Transaction account anomaly identification method and apparatus, electronic device, and storage medium

Abstract

This disclosure provides a method, apparatus, electronic device, and storage medium for anomaly identification of trading accounts. The method includes: acquiring a short-term trading feature sequence and a long-term trading feature sequence of the trading account; extracting a first internal correlation feature from the short-term trading feature sequence and a second internal correlation feature from the long-term trading feature sequence; mapping the first internal correlation feature to the feature space of the second internal correlation feature through a mutual attention mechanism to obtain a correlation representation feature; performing a difference operation on the first internal correlation feature and the correlation representation feature to obtain an offset residual vector; determining an anomaly score for the trading account based on the offset residual vector; and identifying anomalies in the trading account based on the anomaly score. This disclosure can improve the accuracy of identifying accounts with anomalies.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence technology, and in particular to a method, apparatus, electronic device, and storage medium for identifying anomalies in transaction accounts. Background Technology

[0002] With the development of online payment services, more and more people are using online payment to complete transactions. However, the increase in online transaction volume has also led to the proliferation of online fraud, which, if not identified, can cause losses to users.

[0003] Currently, logistic regression models are generally used as the base model to fit multidimensional structured account features, outputting a risk score for the account, and then assessing the account's risk level based on the risk score. However, logistic regression models are linear models, while account trading behavior is non-linear and complexly coupled. Logistic regression models are insufficient in fitting complex and non-linear real-world risk patterns, failing to identify complex abnormal trading patterns and reducing the accuracy of identifying abnormal accounts. Although there are other schemes that use deep learning-based time-series models such as recurrent neural networks and long short-term memory networks to identify abnormal accounts, these methods mostly focus on static feature extraction and lack in-depth analysis of account trading behavior, still failing to improve the accuracy of identifying abnormal accounts. Summary of the Invention

[0004] The following is an overview of the subject matter described in detail in this disclosure. This overview is not intended to limit the scope of the claims.

[0005] This disclosure provides a method, apparatus, electronic device, and storage medium for identifying abnormal transaction accounts, which can improve the accuracy of identifying accounts with abnormalities.

[0006] On one hand, embodiments of this disclosure provide a method for identifying anomalies in trading accounts, including: Obtain short-term and long-term transaction feature sequences of a trading account. The short-term transaction feature sequence includes the transaction features of multiple transactions of the trading account within a first historical time window, and the long-term transaction feature sequence includes the transaction features of multiple transactions of the trading account within a second historical time window. The window length of the first historical time window is less than the window length of the second historical time window. Extract the first internal correlation feature of the short-term trading feature sequence and the second internal correlation feature of the long-term trading feature sequence respectively; The first internal correlation feature is mapped to the feature space of the second internal correlation feature through a mutual attention mechanism to obtain the correlation representation feature; Perform a difference operation on the first internal correlation feature and the correlation representation feature to obtain the offset residual vector; The anomaly score of the trading account is determined based on the offset residual vector, and the anomaly of the trading account is identified based on the anomaly score.

[0007] On the other hand, this disclosure also provides an anomaly detection device for transaction accounts, including: The acquisition module is used to acquire short-term transaction feature sequences and long-term transaction feature sequences of a trading account. The short-term transaction feature sequences include the transaction features of multiple transactions of the trading account within a first historical time window, and the long-term transaction feature sequences include the transaction features of multiple transactions of the trading account within a second historical time window. The window length of the first historical time window is less than the window length of the second historical time window. The extraction module is used to extract the first internal correlation feature of the short-term trading feature sequence and the second internal correlation feature of the long-term trading feature sequence, respectively. The mapping module is used to map the first internal correlation feature to the feature space of the second internal correlation feature through a mutual attention mechanism to obtain the correlation representation feature; The difference operation module is used to perform difference operations on the first internal correlation feature and the correlation representation feature to obtain the offset residual vector; The identification module is used to determine the abnormal score of the trading account based on the offset residual vector, and to identify the abnormality of the trading account according to the abnormal score.

[0008] Furthermore, the extraction module described above is specifically used for: The short-term trading feature sequence and the long-term trading feature sequence are preprocessed respectively to obtain the processed short-term trading feature sequence and the processed long-term trading feature sequence. The first internal correlation feature of the processed short-term transaction feature sequence is extracted using a self-attention mechanism. The second internal correlation feature of the processed long-term transaction feature sequence is extracted using a self-attention mechanism.

[0009] Furthermore, the extraction module described above is specifically used for: If the length of the short-term transaction feature sequence does not reach the preset first sequence length threshold, placeholder vectors are added to the ends of the short-term transaction feature sequence until the length of the short-term transaction feature sequence reaches the first sequence length threshold. If the length of the long-term transaction feature sequence does not reach the preset second sequence length threshold, placeholder vectors are added to the ends of the long-term transaction feature sequence until the length of the long-term transaction feature sequence reaches the second sequence length threshold. The short-term trading feature sequence and the long-term trading feature sequence are respectively subjected to scale normalization to obtain the processed short-term trading feature sequence and the processed long-term trading feature sequence.

[0010] Furthermore, the transaction features have multiple feature dimensions; The above extraction module is specifically used for: For each transaction feature dimension in the short-term transaction feature sequence, calculate the first average value of the feature dimension in all transactions in the short-term transaction feature sequence, and divide the difference obtained by subtracting the first average value from the feature value corresponding to the feature dimension by the standard deviation of the feature dimension in all transactions in the short-term transaction feature sequence to obtain the first processed feature dimension. The first processed feature dimension of each transaction in the short-term transaction feature sequence is integrated to obtain the processed short-term transaction feature sequence. For each transaction feature dimension in the long-term transaction feature sequence, calculate the second average value of the feature dimension among all transactions in the long-term transaction feature sequence, and divide the difference obtained by subtracting the second average value from the feature value corresponding to the feature dimension by the standard deviation of the feature dimension among all transactions in the long-term transaction feature sequence to obtain the second processed feature dimension; The second processed feature dimension of each transaction in the long-term transaction feature sequence is integrated to obtain the processed long-term transaction feature sequence.

[0011] Furthermore, the extraction module described above is specifically used for: The processed short-term transaction feature sequence is projected into a first query vector, a first key vector, and a first value vector, respectively. A first similarity score is calculated based on the first query vector and the first key vector, and a first attention weight is obtained by calculating the first similarity score through a normalization function. The first internal correlation feature is obtained by weighting and summing the first value vector using the first attention weight.

[0012] Furthermore, the extraction module described above is specifically used for: The processed long-term transaction feature sequence is projected into a second query vector, a second key vector, and a second value vector, respectively. The second similarity score is calculated based on the second query vector and the second key vector, and the second attention weight is obtained by calculating the second similarity score through a normalization function. The second internal correlation feature is obtained by weighting and summing the second value vector using the second attention weight.

[0013] Furthermore, the aforementioned mapping module is specifically used for: The first internal association feature is projected into a third query vector, and the second internal association feature is projected into a third key vector and a third value vector, respectively. The third similarity score is calculated based on the third query vector and the third key vector, and the third attention weight is obtained by calculating the third similarity score through a normalization function. The association representation features are obtained by weighting and summing the third value vector using the third attention weight.

[0014] Furthermore, the first internal association feature and the association representation feature have the same feature dimension; The above difference operation module is specifically used for: For each feature dimension, the feature value of the feature dimension in the first internal association feature and the feature value of the feature dimension in the association representation feature are differentially calculated to obtain the offset corresponding to the feature dimension. The offsets corresponding to each feature dimension are integrated to obtain the offset residual vector.

[0015] Furthermore, the aforementioned identification module is specifically used for: The offset residual vector is multiplied by a preset first weight matrix and a preset first bias is added to obtain the first linear transformation result; The anomaly score of the trading account is obtained by calculating the result of the first linear transformation using an activation function.

[0016] Furthermore, the aforementioned identification module is specifically used for: If the abnormal score reaches a preset first abnormal score threshold, it is determined that the transaction account is abnormal; The anomaly detection device for the transaction account also includes a processing module, which is specifically used for: Take action against trading accounts exhibiting abnormal activity.

[0017] Furthermore, the anomaly identification device for the transaction account also includes an anomaly type identification module, which is specifically used for: The offset residual vector is multiplied by a preset second weight matrix, and a preset second bias is added to obtain the second linear transformation result; The normalization function is used to calculate the result of the second linear transformation to obtain the anomaly category feature vector corresponding to the transaction account. The anomaly category feature vector is used to indicate the probability distribution of each anomaly type.

[0018] Furthermore, the aforementioned processing module is specifically used for: From the anomaly category feature vector, extract the anomaly type with the largest probability distribution as the target anomaly type; The system uses a pre-defined handling strategy library to query the handling strategy corresponding to the target anomaly type, and then uses the handling strategy corresponding to the target anomaly type to handle the transaction account with the anomaly. The handling strategy library stores the handling strategies corresponding to each anomaly type.

[0019] Furthermore, both the anomaly score and the anomaly category feature vector are determined by the anomaly recognition model; The anomaly detection device for the transaction account also includes a model training module, which is specifically used for: Obtain a training sample set, wherein each training sample in the training sample set has an account sample, a long-term transaction feature sample corresponding to the account sample, a short-term transaction feature sample corresponding to the account sample, an account label corresponding to the account sample, and an anomaly classification label corresponding to the account sample, wherein the account label is used to indicate whether the account sample is abnormal, and the anomaly classification label is used to indicate the anomaly type corresponding to the account sample. A loss function is generated based on an anomaly identification loss function and an anomaly classification loss function, wherein the anomaly identification loss function is determined based on a first probability that the account sample identified by the anomaly identification model is anomaly, and the anomaly classification loss function is determined based on a second probability that the account sample identified by the anomaly identification model belongs to each anomaly type; The anomaly recognition model is pre-trained using the account samples, long-term transaction feature samples, and short-term transaction feature samples corresponding to the account samples in the training sample set as input text, and the account labels and anomaly classification labels corresponding to the account samples in the training sample set as expected output text, until the loss function converges.

[0020] Furthermore, the aforementioned model training module is specifically used for: For the training samples that have already participated in training, determine the first probability that the account sample corresponding to the training sample is abnormal; Take the logarithm of the first probability, and determine the first product by multiplying the logarithm of the first probability by the account label corresponding to the account sample; Take the logarithm of the first difference obtained by subtracting the first probability from the first value, and determine the second product by multiplying the second difference obtained by subtracting the account label corresponding to the account sample from the first value and the logarithm of the first difference; Determine the first sum of the first product and the second product, and divide the sum of the first sums of each training sample that has participated in training by the number of training samples that have participated in training to obtain the first sample average loss term; The anomaly identification loss sub-function is obtained by taking the negative of the average loss term of the first sample.

[0021] Furthermore, the anomaly classification label is a vector with a length equal to the total number of anomaly types, and in the anomaly classification label, the vector value of the anomaly type corresponding to the account sample is the first value, and the vector values ​​of other anomaly types are the second values; The above model training module is specifically used for: For the training samples that have already participated in training, determine the second probability that the account sample corresponding to the training sample belongs to each anomaly type; For each anomaly type, the third product is obtained by multiplying the vector value of the anomaly type in the anomaly classification label corresponding to the training sample and the logarithm of the second probability that the account sample corresponding to the training sample belongs to the anomaly type; Summing the third product corresponding to each anomaly type yields the second sum. The sum of the second sums of all the training samples that have participated in training is divided by the number of training samples that have participated in training to obtain the second sample average loss term. The anomaly classification loss function is obtained by taking the negative of the average loss term of the second sample.

[0022] Furthermore, the aforementioned model training module is specifically used for: Obtain the anomaly detection weight and anomaly classification weight; Based on the anomaly identification weights and the anomaly classification weights, the anomaly identification loss function and the anomaly classification loss function are weighted and summed to obtain the loss function.

[0023] On the other hand, this disclosure also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method for identifying abnormal transaction accounts.

[0024] On the other hand, this disclosure also provides a computer-readable storage medium storing a computer program that is executed by a processor to implement the above-described method for identifying abnormal transaction accounts.

[0025] On the other hand, this disclosure also provides a computer program product comprising a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform the above-described method for identifying abnormal transaction accounts.

[0026] This disclosure provides at least the following beneficial effects: By acquiring short-term and long-term transaction feature sequences of a trading account, and extracting the first internal correlation feature of the short-term sequence and the second internal correlation feature of the long-term sequence, interference from irrelevant information can be suppressed, and the trading features of the trading account within the first historical time window and the trading features within the second historical time window can be deeply mined. Then, the first internal correlation feature is mapped to the feature space of the second internal correlation feature through a mutual attention mechanism, resulting in a weighted fusion representation of the trading features of the trading account within the first historical time window in the feature space of the second internal correlation feature, i.e., the correlation representation feature. The semantic matching degree of the first and second internal correlation features can be clearly defined through the correlation representation feature. Furthermore, by performing a difference operation on the first internal correlation feature and the correlation representation feature, the offset between the recent and long-term trading behaviors of the trading account can be deeply mined, accurately capturing the degree of offset of the trading account's real-time trading behavior relative to its steady-state historical long-term trading behavior. This can provide highly interpretable support for subsequent anomaly identification. Finally, the anomaly score of the trading account can be comprehensively determined based on the offset residual vector obtained in the previous step, and anomaly identification of the trading account can be performed based on the anomaly score. This embodiment of the disclosure, through the aforementioned behavior deviation mining mechanism for short-term and long-term transaction feature sequences of a single transaction account, can effectively capture the micro-anomalies of a transaction account and effectively improve the accuracy of identifying transaction accounts with short-term behavior changes and potential anomalies.

[0027] Other features and advantages of this disclosure will be set forth in the following description and will be apparent in part from the description or may be learned by practicing this disclosure. Attached Figure Description

[0028] The accompanying drawings are provided to further understand the technical solutions of this disclosure and constitute a part of the specification. They are used together with the embodiments of this disclosure to explain the technical solutions of this disclosure and do not constitute a limitation on the technical solutions of this disclosure.

[0029] Figure 1 A schematic diagram illustrating an optional implementation environment provided for an embodiment of this disclosure; Figure 2A schematic diagram of an optional process for identifying anomalies in transaction accounts provided in this embodiment of the present disclosure; Figure 3 A schematic diagram illustrating the implementation details of anomaly identification of transaction accounts provided in this embodiment of the disclosure; Figure 4 A schematic diagram of the structure of an anomaly detection model for anomaly detection of transaction accounts provided in an embodiment of this disclosure; Figure 5 This is a schematic diagram illustrating the anomaly identification of a transaction account based on anomaly scores, provided in an embodiment of this disclosure. Figure 6 This is a schematic diagram illustrating the handling of abnormal transaction accounts provided in an embodiment of this disclosure; Figure 7 This is a schematic diagram of a training method for training an anomaly detection model provided in an embodiment of this disclosure; Figure 8 A schematic diagram of an optional architecture for the anomaly identification method of transaction accounts provided in this disclosure embodiment; Figure 9 A schematic diagram of an optional structure of the transaction account anomaly identification device provided in this embodiment of the disclosure; Figure 10 This is a partial structural block diagram of a terminal provided in an embodiment of the present disclosure; Figure 11 This is a partial structural block diagram of a server provided in an embodiment of this disclosure. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this disclosure.

