Abnormal transaction identification method and device, storage medium and electronic equipment

Abstract

This application discloses a method, apparatus, storage medium, and electronic device for identifying abnormal transactions. Relating to the field of financial technology, the method includes: acquiring semantic feature vectors and temporal feature vectors associated with the transaction to be identified, and fusing the semantic feature vectors and temporal feature vectors to obtain a fused feature vector; using a reconstruction model to reconstruct the fused feature vector to obtain a reconstructed fused feature vector, wherein the reconstruction model is trained on a variational autoencoder based on a sample dataset; calculating the reconstruction error between the fused feature vector and the reconstructed fused feature vector, and determining the target identification result corresponding to the transaction to be identified based on the reconstruction error, wherein the target identification result is used to characterize whether the transaction to be identified is abnormal. This application solves the problem of low accuracy in related technologies that rely on manually preset rule thresholds for identifying abnormal transactions.

Description

Technical Field

[0001] This application relates to the field of financial technology, and more specifically, to a method and apparatus for identifying abnormal transactions, a storage medium, and an electronic device. Background Technology

[0002] Currently, financial institutions mainly rely on manually preset rule thresholds (such as a set multiple of the historical average for transaction volume) to identify abnormal transactions (such as abnormal transaction operations using undisclosed information). This method is prone to missed reports and false reports, resulting in low accuracy.

[0003] The current technology relies on manually preset rule thresholds for identifying abnormal transactions, which suffers from low accuracy, and no effective solution has yet been proposed. Summary of the Invention

[0004] The main objective of this application is to provide a method, apparatus, storage medium, and electronic device for identifying abnormal transactions, in order to solve the problem that the identification accuracy is low when relying on manually preset rule thresholds for abnormal transaction identification in related technologies.

[0005] To achieve the above objectives, according to one aspect of this application, a method for identifying abnormal transactions is provided. The method includes: acquiring semantic feature vectors and temporal feature vectors associated with the transaction to be identified, and fusing the semantic feature vectors and temporal feature vectors to obtain a fused feature vector; using a reconstruction model to reconstruct the fused feature vector to obtain a reconstructed fused feature vector, wherein the reconstruction model is trained on a variational autoencoder based on a sample dataset; calculating the reconstruction error between the fused feature vector and the reconstructed fused feature vector, and determining the target identification result corresponding to the transaction to be identified based on the reconstruction error, wherein the target identification result is used to characterize whether the transaction to be identified is abnormal.

[0006] Furthermore, the semantic feature vector and the temporal feature vector are fused to obtain the fused feature vector by: mapping the semantic feature vector and the temporal feature vector to the first feature space through linear projection respectively, to obtain the mapped semantic feature vector and the mapped temporal feature vector; calculating the target matrix based on the mapped semantic feature vector and the mapped temporal feature vector; and weighting and fusing the mapped temporal feature vector based on the target matrix to obtain the fused feature vector.

[0007] Furthermore, the fusion feature vector is reconstructed using a reconstruction model. The reconstructed fusion feature vector is obtained by: processing the fusion feature vector through the encoder module of the reconstruction model to obtain the latent distribution parameters in the latent space; and processing the latent variables sampled from the latent distribution defined by the latent distribution parameters through the decoder module of the reconstruction model to obtain the reconstructed fusion feature vector.

[0008] Furthermore, based on the reconstruction error, the target identification result corresponding to the transaction to be identified is determined as follows: the reconstruction error is processed by the target activation function to obtain the abnormal risk score corresponding to the transaction to be identified; if the abnormal risk score is greater than the preset risk threshold, the transaction to be identified is considered to have an anomaly as the target identification result; if the abnormal risk score is less than or equal to the preset risk threshold, the transaction to be identified is considered to have no anomaly as the target identification result.

[0009] Furthermore, before obtaining the semantic feature vector and temporal feature vector of the transaction association to be identified, the method further includes: obtaining the target text of the transaction association to be identified, and performing word segmentation on the target text to obtain an initial word sequence; identifying semantic factors in the initial word sequence that conform to a preset semantic pattern, and assigning a preset initial weight value to each identified semantic factor; mapping each word in the initial word sequence to an initial word vector, and multiplying each initial word vector element-wise with the initial weight value of its corresponding semantic factor to obtain a weighted word vector sequence; and performing semantic enhancement on the weighted word vector sequence through a pre-trained converter to obtain a semantic feature vector.

[0010] Furthermore, before obtaining the semantic feature vector and temporal feature vector associated with the transaction to be identified, the method further includes: obtaining transaction data of the transaction to be identified within a preset time range, and normalizing the transaction data to obtain processed transaction data; inputting the processed transaction data into a temporal convolutional network and a long short-term memory network respectively for feature extraction to obtain a first feature vector and a second feature vector; and fusing the first feature vector and the second feature vector to obtain a temporal feature vector.

