Transaction data anomaly analysis processing method and system based on feature correlation dimension reduction

Abstract

The present application relates to the technical field of transaction data management, and more particularly to a transaction data abnormality analysis processing method and system based on feature correlation dimension reduction, which determines the multi-dimensional original features of transaction data, obtains target features by dimension reduction according to the feature correlation degree, and calculates the initial abnormality probability in combination with the historical normal feature deviation to screen out suspected abnormal transactions; the behavior data of the suspected transactions is extracted by using the target features after dimension reduction, and the behavior abnormality probability and specific abnormal transactions are determined by the deviation amount from the historical behavior data; the initial and behavior abnormality probabilities are comprehensively evaluated to assess the overall transaction risk of the platform. If the risk does not meet the requirements, the abnormality of the full data is reviewed, and the transaction risk label state is updated accordingly. The method removes redundant noise by feature dimension reduction, realizes accurate identification from coarse to fine by two-stage probability evaluation, effectively reduces the false positive rate, and improves the efficiency and accuracy of abnormality detection.

Description

Technical Field

[0001] This invention relates to the field of transaction data management technology, and in particular to a method and system for anomaly analysis and processing of transaction data based on feature correlation dimensionality reduction. Background Technology

[0002] With the rapid development of information technology and the digital economy, transaction management platforms are increasingly widely used in finance, e-commerce, payment clearing, and other fields, generating transaction data that exhibits typical big data characteristics such as high dimensionality, large scale, and strong real-time performance. In actual business operations, accurately identifying abnormal transaction behaviors, such as fraudulent transactions, money laundering, and account theft, from massive amounts of transaction data has become a key challenge in ensuring transaction security and preventing financial risks. Traditional anomaly detection methods are usually based on rule engines or simple statistical models, relying on manually set thresholds and fixed rules. These methods are ill-suited to handling complex and ever-changing transaction patterns and have limited processing capabilities for high-dimensional feature data, easily leading to high false positive and false negative rates.

[0003] In recent years, machine learning and data mining techniques have been widely applied in the field of transaction anomaly detection. However, directly using high-dimensional raw features for modeling is not only computationally expensive but may also lead to performance degradation due to feature redundancy or noise interference. Especially in multi-source heterogeneous transaction data, there are complex nonlinear relationships between different features. If key features are not effectively extracted and data dimensionality is not reduced, the accuracy and timeliness of anomaly identification will be severely affected. Although some studies have attempted to use dimensionality reduction methods such as principal component analysis (PCA) and linear discriminant analysis (LDA) for preprocessing, these methods often ignore the semantic relationships and business logic between features, making it difficult to retain key information sensitive to abnormal behavior. In addition, existing anomaly detection mechanisms mostly adopt single-stage judgment, lacking a hierarchical assessment and dynamic response mechanism for anomaly risk. They cannot flexibly adjust the review strategy according to the risk level, resulting in wasted resources when facing low-risk false alarms and potentially delayed responses in high-risk events.

[0004] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] The main objective of this invention is to provide a method and system for anomaly analysis and processing of transaction data based on feature correlation dimensionality reduction. This aims to solve the technical problems of existing transaction data anomaly detection methods, which are unable to effectively handle the complex correlations and redundant noise between high-dimensional features and lack a hierarchical evaluation mechanism, resulting in low detection accuracy, high computational cost, and inflexible risk response.

[0006] To achieve the above objectives, this invention provides a method for anomaly analysis and processing of transaction data based on feature correlation dimensionality reduction, the method comprising: The transaction management platform determines the multi-dimensional original features of different types of transaction data, and performs feature dimensionality reduction based on the correlation between the original features to obtain the target features after dimensionality reduction. The initial anomaly probability of the transaction data is determined based on the deviation between the target features and the historical normal features of the transaction data. If the initial anomaly probability of the transaction data does not meet the requirements, proceed to the next step. Transaction data whose initial abnormal probability does not meet the requirements are identified as suspected abnormal transactions. The transaction behavior feature data of the suspected abnormal transactions are determined by the target features after dimensionality reduction of the suspected abnormal transactions. The abnormal probability of the suspected abnormal transactions and the abnormal transaction behavior are determined based on the deviation between the transaction behavior feature data and the historical normal behavior feature data. The overall transaction risk of the transaction management platform is determined based on the initial abnormal probability of different suspected abnormal transactions and the behavioral abnormal probability of different behavioral abnormal transactions. When the overall transaction risk does not meet the requirements, proceed to the next step. Anomaly review is performed on all transaction data of the transaction management platform, and the transaction risk label status of the transaction management platform is updated based on the review results.

[0007] Optionally, the multi-dimensional original features of the transaction data include the transaction frequency within the most recent preset transaction window, the time interval between different transaction operations, the transaction amount, the counterparty association attributes, and the transaction channel type.

[0008] Optionally, the method for determining the initial anomaly probability of the transaction data is as follows: Based on the target features after dimensionality reduction, the feature values ​​of each dimension of the transaction data within the current preset transaction window are determined, and the feature association similarity between the current transaction and different historical normal transactions is determined by combining the correlation weights between the features. The initial anomaly score of the current transaction is determined by the similarity of its features with those of different historical normal transactions, and the initial anomaly probability of the transaction data is obtained by mapping the initial anomaly score of the current transaction.

[0009] Optionally, the initial anomaly probability of the transaction data is between 0 and 1, wherein if the initial anomaly probability of the transaction data is greater than a preset initial probability threshold, then the initial anomaly probability of the transaction data is determined to be unsatisfactory.