[0031] It should be noted that in the various specific embodiments of this disclosure, when processing is required based on data related to the characteristics of the target object, such as target object attribute information or a set of attribute information, the permission or consent of the target object will be obtained first. Furthermore, the collection, use, and processing of this data will comply with relevant laws, regulations, and standards. The target object can be a user. In addition, when embodiments of this disclosure require obtaining target object attribute information, separate permission or consent from the target object will be obtained through pop-ups or redirection to a confirmation page. Only after obtaining the target object's separate permission or consent will the necessary target object-related data for the normal operation of the embodiments of this disclosure be obtained.

[0032] In this disclosure, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0033] With the development of online payment services, more and more people are using online payment to complete transactions. However, the increase in online transaction volume has also led to the proliferation of online fraud, which, if not identified, will cause losses to users. Currently, the common approach is to use a logistic regression model as the base model to fit multidimensional structured account features, output an account risk score, and assess the account's risk level based on the risk score. However, the logistic regression model is a linear model, while account transaction behavior is non-linear and complexly coupled. The logistic regression model is insufficient in fitting complex and non-linear real risk patterns, and cannot identify complex abnormal transaction patterns, thus reducing the accuracy of identifying abnormal accounts. Although there are other solutions that use deep learning-based time-series models such as recurrent neural networks and long short-term memory networks to identify abnormal accounts, these methods mostly focus on static feature extraction and lack in-depth analysis of account transaction behavior, still failing to improve the accuracy of identifying abnormal accounts.

[0034] Based on this, the present disclosure provides a method, apparatus, electronic device, and storage medium for identifying abnormal transaction accounts, which can improve the accuracy of identifying accounts with abnormalities.

[0035] Reference Figure 1 , Figure 1 This is a schematic diagram of an optional implementation environment provided by an embodiment of the present disclosure. The implementation environment includes a terminal 101 and a server 102, wherein the terminal 101 and the server 102 are connected through a communication network.

[0036] For example, in response to a payment action sent by a transaction account through terminal 101, server 102 can obtain a short-term transaction feature sequence and a long-term transaction feature sequence of the transaction account, and extract a first internal correlation feature of the short-term transaction feature sequence and a second internal correlation feature of the long-term transaction feature sequence, respectively. Then, the first internal correlation feature is mapped to the feature space of the second internal correlation feature through a mutual attention mechanism to obtain a correlation representation feature, and a difference operation is performed on the first internal correlation feature and the correlation representation feature to obtain an offset residual vector. Finally, the anomaly score of the transaction account is determined based on the offset residual vector, and anomaly identification of the transaction account is performed based on the anomaly score.

[0037] Server 102 acquires short-term and long-term transaction feature sequences of a trading account, and extracts the first internal correlation feature of the short-term sequence and the second internal correlation feature of the long-term sequence, respectively. This suppresses interference from irrelevant information and deeply mines the trading features of the trading account within the first and second historical time windows. Then, through a mutual attention mechanism, the first internal correlation feature is mapped to the feature space of the second internal correlation feature, resulting in a weighted fusion representation of the trading features of the trading account within the first historical time window in the feature space of the second internal correlation feature—the correlation representation feature. The semantic matching degree between the first and second internal correlation features can be clearly defined through the correlation representation feature. Furthermore, by performing a difference operation on the first internal correlation feature and the correlation representation feature, the offset between the recent and long-term trading behaviors of the trading account can be deeply mined, accurately capturing the degree of deviation of the trading account's real-time trading behavior relative to its steady-state historical long-term trading behavior. This provides highly interpretable support for subsequent anomaly identification. Finally, the anomaly score of the trading account can be comprehensively determined based on the offset residual vector obtained in the previous step, and anomaly identification of the trading account can be performed based on the anomaly score. This embodiment of the disclosure, through the aforementioned behavior deviation mining mechanism for short-term and long-term transaction feature sequences of a single transaction account, can effectively capture the micro-anomalies of a transaction account and effectively improve the accuracy of identifying transaction accounts with short-term behavior changes and potential anomalies.

[0038] Server 102 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Additionally, server 102 can also be a node server in a blockchain network.

[0039] Terminal 101 may be a mobile phone, computer, smart voice interaction device, smart home appliance, vehicle terminal, etc., but is not limited to these. Terminal 101 and server 102 can be directly or indirectly connected through wired or wireless communication, and this embodiment of the disclosure does not impose any limitations.

[0040] This disclosure can be applied to real-time transaction management. For example, if transaction account A's transactions in the past 90 days account for less than 1% of its total transactions, and the amount of any single transaction has never exceeded 5,000 yuan, and if transaction account A initiates a large transfer of 50,000 yuan at 3:00 AM, even after the user has confirmed payment and the transaction instruction has been issued, but the funds have not yet been transferred, the anomaly identification method of this disclosure can be used to analyze the transaction characteristics of transaction account A's recent transactions (including the characteristics of the current transaction, i.e., the characteristics of the transaction at 3:00 AM) and the degree of deviation in the characteristics of its historical transactions over the past 90 days. This will reveal that the deviations in the transaction time and transaction amount dimensions are abnormally large. Based on this, anomalies in transaction account A can be identified, and the system will automatically trigger an interception and notify the reviewer that "this transaction deviates significantly from historical patterns in terms of time and amount characteristics, suggesting possible fraudulent use." This disclosure can be applied to the detection of abnormal transaction behavior. For example, if transaction account B's historical transaction history over the past 90 days shows a pattern of several fixed transfers per month, and if in recent days transaction account B's history changes to dozens of small, high-frequency transactions per day, with recipients often being suspicious merchants, and the user has confirmed payment and the transaction instruction has been issued, but the funds have not yet been transferred, the abnormal transaction identification method of this disclosure can be used to analyze the recent transaction characteristics of transaction account B (i.e., dozens of small, high-frequency transactions per day, with recipients often being suspicious merchants) and the degree of deviation in the characteristics of historical transactions over the past 90 days. This will reveal significant deviations in the transaction frequency and recipient characteristics. Based on this, abnormality in transaction account B can be identified. The system will attribute the significantly deviated characteristic dimensions to "potential gambling money laundering" and initiate subsequent fund tracing and account freezing procedures.

[0041] Reference Figure 2 , Figure 2 This is an optional flowchart illustrating a method for identifying anomalies in a transaction account provided in this embodiment of the present disclosure. This method can be executed by a server, a terminal, or a server in cooperation with a terminal. The method includes, but is not limited to, the following steps 201 to 205.

[0042] Step 201: Obtain the short-term and long-term trading characteristic sequences of the trading account.

[0043] The short-term transaction feature sequence includes the transaction features of multiple transactions of a trading account within the first historical time window, and the long-term transaction feature sequence includes the transaction features of multiple transactions of a trading account within the second historical time window. The window length of the first historical time window is shorter than the window length of the second historical time window.

[0044] As we can understand, a transaction account refers to an independent entity in a payment system used to identify a user, hold funds, and record transaction behavior; it is the basic carrier for initiating and receiving transactions. A transaction refers to a fund-related operation initiated by a transaction account in the payment system. Each transaction is not a single number, but rather a combination of transaction feature information with multiple dimensions. This transaction feature information is encoded into a vector form of transaction features. Specifically, transaction features are quantitative indicators extracted from a single transaction that reflect the transaction attributes and behavioral habits of the transaction account. Transaction features typically include transaction amount, transaction timestamp, transaction currency, transaction type (e.g., consumption, transfer, and top-up), transaction channel (e.g., app, webpage, and QR code scanning), historical transaction frequency, and transaction location. By extracting transaction features with multiple dimensions from a transaction, as much key information as possible can be encoded within a limited set of features, providing a rich feature foundation for subsequent steps such as mutual attention and differential calculation.

[0045] It should be noted that the first historical time window refers to a fixed time interval tracing back from the current transaction time to characterize a user's short-term trading habits. The first historical time window can be a fixed time interval of 7 days, 3 days, or 12 hours prior to the current transaction time. The short-term trading feature sequence includes the trading characteristics of multiple transactions of the trading account within the first historical time window, and also includes the transaction to be identified. The expression for the short-term trading feature sequence can be: ;in, Represents a short-term trading characteristic sequence. This represents the transaction feature of the nth transaction in the short-term transaction feature sequence, and the transaction feature has multiple feature dimensions.

[0046] The second historical time window refers to a fixed time interval that traces back from the current transaction time to depict a user's long-term, stable trading habits. Furthermore, the length of the second historical time window is longer than that of the first historical time window. The second historical time window can be a fixed time interval tracing back six months from the current transaction time, 90 days from the current transaction time, or 30 days from the current transaction time. The long-term trading feature sequence includes the trading characteristics of multiple transactions by the trading account within the second historical time window, but the transaction to be identified at the moment is not included in the long-term trading feature sequence. The expression for the long-term trading feature sequence can be: ;in, Represents a long-term transaction characteristic sequence. This represents the transaction feature of the nth transaction in the long-term transaction feature sequence, and the transaction feature has multiple feature dimensions.

[0047] Furthermore, there are two ways to obtain the short-term and long-term transaction characteristic sequences of a transaction account. The first method is when the user initiates a critical business transaction such as payment, transfer, or contract signing (at which point the user has confirmed the payment and the transaction instruction has been issued, but the funds have not yet been actually transferred out), such as... Figure 3 The risk control platform shown treats this transaction instruction as a trigger signal and extracts current transaction information in real time. Simultaneously, it invokes the anomaly identification method of this embodiment to obtain the short-term and long-term transaction characteristic sequences of the corresponding transaction account on the user's end. By evaluating the anomaly in real time, it achieves proactive interception of abnormal transactions. The risk control platform refers to an integrated intelligent management and control system that addresses transaction and account security, enabling automatic anomaly identification, intelligent decision-making, and anomaly tracing.

[0048] The second method of acquisition refers to targeting suspicious transaction accounts, such as... Figure 3 The risk control platform, as shown, proactively and specifically acquires the short-term and long-term transaction characteristic sequences of this trading account at preset detection intervals to conduct an in-depth anomaly investigation, rather than waiting for the next transaction of this trading account to trigger the risk control platform.

[0049] Step 202: Extract the first internal correlation feature of the short-term trading feature sequence and the second internal correlation feature of the long-term trading feature sequence respectively.

[0050] The first internal correlation feature refers to the real-time behavioral representation obtained after feature learning from the short-term transaction feature sequence. By learning features from the short-term transaction feature sequence, we can focus on a small number of transactions within a recent period of the trading account, highlighting the latest, most immediate, and most volatile behavioral features to form a feature snapshot that reflects the current behavioral state of the trading account. Specifically, a self-attention mechanism can be used to extract the short-term transaction feature sequence.

[0051] Similarly, the second internal correlation feature refers to the overall behavioral representation obtained after feature learning from the long-term trading feature sequence. By learning features from the long-term trading feature sequence, the stable, long-term, and habitual trading behaviors of the trading account can be fully learned and extracted, forming a feature space that can represent the normal behavioral benchmark of the trading account. Specifically, the long-term trading feature sequence can also be extracted through a self-attention mechanism.

[0052] It should be noted that, as Figure 3 As shown, this embodiment extracts the first internal correlation feature of the short-term transaction feature sequence and the second internal correlation feature of the long-term transaction feature sequence using parallel encoders (i.e., two parallel self-attention mechanism encoders). The self-attention mechanism is a feature encoding method that allows each feature in a single sequence to be correlated with features at all other positions in the sequence, thereby automatically learning and extracting global contextual dependencies. The self-attention mechanism calculates the correlation between elements within the sequence, dynamically assigns different attention weights to each element, and then weights and fuses the features of all elements according to these weights, ultimately generating a new feature representation that incorporates global contextual information. Using the self-attention mechanism to process the short-term and long-term transaction feature sequences separately can suppress interference from irrelevant information, automatically learn the global contextual correlations within these two types of sequences, and deeply mine the transaction features of the trading account within the first historical time window and the second historical time window. This ensures both the stability and representativeness of the second internal correlation feature and retains the sensitivity and timeliness of the first internal correlation feature, providing high-quality feature support for subsequent difference operations and effectively improving the accuracy and robustness of the anomaly detection model in identifying abnormal transactions.

[0053] Step 203: Map the first internal correlation feature to the feature space of the second internal correlation feature through the mutual attention mechanism to obtain the correlation representation feature.

[0054] Mutual attention mechanism refers to an encoding method that establishes feature associations between two different sequences. One sequence is used as the query basis and the other sequence is used as the reference. Cross-sequence attention weights are generated by calculating the correlation between elements in the two sequences. The features of the reference sequence are then weighted and fused according to the weights to obtain a feature representation that incorporates the contextual information of the external sequence, thereby realizing information interaction and feature alignment between different sequences.

[0055] Understandingly, mapping the first internal correlation feature to the feature space of the second internal correlation feature through the mutual attention mechanism is equivalent to using the current behavioral state (corresponding to the first internal correlation feature) to query the historical behavioral benchmark (corresponding to the second internal correlation feature), identifying which parts of the current behavioral state are most relevant to the historical behavioral benchmark, and then mapping the current behavioral state to the feature space corresponding to the historical behavioral benchmark. This achieves deep alignment between the first and second internal correlation features, resulting in correlation representation features. Through this process, deep synergy between long-term and short-term transaction features can be achieved, facilitating subsequent measurement of the degree of deviation between long-term and short-term transaction features.

[0056] Specifically, the essence of association representation features refers to the weighted fusion representation of the current behavioral state in the feature space corresponding to the historical behavioral benchmark. Association representation features can also be understood as a re-description of the current behavioral state from the perspective of the historical behavioral benchmark. Through association representation features, the semantic matching degree between the first and second internal association features can be clearly defined.

[0057] Step 204: Perform a difference operation on the first internal correlation feature and the correlation representation feature to obtain the offset residual vector.

[0058] It should be noted that both the first internal correlation feature and the correlation representation feature are feature vectors with multiple feature dimensions. These feature dimensions include transaction amount, transaction timestamp, transaction currency, transaction type, transaction channel, historical transaction frequency, and transaction location. Performing a difference operation on the first internal correlation feature and the correlation representation feature means subtracting from each feature dimension of the first internal correlation feature and the correlation representation feature to obtain the deviation value for each feature dimension, i.e., the offset residual vector. The offset residual vector can be used to represent the difference between the current behavioral state and the historical behavioral benchmark.