[0011] Furthermore, after determining the target identification result corresponding to the transaction to be identified, the method further includes: when the target identification result indicates that the transaction to be identified is abnormal, calculating the contribution value of each word in the semantic feature vector to the target identification result through a feature attribution algorithm, and calculating the contribution value of the data segment corresponding to each time point in the temporal feature vector to the target identification result; taking the word whose contribution value is greater than a first preset threshold as the target semantic factor, and taking the data segment whose contribution value is greater than a second preset threshold as the target temporal segment; determining the abnormal evidence chain of the transaction to be identified based on the correspondence between the target semantic factor and the target temporal segment, wherein the abnormal evidence chain is used to provide data reference for the target object.

[0012] To achieve the above objectives, according to another aspect of this application, an apparatus for identifying abnormal transactions is provided. The apparatus includes: a first acquisition unit, configured to acquire semantic feature vectors and temporal feature vectors associated with the transaction to be identified, and to fuse the semantic feature vectors and temporal feature vectors to obtain a fused feature vector; a first processing unit, configured to reconstruct the fused feature vector using a reconstruction model to obtain a reconstructed fused feature vector, wherein the reconstruction model is trained on a variational autoencoder based on a sample dataset; and a first determination unit, configured to calculate the reconstruction error between the fused feature vector and the reconstructed fused feature vector, and to determine the target identification result corresponding to the transaction to be identified based on the reconstruction error, wherein the target identification result is used to characterize whether the transaction to be identified is abnormal.

[0013] Further, the first acquisition unit includes: a first processing subunit, used to map the semantic feature vector and the temporal feature vector to the first feature space through linear projection respectively, to obtain the mapped semantic feature vector and the mapped temporal feature vector; a second processing subunit, used to calculate based on the mapped semantic feature vector and the mapped temporal feature vector to obtain the target matrix; and a third processing subunit, used to perform weighted fusion of the mapped temporal feature vector based on the target matrix to obtain the fused feature vector.

[0014] Furthermore, the first processing unit includes: a fourth processing subunit, used to process the fused feature vector through the encoder module of the reconstruction model to obtain the latent distribution parameters in the latent space; and a fifth processing subunit, used to process the latent variables sampled from the latent distribution defined by the latent distribution parameters through the decoder module of the reconstruction model to obtain the reconstructed fused feature vector.

[0015] Further, the first determining unit includes: a sixth processing subunit, used to process the reconstruction error through a target activation function to obtain an anomaly risk score corresponding to the transaction to be identified; a first determining subunit, used to determine that the transaction to be identified has an anomaly as the target identification result when the anomaly risk score is greater than a preset risk threshold; and a second determining subunit, used to determine that the transaction to be identified does not have an anomaly as the target identification result when the anomaly risk score is less than or equal to the preset risk threshold.

[0016] Furthermore, the device also includes: a second acquisition unit, used to acquire the target text of the transaction association to be identified before acquiring the semantic feature vector and temporal feature vector of the transaction association to be identified, and to perform word segmentation on the target text to obtain an initial word sequence; a second processing unit, used to identify semantic factors in the initial word sequence that conform to a preset semantic pattern, and to assign a preset initial weight value to each identified semantic factor; a third processing unit, used to map each word in the initial word sequence to an initial word vector, and to multiply each initial word vector element-wise with the initial weight value of its corresponding semantic factor to obtain a weighted word vector sequence; and a fourth processing unit, used to perform semantic enhancement on the weighted word vector sequence through a pre-trained converter to obtain a semantic feature vector.

[0017] Furthermore, the device also includes: a third acquisition unit, used to acquire transaction data of the transaction to be identified within a preset time range before acquiring the semantic feature vector and temporal feature vector associated with the transaction to be identified, and to normalize the transaction data to obtain processed transaction data; a fifth processing unit, used to input the processed transaction data into a temporal convolutional network and a long short-term memory network respectively for feature extraction to obtain a first feature vector and a second feature vector; and a sixth processing unit, used to fuse the first feature vector and the second feature vector to obtain a temporal feature vector.

[0018] Furthermore, the device also includes: a seventh processing unit, configured to, after determining the target identification result corresponding to the transaction to be identified, calculate the contribution value of each word in the semantic feature vector to the target identification result through a feature attribution algorithm when the target identification result indicates that the transaction to be identified is abnormal, and calculate the contribution value of the data segment corresponding to each time point in the temporal feature vector to the target identification result; a second determining unit, configured to take words whose contribution value is greater than a first preset threshold as target semantic factors, and take data segments whose contribution value is greater than a second preset threshold as target temporal segments; and a third determining unit, configured to determine the abnormal evidence chain of the transaction to be identified based on the correspondence between the target semantic factors and the target temporal segments, wherein the abnormal evidence chain is used to provide data reference for the target object.

[0019] According to another aspect of the present invention, an electronic device is also provided, comprising: a memory storing an executable program; and a processor for running the program, wherein the program executes the abnormal transaction identification method of any one of the above-mentioned methods during runtime.

[0020] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein a program is stored in the storage medium, and a method for identifying abnormal transactions that controls the device where the storage medium is located to execute any of the above-mentioned transactions is provided when the program is running.