[0010] Optionally, the method for determining the initial anomaly probability of the transaction data is as follows: The benchmark feature values ​​for each dimension of all normal transactions are determined by using the feature data of historical normal transactions, as well as the benchmark correlation between different features, and these are used as benchmark features and benchmark correlation strength. The initial outliers of the current transaction are determined based on the deviations of the current transaction's feature values ​​from the benchmark features and the deviations of the current transaction's feature correlation strength from the benchmark correlation strength. The initial anomaly probability of the transaction data is obtained by mapping the initial outlier of the current transaction.

[0011] Optionally, the transaction behavior characteristic data of the suspected abnormal transaction includes the transaction amount changes, transaction operation frequency, and transaction fund flow characteristics of the suspected abnormal transaction at different time periods within the current preset transaction window.

[0012] Optionally, the method for determining the probability of abnormal behavior in the suspected abnormal transaction is as follows: The average daily transaction amount and average transaction frequency for different time periods are determined by using historical normal transaction behavior data; Based on the transaction behavior characteristic data, the total transaction amount and transaction volume of the suspected abnormal transaction within the current preset transaction window are determined, and the abnormal behavior value of the current transaction is determined by combining the average daily transaction amount of the corresponding transaction type and the average transaction frequency of different time periods. The probability of abnormal behavior of the suspected abnormal transaction is obtained by mapping the abnormal behavior values ​​of the current transaction.

[0013] Optionally, if the probability of abnormal behavior of the suspected abnormal transaction is not less than a preset limit value for abnormal behavior, then the suspected abnormal transaction is determined to be an abnormal behavior transaction.

[0014] Optionally, when the overall transaction risk meets the requirements, it is not necessary to review all transaction data of the transaction management platform; only suspected abnormal transactions and transactions with abnormal behavior need to be reviewed and marked.

[0015] Furthermore, to achieve the above objectives, the present invention also provides a transaction data anomaly analysis and processing system based on feature correlation dimensionality reduction, the system comprising: The feature dimensionality reduction module is used to determine the multi-dimensional original features of different types of transaction data based on the transaction management platform, and to perform feature dimensionality reduction processing based on the degree of correlation between the original features to obtain the dimensionality-reduced target features. The module determines the initial anomaly probability of the transaction data based on the deviation between the target features and the historical normal features of the transaction data. If the initial anomaly probability of the transaction data does not meet the requirements, the module proceeds to the next step. The behavior analysis module is used to identify transaction data whose initial abnormal probability does not meet the requirements as suspected abnormal transactions, determine the transaction behavior feature data of the suspected abnormal transactions through the dimensionality-reduced target features of the suspected abnormal transactions, and determine the behavior abnormal probability and behavior abnormal transactions of the suspected abnormal transactions based on the deviation between the transaction behavior feature data and historical normal behavior feature data. The risk assessment module is used to determine the overall transaction risk of the transaction management platform based on the initial abnormal probability of different suspected abnormal transactions and the behavioral abnormal probability of different behavioral abnormal transactions. When the overall transaction risk does not meet the requirements, the process proceeds to the next step. The review and update module is used to perform anomaly review on all transaction data of the transaction management platform and update the transaction risk label status of the transaction management platform based on the review results.

[0016] This invention provides a method for anomaly analysis and processing of transaction data based on feature correlation dimensionality reduction. This method effectively removes redundant information and noise interference from high-dimensional transaction data by performing feature dimensionality reduction based on the correlation between original features, while retaining key feature information. This not only significantly reduces the resource consumption and time cost of subsequent calculations but also avoids the curse of dimensionality, improving the convergence speed and generalization ability of the anomaly detection model. A two-stage screening mechanism combining initial anomaly probability and behavioral anomaly probability is employed. First, a rapid initial screening is performed using the dimensionality-reduced target features, followed by in-depth behavioral feature deviation analysis of suspected anomaly transactions. This coarse-to-fine, progressive judgment logic effectively distinguishes between normal fluctuations and genuine anomalies, significantly reducing false positive and false negative rates. Determining the overall transaction risk based on different levels of anomaly probability allows the system to flexibly adjust its response strategy according to the risk level. When the overall risk is controllable, a full review is unnecessary; only high-risk objects are processed. Only when the risk exceeds the limit is a full or more stringent review process triggered. This mechanism optimizes resource allocation and improves the system's response speed and flexibility to sudden risks. Through final anomaly review and updating of transaction risk label status, a closed-loop management process of detection, assessment, review, and feedback is formed. This not only ensures the accuracy of current transaction data but also provides continuous correction data for historical normal feature and behavioral feature databases, enabling the system to evolve with changes in transaction patterns and maintain long-term detection effectiveness. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating an embodiment of the transaction data anomaly analysis and processing method based on feature correlation dimensionality reduction according to the present invention; Figure 2 This is a structural block diagram of an embodiment of the transaction data anomaly analysis and processing system based on feature correlation dimensionality reduction according to the present invention.

[0018] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0020] Reference Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the transaction data anomaly analysis and processing method based on feature association dimensionality reduction according to the present invention. An embodiment of the transaction data anomaly analysis and processing method based on feature association dimensionality reduction according to the present invention is presented.

[0021] In one embodiment, the transaction data anomaly analysis and processing method based on feature correlation dimensionality reduction includes: Step S100: Determine the multi-dimensional original features of different types of transaction data according to the transaction management platform, and perform feature dimensionality reduction processing according to the degree of correlation between the original features to obtain the target features after dimensionality reduction. Determine the initial anomaly probability of the transaction data according to the deviation between the target features and the historical normal features of the transaction data. If the initial anomaly probability of the transaction data does not meet the requirements, proceed to the next step.