[0059] Understandably, compared to traditional feature concatenation methods, differential operations on the first internal correlation feature and the correlation representation feature can explicitly extract and enhance the offset between the current behavioral state and the historical behavioral benchmark. By performing differential operations on the first internal correlation feature and the correlation representation feature, the degree of offset of the real-time trading behavior of a trading account relative to its steady-state historical long-term trading behavior can be accurately captured. Residual modeling significantly improves the sensitivity of the anomaly identification model to abnormal disturbances, providing highly interpretable support for subsequent anomaly identification.

[0060] Step 205: Determine the anomaly score of the trading account based on the offset residual vector, and identify anomalies in the trading account based on the anomaly score.

[0061] The anomaly score is a rating used by users to measure the degree of anomaly in a trading account. A higher anomaly score indicates a higher degree of anomaly, and vice versa.

[0062] As can be understood, as mentioned above, the offset residual vector represents the deviation of the current behavioral state from the historical behavioral benchmark in each feature dimension, and the deviation value of each feature dimension represents the degree of deviation of the current behavioral state of the trading account from the historical benchmark in that feature dimension. In other words, the offset residual vector directly reflects whether an abnormal deviation has occurred and the specific triggering factor for the abnormality. Based on this, the anomaly score of the trading account can be determined according to the deviation values ​​of each feature dimension in the offset residual vector. Generally speaking, the more feature dimensions with deviations (e.g., deviations in transaction amount, transaction timestamp, transaction currency, and transaction frequency) and the larger the deviation value (e.g., a sudden increase of tens or even hundreds of times in transfer amount), the higher the anomaly score of the trading account. Similarly, the fewer feature dimensions with deviations and the smaller the deviation value, the lower the anomaly score of the trading account.

[0063] Furthermore, this embodiment of the disclosure also presets multiple abnormal score thresholds for judging whether the abnormal scores of a transaction account are within the tolerable range. Generally, the abnormality of a transaction account can be determined by comparing the abnormal score with the abnormal score threshold. For example, there is a first abnormal score threshold of 0.8 and a second abnormal score threshold of 0.6. If the abnormal score is greater than or equal to the first abnormal score threshold, it indicates that the transaction account is abnormal and needs to be dealt with. If the abnormal score is greater than or equal to the second abnormal score threshold but less than the first abnormal score threshold, it indicates that the transaction account may be abnormal and needs to be monitored by the system. If the abnormal score is less than the second abnormal score threshold, it indicates that the transaction account is not abnormal and can be allowed to proceed normally. By setting clear abnormal score thresholds, the system's decision-making becomes clearer and more interpretable, accurately reflecting the degree of abnormality.

[0064] Based on this, by acquiring the short-term and long-term transaction feature sequences of a trading account, and extracting the first internal correlation feature of the short-term sequence and the second internal correlation feature of the long-term sequence, interference from irrelevant information can be suppressed, and the trading features of the trading account within the first and second historical time windows can be deeply mined. Then, through a mutual attention mechanism, the first internal correlation feature is mapped to the feature space of the second internal correlation feature, resulting in a weighted fusion representation of the trading features of the trading account within the first historical time window in the feature space of the second internal correlation feature, i.e., the correlation representation feature. The semantic matching degree between the first and second internal correlation features can be clearly defined through the correlation representation feature. Furthermore, by performing a difference operation on the first internal correlation feature and the correlation representation feature, the offset between the recent and long-term trading behaviors of the trading account can be deeply mined, accurately capturing the degree of deviation of the trading account's real-time trading behavior relative to its steady-state historical long-term trading behavior. This provides highly interpretable support for subsequent anomaly identification. Finally, the anomaly score of the trading account can be comprehensively determined based on the offset residual vector obtained in the previous step, and anomaly identification of the trading account can be performed based on the anomaly score. This embodiment of the disclosure, through the aforementioned behavior deviation mining mechanism for short-term and long-term transaction feature sequences of a single transaction account, can effectively capture the micro-anomalies of a transaction account and effectively improve the accuracy of identifying transaction accounts with short-term behavior changes and potential anomalies.

[0065] It is worth noting that the original short-term and long-term transaction feature sequences of the trading account are extracted by the risk control platform from the trading account, and may contain issues such as missing data, noise interference, inconsistent units, and inconsistent sequence lengths. Therefore, before extracting the first internal correlation feature of the short-term transaction feature sequence and the second internal correlation feature of the long-term transaction feature sequence, preprocessing of the original short-term and long-term transaction feature sequences is required. The preprocessing process is described in detail below.

[0066] In one possible implementation, the first internal correlation feature of the short-term trading feature sequence and the second internal correlation feature of the long-term trading feature sequence are extracted respectively. Specifically, the short-term trading feature sequence and the long-term trading feature sequence are preprocessed to obtain the processed short-term trading feature sequence and the processed long-term trading feature sequence respectively; the first internal correlation feature of the processed short-term trading feature sequence is extracted using a self-attention mechanism; and the second internal correlation feature of the processed long-term trading feature sequence is extracted using a self-attention mechanism.

[0067] Understandably, preprocessing refers to addressing various data quality issues present in the original short-term and long-term transaction feature sequences (these issues include, but are not limited to, missing data, noise interference, inconsistent dimensions, and inconsistent sequence lengths). Specifically, preprocessing includes standardization, completion, denoising, and normalization. The preprocessed short-term transaction feature sequence refers to the feature sequence obtained after preprocessing the short-term transaction feature sequence; similarly, the preprocessed long-term transaction feature sequence refers to the feature sequence obtained after preprocessing the long-term transaction feature sequence.

[0068] It should be noted that by preprocessing the short-term and long-term transaction feature sequences separately, the messy raw data can be transformed into a regular, reliable, and effective data form. This not only effectively eliminates the interference of invalid information in the short-term and long-term transaction feature sequences on subsequent steps, but also unifies the data format and feature range, facilitating the provision of high-quality input data for subsequent steps such as self-attention mechanism operations and mutual attention mechanism operations.

[0069] Furthermore, such as Figure 4 As shown, the anomaly recognition model using the anomaly recognition method of this disclosure includes two parallel self-attention layers. Based on this, after obtaining the processed short-term transaction feature sequence and the processed long-term transaction feature sequence, the processed short-term transaction feature sequence can be input into one of the self-attention layers, and the processed long-term transaction feature sequence can be input into the other self-attention layer, respectively, to extract the behavioral dependencies within the processed short-term transaction feature sequence and the behavioral dependencies within the processed long-term transaction feature sequence.

[0070] Specifically, the first internal correlation feature of the processed short-term trading feature sequence is extracted using a self-attention mechanism. This involves calculating the correlation between elements within the processed short-term trading feature sequence and dynamically assigning different attention weights to each element, ensuring that each element in the processed short-term trading feature sequence pays attention to other elements in the sequence. Then, the features of all elements are weighted and fused according to these weights to ultimately learn the global contextual dependencies in the short-term trading feature sequence, which represent the core trading features of the trading account in recent trading behavior. Similarly, the second internal correlation feature of the processed long-term trading feature sequence is extracted using a self-attention mechanism. This involves calculating the correlation between elements within the processed long-term trading feature sequence and dynamically assigning different attention weights to each element, ensuring that each element in the processed long-term trading feature sequence pays attention to other elements in the long-term trading feature sequence. Then, the features of all elements are weighted and fused according to these weights to ultimately learn the global contextual dependencies in the long-term trading feature sequence, which represent the stable trading features of the trading account over a long historical period (which can also be understood as a reference standard for the normal behavior of the trading account).

[0071] Understandably, by performing self-attention operations on the processed short-term and long-term trading feature sequences separately using parallel self-attention layers, interference from irrelevant information can be suppressed. This automatically focuses on and extracts the first internal correlation feature that best reflects the trading account's recent trading habits, and the second internal correlation feature that best reflects the trading account's stable trading habits over a past period. This approach ensures both the stability and representativeness of the second internal correlation feature and retains the sensitivity and timeliness of the first internal correlation feature, providing high-quality feature support for subsequent difference operations and effectively improving the accuracy and robustness of the anomaly detection model in identifying abnormal transactions.

[0072] In one possible implementation, the short-term and long-term trading feature sequences are preprocessed separately to obtain processed short-term and long-term trading feature sequences. Specifically, if the length of the short-term trading feature sequence does not reach a preset first sequence length threshold, placeholder vectors are added to the ends of the short-term trading feature sequence until the length of the short-term trading feature sequence reaches the first sequence length threshold; if the length of the long-term trading feature sequence does not reach a preset second sequence length threshold, placeholder vectors are added to the ends of the long-term trading feature sequence until the length of the long-term trading feature sequence reaches the second sequence length threshold; scale normalization is then performed on the short-term and long-term trading feature sequences respectively to obtain processed short-term and long-term trading feature sequences.

[0073] The first sequence length threshold refers to the length of the trading sequence used to determine whether a short-term trading feature sequence needs to be padded with a placeholder vector. The second sequence length threshold refers to the length of the trading sequence used to determine whether a long-term trading feature sequence needs to be padded with a placeholder vector. Furthermore, the second sequence length threshold is generally greater than the first sequence length threshold. The placeholder vector is a zero-value feature vector used to fill short-term / long-term trading feature sequences that have not reached the first / second sequence length thresholds.

[0074] It is understandable that if the length of the short-term trading feature sequence does not reach the preset first sequence length threshold, it indicates that the length of the short-term trading feature sequence is insufficient to support subsequent self-attention operations. Based on this, placeholder vectors can be added to the ends of the short-term trading feature sequence until the length of the short-term trading feature sequence reaches the first sequence length threshold. The ends of the short-term trading feature sequence can be either the beginning or the end of the short-term trading feature sequence. Specifically, adding placeholder vectors to the end of the short-term trading feature sequence can be expressed by the following formula: The placeholder vector added to the head of the short-term trading feature sequence can be expressed by the following formula: ;in, Represents a short-term trading characteristic sequence. This represents the transaction feature of the nth transaction in the short-term transaction feature sequence, with 0 indicating a placeholder vector. This process forces the variable-length sequence into a fixed-length feature tensor, thus satisfying the consistency requirements of the input data tensor shape and the computational needs of subsequent deep learning models.

[0075] For example, if the first sequence length threshold is 8, the short-term trading feature sequence is: Therefore, the length of the short-term trading feature sequence is 5. Since the length of the short-term trading feature sequence does not reach the preset first sequence length threshold, placeholder vectors can be added to the beginning or end of the short-term trading feature sequence until the length of the short-term trading feature sequence reaches 8. The short-term trading feature sequence with added placeholder vectors can be... It can also be used as .

[0076] Similarly, if the length of the long-term trading feature sequence does not reach the preset second sequence length threshold, it indicates that the length of the long-term trading feature sequence is insufficient to support subsequent self-attention operations. Therefore, placeholder vectors can be added to the ends of the long-term trading feature sequence until its length reaches the second sequence length threshold. The ends of the long-term trading feature sequence can be either the beginning or the end. Specifically, adding placeholder vectors to the end of the long-term trading feature sequence can be expressed by the following formula: The placeholder vector added to the head of the long-term trading feature sequence can be expressed by the following formula: ;in, Represents a long-term transaction characteristic sequence. This represents the transaction feature of the nth transaction in a long-term transaction feature sequence, with 0 indicating a placeholder vector. This process forces the variable-length sequence into a fixed-length feature tensor, thus satisfying the consistency requirements of the input data tensor shape and the computational needs of subsequent deep learning models.

[0077] In another embodiment, if the length of the short-term transaction feature sequence exceeds a first sequence length threshold, the transaction features of transactions farther from the current time in the short-term transaction feature sequence can be truncated until the length of the short-term transaction feature sequence equals the first sequence length threshold. If the length of the long-term transaction feature sequence exceeds a second sequence length threshold, the transaction features of transactions closer to the current time in the long-term transaction feature sequence can be truncated until the length of the long-term transaction feature sequence equals the second sequence length threshold.

[0078] Understandably, scale normalization refers to a feature standardization method that maps transaction features with different dimensions and numerical ranges to the same numerical interval to eliminate dimensional differences. In the original short-term and long-term transaction feature sequences, features of different dimensions not only have inconsistent dimensions but also significantly different numerical ranges. Therefore, scale normalization is required for both short-term and long-term transaction feature sequences. This means mapping all transaction features of each dimension in the short-term sequence to the same numerical interval, and vice versa. This process effectively eliminates the impact of differences in dimensions and numerical values, allowing feature values ​​of each dimension to participate equally in the anomaly detection model, thus improving the stability of subsequent mutual attention and difference operations.

[0079] In one possible implementation, scaling normalization is performed on both the short-term and long-term trading feature sequences to obtain processed short-term and long-term trading feature sequences. Specifically, for each trade in the short-term trading feature sequence, the first average value of the feature dimension across all trades in the short-term trading feature sequence is calculated. The difference between the feature value corresponding to the feature dimension and the first average value is then divided by the standard deviation of the feature dimension across all trades in the short-term trading feature sequence to obtain the first processed feature dimension. The first processed feature dimensions of each trade in the short-term trading feature sequence are then integrated to obtain the processed short-term trading feature sequence. For each trade in the long-term trading feature sequence, the second average value of the feature dimension across all trades in the long-term trading feature sequence is calculated. The difference between the feature value corresponding to the feature dimension and the second average value is then divided by the standard deviation of the feature dimension across all trades in the long-term trading feature sequence to obtain the second processed feature dimension. The second processed feature dimensions of each trade in the long-term trading feature sequence are then integrated to obtain the processed long-term trading feature sequence.

[0080] Transaction features have multiple dimensions, such as transaction amount, transaction timestamp, transaction currency, transaction type, transaction channel, historical transaction frequency, and transaction location. In a short-term transaction feature sequence, the j-th feature dimension of the i-th transaction can be represented as... In a long-term trading feature sequence, the j-th feature dimension of the i-th trading feature can be represented as: .

[0081] It should be noted that, as mentioned above, in the original short-term and long-term transaction feature sequences, the features of different feature dimensions not only have inconsistent dimensions but also significantly different numerical ranges. Therefore, it is necessary to perform scale normalization on both the short-term and long-term transaction feature sequences separately. Here, we will explain the "scale normalization of the short-term transaction feature sequence" process using a formula: For the j-th feature dimension (e.g., transaction amount) of the i-th transaction in the short-term transaction feature sequence, first calculate the average value of the j-th feature dimension of all transactions in the entire short-term transaction feature sequence. ,this This is the first average value. Then, the eigenvalue corresponding to the j-th dimension of the i-th transaction in the short-term transaction feature sequence is... Subtract the first average The difference obtained Divide by the standard deviation of the j-th feature dimension of all transactions in the entire short-term trading feature sequence. The first processed feature dimension (i.e., the j-th feature dimension of the i-th transaction after normalization in the short-term transaction feature sequence) is obtained as follows: For each transaction in the short-term transaction feature sequence, the various first-processed feature dimensions of this transaction can be integrated to obtain the processed transaction features. Then, by integrating all the processed transaction features in the short-term transaction feature sequence, the processed short-term transaction feature sequence can be obtained. This processed short-term transaction feature sequence refers to the short-term transaction feature sequence after normalization.