[0021] In this embodiment, the following steps are employed: obtaining semantic feature vectors and temporal feature vectors associated with the transaction to be identified, and fusing the semantic feature vectors and temporal feature vectors to obtain a fused feature vector; using a reconstruction model to reconstruct the fused feature vector to obtain a reconstructed fused feature vector, wherein the reconstruction model is trained on a variational autoencoder based on a sample dataset; calculating the reconstruction error between the fused feature vector and the reconstructed fused feature vector, and determining the target identification result corresponding to the transaction to be identified based on the reconstruction error, wherein the target identification result is used to characterize whether the transaction to be identified is abnormal. This solves the technical problem in related technologies where relying on manually preset rule thresholds for abnormal transaction identification results in low identification accuracy.

[0022] In this scheme, cross-modal semantic alignment and temporal response modeling are achieved by fusing semantic feature vectors and temporal feature vectors. Deep neural networks are used to automatically learn the normal correspondence between semantics and behavior from historical text information and transaction data, forming a dynamic distribution model (i.e., reconstruction model) to represent normal behavior. When a new sample is input, its reconstruction error with the distribution in the high-dimensional feature space can be calculated to determine whether it is an abnormal transaction behavior. This is used to assist manual analysis and judgment, and improves the detection accuracy of hidden and nonlinear abnormal transactions. Attached Figure Description

[0023] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0024] Figure 1 A hardware structure block diagram of a computer terminal for implementing a method for identifying abnormal transactions is shown.

[0025] Figure 2 This is a flowchart of an abnormal transaction identification method provided according to an embodiment of this application;

[0026] Figure 3 This is a schematic diagram of an abnormal transaction identification device provided according to an embodiment of this application;

[0027] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0031] Example 1

[0032] According to an embodiment of this application, a method embodiment for identifying abnormal transactions is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0033] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a method for identifying abnormal transactions is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0034] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0035] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal transaction identification method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the above-mentioned abnormal transaction identification method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0036] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0037] The display may be a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0038] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for identifying abnormal transactions is shown. Figure 2 This is a flowchart of an abnormal transaction identification method according to Embodiment 1 of this application. The abnormal transaction identification method includes:

[0039] Step S201: Obtain the semantic feature vector and temporal feature vector of the transaction association to be identified, and fuse the semantic feature vector and temporal feature vector to obtain the fused feature vector;

[0040] Step S202: The fused feature vector is reconstructed using a reconstruction model to obtain the reconstructed fused feature vector. The reconstruction model is obtained by training the variational autoencoder based on the sample dataset.

[0041] Step S203: Calculate the reconstruction error between the fused feature vector and the reconstructed fused feature vector, and determine the target identification result corresponding to the transaction to be identified based on the reconstruction error. The target identification result is used to characterize whether there is an anomaly in the transaction to be identified.

[0042] Optionally, the abnormal transaction identification system acquires the semantic feature vector and temporal feature vector associated with the transaction to be identified. The semantic feature vector represents the semantic content of the text information associated with the transaction to be identified, for example, generated by the announcement text through a pre-trained converter. The temporal feature vector represents the spatiotemporal response pattern of the transaction behavior, for example, generated by the transaction data within a preset window before and after the announcement is published through a temporal convolutional network and a long short-term memory network.

[0043] Optionally, in the abnormal transaction identification method provided in this application embodiment, before obtaining the semantic feature vector and temporal feature vector associated with the transaction to be identified, the method further includes: obtaining the target text associated with the transaction to be identified, and performing word segmentation on the target text to obtain an initial word sequence; identifying semantic factors in the initial word sequence that conform to a preset semantic pattern, and assigning a preset initial weight value to each identified semantic factor; mapping each word in the initial word sequence to an initial word vector, and multiplying each initial word vector element-wise with the initial weight value of its corresponding semantic factor to obtain a weighted word vector sequence; and performing semantic enhancement on the weighted word vector sequence through a pre-trained converter to obtain a semantic feature vector.

[0044] In an optional embodiment, for example, anomaly identification is performed on the trading behavior of a company's related products (such as financial products) within 10 trading days before and after the announcement of a certain announcement on a certain date. First, the target text of the transaction association to be identified, i.e., the full text of the announcement, is obtained. Then, the full text of the announcement is segmented into word units to generate a basic word sequence, i.e., an initial word sequence. Then, semantic factors in the initial word sequence that conform to a preset semantic pattern are identified. For example, a preset financial sensitive factor dictionary (constructed from relevant rules and historical cases) is called to perform pattern matching on the basic word sequence, identify and label the sensitive factors, including keyword categories (such as restructuring, mergers and acquisitions, etc.) and numerical categories (such as amount, proportion, time, etc.). Then, a preset initial weight value is assigned to each identified semantic factor. For example, for each identified sensitive factor, a preset initial weight coefficient is assigned according to actual needs. For example, the weight corresponding to "restructuring" is 1.8, the weight corresponding to "amount" is 1.6, and the default weight of unmatched words is 1.0.