[0022] The transaction management platform can be an information system used to process, record, and monitor transaction activities in fields such as finance, e-commerce, or payment clearing. It can serve as a source of transaction data and an execution environment for anomaly detection, supporting the entire anomaly analysis process. Different types of transaction data can be collections of transaction records with different business attributes or sources generated within the transaction management platform, forming the foundation of the original input data for anomaly detection. For example, different types of transaction data can include, but are not limited to, one or more of payment transaction data, transfer transaction data, and recharge transaction data. Multi-dimensional original features can be multiple numerical or categorical indicators extracted from different types of transaction data, describing transaction attributes. They can be used to characterize the complete state of a single transaction and serve as the initial input to the anomaly detection model. In an exemplary embodiment, multi-dimensional original features can be obtained by parsing, encoding, aggregating, or deriving calculations from transaction record fields. Furthermore, multi-dimensional original features can include, but are not limited to, one or more of timestamp features, amount features, and device fingerprint features.

[0023] The degree of correlation between original features can be a quantitative indicator measuring the statistical dependence or semantic relevance between multi-dimensional original features, and can be used to guide the retention of feature combinations with collaborative discriminative capabilities during feature dimensionality reduction. In a specific embodiment, the degree of correlation between original features can be calculated using mutual information, Pearson correlation coefficient, Granger causality test, or graph neural network embedding. Feature dimensionality reduction can be an operation that compresses a high-dimensional feature space based on the degree of correlation between original features, and can be used to remove redundancy and noise, retaining key feature combinations sensitive to anomalies. The target feature after dimensionality reduction can be a low-dimensional but higher information density feature subset obtained after feature dimensionality reduction, which can be used as an efficient input for subsequent anomaly probability calculation and behavior analysis. Furthermore, the target feature after dimensionality reduction can form an input-output relationship with the multi-dimensional original features; and participate in the initial anomaly probability calculation together with historical normal features. Historical normal features can be feature distributions or statistical models extracted and stored from historically confirmed normal transaction data, and can be used as a benchmark to determine whether the current transaction deviates from the normal pattern. In one exemplary embodiment, historical normal features can be formed by continuously accumulating verified non-anomaly-free transaction samples and clustering, density estimation, or distribution modeling their target features.

[0024] The initial anomaly probability can be a measure of the likelihood of a transaction being abnormal, calculated based on the deviation between the dimensionality-reduced target features and historical normal features. It can be used to quickly screen potentially abnormal transactions and trigger the next stage of fine-grained analysis. In a specific embodiment, the initial anomaly probability can be quantified and mapped to probability using methods such as Mahalanobis distance, local outlier factor (LOF), and Gaussian mixture model likelihood.

[0025] Determining the multi-dimensional original features of different types of transaction data based on the transaction management platform can involve extracting various transaction records from the platform's logs or database and structuring them into feature vectors containing multiple dimensions. Further, this operation can be performed by cleaning, parsing, and feature engineering the original transaction logs through an ETL pipeline, or by using a streaming engine to extract key fields from transaction events in real time and encode them as features. This achieves the technical effect of constructing standardized data representations that can be used as input for machine learning models. Feature dimensionality reduction based on the degree of correlation between original features can involve calculating the correlation strength between original features and selecting or constructing a low-dimensional feature subset with high information retention based on this correlation. For example, this operation can be achieved by constructing a feature correlation graph and using graph neural networks for node embedding dimensionality reduction, or by performing feature clustering based on a mutual information matrix and selecting representative features or constructing synthetic features in each cluster. This achieves the technical effect of reducing dimensionality while retaining semantically relevant features sensitive to anomalies and suppressing noise interference.

[0026] Determining the initial anomaly probability of transaction data based on the deviation between the target features and the historical normal features can be achieved by comparing the dimensionality-reduced target features with the distribution model of historical normal features, calculating the degree of deviation, and mapping it to a probability value. In a specific embodiment, this operation can be achieved by fitting the distribution of historical normal features using a Gaussian mixture model and calculating the negative log-likelihood of the current sample as an anomaly score, or by using a local outlier factor algorithm to evaluate the local density deviation of samples in the target feature space. This can achieve the technical effect of efficiently screening massive amounts of transactions and filtering obviously normal samples. Transaction data whose initial anomaly probability does not meet the requirements can be classified as suspected anomaly transactions. This can be achieved by setting an initial anomaly probability threshold; transactions below the threshold are considered normal, and those above are marked as suspected anomalies. This can achieve the technical effect of narrowing down the range of samples requiring in-depth analysis and improving the system's processing efficiency.

[0027] Step S200: Transaction data whose initial abnormal probability does not meet the requirements are identified as suspected abnormal transactions. The transaction behavior feature data of suspected abnormal transactions are determined by the target features after dimensionality reduction of the suspected abnormal transactions. The abnormal probability of the suspected abnormal transactions and the abnormal transactions are determined based on the deviation between the transaction behavior feature data and the historical normal behavior feature data.

[0028] Among them, suspected abnormal transactions can be transaction data whose initial abnormal probability does not meet the preset threshold requirement, and can be used as input objects for the second stage of behavioral anomaly analysis. Further, suspected abnormal transactions are generated by the initial abnormal probability determination; their dimensionality-reduced target features are used to derive transaction behavior feature data. Transaction behavior feature data can be features reflecting user or account behavior patterns further extracted from the dimensionality-reduced target features of suspected abnormal transactions, which can be used to characterize the behavioral logic behind the transactions and support deeper anomaly identification. In an exemplary embodiment, transaction behavior feature data can be generated by performing time-series aggregation, sequence modeling, or graph structure construction on the target features. For example, transaction behavior feature data can include, but is not limited to, one or more of the following: transaction frequency patterns, cross-account interaction graphs, device switching trajectories, etc. Historical normal behavior feature data can be a library of typical user or account behavior patterns extracted and accumulated from historical normal transactions, which can be used as a reference benchmark for calculating behavioral anomaly probability. In a specific embodiment, historical normal behavior feature data can be constructed based on long-term observed compliant user behavior through behavior clustering, Markov chain modeling, or behavior embedding learning.