[0082] Here, we'll explain the process of "scale normalization of the long-term trading feature sequence" using a formula: For the j-th feature dimension (e.g., transaction frequency) of the i-th transaction in the long-term trading feature sequence, we first calculate the average value of the j-th feature dimension of all transactions in the entire long-term trading feature sequence. ,this This is the second average value. Then, the eigenvalue corresponding to the j-th dimension of the i-th transaction in the long-term transaction feature sequence is... Subtract the second average The difference obtained Divide by the standard deviation of the j-th feature dimension of all transactions in the entire long-term transaction feature sequence. The second processed feature dimension (i.e., the j-th feature dimension of the i-th transaction after normalization in the long-term transaction feature sequence) is obtained as follows: For each transaction in the long-term transaction feature sequence, the various second-processed feature dimensions of this transaction can be integrated to obtain the processed transaction features. Then, by integrating all the processed transaction features in the long-term transaction feature sequence, the processed long-term transaction feature sequence can be obtained. This processed long-term transaction feature sequence refers to the long-term transaction feature sequence after normalization.

[0083] Understandably, by performing scale normalization on the short-term and long-term trading feature sequences respectively, the impact of differences in dimensions and numerical values ​​in the short-term and long-term trading feature sequences can be effectively eliminated. This allows the feature values ​​of each feature dimension in the short-term and long-term trading feature sequences to participate equally in the calculation in the anomaly identification model, thereby improving the stability of subsequent mutual attention and difference operations.

[0084] In one possible implementation, a first internal association feature is extracted from the processed short-term transaction feature sequence using a self-attention mechanism. Specifically, the processed short-term transaction feature sequence is projected into a first query vector, a first key vector, and a first value vector, respectively. A first similarity score is calculated based on the first query vector and the first key vector, and the first similarity score is calculated using a normalization function to obtain a first attention weight. The first value vector is then weighted and summed using the first attention weight to obtain the first internal association feature.

[0085] The first query vector is an element vector used to query other elements in the processed short-term transaction feature sequence. The first query vector can be obtained by linearly projecting the processed short-term transaction feature sequence. The formula for calculating the first query vector is as follows: ;in, This represents the first query vector; This represents the short-term transaction characteristic sequence after processing; This represents the learnable weight matrix.

[0086] The first key vector represents the element vector in the processed short-term transaction feature sequence that is queried by other elements. The first key vector can also be obtained by linearly projecting the processed short-term transaction feature sequence. The formula for calculating the first key vector is as follows: ;in, Represents the first key vector; This represents the short-term transaction characteristic sequence after processing; This also represents a learnable weight matrix.

[0087] The first value vector is the information vector used for weighted fusion during self-attention operations on the processed short-term trading feature sequence. The first value vector can also be obtained by linearly projecting the processed short-term trading feature sequence. The formula for calculating the first value vector is as follows: ;in, Represents the first value vector; This represents the short-term transaction characteristic sequence after processing; This also represents a learnable weight matrix.

[0088] Understandably, the first similarity score is a value used to measure the similarity between each element in the first query vector and each element in the first key vector, and can be calculated based on the first query vector and the first key vector. Specifically, the formula for calculating the first similarity score can be: ;in, This represents the first similarity score; This represents the first query vector; The transpose of the first key vector is represented by this matrix. This represents the scaling factor, used to prevent saturation of the results in subsequent normalization processing.

[0089] The first attention weight is a numerical value used to measure the correlation between elements within the processed short-term transaction feature sequence. A higher first attention weight indicates a stronger correlation. The first attention weight can be obtained by calculating the first similarity score using a normalization function. Specifically, the formula for calculating the first attention weight can be expressed as: ;in, Indicates the first attention weight; Represents the normalization function; This represents the first similarity score; This represents the first query vector; The transpose of the first key vector is represented by this matrix. This represents the scaling factor.

[0090] Finally, by using the first attention weights to perform a weighted summation of the first value vector, we can obtain the context-aware identifier for each position in the processed short-term trading feature sequence, i.e., the first internal correlation feature. Specifically, the calculation formula for the first internal correlation feature can be expressed as: ;in, Indicates the first internal association feature; Indicates the first attention weight; Represents the normalization function; This represents the first query vector; The transpose of the first key vector is represented by this matrix. Indicates the scaling factor; This represents the first value vector.

[0091] Understandably, by employing a self-attention mechanism to process the processed short-term transaction feature sequence, interference from irrelevant information can be suppressed, and the global contextual relationships within the processed short-term transaction feature sequence can be automatically learned, allowing for in-depth mining of the transaction characteristics of the trading account within the first historical time window. This approach preserves the sensitivity and timeliness of the first internal correlation features, providing high-quality feature support for subsequent difference operations and effectively improving the accuracy and robustness of the anomaly detection model in identifying abnormal transactions.

[0092] In one possible implementation, a second internal association feature is extracted from the processed long-term transaction feature sequence using a self-attention mechanism. Specifically, the processed long-term transaction feature sequence can be projected into a second query vector, a second key vector, and a second value vector, respectively. A second similarity score is calculated based on the second query vector and the second key vector, and the second similarity score is calculated using a normalization function to obtain the second attention weight. The second attention weight is then used to perform a weighted summation of the second value vector to obtain the second internal association feature.

[0093] The second query vector is an element vector used to query other elements in the processed long-term transaction feature sequence. The second query vector can be obtained by linearly projecting the processed long-term transaction feature sequence. The formula for calculating the second query vector is as follows: ;in, This represents the second query vector; This represents the long-term transaction feature sequence after processing; This represents the learnable weight matrix.

[0094] The second key vector represents the element vector in the processed long-term transaction feature sequence that is queried by other elements. The second key vector can also be obtained by linearly projecting the processed long-term transaction feature sequence. The formula for calculating the second key vector is as follows: ;in, Represents the second key vector; This represents the long-term transaction feature sequence after processing; This also represents a learnable weight matrix.

[0095] The second value vector is the information vector used for weighted fusion during self-attention operations on the processed long-term trading feature sequence. The second value vector can also be obtained by linearly projecting the processed long-term trading feature sequence. The formula for calculating the second value vector is as follows: ;in, Represents the second value vector; This represents the long-term transaction feature sequence after processing; This also represents a learnable weight matrix.

[0096] Understandably, the second similarity score is a value used to measure the similarity between each element in the second query vector and each element in the second key vector. It can be calculated based on the second query vector and the second key vector. Specifically, the formula for calculating the second similarity score is: ;in, This represents the second similarity score; This represents the second query vector; The transpose of the second key vector is represented by this matrix. This represents the scaling factor, used to prevent saturation of the results in subsequent normalization processing.

[0097] The second attention weight is a numerical value used to measure the correlation between elements within the processed long-term transaction feature sequence. A larger second attention weight indicates a stronger correlation. The second attention weight can be obtained by calculating the second similarity score using a normalization function. Specifically, the formula for calculating the second attention weight can be expressed as: ;in, Indicates the second attention weight; Represents the normalization function; This represents the second similarity score; This represents the second query vector; The transpose of the second key vector is represented by this matrix. This represents the scaling factor.

[0098] Finally, by using the second attention weights to perform a weighted summation of the second value vector, we can obtain the context-aware identifier for each position in the processed long-term transaction feature sequence, i.e., the second internal correlation feature. Specifically, the calculation formula for the second internal correlation feature can be expressed as: ;in, Indicates the second internal association feature; Indicates the second attention weight; Represents the normalization function; This represents the second query vector; The transpose of the second key vector is represented by this matrix. Indicates the scaling factor; This represents the second value vector.

[0099] Understandably, by employing a self-attention mechanism to process the long-term transaction feature sequence after processing, interference from irrelevant information can be suppressed, and the global contextual relationships within the processed long-term transaction feature sequence can be automatically learned, allowing for in-depth mining of the transaction characteristics of the trading account within the second historical time window. This ensures the stability and representativeness of the second internal correlation features, providing high-quality feature support for subsequent difference operations, and effectively improving the accuracy and robustness of the anomaly detection model in identifying abnormal transactions.

[0100] In one possible implementation, a mutual attention mechanism is used to map the first internal association feature to the feature space of the second internal association feature to obtain the association representation feature. Specifically, the first internal association feature is projected as a third query vector, and the second internal association feature is projected as a third key vector and a third value vector, respectively. A third similarity score is calculated based on the third query vector and the third key vector, and the third similarity score is calculated using a normalization function to obtain the third attention weight. The third attention weight is then used to perform a weighted summation of the third value vector to obtain the association representation feature.

[0101] The third query vector is an element vector used to query the correlation between the short-term and long-term behaviors of a trading account. The third query vector can be obtained by linearly projecting the first internal correlation feature. The formula for calculating the third query vector is as follows: ;in, This represents the third query vector; Indicates the first internal association feature; This represents the learnable weight matrix.

[0102] The third key vector represents the element vector in the second internal association feature that is queried by the element in the first internal association feature. The third key vector can be obtained by linearly projecting the second internal association feature. The formula for calculating the third key vector is: ;in, Represents the third bond vector; Indicates the second internal association feature; This also represents a learnable weight matrix.

[0103] The third value vector is the information vector used for weighted fusion when performing mutual attention operations on the first and second internal correlation features. The third value vector can also be obtained by linearly projecting the second internal correlation feature. The formula for calculating the third value vector is as follows: ;in, Represents a third-valued vector; Indicates the second internal association feature; This also represents a learnable weight matrix.

[0104] Understandably, the third similarity score is a value used to measure the similarity between each element in the first internal association feature and each element in the second internal association feature. It can be calculated based on the third query vector and the third key vector. Specifically, the formula for calculating the third similarity score is as follows: in, This represents the third similarity score; This represents the third query vector; The transpose of the third key vector; This represents the scaling factor, used to prevent saturation of the results in subsequent normalization processing.

[0105] The third attention weight is a numerical value used to measure the degree of attention (or correlation) that current behavior (i.e., short-term behavioral habits) pays to historical behavior (i.e., long-term behavioral habits). A higher third attention weight indicates a stronger correlation between the first and second internal correlation features. Specifically, the formula for calculating the third attention weight can be expressed as: ;in, Indicates the third attention weight; Represents the normalization function; This represents the third similarity score; This represents the third query vector; The transpose of the third key vector; This represents the scaling factor.

[0106] Finally, by using the third attention weights to perform a weighted summation of the third value vector, we can obtain the weighted fusion representation of the recent trading behavior features of the trading account in the historical benchmark habit feature space constructed based on the long-term trading behavior of the trading account, i.e., the correlation representation features. Specifically, the calculation formula for the correlation representation features can be expressed as follows: ;in, Indicates the characteristics of association; Indicates the third attention weight; Represents the normalization function; This represents the third query vector; The transpose of the third key vector; Indicates the scaling factor; This represents the third value vector.

[0107] It's worth noting that mapping the first internal correlation feature to the feature space of the second internal correlation feature through the mutual attention mechanism is essentially using the current behavioral state to query the historical behavioral benchmark, identifying which parts of the current behavioral state are most relevant to the historical benchmark, and then mapping the current behavioral state to the feature space corresponding to the historical benchmark. This achieves deep alignment between the first and second internal correlation features, resulting in correlation representation features. This approach enables deep synergy between long-term and short-term transaction features, facilitating subsequent measurement of the degree of deviation between them.

[0108] In one possible implementation, a difference operation is performed on the first internal correlation feature and the correlation representation feature to obtain an offset residual vector. Specifically, for each feature dimension, the feature value of the feature dimension in the first internal correlation feature and the feature value of the feature dimension in the correlation representation feature are differentially operated to obtain the offset corresponding to the feature dimension; the offsets corresponding to each feature dimension are integrated to obtain the offset residual vector.

[0109] The first internal correlation feature and the correlation representation feature have the same feature dimensions. That is, if the feature dimensions of the first internal correlation feature include transaction amount, transaction frequency, transaction currency, transaction type, and transaction timestamp, then the feature dimensions of the correlation representation feature also include transaction amount, transaction frequency, transaction currency, transaction type, and transaction timestamp.

[0110] Understandably, the offset residual vector aims to quantify the difference between the current short-term trading feature sequence of a trading account and its projection mapping in the long-term historical benchmark feature space. Based on this, a difference operation can be performed on each feature dimension of the first internal correlation feature and the correlation representation feature to obtain the deviation value on each feature dimension, i.e., the offset residual vector. The formula for calculating the offset residual vector is as follows: ;in, Represents the offset residual vector; Indicates the first internal association feature; This indicates the characteristics of association.

[0111] Specifically, for each feature dimension of the first internal correlation feature / correlation representation feature, the difference between the feature value of this feature dimension in the first internal correlation feature and the feature value of the feature dimension in the correlation representation feature can be calculated to obtain the offset corresponding to this feature dimension. Through the offset corresponding to the feature dimension, the changes of the feature dimension in the real-time trading behavior of the trading account relative to the feature dimension in its steady-state historical long-term behavior can be clearly identified. Furthermore, by integrating the offsets corresponding to each feature dimension, an offset residual vector is obtained, which can accurately capture the difference between the current behavioral state and the historical behavioral benchmark. Residual modeling significantly improves the sensitivity of the anomaly identification model to abnormal disturbances, providing highly interpretable support for subsequent anomaly identification.

[0112] In one possible implementation, the anomaly score of a trading account is determined based on the offset residual vector. Specifically, the offset residual vector is multiplied by a preset first weight matrix and a preset first bias is added to obtain a first linear transformation result. The first linear transformation result is then calculated using an activation function to obtain the anomaly score of the trading account.

[0113] The first weight matrix is ​​as follows: Figure 4 The learnable weight matrix in the fully connected layer for anomaly scoring, as shown, maps the offset residual vector to an intermediate feature space, preparing it for subsequent activation functions. Furthermore, the first weight matrix is ​​continuously updated through backpropagation during the training of the anomaly detection model to learn the feature representation that best characterizes the anomaly score. The first bias is a learnable bias vector corresponding to the first weight matrix, used to adjust the offset of the linear transformation; this first bias enhances the expressive power of the anomaly detection model.

[0114] Understandably, the offset residual vector can first be linearly projected onto it using a learnable first weight matrix (i.e., multiplying the offset residual vector by the preset first weight matrix), mapping it to a more discriminative intermediate feature space to extract key features highly correlated with anomaly scores. Then, the output offset of the linear transformation can be adjusted using a first bias to obtain the first linear transformation result. Specifically, the first linear transformation result can be expressed as... ;in, This represents the first weight matrix; Represents the offset residual vector; This indicates the first bias.