[0045] Furthermore, each word in the initial word sequence is mapped to an initial word vector through a pre-trained word embedding layer, and each initial word vector is multiplied element-wise with the initial weight value of its corresponding semantic factor to obtain a weighted word vector sequence. The weighted word vector sequence is then input into a pre-trained converter, which models the contextual dependencies between word elements through its self-attention mechanism, and outputs a semantic embedding vector Vtext (i.e., a semantic feature vector).

[0046] By introducing a semantic factor weighting mechanism to enhance the semantic perception capability of the pre-trained converter, the model can accurately focus on key sensitive information in the announcement text, thereby improving the recognition accuracy and representation robustness of semantics related to abnormal transactions.

[0047] Optionally, in the abnormal transaction identification method provided in this application embodiment, before obtaining the semantic feature vector and temporal feature vector associated with the transaction to be identified, the method further includes: obtaining transaction data of the transaction to be identified within a preset time range, and normalizing the transaction data to obtain processed transaction data; inputting the processed transaction data into a temporal convolutional network and a long short-term memory network respectively for feature extraction to obtain a first feature vector and a second feature vector; and fusing the first feature vector and the second feature vector to obtain a temporal feature vector.

[0048] In an optional embodiment, transaction data of the transaction to be identified within a preset time range is acquired, and the transaction data is normalized to obtain processed transaction data. For example, multi-dimensional time-series data such as transaction volume and fund flow of the target product in the N (e.g., N=30) trading days before and after the announcement date are automatically collected from a financial database. The data of each dimension is normalized to obtain normalized time-series data. Then, the normalized time-series data is input into a temporal convolutional network and a long short-term memory network respectively for parallel feature extraction processing to obtain a short-term high-frequency feature sequence (i.e., the first feature vector) and a long-term trend feature sequence (i.e., the second feature vector). Then, the short-term high-frequency feature sequence and the long-term trend feature sequence are fused to obtain a multi-dimensional time-series feature vector Vseries.

[0049] By employing a parallel dual-path architecture of temporal convolutional networks and long short-term memory networks to collaboratively extract short-term high-frequency features and long-term trend features from transaction data, and fusing them to generate temporal feature vectors with more comprehensive representation and richer temporal semantics, the dynamic modeling capability and recognition accuracy for hidden abnormal transaction behaviors are improved.

[0050] Furthermore, the semantic feature vector and temporal feature vector are fused to obtain a fused feature vector. Then, a reconstruction model is used to reconstruct the fused feature vector, resulting in a reconstructed fused feature vector. This reconstructed fused feature vector represents the optimal estimate that the semantics of the announcement should trigger under normal circumstances, conforming to historical transaction response patterns; it signifies normal transaction characteristics. By calculating the error between the current transaction characteristics (i.e., the fused feature vector) and the normal transaction characteristics (i.e., the reconstructed fused feature vector) (i.e., the reconstruction error), anomalies are determined, leading to the final identification result. For example, the Euclidean distance or Mahalanobis distance between the input vector and the reconstructed vector is calculated as the reconstruction error Lrec. A larger Lrec indicates that the transaction behavior deviates more from the normal pattern in the semantic and temporal joint feature space, and is more likely to be an abnormal transaction behavior.

[0051] In summary, by fusing semantic feature vectors and temporal feature vectors, cross-modal semantic alignment and temporal response modeling are achieved. Deep neural networks are used to automatically learn the normal correspondence between semantics and behavior from historical text information and transaction data, forming a dynamic distribution model (i.e., a reconstruction model) to represent normal behavior. When a new sample is input, its reconstruction error in the high-dimensional feature space relative to this distribution can be calculated, thereby determining whether it is an abnormal transaction behavior. This assists in manual analysis and judgment, improving the detection accuracy of concealed and nonlinear abnormal transactions.

[0052] Optionally, in the abnormal transaction identification method provided in this application embodiment, the fusion processing of semantic feature vector and temporal feature vector to obtain fused feature vector includes: mapping the semantic feature vector and temporal feature vector to a first feature space through linear projection respectively to obtain mapped semantic feature vector and mapped temporal feature vector; calculating a target matrix based on the mapped semantic feature vector and mapped temporal feature vector; and performing weighted fusion of the mapped temporal feature vector based on the target matrix to obtain fused feature vector.

[0053] In an optional embodiment, Vtext and Vseries are mapped to the same feature space through a linear projection layer, resulting in two dimensionally consistent and semantically aligned vector representations: the mapped semantic feature vector and the mapped temporal feature vector. Then, the mapped semantic feature vector is used as the query vector, and the mapped temporal feature vector is used as the key vector and value vector. The dot product similarity between the query vector and the key vector is calculated to obtain the semantic-temporal cross-correlation matrix (i.e., the target matrix). Each element in the matrix represents the response strength of a specific announcement semantic to a specific transaction time point. Then, the value vector is weighted and fused based on this matrix to obtain the cross-modal fusion feature Vfusion (i.e., the fusion feature vector), which represents the dynamic fit between the announcement information content and the transaction behavior sequence response.

[0054] By achieving cross-modal alignment of semantics and temporal modalities through linear projection and generating a target matrix based on an interactive attention mechanism, and dynamically weighting and fusing temporal features, the sensitivity and interpretability of abnormal transactions can be improved.