[0029] Deviation can be a measure of the difference between transaction behavior characteristic data and historical normal behavior characteristic data. It can be used to quantify the degree to which current behavior deviates from normal behavior and to calculate the probability of behavioral anomalies. Furthermore, deviation can be obtained using measurement methods suitable for behavioral sequences or structures, such as Dynamic Time Warping (DTW), KL divergence, and graph edit distance. The probability of behavioral anomalies is a probability value calculated based on deviation, reflecting the likelihood of anomalies at the transaction behavior level. It can be used to confirm whether suspected abnormal transactions constitute genuine behavioral anomalies. Furthermore, the probability of behavioral anomalies can be used in conjunction with the initial anomaly probability to determine overall transaction risk. A behaviorally abnormal transaction can be a suspected abnormal transaction whose probability of behavioral anomalies reaches a judgment threshold; it can be used as a high-confidence anomaly sample to participate in overall risk assessment.

[0030] Determining the transaction behavior characteristics of suspected abnormal transactions by using dimensionality-reduced target features can be achieved by combining the target features of a single transaction with the contextual information of its associated account or user to generate high-order features reflecting behavioral patterns. In one specific embodiment, this operation can be implemented by grouping target features by user ID and constructing behavioral sequences within a sliding time window to extract statistical features, or by using target features to construct a heterogeneous graph of user-device-IP and generating behavioral embeddings through a graph neural network. This achieves the technical effect of moving from isolated transactions to the behavioral level and enhancing the contextual awareness capability of anomaly identification.

[0031] Determining the probability of suspected abnormal transactions and identifying abnormal transactions based on the deviation between transaction behavior feature data and historical normal behavior feature data can be achieved by calculating the deviation between the current behavior features and the historical normal behavior model, and generating an abnormal behavior probability accordingly. Transactions exceeding a threshold are classified as abnormal. For example, this operation can be implemented by using a variational autoencoder to model normal behavior and using the reconstruction error as the deviation, or by using a Markov chain model of the behavior sequence and calculating the log-likelihood of the observed sequence as the anomaly score. This can achieve the technical effect of accurately identifying complex abnormal patterns (such as slow money laundering and account theft).

[0032] Step S300: Determine the overall transaction risk of the transaction management platform based on the initial abnormal probability of different suspected abnormal transactions and the behavioral abnormal probability of different behavioral abnormal transactions. If the overall transaction risk does not meet the requirements, proceed to the next step.

[0033] The overall transaction risk can be a platform-level risk level calculated by combining the initial anomaly probability of all suspected abnormal transactions with the behavioral anomaly probability of transactions with abnormal behavior. This risk level can be used as a decision-making basis for whether to trigger a full review. In an exemplary embodiment, the overall transaction risk can aggregate individual risks through weighted fusion, risk integral models, or Bayesian networks.

[0034] Determining the overall transaction risk of a transaction management platform based on the initial probability of different suspected abnormal transactions and the behavioral probability of different abnormal transactions can aggregate the risk probabilities of all individual transactions to form a platform-level risk indicator. Furthermore, this operation can be achieved by weighted summation of the probabilities of high-risk transactions (weights determined by business importance or amount), or by constructing a risk heatmap and statistically analyzing the density and concentration of high-risk transactions per unit time, thereby achieving the technical effect of supporting dynamic resource scheduling and response strategy adjustments.

[0035] Step S400: Perform anomaly review on all transaction data of the transaction management platform, and update the transaction risk label status of the transaction management platform based on the review results.

[0036] The full transaction data can be the collection of all transaction records generated by the transaction management platform within a specific time window, serving as the scope for review when overall transaction risk exceeds the limit. Anomaly review processing can be a process of manually or automatically auditing transaction data to confirm its true risk status. It can be used to verify the accuracy of anomaly detection results and generate feedback signals. Transaction risk label status can be metadata identifiers assigned to each transaction, representing its risk assessment result. It can be used to update the historical normal feature database and behavioral feature database, driving the system's adaptive evolution. For example, transaction risk label status can include, but is not limited to, one or more of the following: Normal Confirmed, Anomaly Confirmed, Pending Review.

[0037] Performing anomaly review on all transaction data of the transaction management platform can be achieved by initiating a deep review process for all transactions when the overall transaction risk exceeds the limit. In one specific embodiment, this operation can be implemented by calling a high-precision but computationally intensive deep anomaly detection model to re-evaluate all data, or by pushing all transactions to a manual review queue for sampling or full analysis by risk control experts. This can achieve the technical effect of preventing systemic risks from being missed and ensuring risk control coverage in extreme scenarios. Updating the transaction risk label status of the transaction management platform based on the review results can be achieved by writing the confirmed review results into the transaction metadata and simultaneously updating the historical normal feature library and behavioral feature library. Furthermore, this operation can be achieved by adding confirmed normal anomaly false alarm samples to the historical normal feature library for incremental training, or by labeling confirmed anomaly samples for negative sample augmentation of the supervised learning model. This can achieve the technical effect of forming a closed-loop feedback mechanism, enabling the system to have continuous learning and adaptive capabilities.