[0115] It is worth noting that an activation function is a continuously differentiable, monotonically increasing nonlinear function that maps any real-valued vector input to a value within the interval from zero to one. This function can transform the offset residual vector into a probabilistic value. The activation function can also be used to calculate the result of the first linear transformation, compressing it to the [0,1] interval as an anomaly score. Specifically, the formula for calculating the anomaly score can be: ;in, Indicates abnormal rating; Indicates the activation function; Let represent the result of the first linear transformation, where This represents the first weight matrix; Represents the offset residual vector; This indicates the first bias.

[0116] It should be noted that using the activation function to calculate the anomaly score of the trading account can not only amplify the differences in features and improve the sensitivity of risk identification, but also, as a continuous probability value, the anomaly score can facilitate the subsequent determination of the anomaly level based on multiple anomaly score thresholds, making the anomaly identification results more intuitive and interpretable.

[0117] In one possible implementation, anomaly identification of trading accounts is performed based on anomaly scores. Specifically, if the anomaly score reaches a preset first anomaly score threshold, it can be determined that the trading account is abnormal. After anomaly identification of trading accounts based on anomaly scores, the method further includes: taking action on the abnormal trading accounts.

[0118] The first anomaly score threshold refers to the minimum anomaly score when a trading account has an anomaly. Generally, the first anomaly score threshold can be set to 0.8.

[0119] Understandably, the presence of anomalies in a trading account can be determined by comparing its anomaly score with a first anomaly score threshold. If the anomaly score reaches the first anomaly score threshold, the account is considered anomaly-free. Conversely, if the anomaly score is below the first anomaly score threshold, the account is either likely to be anomaly-free or not. The specific judgment in this case depends on the anomaly score of the trading account.

[0120] Specifically, this embodiment of the disclosure also presets a second anomaly scoring threshold, which is lower than the first anomaly scoring threshold. If the anomaly score of a trading account is greater than or equal to the second anomaly scoring threshold and less than the first anomaly scoring threshold, it indicates that the trading account may be abnormal. If the anomaly score is less than the second anomaly scoring threshold, it indicates that the trading account is not abnormal. By setting clear first and second anomaly scoring thresholds in this way, the system's decision-making becomes clearer and more interpretable, accurately reflecting the degree of anomaly.

[0121] Furthermore, this embodiment of the disclosure also presets a third anomaly scoring threshold, which is greater than the first anomaly scoring threshold. If the anomaly score of a trading account reaches the first anomaly scoring threshold but is less than the third anomaly scoring threshold, it indicates that the trading account is abnormal, and the degree of abnormality is moderate. If the anomaly score of a trading account reaches the third anomaly scoring threshold, it indicates that the trading account not only is abnormal, but the degree of abnormality is high. By setting a third anomaly scoring threshold, the degree of anomaly of a trading account can be more accurately classified when an anomaly exists, precisely reflecting the urgency of the situation.

[0122] For example, refer to Figure 5 If the first anomaly score threshold is 0.8, the second anomaly score threshold is 0.7, and the third anomaly score threshold is 0.9, and given that trading account 1 has an anomaly score of 0.95, trading account 2 has an anomaly score of 0.1, trading account 3 has an anomaly score of 0.55, trading account 4 has an anomaly score of 0.85, trading account 5 has an anomaly score of 0.73, and trading account 6 has an anomaly score of 0.3, then it can be determined that trading accounts 2, 3, and 6 are not abnormal, trading account 5 may be abnormal, and trading accounts 1 and 4 are abnormal. Furthermore, trading account 1 has a high degree of anomaly, while trading account 4 has a moderate degree of anomaly.

[0123] It's worth noting that after confirming the anomaly identification results for a trading account, actions can be taken based on these results for accounts exhibiting anomalies or those potentially exhibiting anomalies. If an account is potentially anomaly-prone, it needs to be monitored and recorded by the system. If an account exhibits anomalies, and the degree of anomaly is moderate, it needs to be referred to manual verification. If an account exhibits anomalies, and the degree of anomaly is high, immediate action is required.

[0124] In one possible implementation, after determining the anomaly score of a trading account based on the offset residual vector, the method further includes: multiplying the offset residual vector with a preset second weight matrix and adding a preset second bias to obtain a second linear transformation result; and using a normalization function to calculate the second linear transformation result to obtain the anomaly category feature vector corresponding to the trading account.

[0125] The second weight matrix is ​​as follows: Figure 4 The learnable weight matrix in the fully connected layer for anomaly classification, as shown, maps the offset residual vector to an intermediate feature space, preparing for the subsequent normalization function. Furthermore, the second weight matrix is ​​also continuously updated through backpropagation during the training of the anomaly recognition model to learn the feature weight distribution for multi-class tasks. The second bias is a learnable bias vector corresponding to the second weight matrix, used to adjust the offset of the linear transformation. The second bias can improve the fitting ability and stability for multi-class tasks.

[0126] Understandably, firstly, the offset residual vector can be linearly projected using a learnable second weight matrix (i.e., multiplied by the preset second weight matrix), mapping it to an intermediate feature space suitable for multi-classification tasks, and extracting feature labels highly correlated with different anomaly types. Then, the output offset of the linear transformation can be adjusted using a second bias to obtain the second linear transformation result. Specifically, the second linear transformation result can be expressed as... ;in, This represents the second weight matrix; Represents the offset residual vector; This indicates the second bias.

[0127] It is worth noting that a normalization function is a non-linear transformation method that converts any real-valued vector into a probability distribution where all dimensions take values ​​between 0 and 1, and the sum of all dimensions is 1. The normalization function amplifies the proportion of larger values ​​and compresses the proportion of smaller values ​​in the input vector, making the output anomaly category feature vector statistically meaningful. The anomaly category feature vector indicates the probability distribution of each anomaly type. An anomaly type refers to a category with clear business meaning that a transaction account exhibits within the current time window due to behavioral patterns deviating from historical benchmarks, triggering abnormal features, or violating business rules. Anomaly types include fraudulent transactions, money laundering, abnormal transfers, and transaction account theft. The probability distribution of an anomaly type indicates the likelihood that the current anomaly of the transaction account belongs to that anomaly type.

[0128] Specifically, by using a normalization function to calculate the result of the second linear transformation, the result can be converted into a probability distribution where the values ​​of each anomaly type are all between 0 and 1, and the sum of the probability distribution values ​​of all anomaly types is 1. The normalization function can amplify the proportion of larger values ​​and compress the proportion of smaller values ​​in the result of the second linear transformation. The calculation formula for the result of the second linear transformation using the normalization function is as follows: ;in, This represents a multidimensional probability distribution vector, used to indicate the probability distribution of each anomaly type; Represents the normalization function; Denotes the result of the second linear transformation, where, This represents the second weight matrix; Represents the offset residual vector; This indicates the second bias.

[0129] It should be noted that by using the normalization function to calculate the result of the second linear transformation and obtaining the probability distribution of each anomaly type, not only can the feature differences between different anomaly types be amplified and the accuracy of anomaly type identification in multi-classification tasks be improved, but the occurrence probability of each anomaly type can also be quantified, which is convenient for quickly locating the main anomaly types and provides a clear basis for subsequent handling of trading accounts with anomalies.

[0130] In one possible implementation, abnormal trading accounts are handled by extracting the abnormal type with the highest probability distribution from the abnormal category feature vector as the target abnormal type; querying the corresponding handling strategy for the target abnormal type using a preset handling strategy library; and handling the abnormal trading accounts using the handling strategy corresponding to the target abnormal type.

[0131] The handling strategy library stores the corresponding handling strategies for each anomaly type. These strategies refer to the differentiated responses taken to a trading account after an anomaly is identified. By mapping each anomaly type to a handling strategy, rapid control of anomaly-prone trading accounts can be achieved, ensuring account security while maintaining operational efficiency.

[0132] As can be understood, as mentioned above, the anomaly category feature vector is used to indicate the probability distribution of each anomaly type. The anomaly type with the largest probability distribution is the most likely to be the anomaly of that type in the transaction account. Based on this, the anomaly type with the largest probability distribution can be extracted from the anomaly category feature vector as the target anomaly type. This target anomaly type is the anomaly type of the anomaly existing in the transaction account. For example, if the anomaly category feature vector of transaction account 1 indicates a probability distribution of 0.7 for fraudulent transactions, 0.1 for money laundering, 0.15 for abnormal transfers, and 0.05 for account theft, then the anomaly type of fraudulent transactions can be extracted from the anomaly category feature vector as the target anomaly type for transaction account 1.

[0133] Furthermore, since the known handling strategy library stores handling strategies corresponding to various anomaly types, after determining the target anomaly type, the handling strategy library can be queried to determine the corresponding handling strategy. This allows for the handling of the anomaly-affected trading account using the appropriate strategy. For example, the handling strategy for the anomaly type of fraudulent transaction in the handling strategy library is "intercept the transaction and lock the trading account." If the target anomaly type for trading account 1 is fraudulent transaction, then the incomplete transactions of trading account 1 can be intercepted, and trading account 1 can be locked. By establishing a clear mapping relationship between anomaly types and handling strategies, not only can precise measures be taken for different risk characteristics to effectively block risk transmission and ensure transaction security, but every action taken by the system can also be traced and accounted for. This facilitates rapid understanding of the decision-making logic and provides a clear basis for post-event troubleshooting.

[0134] For example, refer to Figure 6 If the target anomaly type for trading account 1 is anomaly type 1, the target anomaly type for trading account 2 is anomaly type 2, the target anomaly type for trading account 3 is anomaly type 3, the target anomaly type for trading account 4 is anomaly type 1, and the target anomaly type for trading account 5 is anomaly type 4, after querying the corresponding handling strategies for the target anomaly types of each trading account using the preset handling strategy library, it can be determined that trading account 1 needs to be handled using handling strategy 1, trading account 2 needs to be handled using handling strategy 2, trading account 3 needs to be handled using handling strategy 3, trading account 4 needs to be handled using handling strategy 1, and trading account 5 needs to be handled using handling strategy 4.

[0135] In another embodiment, if there is a possibility that the trading account is abnormal, although the system will allow the currently incomplete transactions of the trading account, it will keep a record of the trading account for observation until the possibility of the trading account being abnormal is completely ruled out. If it is determined that the trading account is not abnormal, the system will allow the currently incomplete transactions of the trading account.

[0136] In one possible implementation, both the anomaly score and the anomaly category feature vector are determined by the anomaly detection model. The anomaly detection model is trained by: obtaining a training sample set; generating a loss function based on the anomaly detection loss function and the anomaly classification loss function; using account samples, long-term transaction feature samples corresponding to account samples, and short-term transaction feature samples corresponding to account samples in the training sample set as input text, and using account labels and anomaly classification labels corresponding to account samples in the training sample set as expected output text, the anomaly detection model is pre-trained until the loss function converges.

[0137] It's important to note that the anomaly detection model is a deep learning model used to identify whether a trading account exhibits anomalies and the types of such anomalies. Before using the anomaly detection model to identify anomalies in a trading account, it needs to be trained. The training process for the anomaly detection model is explained below: like Figure 7 As shown, the structure of the anomaly detection model needs to be determined first. The structure of the anomaly detection model in this embodiment is known as follows: Figure 4As shown. Next, a training sample set needs to be obtained. The training sample set refers to a collection of multiple training samples, and each training sample in the training sample set has an account sample, a long-term transaction feature sample corresponding to the account sample, a short-term transaction feature sample corresponding to the account sample, an account label corresponding to the account sample, and an anomaly classification label corresponding to the account sample. Here, an account sample refers to an account behavior data unit that simulates the transaction account of a real user. Long-term transaction feature samples refer to the transaction features of multiple transactions of an account sample within a second historical time window, and short-term transaction feature samples refer to the transaction features of multiple transactions of an account sample within a first historical time window. The account label corresponding to the account sample is used to indicate whether the account sample has an anomaly. If the account sample has no anomaly, the value of the account label corresponding to the account sample is 0; if the account sample has an anomaly, the value of the account label corresponding to the account sample is 1. The anomaly classification label corresponding to the account sample is used to indicate the anomaly type of the account sample with anomalies. Moreover, the anomaly classification label is a vector of length equal to the number of anomaly types. In this vector, only the anomaly type corresponding to the account sample has a feature value of 1 in this vector; the feature values ​​of other anomaly types in this vector are all 0. For example, if there are three anomaly types—fraudulent transactions, money laundering, and abnormal transfers—and the anomaly classification labels are in the form of [feature value corresponding to fraudulent transactions, feature value corresponding to money laundering, and feature value corresponding to abnormal transfers], then if account sample 1 corresponds to the fraudulent type, the anomaly classification label for account sample 1 can be determined as [1, 0, 0]. These anomaly classification labels can guide the anomaly identification model to maximize the probability distribution of the anomaly type corresponding to the account sample.

[0138] Furthermore, the loss function measures the difference between the anomaly detection model's anomaly judgment of an account sample and the corresponding account label, as well as the difference between the probability distribution of each anomaly type predicted by the anomaly detection model and the corresponding anomaly classification label. The loss function can be generated based on the anomaly detection loss sub-function and the anomaly classification loss sub-function. The anomaly detection loss sub-function measures the difference between the anomaly detection model's anomaly judgment of an account sample and the corresponding account label, and is determined based on the first probability that the account sample identified by the anomaly detection model is anomaly-prone. The first probability refers to the likelihood that the account sample is anomaly-prone. The anomaly classification loss sub-function measures the difference between the probability distribution of each anomaly type predicted by the anomaly detection model and the corresponding anomaly classification label, and is determined based on the second probability that the account sample identified by the anomaly detection model belongs to each anomaly type. The second probability of an anomaly type refers to the probability that the account sample output by the anomaly detection model belongs to that anomaly type.

[0139] Specifically, a larger anomaly detection loss function indicates a greater discrepancy between the anomaly detection model's judgment of an account sample and the corresponding account label, meaning the model's prediction deviates further from the target. Similarly, a larger anomaly classification loss function indicates a greater discrepancy between the probability distribution of each anomaly type predicted by the anomaly detection model and the corresponding anomaly classification label, meaning the model's prediction deviates further from the target.

[0140] It is worth noting that after determining the loss function, the account samples, the long-term trading feature samples corresponding to the account samples, and the short-term trading feature samples corresponding to the account samples in the training sample set can be used as input text and input into a program such as... Figure 4 In the anomaly detection model shown, the model performs forward computation, outputting the anomaly judgment for account samples and the probability distribution of each anomaly type predicted for the account samples. It then combines this with the account labels and anomaly classification labels corresponding to the account samples in the training sample set, calculating the loss using a loss function. Based on this loss function, backpropagation is performed to update the gradient and weights of the anomaly detection model. This process of forward computation → loss calculation → backpropagation → parameter update is repeated until the loss function converges. Loss function convergence signifies that the accuracy of the anomaly detection model in judging account samples and predicting the probability distribution of each anomaly type has reached its maximum and stabilized. At this point, the anomaly detection model training can be considered complete.