[0055] Optionally, in the abnormal transaction identification method provided in this application embodiment, the reconstruction model is used to reconstruct the fused feature vector to obtain the reconstructed fused feature vector, which includes: processing the fused feature vector through the encoder module of the reconstruction model to obtain the latent distribution parameters in the latent space; and processing the latent variables sampled from the latent distribution defined by the latent distribution parameters through the decoder module of the reconstruction model to obtain the reconstructed fused feature vector.

[0056] In an optional embodiment, the encoder module of the reconstruction model performs nonlinear dimensionality reduction and latent distribution modeling on the fused feature vector Vfusion to obtain the mean vector and variance vector (i.e., latent distribution parameters) in the latent space. Then, the decoder module of the reconstruction model performs nonlinear dimensionality up-construction on the latent variables sampled from the latent distribution defined by the mean vector and variance vector to obtain the reconstructed fused feature vector. fusion.

[0057] The variational autoencoder (i.e., reconstruction model) constructed by the encoder and decoder performs latent space modeling and reconstruction of cross-modal fusion features, realizing unsupervised probabilistic representation of the "normal transaction-announcement response" pattern, enabling the system to quantify the degree of deviation of transaction behavior from the historical baseline based on reconstruction error.

[0058] Optionally, in the abnormal transaction identification method provided in this application embodiment, determining the target identification result corresponding to the transaction to be identified based on the reconstruction error includes: processing the reconstruction error through a target activation function to obtain an abnormal risk score corresponding to the transaction to be identified; if the abnormal risk score is greater than a preset risk threshold, the transaction to be identified is considered to have an anomaly as the target identification result; if the abnormal risk score is less than or equal to the preset risk threshold, the transaction to be identified is considered to have no anomaly as the target identification result.

[0059] In an optional embodiment, the reconstruction error is mapped to a probability score Prisk (i.e., anomaly risk score) in the range [0, 1] using a target activation function (such as the Sigmoid activation function). The closer Prisk is to 1, the more likely the transaction is to be an anomaly. If Prisk is greater than a preset risk threshold (e.g., 0.7), the transaction to be identified is considered to have anomalies as the target identification result; otherwise, the transaction to be identified is considered to have no anomalies as the target identification result.

[0060] In an optional embodiment, Prisk is used as the basis for the final risk rating of the system and can be used for subsequent graded early warning. For example, Prisk < 0.3 is low risk, 0.3 ≤ Prisk ≤ 0.7 is medium risk, and Prisk > 0.7 is high risk.

[0061] By converting reconstruction errors into risk scores through activation functions and performing binary classification based on preset thresholds, the stability and executability of abnormal transaction identification are effectively improved.

[0062] Optionally, in the abnormal transaction identification method provided in this application embodiment, after determining the target identification result corresponding to the transaction to be identified, the method further includes: when the target identification result indicates that the transaction to be identified is abnormal, calculating the contribution value of each word in the semantic feature vector to the target identification result through a feature attribution algorithm, and calculating the contribution value of the data segment corresponding to each time point in the temporal feature vector to the target identification result; taking the word whose contribution value is greater than a first preset threshold as the target semantic factor, and taking the data segment whose contribution value is greater than a second preset threshold as the target temporal segment; determining the abnormal evidence chain of the transaction to be identified based on the correspondence between the target semantic factor and the target temporal segment, wherein the abnormal evidence chain is used to provide data reference for the target object.

[0063] In an optional embodiment, if an anomaly is found in the transaction to be identified, correlation attribution analysis and evidence chain tracing are performed to automatically reverse-locate the key elements leading to the anomaly (such as specific announcement statements, specific abnormal fund inflow times, etc.), and output the correlation chain between semantic factors and abnormal transaction behavior. For example, the contribution value of each word in the semantic feature vector to Prisk is calculated using a feature attribution algorithm, and the contribution value of the data segment corresponding to each time point in the time-series feature vector to Prisk is calculated, thereby determining the target semantic factors and target time-series segments, and then generating an abnormal evidence chain for the transaction to be identified, providing data reference for relevant management personnel.

[0064] By quantifying the local contribution of text semantics and time-series transaction behavior to anomaly detection through feature attribution algorithms, high-influence announcement terms are automatically associated with abnormal transaction periods to form a traceable multimodal association evidence sequence, thereby improving the interpretability and analytical support capabilities of the system output results.

[0065] The abnormal transaction identification method provided in this application includes the following steps: obtaining semantic feature vectors and temporal feature vectors associated with the transaction to be identified, and fusing the semantic feature vectors and temporal feature vectors to obtain a fused feature vector; using a reconstruction model to reconstruct the fused feature vector to obtain a reconstructed fused feature vector, wherein the reconstruction model is trained on a variational autoencoder based on a sample dataset; calculating the reconstruction error between the fused feature vector and the reconstructed fused feature vector, and determining the target identification result corresponding to the transaction to be identified based on the reconstruction error, wherein the target identification result is used to characterize whether the transaction to be identified is abnormal. This method solves the technical problem in related technologies where the identification of abnormal transactions relies on manually preset rule thresholds, resulting in low identification accuracy.