[0038] Taking real-time anti-fraud during e-commerce platform promotions as an example, the transaction data anomaly analysis and processing method based on feature association dimensionality reduction in this embodiment can be used when the transaction management platform receives hundreds of thousands of payment requests per second during the peak period of the Double Eleven promotion. The system first extracts multi-dimensional raw features from each transaction, including user device fingerprints, IP geolocation, order amount, product category, and historical purchase frequency. By calculating the mutual information between these features, it identifies a high correlation between device changes and logins from different locations, merging these into a target feature for identity switching intensity. Subsequently, this target feature is compared with a historical normal feature database (built based on transactions with no complaints in the past three months) to calculate an initial anomaly probability, filtering out approximately 5% of suspected abnormal transactions. For these transactions, the system further extracts their behavioral sequences over the past 24 hours (such as browsing-adding to cart-payment paths) and compares them with the user's historical behavioral patterns to calculate the probability of behavioral anomalies. If an account suddenly switches from purchasing small daily necessities to placing high-frequency luxury orders with an abnormal path, the probability of behavioral anomalies increases significantly. The system integrates the probabilities of all high-risk transactions. If the overall transaction risk exceeds a threshold (such as the proportion of abnormal transactions suddenly increasing to 3%), a full review is triggered, calling a graph neural network to scan the transaction relationships across the entire network. Finally, the normal transactions confirmed by the review are used to expand the historical normal behavior database, enabling the system to adapt to reasonable changes in user behavior during major promotional periods.

[0039] In one embodiment, the multi-dimensional raw features of the transaction data include the transaction frequency within the most recent preset transaction window, the time interval between different transaction operations, the transaction amount, the counterparty association attributes, and the transaction channel type.

[0040] The preset transaction window can be a sliding or fixed time interval used to limit the time range of feature calculation. It can be used to provide calculation boundaries for time-series features such as transaction frequency and time intervals, ensuring that the features reflect recent behavioral patterns. In this embodiment, the preset transaction window can be described in context as constraining the feature extraction range by setting a clear time boundary. For example, the preset transaction window can be one or more of the following, including but not limited to a scrolling 24-hour window, a recent 7-day window, and a session-level dynamic window. Transaction frequency can be the total number of transactions occurring within the preset transaction window or the transaction density per unit time, which can be used to characterize user activity and identify abnormal surges or drops in behavior. Furthermore, transaction frequency can be described in context as being obtained by counting or calculating the rate of transaction records of a specified account within the preset transaction window.

[0041] The time interval between different transaction operations can be a sequence of time differences between two consecutive transactions from the same account. This can be used to characterize the user's operational rhythm and detect mechanical high-frequency trading or non-human behavioral patterns. In an exemplary embodiment, the time interval between different transaction operations can be described in context as being obtained by calculating the timestamp difference between adjacent transactions after sorting the transaction records by time. The transaction amount can be the amount of funds involved in a single transaction, which can be used to reflect the scale of fund flows and to identify large abnormal transfers or splitting transactions to evade detection. In a specific embodiment, the transaction amount can be described in context as being obtained by directly extracting the amount field from the transaction record and performing standardization or logarithmic transformation.

[0042] The counterparty association attribute can be a set of features describing the potential association between the current transaction recipient and historical counterparties. It can be used to reveal hidden account network risks, such as structured associations like shared devices, IP addresses, and receiving accounts. Furthermore, the counterparty association attribute can be described in context as being obtained by constructing an association graph from fields such as device fingerprints, IP addresses, and recipient IDs and extracting topological features through graph databases or association rule mining. For example, the counterparty association attribute can include, but is not limited to, one or more of the following: device overlap, IP co-occurrence frequency, and recipient cluster affiliation. The transaction channel type can be the access channel or payment method category used to initiate the transaction. It can be used to identify uncommon or high-risk channel switching behavior, such as a sudden switch from an official app to a third-party aggregated payment. In this embodiment, the transaction channel type can be described in context as being obtained by parsing channel identifiers from transaction metadata and mapping them to predefined categories. For example, the transaction channel type can use official mobile applications, web gateways, or third-party SDK payments.

[0043] Determining the transaction frequency within the most recent preset transaction window can be achieved by counting the total number of transactions completed by a specified account within the preset window or by calculating the transaction rate per unit time. Furthermore, determining the transaction frequency within the most recent preset transaction window can be achieved by using a sliding window counter to maintain the transaction frequency for each account in real time, or by aggregating the number of transactions within the window in a batch processing job based on event timestamps. This allows for the generation of quantitative indicators reflecting the user's recent activity level, supporting the initial screening of abnormal behavior. Determining the time interval between different transaction operations can be achieved by sorting transactions of the same account by time and calculating the time difference between adjacent transactions. Further, determining the time interval between different transaction operations can be achieved by maintaining the timestamps of the most recent N transactions in stream processing and updating the interval sequence in real time, or by generating a complete time interval vector in offline feature engineering and statistically analyzing its distribution characteristics (such as minimum value and variance). This allows for the extraction of user operation rhythm characteristics, which can be used to identify automated scripts or abnormal behavior patterns.

[0044] Determining the transaction amount can be achieved by directly reading the amount field from the transaction record and performing necessary format conversions or normalization. Furthermore, determining the transaction amount can be achieved by taking the logarithm of the original amount to mitigate the influence of long-tail distribution, or by combining it with the user's historical mean for Z-score standardization, thus providing a basic input for the fund size dimension and supporting anomaly detection. Determining the counterparty's association attributes can be done by querying the co-occurrence of the current counterparty with historical counterparties in dimensions such as device, IP, and account, based on the current counterparty's information. Furthermore, determining the counterparty's association attributes can be achieved by using graph embedding algorithms (such as Node2Vec) to generate a vector representation of the counterparty relationship graph, or by calculating the Jaccard similarity between the current counterparty and historical high-frequency counterparties through a rule engine, thereby constructing implicit association network features and enhancing the ability to identify group fraud or money laundering activities. Determining the transaction channel type can be achieved by parsing the channel identifier field in the transaction request and mapping it to a predefined channel category system. Furthermore, the transaction channel type can be determined by converting the original channel ID into a standardized type label through dictionary mapping, or by combining the channel risk level library to output the channel type and its corresponding risk score. This can capture changes in user channel usage habits and help determine whether an account has been misused.