[0141] Specifically, the anomaly detection model is trained using the gradient descent algorithm, which can be expressed by the formula: ; ;in, This represents all learnable parameters in the anomaly detection model, including the first weight matrix, the second weight matrix, the first bias, the second bias, and the weights of the self-attention layer and the mutual attention layer. This represents all learnable parameters in step t; Let represent the learning rate at step t; This indicates that the loss function is applied to learnable parameters. The gradient of the anomaly detection model is calculated using backpropagation. The formula clearly shows that the training process involves calculating the gradient of the anomaly detection model through backpropagation, and then continuously updating the parameters to minimize the loss function.

[0142] In one possible implementation, the anomaly detection loss function is determined as follows: For the training samples that have already participated in training, a first probability is determined that the account sample corresponding to the training sample is anomaly; the logarithm of the first probability is taken, and the product of the logarithm of the first probability and the account label corresponding to the account sample is determined as the first product; the logarithm of the first difference obtained by subtracting the first probability from the first value is taken, and the product of the second difference obtained by subtracting the account label corresponding to the account sample from the first value and the logarithm of the first difference is determined as the second product; the first sum of the first product and the second product is determined, and the sum of the first sums of each training sample that has already participated in training is divided by the number of training samples that have already participated in training to obtain the first sample average loss term; the negative of the first sample average loss term is taken to obtain the anomaly detection loss function.

[0143] Understandably, the anomaly detection loss function uses binary cross-entropy loss to calculate the difference between the anomaly detection model's anomaly judgment for an account sample and the account label corresponding to the account sample. For the th... For each training sample corresponding to an account sample, the first step is to determine the probability that this account sample is an anomaly. This refers to the confidence level output by the anomaly detection model regarding the existence of an anomaly in the account sample. Then, the logarithm of the first probability is obtained. and the logarithm of the first probability Account tags corresponding to account samples product This is determined to be the first product. Specifically, if the account sample does not contain any anomalies, the value of the account label corresponding to the account sample is... The value is 0; if the account sample is abnormal, the value of the account label corresponding to the account sample is 0. The value is 1.

[0144] Furthermore, generally, the first value is 1; the first difference is the difference obtained by subtracting the first probability from the first value; the second difference is the difference obtained by subtracting the account label corresponding to the account sample from the first value; and the second product is the product of the logarithms of the second difference and the first difference. Specifically, the process of calculating the first difference, the second difference, and the second product will be explained here using the calculation formula: First, subtract the first probability from the first value (set to 1). The first difference obtained Taking the logarithm, we can get Then, calculate the first value minus the account label corresponding to the account sample. The difference, to obtain the second difference After that, calculate the second difference. The logarithm of the first difference The product of these two products yields the second product. .

[0145] Finally, determine the first product. and The sum of the second product yields the sum of the first product. Then, the sum of the first sums of each training sample that has already participated in training can be obtained. Divide by the number of training samples that have already participated in the training. The average loss term of the first sample is obtained. This first-sample average loss term can be used to characterize the average difference between the anomaly detection model's anomaly judgment for each training sample and the account label corresponding to the account sample. The anomaly detection loss sub-function needs to guide the anomaly detection model to identify anomalies. Push it as close to 1 as possible to avoid any anomalies. By pushing the anomaly detection loss function as close to zero as possible, the accuracy of anomaly detection can be continuously improved. To transform the problem of maximizing the log-likelihood into an optimization problem of minimizing the loss function, the average loss term of the first sample needs to be negative, resulting in the anomaly detection loss function: .

[0146] It is worth noting that by setting the anomaly recognition loss function as described above, the anomaly recognition model can be guided to push the first probability of anomaly-containing account samples as close to 1 as possible, and push the first probability of non-anomaly-containing account samples as close to 0 as possible, thereby quickly distinguishing between anomaly-containing and non-anomaly-containing account samples.

[0147] In one possible implementation, the anomaly classification loss function is determined as follows: For the training samples that have already participated in training, the second probability that the account sample corresponding to the training sample belongs to each anomaly type is determined; for each anomaly type, the product of the vector value of the anomaly type in the anomaly classification label corresponding to the training sample and the logarithm of the second probability that the account sample corresponding to the training sample belongs to the anomaly type is calculated to obtain a third product; the third products corresponding to each anomaly type are summed to obtain a second sum, and the sum of the second sums of all the training samples that have already participated in training is divided by the number of training samples that have already participated in training to obtain the second sample average loss term; the negative of the second sample average loss term is taken to obtain the anomaly classification loss function.

[0148] The anomaly classification label is a vector of length equal to the total number of anomaly types. In this vector, only the anomaly type corresponding to the account sample has a first-valued feature (usually 1), while the feature values ​​for other anomaly types are second-valued (usually 0). For example, if there are four anomaly types: fraudulent transactions, money laundering, abnormal transfers, and account theft, fraudulent transactions are the first type, money laundering is the second type, abnormal transfers are the third type, and account theft is the fourth type. Furthermore, the anomaly classification label takes the form of [first type, second type, third type, fourth type]. If account sample A corresponds to the money laundering type, then the anomaly classification label for account sample A can be determined as [0, 1, 0, 0].

[0149] Understandably, the anomaly classification loss function uses classification cross-entropy loss to calculate the difference between the probability distribution of each anomaly type predicted by the anomaly recognition model for the account sample and the anomaly classification label corresponding to the account sample. For the training sample set... The account sample corresponding to the training sample first needs to determine which account sample output by the anomaly detection model belongs to the nth training sample. Probability of exception types ,this That is, the account sample belongs to the first The second probability of the exception type.

[0150] Then, regarding the first For exception types, first calculate the first... The account sample corresponding to the training sample belongs to the... Second probability of class exception type The logarithm of the equation yields the following result. Then calculate the first The anomaly classification label corresponding to the training sample is the first one. Vector values ​​of exception types , and the The account sample corresponding to the training sample belongs to the... Logarithm of the second probability of the exception type The product of these products yields the third product as follows: .

[0151] Furthermore, in order to calculate the difference between the probability distribution of each anomaly type for each training sample and the anomaly classification label corresponding to the account sample, for the For each training sample corresponding to an account sample, the third product needs to be calculated for each anomaly type. Summing yields the second sum. ;in, This represents the total number of anomaly types. Then, we need to sum the second sum of the account samples corresponding to the training samples that have already participated in the training, to obtain... ;in, This indicates the number of training samples that have already been used in the training process.

[0152] Finally, the sum of the second sums of all the training samples that have already participated in the training can be calculated. Divide by the number of training samples that have already participated in the training. The average loss term of the second sample is obtained. This second-sample average loss term can be used to characterize the probability distribution of each anomaly type identified by the anomaly detection model for each training sample that has participated in training, and the average difference between this distribution and the anomaly classification label corresponding to the account sample. The anomaly classification loss sub-function needs to guide the anomaly detection model to classify training samples as the correct anomaly type using the second probability factor. Pushing the probability as close to 1 as possible to the second probability that the training sample belongs to the wrong anomaly type By pushing the loss function towards zero as much as possible, the accuracy of anomaly classification can be continuously improved. To transform the problem of maximizing the log-likelihood into an optimization problem of minimizing the loss function, the average loss of the second sample needs to be negative, resulting in the anomaly classification loss function. .

[0153] It is worth noting that by setting the anomaly classification loss function as described above, the anomaly recognition model can be guided to push the second probability of the training sample belonging to the correct anomaly type as close to 1 as possible, and to push the second probability of the training sample belonging to the wrong anomaly type as close to 0 as possible, thereby quickly determining the anomaly type of the account sample with an anomaly.

[0154] In one possible implementation, a loss function is generated based on the anomaly identification loss function and the anomaly classification loss function. Specifically, this can be achieved by obtaining the anomaly identification weights and the anomaly classification weights; and by weighting the anomaly identification loss function and the anomaly classification loss function based on the anomaly identification weights and the anomaly classification weights, the loss function is obtained.

[0155] In this model, the anomaly detection weight is a hyperparameter used to balance the anomaly detection subtask, and the anomaly classification weight is a hyperparameter used to balance the anomaly classification subtask. Generally, the magnitudes of the anomaly detection weight and the anomaly classification weight can be dynamically adjusted according to the actual needs of the anomaly detection model. Specifically, if high security is prioritized during the training of the anomaly detection model, then the anomaly detection subtask is more important, and its weight can be set higher than that of the anomaly classification subtask. Similarly, if finer-grained processing is desired during the training of the anomaly detection model, then the anomaly classification subtask is more important, and its weight can be set higher than that of the anomaly detection subtask.

[0156] It is understood that the loss function in this embodiment is a weighted sum of an anomaly identification loss sub-function (as a binary cross-entropy loss) and an anomaly classification sub-function (as a classification cross-entropy loss). After determining the anomaly identification weights and anomaly classification weights, the anomaly identification loss sub-function and the anomaly classification loss sub-function can be weighted and summed based on these weights to obtain the loss function. This setup not only avoids performance degradation in one task due to optimization of a single task, thus improving overall risk control capabilities, but also allows the anomaly identification model to simultaneously capture the two related features of anomaly presence and anomaly type during training. This avoids feature fragmentation and information loss caused by staged training, enhancing adaptability to unknown transaction scenarios and novel anomalies.

[0157] Specifically, the formula for calculating the loss function can be expressed as: ;in, Represents the loss function. Indicates the weight for anomaly detection; This represents the anomaly detection loss function; Indicates the weight of the anomaly classification; This represents the anomaly classification loss function.

[0158] The following details the complete process of identifying anomalies in trading accounts.

[0159] Reference Figure 8 , Figure 8 This is a schematic diagram of an optional architecture for an anomaly identification method for transaction accounts provided in this embodiment of the disclosure.

[0160] Step 801: Obtain the short-term and long-term transaction feature sequences of the trading account.

[0161] Step 802: Add placeholder vectors to the ends of the short-term trading feature sequence. Specifically, this may include the following steps: if the length of the short-term trading feature sequence does not reach a preset first sequence length threshold, add placeholder vectors to the ends of the short-term trading feature sequence until the length of the short-term trading feature sequence reaches the first sequence length threshold.

[0162] Step 803 involves scaling the short-term trading feature sequence. Specifically, this may include the following steps: For each trade in the short-term trading feature sequence, calculate the first average value of that feature dimension across all trades in the sequence; subtract the first average value from the corresponding feature value of the feature dimension; divide the difference by the standard deviation of that feature dimension across all trades in the short-term trading feature sequence to obtain the first processed feature dimension; integrate the first processed feature dimensions of each trade in the short-term trading feature sequence to obtain the processed short-term trading feature sequence.

[0163] Step 804: Extract the first internal association feature of the processed short-term transaction feature sequence using a self-attention mechanism. Specifically, this may include the following steps: projecting the processed short-term transaction feature sequence into a first query vector, a first key vector, and a first value vector; calculating a first similarity score based on the first query vector and the first key vector, and then calculating the first similarity score using a normalization function to obtain a first attention weight; and using the first attention weight to perform a weighted summation of the first value vector to obtain the first internal association feature.

[0164] Step 805: Add placeholder vectors to the ends of the long-term trading feature sequence. Specifically, this may include the following steps: if the length of the long-term trading feature sequence does not reach a preset second sequence length threshold, add placeholder vectors to the ends of the long-term trading feature sequence until the length of the long-term trading feature sequence reaches the second sequence length threshold.

[0165] Step 806 involves scaling the long-term trading feature sequence. This may include the following steps: For each trade's feature dimension in the long-term trading feature sequence, calculate the second average of that feature dimension across all trades in the sequence; subtract the second average from the corresponding feature value of the feature dimension; divide the difference by the standard deviation of that feature dimension across all trades in the long-term trading feature sequence to obtain the second processed feature dimension; integrate the second processed feature dimensions of each trade in the long-term trading feature sequence to obtain the processed long-term trading feature sequence.

[0166] Step 807: Extract the second internal association feature of the processed long-term transaction feature sequence using a self-attention mechanism. Specifically, this may include the following steps: projecting the processed long-term transaction feature sequence into a second query vector, a second key vector, and a second value vector; calculating a second similarity score based on the second query vector and the second key vector, and then calculating the second similarity score using a normalization function to obtain the second attention weight; and using the second attention weight to perform a weighted summation of the second value vector to obtain the second internal association feature.

[0167] Step 808 involves mapping the first internal association feature to the feature space of the second internal association feature using a mutual attention mechanism to obtain the association representation feature. Specifically, this may include the following steps: projecting the first internal association feature into a third query vector, and projecting the second internal association feature into a third key vector and a third value vector, respectively; calculating a third similarity score based on the third query vector and the third key vector, and calculating the third similarity score using a normalization function to obtain the third attention weight; and using the third attention weight to perform a weighted summation of the third value vector to obtain the association representation feature.

[0168] Step 809 involves performing a difference operation on the first internal correlation feature and the correlation representation feature to obtain an offset residual vector. Specifically, this may include the following steps: the first internal correlation feature and the correlation representation feature have the same feature dimension; for each feature dimension, the feature value of the feature dimension in the first internal correlation feature and the feature value of the feature dimension in the correlation representation feature are differentially analyzed to obtain the offset corresponding to the feature dimension; the offsets corresponding to each feature dimension are then integrated to obtain the offset residual vector.

[0169] Step 810: Multiply the behavior offset residual vector with the preset first weight matrix and add the preset first bias to obtain the first linear transformation result.

[0170] Step 811: Calculate the result of the first linear transformation using the activation function to obtain the anomaly score of the trading account.

[0171] Step 812: If the abnormal score reaches the preset first abnormal score threshold, it is determined that the transaction account is abnormal.

[0172] Step 813: Multiply the behavior offset residual vector with the preset second weight matrix and add the preset second bias to obtain the second linear transformation result.

[0173] Step 814: Calculate the result of the second linear transformation using a normalization function to obtain the anomaly category feature vector corresponding to the trading account. Both the anomaly score and the anomaly category feature vector are determined by the anomaly recognition model. The anomaly recognition model is trained as follows: A training sample set is obtained, where each training sample has an account sample, a long-term trading feature sample corresponding to the account sample, a short-term trading feature sample corresponding to the account sample, an account label corresponding to the account sample, and an anomaly classification label corresponding to the account sample. The account label indicates whether the account sample is abnormal, and the anomaly classification label indicates the anomaly type corresponding to the account sample. A loss function is generated based on the anomaly recognition loss function and the anomaly classification loss function. The anomaly recognition loss function is determined based on the first probability that the account sample identified by the anomaly recognition model is abnormal, and the anomaly classification loss function is determined based on the second probability that the account sample identified by the anomaly recognition model belongs to each anomaly type. The account sample, the long-term trading feature sample, and the short-term trading feature sample in the training sample set are used as input text, and the account label and the anomaly classification label in the training sample set are used as the expected output text. The anomaly recognition model is pre-trained until the loss function converges.