[0066] In this scheme, cross-modal semantic alignment and temporal response modeling are achieved by fusing semantic feature vectors and temporal feature vectors. Deep neural networks are used to automatically learn the normal correspondence between semantics and behavior from historical text information and transaction data, forming a dynamic distribution model (i.e., reconstruction model) to represent normal behavior. When a new sample is input, its reconstruction error with the distribution in the high-dimensional feature space can be calculated to determine whether it is an abnormal transaction behavior. This is used to assist manual analysis and judgment, and improves the detection accuracy of hidden and nonlinear abnormal transactions.

[0067] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0068] Example 2

[0069] This application also provides an abnormal transaction identification device. It should be noted that the abnormal transaction identification device of this application can be used to execute the abnormal transaction identification method provided in this application. The abnormal transaction identification device provided in this application will be described below.

[0070] According to an embodiment of this application, an abnormal transaction identification device for implementing the above-described abnormal transaction identification method is also provided, such as... Figure 3 As shown, the device includes: a first acquisition unit 301, a first processing unit 302, and a first determination unit 303.

[0071] The first acquisition unit 301 is used to acquire the semantic feature vector and temporal feature vector of the transaction association to be identified, and to fuse the semantic feature vector and temporal feature vector to obtain the fused feature vector.

[0072] The first processing unit 302 is used to reconstruct the features of the fused feature vector using a reconstruction model to obtain the reconstructed fused feature vector. The reconstruction model is obtained by training the variational autoencoder based on the sample dataset.

[0073] The first determining unit 303 is used to calculate the reconstruction error between the fused feature vector and the reconstructed fused feature vector, and to determine the target identification result corresponding to the transaction to be identified based on the reconstruction error, wherein the target identification result is used to characterize whether there is an anomaly in the transaction to be identified.

[0074] The abnormal transaction identification device provided in this application embodiment acquires the semantic feature vector and temporal feature vector associated with the transaction to be identified by the first acquisition unit 301, and performs fusion processing on the semantic feature vector and temporal feature vector to obtain a fused feature vector; the first processing unit 302 uses a reconstruction model to reconstruct the fused feature vector to obtain a reconstructed fused feature vector, wherein the reconstruction model is obtained by training a variational autoencoder based on a sample dataset; the first determining unit 303 calculates the reconstruction error between the fused feature vector and the reconstructed fused feature vector, and determines the target identification result corresponding to the transaction to be identified based on the reconstruction error, wherein the target identification result is used to characterize whether the transaction to be identified is abnormal.

[0075] Optionally, in the abnormal transaction identification device provided in this application embodiment, the first acquisition unit includes: a first processing subunit, used to map the semantic feature vector and the temporal feature vector to the first feature space through linear projection respectively, to obtain the mapped semantic feature vector and the mapped temporal feature vector; a second processing subunit, used to calculate based on the mapped semantic feature vector and the mapped temporal feature vector to obtain a target matrix; and a third processing subunit, used to perform weighted fusion of the mapped temporal feature vector based on the target matrix to obtain a fused feature vector.

[0076] Optionally, in the abnormal transaction identification device provided in the embodiments of this application, the first processing unit includes: a fourth processing subunit, used to process the fused feature vector through the encoder module of the reconstruction model to obtain the latent distribution parameters in the latent space; and a fifth processing subunit, used to process the latent variables sampled from the latent distribution defined by the latent distribution parameters through the decoder module of the reconstruction model to obtain the reconstructed fused feature vector.

[0077] Optionally, in the abnormal transaction identification device provided in this application embodiment, the first determining unit includes: a sixth processing subunit, used to process the reconstruction error through a target activation function to obtain an abnormal risk score corresponding to the transaction to be identified; a first determining subunit, used to identify the transaction to be identified as having an abnormality as the target identification result when the abnormal risk score is greater than a preset risk threshold; and a second determining subunit, used to identify the transaction to be identified as not having an abnormality as the target identification result when the abnormal risk score is less than or equal to the preset risk threshold.

[0078] Optionally, in the abnormal transaction identification device provided in this application embodiment, the device further includes: a second acquisition unit, configured to acquire the target text associated with the transaction to be identified before acquiring the semantic feature vector and temporal feature vector associated with the transaction to be identified, and to perform word segmentation on the target text to obtain an initial word sequence; a second processing unit, configured to identify semantic factors in the initial word sequence that conform to a preset semantic pattern, and to assign a preset initial weight value to each identified semantic factor; a third processing unit, configured to map each word in the initial word sequence to an initial word vector, and to multiply each initial word vector element-wise with the initial weight value of its corresponding semantic factor to obtain a weighted word vector sequence; and a fourth processing unit, configured to perform semantic enhancement on the weighted word vector sequence through a pre-trained converter to obtain a semantic feature vector.