[0045] For example, in a scenario involving real-time monitoring of bank account theft, the transaction data anomaly analysis and processing method based on feature association dimensionality reduction in this embodiment could be as follows: A user account typically makes 1-2 small transfers per week through the official mobile banking app, with the counterparties being fixed friends and family. One day, the system detects that this account initiated 5 large transfers within 10 minutes through a third-party aggregated payment channel, with the recipients being newly appearing unfamiliar accounts that share the same device. In this scenario, the preset transaction window is set to the most recent hour, and the transaction frequency suddenly increases from an average of 1.5 times per week to 5 times / 10 minutes; the time intervals are extremely short and uniform (approximately 2 minutes per transaction), consistent with script behavior; the transaction amount is significantly higher than the historical average; the counterparty association attribute shows that the new recipients share the same device fingerprint; and the transaction channel type changes from the official app to a high-risk third-party channel. These feature combinations retain strong discriminative power after correlation and dimensionality reduction. They are marked as high-risk in the initial anomaly probability stage. After entering the behavior analysis stage, it is further confirmed that their operation rhythm deviates significantly from historical behavior, which ultimately triggers high-risk review and freezes the account. At the same time, the normal transaction samples before this misuse are updated to the historical normal feature library, so that the system can adapt to possible future channel expansion but maintain sensitivity to abnormal combinations.

[0046] In one embodiment, the method for determining the initial anomaly probability of the transaction data is as follows: Based on the target features after dimensionality reduction, the feature values ​​of each dimension of the transaction data within the current preset transaction window are determined, and the feature association similarity between the current transaction and different historical normal transactions is determined by combining the correlation weights between the features. The initial anomaly score of the current transaction is determined by the similarity of its features with those of different historical normal transactions, and the initial anomaly probability of the transaction data is obtained by mapping the initial anomaly score of the current transaction.

[0047] The current preset transaction window can be a sliding or fixed time interval used to limit the time range of the current transaction analysis. It can be used to constrain the time boundary of feature values ​​compared with historical normal transactions, ensuring that similarity calculation is based on a comparable business context. In this embodiment, the current preset transaction window can be one or more of the following, including but not limited to a real-time sliding window, a daily batch processing window, and an event-triggered window. The feature values ​​of each dimension can be the specific numerical or category values ​​corresponding to the dimensionality-reduced target features within the current preset transaction window. They can be used to constitute the specific representation of the current transaction in the low-dimensional feature space, serving as the basic unit for similarity calculation. The association weights between features can be weighted coefficients reflecting the strength of business semantic dependence or statistical coupling between the dimensions of the dimensionality-reduced target features. They can be used to differentiate the importance of different feature combinations when calculating similarity, highlighting key association paths that are sensitive to anomalies. Furthermore, the association weights between features can be obtained by preserving or reconstructing the original feature association degree during the dimensionality reduction process, and can be generated through attention mechanisms, graph edge weights, or mutual information normalization.

[0048] Historical normal transactions can be past transaction records that have been confirmed to be without anomalies and are within the effective time range of the current preset transaction window. These can be used as a reference sample set for calculating feature association similarity. In an exemplary embodiment, historical normal transactions can be compared with the current transaction through feature association similarity; their feature values ​​participate in the aggregation calculation of the initial anomaly score. The current transaction can be an instance of transaction data being analyzed and can be used as the subject of the initial anomaly probability calculation. For example, the current transaction can have its feature association similarity calculated with historical normal transactions based on its feature values ​​across various dimensions. Feature association similarity can be a weighted similarity measure between the current transaction and a single historical normal transaction, taking into account differences in feature values ​​and the association weights between features. This can be used to replace traditional unweighted distance measures, more accurately characterizing the consistency of transaction behavior patterns. In a specific embodiment, feature association similarity can be calculated using weighted cosine similarity, Mahalanobis distance (the covariance matrix is ​​constructed from association weights), or graph embedding inner product, etc.

[0049] The initial anomaly score can be a quantitative indicator of the degree of anomaly generated by aggregating the feature association similarity between the current transaction and multiple historical normal transactions. It can be used as an intermediate variable to map the initial anomaly probability, reflecting the degree of deviation from the normal group. Furthermore, the initial anomaly score can be aggregated by taking the negative value of the similarity and then calculating the mean, minimum, or weighted quantile. Determining the feature values ​​of transaction data within the current preset transaction window based on the dimensionality-reduced target features can be achieved by mapping the current transaction to the dimensionality-reduced target feature space and extracting its specific feature values ​​under the constraints of a preset time window. Further, this operation can be achieved by projecting the current transaction's features into the dimensionality-reduced low-dimensional space, thereby ensuring that the feature representation is aligned with the time-sensitive business scenario and avoiding cross-cycle pattern confusion.

[0050] Determining the feature association similarity between the current transaction and different historical normal transactions by combining the association weights between features can be achieved by introducing association weights between feature dimensions for weighted measurement when calculating the similarity between the current transaction and each historical normal transaction. Furthermore, this operation can be implemented by constructing a diagonal or off-diagonal weight matrix using association weights and substituting it into the weighted Euclidean distance formula to calculate similarity, or by treating features as graph nodes and association weights as edges, using graph neural network embedding, and calculating the inner product of the embedded vectors as the similarity. This allows similarity assessment to focus on feature combinations with strong business logic connections, improving the semantic accuracy of anomaly detection.