[0174] Step 815: Extract the anomaly type with the largest probability distribution from the anomaly category feature vector, and use it as the target anomaly type.

[0175] Step 816: Use the preset handling strategy library to query the handling strategy corresponding to the target anomaly type, and handle the transaction account with anomalies according to the handling strategy corresponding to the target anomaly type.

[0176] Based on this, by acquiring the short-term and long-term transaction feature sequences of a trading account, and extracting the first internal correlation feature of the short-term sequence and the second internal correlation feature of the long-term sequence, interference from irrelevant information can be suppressed, and the trading features of the trading account within the first and second historical time windows can be deeply mined. Then, through a mutual attention mechanism, the first internal correlation feature is mapped to the feature space of the second internal correlation feature, resulting in a weighted fusion representation of the trading features of the trading account within the first historical time window in the feature space of the second internal correlation feature, i.e., the correlation representation feature. The semantic matching degree between the first and second internal correlation features can be clearly defined through the correlation representation feature. Furthermore, by performing a difference operation on the first internal correlation feature and the correlation representation feature, the offset between the recent and long-term trading behaviors of the trading account can be deeply mined, accurately capturing the degree of deviation of the trading account's real-time trading behavior relative to its steady-state historical long-term trading behavior. This provides highly interpretable support for subsequent anomaly identification. Finally, the anomaly score of the trading account can be comprehensively determined based on the offset residual vector obtained in the previous step, and anomaly identification of the trading account can be performed based on the anomaly score. This embodiment of the disclosure, through the aforementioned behavior deviation mining mechanism for short-term and long-term transaction feature sequences of a single transaction account, can effectively capture the micro-anomalies of a transaction account and effectively improve the accuracy of identifying transaction accounts with short-term behavior changes and potential anomalies.

[0177] It is understood that although the steps in the above flowcharts are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated in this embodiment, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the above flowcharts may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps.

[0178] Reference Figure 9 , Figure 9 This is a schematic diagram of an optional structure of a transaction account anomaly identification device 900 provided in an embodiment of this disclosure. The transaction account anomaly identification device 900 includes: The acquisition module 901 is used to acquire the short-term transaction feature sequence and the long-term transaction feature sequence of the trading account. The short-term transaction feature sequence includes the transaction features of multiple transactions of the trading account within a first historical time window, and the long-term transaction feature sequence includes the transaction features of multiple transactions of the trading account within a second historical time window. The window length of the first historical time window is shorter than the window length of the second historical time window. Extraction module 902 is used to extract the first internal correlation feature of the short-term transaction feature sequence and the second internal correlation feature of the long-term transaction feature sequence, respectively. The mapping module 903 is used to map the first internal correlation feature to the feature space of the second internal correlation feature through a mutual attention mechanism to obtain the correlation representation feature; The difference operation module 904 is used to perform difference operations on the first internal correlation feature and the correlation representation feature to obtain the offset residual vector; The identification module 905 is used to determine the anomaly score of a trading account based on the offset residual vector, and to identify anomalies in the trading account based on the anomaly score.

[0179] Furthermore, the extraction module 902 is specifically used for: The short-term and long-term trading feature sequences are preprocessed separately to obtain the processed short-term and long-term trading feature sequences. The first internal correlation feature of the processed short-term transaction feature sequence is extracted using a self-attention mechanism. The second internal correlation feature of the processed long-term transaction feature sequence is extracted using a self-attention mechanism.

[0180] Furthermore, the extraction module 902 is specifically used for: If the length of the short-term trading feature sequence does not reach the preset first sequence length threshold, placeholder vectors are added to the ends of the short-term trading feature sequence until the length of the short-term trading feature sequence reaches the first sequence length threshold. If the length of the long-term trading feature sequence does not reach the preset second sequence length threshold, placeholder vectors are added to the ends of the long-term trading feature sequence until the length of the long-term trading feature sequence reaches the second sequence length threshold. The short-term and long-term trading feature sequences are scaled and normalized respectively to obtain the processed short-term and long-term trading feature sequences.

[0181] Furthermore, transaction characteristics have multiple feature dimensions; The extraction module 902 described above is specifically used for: For each transaction feature dimension in the short-term transaction feature sequence, calculate the first average value of the feature dimension among all transactions in the short-term transaction feature sequence, and divide the difference between the feature value corresponding to the feature dimension and the first average value by the standard deviation of the feature dimension among all transactions in the short-term transaction feature sequence to obtain the first processed feature dimension. The first post-processed feature dimension of each transaction in the short-term transaction feature sequence is integrated to obtain the processed short-term transaction feature sequence. For each feature dimension in the long-term trading feature sequence, calculate the second average value of the feature dimension among all transactions in the long-term trading feature sequence, and divide the difference between the feature value corresponding to the feature dimension and the second average value by the standard deviation of the feature dimension among all transactions in the long-term trading feature sequence to obtain the second processed feature dimension. The second processed feature dimension of each transaction in the long-term transaction feature sequence is integrated to obtain the processed long-term transaction feature sequence.

[0182] Furthermore, the extraction module 902 is specifically used for: The processed short-term transaction feature sequence is projected into a first query vector, a first key vector, and a first value vector, respectively. The first similarity score is calculated based on the first query vector and the first key vector, and the first attention weight is obtained by calculating the first similarity score through a normalization function. The first internal correlation feature is obtained by weighting and summing the first value vector using the first attention weight.

[0183] Furthermore, the extraction module 902 is specifically used for: The processed long-term transaction feature sequence is projected into the second query vector, the second key vector, and the second value vector, respectively. The second similarity score is calculated based on the second query vector and the second key vector, and the second attention weight is obtained by calculating the second similarity score through a normalization function. The second internal correlation feature is obtained by weighting and summing the second value vector using the second attention weight.

[0184] Furthermore, the mapping module 903 mentioned above is specifically used for: The first internal association feature is projected into the third query vector, and the second internal association feature is projected into the third key vector and the third value vector, respectively. The third similarity score is calculated based on the third query vector and the third key vector, and the third attention weight is obtained by calculating the third similarity score through a normalization function. The association representation features are obtained by weighting and summing the third value vector using the third attention weight.

[0185] Furthermore, the first internal association feature and the association representation feature have the same feature dimension; The aforementioned difference operation module 904 is specifically used for: For each feature dimension, the feature value of the feature dimension in the first internal association feature and the feature value of the feature dimension in the association representation feature are differentially calculated to obtain the offset corresponding to the feature dimension. The offsets corresponding to each feature dimension are integrated to obtain the offset residual vector.

[0186] Furthermore, the aforementioned identification module 905 is specifically used for: The offset residual vector is multiplied by a preset first weight matrix and a preset first bias is added to obtain the first linear transformation result; The anomaly score of the trading account is obtained by calculating the result of the first linear transformation using an activation function.

[0187] Furthermore, the aforementioned identification module 905 is specifically used for: If the abnormal score reaches the preset first abnormal score threshold, it is determined that the trading account is abnormal; The transaction account anomaly detection device 900 also includes a processing module, which is specifically used for: Take action against trading accounts that exhibit abnormal activity.

[0188] Furthermore, the transaction account anomaly detection device 900 also includes an anomaly type detection module 905, which is specifically used for: The offset residual vector is multiplied by the preset second weight matrix, and a preset second bias is added to obtain the second linear transformation result; The normalization function is used to calculate the result of the second linear transformation to obtain the anomaly category feature vector corresponding to the trading account. The anomaly category feature vector is used to indicate the probability distribution of each anomaly type.

[0189] Furthermore, the aforementioned processing module is specifically used for: From the anomaly category feature vector, extract the anomaly type with the largest probability distribution to be used as the target anomaly type; The system uses a pre-defined handling strategy library to query the handling strategy corresponding to the target anomaly type, and then handles the abnormal trading account according to the handling strategy corresponding to the target anomaly type. The handling strategy library stores the handling strategies corresponding to each anomaly type.

[0190] Furthermore, both the anomaly score and the anomaly category feature vector are determined by the anomaly recognition model; The transaction account anomaly detection device 900 also includes a model training module, which is specifically used for: Obtain a training sample set. Each training sample in the training sample set has an account sample, a long-term transaction feature sample corresponding to the account sample, a short-term transaction feature sample corresponding to the account sample, an account label corresponding to the account sample, and an anomaly classification label corresponding to the account sample. The account label is used to indicate whether the account sample is abnormal, and the anomaly classification label is used to indicate the anomaly type corresponding to the account sample. A loss function is generated based on the anomaly identification loss function and the anomaly classification loss function. The anomaly identification loss function determines the probability that the account sample identified by the anomaly identification model is anomaly, and the anomaly classification loss function determines the probability that the account sample identified by the anomaly identification model belongs to each anomaly type. The anomaly recognition model is pre-trained using the account samples, long-term transaction feature samples, and short-term transaction feature samples corresponding to the account samples in the training sample set as input text, and the account labels and anomaly classification labels corresponding to the account samples in the training sample set as expected output text, until the loss function converges.

[0191] Furthermore, the aforementioned model training module is specifically used for: For training samples that have already been used in training, determine the first probability that the account sample corresponding to the training sample is abnormal; Take the logarithm of the first probability, and determine the first product by multiplying the logarithm of the first probability by the account label corresponding to the account sample; Take the logarithm of the first difference obtained by subtracting the first probability from the first value, and determine the second product by multiplying the second difference obtained by subtracting the account label corresponding to the account sample from the first value and the logarithm of the first difference; Determine the first sum of the first product and the second product, and divide the sum of the first sums of all training samples that have participated in training by the number of training samples that have participated in training to obtain the first sample average loss term; By taking the negative of the average loss term of the first sample, we obtain the anomaly identification loss function.

[0192] Furthermore, the anomaly classification label is a vector with the same length as the total number of anomaly types, and in the anomaly classification label, the vector value of the anomaly type corresponding to the account sample is the first value, and the vector value of other anomaly types is the second value; The above model training module is specifically used for: For the training samples that have already been trained, determine the second probability that the account samples corresponding to the training samples belong to each anomaly type; For each anomaly type, the third product is obtained by multiplying the vector value of the anomaly type in the anomaly classification label corresponding to the training sample and the logarithm of the second probability that the account sample corresponding to the training sample belongs to the anomaly type. Summing the third product corresponding to each anomaly type yields the second sum. The sum of the second sums of all training samples that have participated in training is divided by the number of training samples that have participated in training to obtain the second sample average loss term. By taking the negative of the average loss term of the second sample, we obtain the anomaly classification loss function.

[0193] Furthermore, the aforementioned model training module is specifically used for: Obtain the anomaly detection weight and anomaly classification weight; Based on the anomaly identification weight and the anomaly classification weight, the anomaly identification loss function and the anomaly classification loss function are weighted and summed to obtain the loss function.

[0194] The aforementioned anomaly detection device 800 for trading accounts and the anomaly detection method for trading accounts are based on the same inventive concept. By acquiring short-term and long-term trading feature sequences of a trading account, and extracting the first internal correlation feature of the short-term trading feature sequence and the second internal correlation feature of the long-term trading feature sequence respectively, interference from irrelevant information can be suppressed, and the trading features of the trading account within the first historical time window and the trading features of the trading account within the second historical time window can be deeply mined. Then, through a mutual attention mechanism, the first internal correlation feature is mapped to the feature space of the second internal correlation feature, resulting in a weighted fusion representation of the trading features of the trading account within the first historical time window in the feature space of the second internal correlation feature, i.e., the correlation representation feature. The semantic matching degree of the first and second internal correlation features can be clearly defined through the correlation representation feature. Furthermore, by performing a difference operation on the first internal correlation feature and the correlation representation feature, the offset between the recent and long-term trading behaviors of the trading account can be deeply mined, accurately capturing the degree of offset of the trading account's real-time trading behavior relative to its steady-state historical long-term trading behavior. This can provide highly interpretable support for subsequent anomaly detection. Finally, the anomaly score of the trading account can be comprehensively determined based on the offset residual vector obtained in the previous step, and the trading account can be identified as anomaly based on the anomaly score. This embodiment of the present disclosure, through the aforementioned behavioral deviation mining mechanism targeting the short-term and long-term trading feature sequences of a single trading account, can effectively capture the micro-anomalies of trading accounts and significantly improve the accuracy of identifying trading accounts with short-term behavioral changes and potential anomalies.

[0195] The electronic device provided in this disclosure for executing the above-described method for identifying abnormal transaction accounts can be a terminal, as shown in the embodiments below. Figure 10 , Figure 10This is a partial structural block diagram of a terminal provided in an embodiment of the present disclosure. The terminal includes: a camera assembly 1010, a first memory 1020, an input unit 1030, a display unit 1040, a sensor 1050, an audio circuit 1060, a wireless fidelity (WiFi) module 1070, a first processor 1080, and a first power supply 1090, among other components. Those skilled in the art will understand that... Figure 10 The terminal structure shown does not constitute a limitation on the terminal and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0196] The camera assembly 1010 can be used to capture images or videos. Optionally, the camera assembly 1010 includes a front-facing camera and a rear-facing camera. Typically, the front-facing camera is located on the front panel of the terminal, and the rear-facing camera is located on the back of the terminal. In some embodiments, there are at least two rear-facing cameras, which are any one of a main camera, a depth-sensing camera, a wide-angle camera, and a telephoto camera, to achieve background blurring by fusion of the main camera and the depth-sensing camera, panoramic shooting by fusion of the main camera and the wide-angle camera, VR (Virtual Reality) shooting, or other fusion shooting functions.

[0197] The first memory 1020 can be used to store software programs and modules. The first processor 1080 executes various terminal functions and data processing by running the software programs and modules stored in the first memory 1020.

[0198] The input unit 1030 can be used to receive input numeric or character information, and to generate key signal inputs related to the terminal's settings and function control. Specifically, the input unit 1030 may include a touch panel 1031 and other input devices 1032.

[0199] The display unit 1040 can be used to display input or provided information, as well as various menus of the terminal. The display unit 1040 may include a display panel 1041.

[0200] Audio circuitry 1060, speaker 1061, and microphone 1062 provide an audio interface.

[0201] The first power source 1090 can be AC ​​power, DC power, a disposable battery, or a rechargeable battery.

[0202] The number of sensors 1050 can be one or more, and these sensors 1050 include, but are not limited to: accelerometers, gyroscopes, pressure sensors, optical sensors, etc. An accelerometer can detect the magnitude of acceleration along the three coordinate axes of a coordinate system established by the terminal. For example, an accelerometer can be used to detect the components of gravitational acceleration along the three coordinate axes. The first processor 1080 can control the display unit 1040 to display the user interface in either a horizontal or vertical view based on the gravitational acceleration signal acquired by the accelerometer. The accelerometer can also be used for games or for acquiring user motion data.