[0079] Optionally, in the abnormal transaction identification device provided in the embodiments of this application, the device further includes: a third acquisition unit, used to acquire transaction data of the transaction to be identified within a preset time range before acquiring the semantic feature vector and temporal feature vector associated with the transaction to be identified, and to normalize the transaction data to obtain processed transaction data; a fifth processing unit, used to input the processed transaction data into a temporal convolutional network and a long short-term memory network respectively for feature extraction to obtain a first feature vector and a second feature vector; and a sixth processing unit, used to fuse the first feature vector and the second feature vector to obtain a temporal feature vector.

[0080] Optionally, in the abnormal transaction identification device provided in this application embodiment, the device further includes: a seventh processing unit, configured to, after determining the target identification result corresponding to the transaction to be identified, calculate the contribution value of each word in the semantic feature vector to the target identification result through a feature attribution algorithm, and calculate the contribution value of each data segment corresponding to each time point in the temporal feature vector to the target identification result when the target identification result indicates that the transaction to be identified is abnormal; a second determining unit, configured to take words with contribution values ​​greater than a first preset threshold as target semantic factors, and take data segments with contribution values ​​greater than a second preset threshold as target temporal segments; and a third determining unit, configured to determine the abnormal evidence chain of the transaction to be identified based on the correspondence between the target semantic factors and the target temporal segments, wherein the abnormal evidence chain is used to provide data reference for the target object.

[0081] It should be noted that the first acquisition unit 301, the first processing unit 302, and the first determination unit 303 mentioned above correspond to steps S201 to S203 in Embodiment 1. The three units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0082] Example 3

[0083] Embodiments of this application may provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (Only one is shown) Processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0084] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0085] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: acquiring the semantic feature vector and temporal feature vector associated with the transaction to be identified, and fusing the semantic feature vector and temporal feature vector to obtain a fused feature vector; using a reconstruction model to reconstruct the fused feature vector to obtain a reconstructed fused feature vector, wherein the reconstruction model is trained on a variational autoencoder based on a sample dataset; calculating the reconstruction error between the fused feature vector and the reconstructed fused feature vector, and determining the target identification result corresponding to the transaction to be identified based on the reconstruction error, wherein the target identification result is used to characterize whether the transaction to be identified is abnormal.

[0086] The processor can call the information and application program stored in the memory through the transmission device to perform the following steps: map the semantic feature vector and the temporal feature vector to the first feature space by linear projection respectively to obtain the mapped semantic feature vector and the mapped temporal feature vector; calculate the target matrix based on the mapped semantic feature vector and the mapped temporal feature vector; and perform weighted fusion on the mapped temporal feature vector based on the target matrix to obtain the fused feature vector.

[0087] The processor can call the information and application program stored in the memory through the transmission device to perform the following steps: process the fused feature vector through the encoder module of the reconstruction model to obtain the latent distribution parameters in the latent space; process the latent variables sampled from the latent distribution defined by the latent distribution parameters through the decoder module of the reconstruction model to obtain the reconstructed fused feature vector.

[0088] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: process the reconstruction error through the target activation function to obtain the abnormal risk score corresponding to the transaction to be identified; if the abnormal risk score is greater than the preset risk threshold, the transaction to be identified is considered to have an anomaly as the target identification result; if the abnormal risk score is less than or equal to the preset risk threshold, the transaction to be identified is considered to have no anomaly as the target identification result.

[0089] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: before acquiring the semantic feature vector and temporal feature vector of the transaction association to be identified, acquire the target text of the transaction association to be identified and perform word segmentation on the target text to obtain an initial word sequence; identify semantic factors in the initial word sequence that conform to a preset semantic pattern and assign a preset initial weight value to each identified semantic factor; map each word in the initial word sequence to an initial word vector and multiply each initial word vector element-wise with the initial weight value of its corresponding semantic factor to obtain a weighted word vector sequence; perform semantic enhancement on the weighted word vector sequence through a pre-trained converter to obtain a semantic feature vector.

[0090] The processor can call the information and application program stored in the memory through the transmission device to perform the following steps: before obtaining the semantic feature vector and temporal feature vector associated with the transaction to be identified, obtain the transaction data of the transaction to be identified within a preset time range, and normalize the transaction data to obtain the processed transaction data; input the processed transaction data into a temporal convolutional network and a long short-term memory network respectively for feature extraction to obtain a first feature vector and a second feature vector; fuse the first feature vector and the second feature vector to obtain the temporal feature vector.

[0091] The processor can invoke information and application programs stored in the memory via a transmission device to execute the following steps: After determining the target identification result corresponding to the transaction to be identified, if the target identification result indicates that the transaction to be identified is abnormal, the contribution value of each word in the semantic feature vector to the target identification result is calculated by a feature attribution algorithm, and the contribution value of the data segment corresponding to each time point in the temporal feature vector to the target identification result is calculated; words whose contribution values ​​are greater than a first preset threshold are taken as target semantic factors, and data segments whose contribution values ​​are greater than a second preset threshold are taken as target temporal segments; based on the correspondence between the target semantic factors and the target temporal segments, the abnormal evidence chain of the transaction to be identified is determined, wherein the abnormal evidence chain is used to provide data reference for the target object.

