgraph and at least one second subgraph; Acquire historical transaction data between users in at least one first subgraph and at least one second subgraph, wherein the historical transaction data includes transaction tags, which are used to characterize whether a transaction is a normal transaction or an abnormal transaction; The abnormal transaction detection model is trained by constructing training data using at least one first subgraph, at least one second subgraph, and the historical transaction data.

8. An abnormal transaction detection device, wherein, The device includes: The information extraction module is used to extract information about the payee, payer, and transaction characteristics of the first transaction, provided that the authorization of the payee and payer of the first transaction has been obtained. The subgraph acquisition module is used to acquire the first subgraph and the second subgraph when the payee of the first transaction belongs to a user in the first subgraph and the payer of the first transaction belongs to a user in the second subgraph. The first subgraph is composed of a first type of user who has been confirmed to have initiated an abnormal transaction and a first type of potential user who meets the first type of user's first similarity condition. The second subgraph is composed of a second type of user who has been confirmed to be affected by the abnormal transaction and a second type of potential user who meets the second type of user's second similarity condition. The transaction detection module is used to take the transaction features of the first subgraph, the second subgraph, and the first transaction as input to a trained abnormal transaction detection model, and use the abnormal transaction detection model to detect whether the first transaction is an abnormal transaction or a normal transaction.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, wherein, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product comprising a computer program or instructions, wherein, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images