[0051] The initial anomaly score of the current transaction is determined by associating it with the features of different historical normal transactions. This can be achieved by aggregating the feature association similarities between the current transaction and all historical normal transactions to generate a single anomaly score. Further, this operation can be implemented by taking the minimum of all similarities (i.e., the least similar historical sample) as the basis for anomaly assessment, or by calculating the tail statistics of the similarity distribution (such as the mean below the 10th percentile) to measure the degree of extreme deviation. This transforms many-to-one similarity comparisons into a unified anomaly strength index, supporting subsequent probability mapping. The initial anomaly probability of the transaction data is obtained by mapping the initial anomaly score based on the current transaction. This can be achieved by converting the initial anomaly score into a probability value within the interval [0, 1] using a monotonically decreasing function. Further, this operation can be implemented by smoothing the score using the Sigmoid function, or by fitting an extreme value distribution (such as Gumbel) based on the historical score distribution to calculate the probability exceeding a threshold. This provides a standardized probability output, facilitating comparison with the threshold and subsequent fusion.

[0052] For example, in the context of real-time anti-money laundering monitoring in cross-border payment scenarios, the transaction data anomaly analysis and processing method based on feature association dimensionality reduction in this embodiment can be as follows: When a user initiates a cross-border remittance, the system first extracts the target features after dimensionality reduction (such as the risk level of the receiving country, the ratio of the amount to the historical average, the rate of change in remittance frequency, etc.) within a 5-minute sliding window. These feature dimensions have preset association weights—for example, the combined weight of "high-risk receiving country" and "first large remittance" is significantly higher than that of their individual occurrences. The system retrieves compliant cross-border transactions of the same user or similar users within the past 30 days from the historical normal transaction database and calculates the feature association similarity between the current transaction and each historical transaction: if the historical transactions are mostly small amounts, low frequency, and the receiving country is on the whitelist, then the current transaction obtains extremely low similarity due to the mismatch of high-weight feature combinations. The system takes the minimum value among all similarities as the basis for anomaly, generates a high initial anomaly score, and obtains an initial anomaly probability of 0.92 after Sigmoid mapping, which exceeds the initial screening threshold and enters the behavior analysis stage. This process avoids false alarms due to high single-dimensional amounts and also prevents weak multi-dimensional anomaly signals from being ignored.

[0053] In one embodiment, the initial anomaly probability of the transaction data ranges from 0 to 1. When the initial anomaly probability of the transaction data is greater than a preset initial probability threshold, it is determined that the initial anomaly probability of the transaction data does not meet the requirements.

[0054] The preset initial probability threshold can be a pre-defined probability boundary value used to determine whether the initial anomaly probability triggers the next stage of analysis. It can serve as the decision threshold for the first stage in a two-stage anomaly detection mechanism, filtering out suspected abnormal transactions requiring further analysis. In an exemplary embodiment, the preset initial probability threshold can be determined using ROC curves on a historical validation set, business risk tolerance, or online A / B testing. Furthermore, the preset initial probability threshold can be used in conjunction with the initial anomaly probability to form a quantitative comparison relationship, supporting efficient initial risk screening. For example, the preset initial probability threshold can include, but is not limited to, one or more of a fixed threshold calibrated based on statistical learning, an adaptive threshold dynamically adjusted over time, etc. When the initial anomaly probability of the transaction data is greater than the preset initial probability threshold, it is determined that the initial anomaly probability of the transaction data does not meet the requirements. This can be achieved by comparing the calculated initial anomaly probability with the preset initial probability threshold; if the former is larger, it is determined that the requirements are not met. Furthermore, this judgment operation can be implemented through a real-time streaming computing engine or a batch processing scoring module, thereby enabling rapid filtering of low-risk transactions and retaining only high-probability anomaly samples for behavioral-level analysis, improving the overall processing efficiency of the system.

[0055] For example, in the scenario of real-time fraud interception on mobile payment platforms, the transaction data anomaly analysis and processing method based on feature association dimensionality reduction in this embodiment can be as follows: When a user initiates a large transfer on a device in a different location, the system outputs an initial anomaly probability of 0.78 after feature association dimensionality reduction and similarity modeling. The platform calibrates based on historical fraud cases and sets a preset initial probability threshold of 0.65. Since 0.78 > 0.65, the system determines that the initial anomaly probability of the transaction does not meet the requirements, automatically marks it as a suspected abnormal transaction, and transfers it to the second-stage behavior analysis module to check its behavioral characteristics such as login switching and unfamiliarity of the receiving account within the past hour; while a large number of small daily payments with an initial anomaly probability below 0.65 (such as probabilities of 0.32 and 0.41) are directly allowed without additional computational resource consumption. This threshold mechanism ensures that high-risk transactions are not missed, while avoiding overreaction to normal fluctuations.

[0056] In one embodiment, the method for determining the initial anomaly probability of the transaction data is as follows: The benchmark feature values ​​for each dimension of all normal transactions are determined by using the feature data of historical normal transactions, as well as the benchmark correlation between different features, and these are used as benchmark features and benchmark correlation strength. The initial outliers of the current transaction are determined based on the deviations of the current transaction's feature values ​​from the benchmark features and the deviations of the current transaction's feature correlation strength from the benchmark correlation strength. The initial anomaly probability of the transaction data is obtained by mapping the initial outlier of the current transaction.

[0057] The feature data of historical normal transactions can be the multi-dimensional original features or the target feature set after dimensionality reduction corresponding to transaction samples that have been verified as normal. This data can be used to construct benchmark features and benchmark correlation strength reflecting normal transaction patterns. Furthermore, the feature data of historical normal transactions can originate from historical transaction records with a transaction risk label status of "normal confirmed." The benchmark feature values ​​for each dimension of all normal transactions can be typical values ​​or distribution parameters for each feature dimension statistically derived from the feature data of historical normal transactions. These values ​​can be used as a reference standard to measure whether the current transaction feature values ​​deviate from normal. In an exemplary embodiment, the benchmark feature values ​​for each dimension of all normal transactions can be obtained by calculating the mean, median, quantiles, or fitting a probability distribution (such as a Gaussian distribution). For example, the benchmark feature values ​​for each dimension of all normal transactions can include, but are not limited to, one or more of the following: benchmark mean for the amount dimension, benchmark mode interval for the login period, and benchmark distribution of device type frequency.