[0092] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0093] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0094] Example 4

[0095] Embodiments of this application also provide a computer-readable storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the abnormal transaction identification method provided in Embodiment 1.

[0096] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0097] This application also provides a computer program product, which, when executed on a data processing device, is suitable for performing steps of a method for identifying abnormal transactions.

[0098] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0099] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0100] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0101] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0102] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0103] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0104] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for identifying abnormal transactions, characterized in that, include: Obtain the semantic feature vector and temporal feature vector of the transaction association to be identified, and fuse the semantic feature vector and the temporal feature vector to obtain the fused feature vector; The fused feature vector is reconstructed using a reconstruction model to obtain a reconstructed fused feature vector. The reconstruction model is obtained by training a variational autoencoder based on a sample dataset. Calculate the reconstruction error between the fused feature vector and the reconstructed fused feature vector, and determine the target identification result corresponding to the transaction to be identified based on the reconstruction error, wherein the target identification result is used to characterize whether the transaction to be identified is abnormal.

2. The method according to claim 1, characterized in that, The semantic feature vector and the temporal feature vector are fused to obtain a fused feature vector, which includes: The semantic feature vector and the temporal feature vector are respectively mapped to the first feature space by linear projection to obtain the mapped semantic feature vector and the mapped temporal feature vector. The target matrix is ​​obtained by calculating based on the mapped semantic feature vector and the mapped temporal feature vector; The mapped temporal feature vector is weighted and fused based on the target matrix to obtain the fused feature vector.

3. The method according to claim 1, characterized in that, The fused feature vector is reconstructed using a reconstruction model, resulting in a reconstructed fused feature vector including: The encoder module of the reconstruction model processes the fused feature vector to obtain the latent distribution parameters in the latent space; The latent variables sampled from the latent distribution defined by the latent distribution parameters are processed by the decoder module of the reconstruction model to obtain the reconstructed fusion feature vector.

4. The method according to claim 1, characterized in that, Based on the reconstruction error, the target identification result corresponding to the transaction to be identified is determined as follows: The reconstruction error is processed by a target activation function to obtain the abnormal risk score corresponding to the transaction to be identified; If the abnormal risk score is greater than a preset risk threshold, the abnormality of the transaction to be identified will be taken as the target identification result. If the abnormal risk score is less than or equal to the preset risk threshold, the absence of abnormality in the transaction to be identified is taken as the target identification result.

5. The method according to claim 1, characterized in that, Before obtaining the semantic feature vector and temporal feature vector of the transaction association to be identified, the method further includes: Obtain the target text associated with the transaction to be identified, and perform word segmentation on the target text to obtain an initial word sequence; Identify semantic factors in the initial word sequence that conform to a preset semantic pattern, and assign a preset initial weight value to each identified semantic factor; Each word in the initial word sequence is mapped to an initial word vector, and each initial word vector is multiplied element-wise by the initial weight value of its corresponding semantic factor to obtain a weighted word vector sequence. The semantic feature vector is obtained by semantically enhancing the weighted word vector sequence through a pre-trained converter.

6. The method according to claim 1, characterized in that, Before obtaining the semantic feature vector and temporal feature vector of the transaction association to be identified, the method further includes: The transaction data of the transaction to be identified within a preset time range is obtained, and the transaction data is normalized to obtain the processed transaction data. The processed transaction data is input into a temporal convolutional network and a long short-term memory network for feature extraction to obtain a first feature vector and a second feature vector. The first feature vector and the second feature vector are fused to obtain the time-series feature vector.

7. The method according to claim 1, characterized in that, After determining the target identification result corresponding to the transaction to be identified, the method further includes: When the target identification result indicates that the transaction to be identified is abnormal, the contribution value of each word in the semantic feature vector to the target identification result is calculated by the feature attribution algorithm, and the contribution value of the data segment corresponding to each time point in the temporal feature vector to the target identification result is calculated. The lexical elements whose contribution values ​​are greater than the first preset threshold are taken as target semantic factors, and the data segments whose contribution values ​​are greater than the second preset threshold at the corresponding time points are taken as target time segments. Based on the correspondence between the target semantic factor and the target time segment, an abnormal evidence chain for the transaction to be identified is determined, wherein the abnormal evidence chain is used to provide data reference for the target object.

8. A device for identifying abnormal transactions, characterized in that, include: The first acquisition unit is used to acquire the semantic feature vector and the temporal feature vector of the transaction association to be identified, and to perform fusion processing on the semantic feature vector and the temporal feature vector to obtain the fused feature vector; The first processing unit is used to reconstruct the features of the fused feature vector using a reconstruction model to obtain a reconstructed fused feature vector, wherein the reconstruction model is obtained by training a variational autoencoder based on a sample dataset. The first determining unit is used to calculate the reconstruction error between the fused feature vector and the reconstructed fused feature vector, and to determine the target identification result corresponding to the transaction to be identified based on the reconstruction error, wherein the target identification result is used to characterize whether the transaction to be identified is abnormal.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the computer-readable storage medium is located to perform the abnormal transaction identification method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, executes the method for identifying abnormal transactions as described in any one of claims 1 to 7.

Images