[0203] The gyroscope sensor can detect the terminal's orientation and rotation angle. It can work in conjunction with an accelerometer to collect 3D user movements on the terminal. Based on the data collected by the gyroscope sensor, the first processor 1080 can perform the following functions: motion sensing (e.g., changing the UI based on the user's tilt), image stabilization during shooting, game control, and inertial navigation.

[0204] The pressure sensor can be installed on the side bezel of the terminal and / or on the lower layer of the display unit 1040. When the pressure sensor is installed on the side bezel of the terminal, it can detect the user's grip signal on the terminal, and the first processor 1080 can perform left / right hand recognition or quick operation based on the grip signal collected by the pressure sensor. When the pressure sensor is installed on the lower layer of the display unit 1040, the first processor 1080 can control the operable controls on the UI interface based on the user's pressure operation on the display unit 1040. The operable controls include at least one of button controls, scroll bar controls, icon controls, and menu controls.

[0205] An optical sensor is used to collect ambient light intensity. In one embodiment, the first processor 1080 can control the display brightness of the display unit 1040 based on the ambient light intensity collected by the optical sensor. Specifically, when the ambient light intensity is high, the display brightness of the display unit 1040 is increased; when the ambient light intensity is low, the display brightness of the display unit 1040 is decreased. In another embodiment, the first processor 1080 can also dynamically adjust the shooting parameters of the camera assembly 1010 based on the ambient light intensity collected by the optical sensor.

[0206] In this embodiment, the first processor 1080 included in the terminal can execute the abnormal identification method for transaction accounts in the previous embodiment.

[0207] The electronic device provided in this disclosure for executing the above-described method for identifying abnormal transaction accounts can also be a server, see below. Figure 11 , Figure 11This is a partial structural block diagram of a server provided in an embodiment of the present disclosure. The server can vary significantly due to differences in configuration or performance. It may include one or more second processors 1110 and second memories 1130, and one or more storage media 1140 (e.g., one or more mass storage devices) for storing application programs 1143 or data 1142. The second memories 1130 and storage media 1140 may be temporary or persistent storage. The program stored in the storage media 1140 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the server. Furthermore, the second processor 1110 may be configured to communicate with the storage media 1140 and execute the series of instruction operations stored in the storage media 1140 on the server.

[0208] The server may also include one or more secondary power supplies 1120, one or more wired or wireless network interfaces 1150, one or more input / output interfaces 1160, and / or one or more operating systems 1141, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0209] The second processor 1110 in the server can be used to execute anomaly detection methods for transaction accounts.

[0210] This disclosure also provides a computer-readable storage medium for storing a computer program for executing the transaction account anomaly identification method of the foregoing embodiments.

[0211] This disclosure also provides a computer program product comprising a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform the above-described method for identifying abnormal transaction accounts.

[0212] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in this disclosure and the foregoing drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate to describe embodiments of this disclosure, for example, those that can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatuses.

[0213] It should be understood that in this disclosure, "at least one item" means one or more, and "more than one" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0214] It should be understood that in the description of the embodiments of this disclosure, "multiple" means two or more, "greater than", "less than", "exceeding" etc. are understood to exclude the number itself, and "above", "below", "within" etc. are understood to include the number itself.

[0215] In the several embodiments provided in this disclosure, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0216] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0217] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0218] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0219] It should also be understood that the various implementation methods provided in this disclosure can be combined arbitrarily to achieve different technical effects.

[0220] The above is a detailed description of the preferred embodiments of this disclosure. However, this disclosure is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this disclosure. All such equivalent modifications or substitutions are included within the scope defined by the claims of this disclosure.

Claims

1. A method for identifying anomalies in trading accounts, characterized in that, include: Obtain short-term and long-term transaction feature sequences of a trading account. The short-term transaction feature sequence includes the transaction features of multiple transactions of the trading account within a first historical time window, and the long-term transaction feature sequence includes the transaction features of multiple transactions of the trading account within a second historical time window. The window length of the first historical time window is less than the window length of the second historical time window. Extract the first internal correlation feature of the short-term trading feature sequence and the second internal correlation feature of the long-term trading feature sequence respectively; The first internal correlation feature is mapped to the feature space of the second internal correlation feature through a mutual attention mechanism to obtain the correlation representation feature; Perform a difference operation on the first internal correlation feature and the correlation representation feature to obtain the offset residual vector; The anomaly score of the trading account is determined based on the offset residual vector, and the anomaly of the trading account is identified based on the anomaly score.

2. The method for identifying anomalies in transaction accounts according to claim 1, characterized in that, The step of extracting the first internal correlation feature of the short-term trading feature sequence and the second internal correlation feature of the long-term trading feature sequence respectively includes: The short-term trading feature sequence and the long-term trading feature sequence are preprocessed respectively to obtain the processed short-term trading feature sequence and the processed long-term trading feature sequence. The first internal correlation feature of the processed short-term transaction feature sequence is extracted using a self-attention mechanism. The second internal correlation feature of the processed long-term transaction feature sequence is extracted using a self-attention mechanism.

3. The method for identifying anomalies in transaction accounts according to claim 2, characterized in that, The step of preprocessing the short-term trading feature sequence and the long-term trading feature sequence respectively to obtain the processed short-term trading feature sequence and the processed long-term trading feature sequence includes: If the length of the short-term transaction feature sequence does not reach the preset first sequence length threshold, placeholder vectors are added to the ends of the short-term transaction feature sequence until the length of the short-term transaction feature sequence reaches the first sequence length threshold. If the length of the long-term transaction feature sequence does not reach the preset second sequence length threshold, placeholder vectors are added to the ends of the long-term transaction feature sequence until the length of the long-term transaction feature sequence reaches the second sequence length threshold. The short-term trading feature sequence and the long-term trading feature sequence are respectively subjected to scale normalization to obtain the processed short-term trading feature sequence and the processed long-term trading feature sequence.

4. The method for identifying anomalies in transaction accounts according to claim 3, characterized in that, The transaction features have multiple feature dimensions; The step of performing scale normalization on the short-term trading feature sequence and the long-term trading feature sequence respectively to obtain the processed short-term trading feature sequence and the processed long-term trading feature sequence includes: For each transaction feature dimension in the short-term transaction feature sequence, calculate the first average value of the feature dimension in all transactions in the short-term transaction feature sequence, and divide the difference obtained by subtracting the first average value from the feature value corresponding to the feature dimension by the standard deviation of the feature dimension in all transactions in the short-term transaction feature sequence to obtain the first processed feature dimension. The first processed feature dimension of each transaction in the short-term transaction feature sequence is integrated to obtain the processed short-term transaction feature sequence. For each transaction feature dimension in the long-term transaction feature sequence, calculate the second average value of the feature dimension among all transactions in the long-term transaction feature sequence, and divide the difference obtained by subtracting the second average value from the feature value corresponding to the feature dimension by the standard deviation of the feature dimension among all transactions in the long-term transaction feature sequence to obtain the second processed feature dimension; The second processed feature dimension of each transaction in the long-term transaction feature sequence is integrated to obtain the processed long-term transaction feature sequence.

5. The method for identifying anomalies in transaction accounts according to claim 2, characterized in that, The extraction of the first internal correlation feature of the processed short-term trading feature sequence using a self-attention mechanism includes: The processed short-term transaction feature sequence is projected into a first query vector, a first key vector, and a first value vector, respectively. A first similarity score is calculated based on the first query vector and the first key vector, and a first attention weight is obtained by calculating the first similarity score through a normalization function. The first internal correlation feature is obtained by weighting and summing the first value vector using the first attention weight.

6. The method for identifying anomalies in transaction accounts according to claim 2, characterized in that, The extraction of the second internal correlation feature of the processed long-term transaction feature sequence using a self-attention mechanism includes: The processed long-term transaction feature sequence is projected into a second query vector, a second key vector, and a second value vector, respectively. The second similarity score is calculated based on the second query vector and the second key vector, and the second attention weight is obtained by calculating the second similarity score through a normalization function. The second internal correlation feature is obtained by weighting and summing the second value vector using the second attention weight.

7. The method for identifying anomalies in transaction accounts according to claim 1, characterized in that, The step of mapping the first internal correlation feature to the feature space of the second internal correlation feature through a mutual attention mechanism to obtain correlation representation features includes: The first internal association feature is projected into a third query vector, and the second internal association feature is projected into a third key vector and a third value vector, respectively. The third similarity score is calculated based on the third query vector and the third key vector, and the third attention weight is obtained by calculating the third similarity score through a normalization function. The association representation features are obtained by weighting and summing the third value vector using the third attention weight.

8. The method for identifying anomalies in transaction accounts according to claim 1, characterized in that, The first internal association feature and the association representation feature have the same feature dimension; The step of performing a difference operation on the first internal correlation feature and the correlation representation feature to obtain the offset residual vector includes: For each feature dimension, a difference operation is performed on the feature value of the feature dimension in the first internal association feature and the feature value of the feature dimension in the association representation feature to obtain the offset corresponding to the feature dimension; The offsets corresponding to each feature dimension are integrated to obtain the offset residual vector.

9. The method for identifying anomalies in transaction accounts according to claim 1, characterized in that, The step of determining the anomaly score of the trading account based on the offset residual vector includes: The offset residual vector is multiplied by a preset first weight matrix and a preset first bias is added to obtain the first linear transformation result; The anomaly score of the trading account is obtained by calculating the result of the first linear transformation using an activation function.

10. The method for identifying anomalies in transaction accounts according to claim 1, characterized in that, The step of identifying anomalies in the trading account based on the anomaly score includes: If the abnormal score reaches a preset first abnormal score threshold, it is determined that the transaction account is abnormal; After identifying the transaction account as abnormal based on the abnormal score, the process further includes: Take action against trading accounts exhibiting abnormal activity.

11. The method for identifying anomalies in transaction accounts according to claim 10, characterized in that, After determining the anomaly score of the trading account based on the offset residual vector, the method further includes: The offset residual vector is multiplied by a preset second weight matrix, and a preset second bias is added to obtain the second linear transformation result; The normalization function is used to calculate the result of the second linear transformation to obtain the anomaly category feature vector corresponding to the transaction account. The anomaly category feature vector is used to indicate the probability distribution of each anomaly type.

12. The method for identifying anomalies in transaction accounts according to claim 11, characterized in that, The handling of abnormal trading accounts includes: From the anomaly category feature vector, extract the anomaly type with the largest probability distribution as the target anomaly type; The system uses a pre-defined handling strategy library to query the handling strategy corresponding to the target anomaly type, and then uses the handling strategy corresponding to the target anomaly type to handle the transaction account with the anomaly. The handling strategy library stores the handling strategies corresponding to each anomaly type.

13. The method for identifying anomalies in transaction accounts according to claim 11, characterized in that, Both the anomaly score and the anomaly category feature vector are determined by the anomaly recognition model; The anomaly detection model is trained in the following way: Obtain a training sample set, wherein each training sample in the training sample set has an account sample, a long-term transaction feature sample corresponding to the account sample, a short-term transaction feature sample corresponding to the account sample, an account label corresponding to the account sample, and an anomaly classification label corresponding to the account sample, wherein the account label is used to indicate whether the account sample is abnormal, and the anomaly classification label is used to indicate the anomaly type corresponding to the account sample. A loss function is generated based on an anomaly identification loss function and an anomaly classification loss function, wherein the anomaly identification loss function is determined based on a first probability that the account sample identified by the anomaly identification model is anomaly, and the anomaly classification loss function is determined based on a second probability that the account sample identified by the anomaly identification model belongs to each anomaly type; The anomaly recognition model is pre-trained using the account samples, long-term transaction feature samples, and short-term transaction feature samples corresponding to the account samples in the training sample set as input text, and the account labels and anomaly classification labels corresponding to the account samples in the training sample set as expected output text, until the loss function converges.

14. The method for identifying anomalies in transaction accounts according to claim 13, characterized in that, The anomaly identification loss function is determined in the following way: For the training samples that have already participated in training, determine the first probability that the account sample corresponding to the training sample is abnormal; Take the logarithm of the first probability, and determine the first product by multiplying the logarithm of the first probability by the account label corresponding to the account sample; Take the logarithm of the first difference obtained by subtracting the first probability from the first value, and determine the second product by multiplying the second difference obtained by subtracting the account label corresponding to the account sample from the first value and the logarithm of the first difference; Determine the first sum of the first product and the second product, and divide the sum of the first sums of each training sample that has participated in training by the number of training samples that have participated in training to obtain the first sample average loss term; The anomaly identification loss sub-function is obtained by taking the negative of the average loss term of the first sample.

15. The method for identifying anomalies in trading accounts according to claim 13, characterized in that, The anomaly classification label is a vector with a length equal to the total number of anomaly types, and in the anomaly classification label, the vector value of the anomaly type corresponding to the account sample is the first value, and the vector value of other anomaly types is the second value. The anomaly classification loss function is determined in the following way: For the training samples that have already participated in training, determine the second probability that the account sample corresponding to the training sample belongs to each anomaly type; For each anomaly type, the third product is obtained by multiplying the vector value of the anomaly type in the anomaly classification label corresponding to the training sample and the logarithm of the second probability that the account sample corresponding to the training sample belongs to the anomaly type; Summing the third product corresponding to each anomaly type yields the second sum. The sum of the second sums of all the training samples that have participated in training is divided by the number of training samples that have participated in training to obtain the second sample average loss term. The anomaly classification loss function is obtained by taking the negative of the average loss term of the second sample.

16. The method for identifying anomalies in transaction accounts according to claim 13, characterized in that, The loss function generated based on the anomaly identification loss function and the anomaly classification loss function includes: Obtain the anomaly detection weight and anomaly classification weight; Based on the anomaly identification weights and the anomaly classification weights, the anomaly identification loss function and the anomaly classification loss function are weighted and summed to obtain the loss function.

17. An anomaly detection device for a transaction account, characterized in that, include: The acquisition module is used to acquire short-term transaction feature sequences and long-term transaction feature sequences of a trading account. The short-term transaction feature sequences include the transaction features of multiple transactions of the trading account within a first historical time window, and the long-term transaction feature sequences include the transaction features of multiple transactions of the trading account within a second historical time window. The window length of the first historical time window is less than the window length of the second historical time window. The extraction module is used to extract the first internal correlation feature of the short-term trading feature sequence and the second internal correlation feature of the long-term trading feature sequence, respectively. The mapping module is used to map the first internal correlation feature to the feature space of the second internal correlation feature through a mutual attention mechanism to obtain the correlation representation feature; The difference operation module is used to perform difference operations on the first internal correlation feature and the correlation representation feature to obtain the offset residual vector; The identification module is used to determine the abnormal score of the trading account based on the offset residual vector, and to identify the abnormality of the trading account according to the abnormal score.

18. An electronic device comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the abnormal identification method for transaction accounts as described in any one of claims 1 to 16.

19. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the abnormal identification method for transaction accounts as described in any one of claims 1 to 16.

20. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the abnormal identification method for transaction accounts as described in any one of claims 1 to 16.

Images