[0058] The baseline correlation between different features can be a quantitative representation of the statistical dependence or semantic relevance between different feature dimensions in historical normal transactions. It can be used to characterize the structured relationships between features under normal conditions and to detect relationship anomalies. In a specific embodiment, the baseline correlation between different features can be learned from historical normal transactions through mutual information, partial correlation coefficients, conditional probabilities, or graph edge weights. Furthermore, the baseline correlation between different features can include, but is not limited to, the co-occurrence strength of frequently used devices and IP addresses, the conditional probability of transaction amount and product category, and the joint distribution density of login time and geographical location. The baseline feature can be a vector or model composed of the baseline feature values ​​of each dimension of all normal transactions, and can be used as a comparison benchmark for calculating the numerical deviation of the current transaction features. Furthermore, the baseline feature can participate in the calculation of initial outliers together with the feature values ​​of each dimension of the current transaction.

[0059] The baseline correlation strength can be a correlation structure model (such as a matrix, graph, or tensor) composed of the baseline correlation degrees between different features, and can be used as a reference for calculating the deviation of the current transaction feature correlation strength. In an exemplary embodiment, the baseline correlation strength can participate in the calculation of the initial outlier value together with the feature correlation strength of the current transaction. The feature values ​​of each dimension of the current transaction can be the specific observation values ​​of the transaction to be evaluated in each dimension of the target feature after dimensionality reduction, which can be used to compare with the baseline feature to calculate the degree of anomaly at the numerical level.

[0060] The feature correlation strength of the current transaction can be a measure of the correlation between features calculated based on the current transaction or its context (such as recent user behavior), which can be used to reflect whether the feature relationships in the current transaction conform to a normal pattern. Furthermore, when the feature correlation strength of the current transaction cannot be directly calculated for a single transaction, local correlation modeling can be performed by combining the sequence of transactions with the same subject within a sliding window. The initial outlier of the current transaction can be a comprehensive anomaly score generated by fusing the numerical deviation and correlation structure deviation of the current transaction, which can be used as an intermediate indicator for mapping the initial anomaly probability, reflecting a dual anomaly signal. In a specific embodiment, the initial outlier of the current transaction can integrate the two types of deviations through weighted summation, a multimodal fusion network, or a distance metric function. The initial anomaly probability of the transaction data can be a probabilistic anomaly measure obtained by transforming the initial outlier through a monotonic mapping function, which can be used to determine whether to enter the second stage of behavioral analysis. Furthermore, the calculation logic of the initial anomaly probability of the transaction data differs from the initial anomaly probability in the original scheme due to the introduction of correlation strength deviation.

[0061] Determining the baseline feature values ​​for all dimensions of normal transactions and the baseline correlation between different features by using historical normal transaction feature data can be achieved by statistically analyzing the typical values ​​of each dimension and the correlation strength between feature pairs from the historical normal transaction feature data. Furthermore, this operation can be achieved by fitting a Gaussian distribution to continuous features to obtain the mean and variance as baseline feature values, while simultaneously calculating the feature covariance matrix as the baseline correlation, or by jointly modeling the baseline features and baseline correlation using kernel density estimation and conditional mutual information for categorical and continuous mixed features. This allows for the construction of a dual normal pattern prior that includes both numerical distribution and structural relationships.

[0062] Using these as benchmark features and benchmark correlation strengths can solidify the statistically obtained benchmark feature values ​​and benchmark correlation degrees into a reference model for system operation. Furthermore, this operation can provide a stable and reusable normality criterion for real-time transaction anomaly assessment. Determining the initial outlier value of the current transaction based on the deviations of its various feature values ​​from the benchmark features and the deviations of the current transaction's feature correlation strength from the benchmark correlation strength can be achieved by separately calculating numerical deviations and correlation structure deviations, and then fusing them into a single anomaly score. In an exemplary embodiment, this operation can be implemented by using Mahalanobis distance to measure numerical deviations and Frobenius norm to measure correlation matrix differences, followed by linear weighting of the two, or by feeding the two types of deviations as inputs into a lightweight neural network for nonlinear fusion to generate the initial outlier value. This allows the initial screening mechanism to simultaneously perceive numerical anomalies and relational anomalies, improving the ability to identify complex spoofing behaviors. Mapping the initial outlier value of the current transaction to obtain the initial anomaly probability of the transaction data can be achieved by converting the initial outlier value into a probability value within the interval [0, 1] using a Sigmoid, Softmax, or other monotonic function. Furthermore, this operation can be achieved by mapping outlier quantiles to probabilities using an empirical distribution function, or by calibrating outliers probabilities using a calibration model (such as PlattScaling), thereby unifying the outlier measurement scale and facilitating subsequent threshold determination and risk aggregation.

[0063] Taking account theft identification in cross-border payments as an example, the transaction data anomaly analysis and processing method based on feature association dimensionality reduction in this embodiment can be as follows: A user has been using a fixed device for small-amount cross-border payments within China for a long time. Their historical normal transactions show a high correlation between the device ID and frequently used countries (high baseline correlation strength), and the average amount per transaction is $200 (baseline feature). One day, a new transaction suddenly increases to $5000 (the current transaction's feature values ​​deviate significantly from the baseline feature), and it is initiated from a less frequently used country using a new device (causing the "device-country" correlation strength in the current transaction to approach zero, which is seriously inconsistent with the baseline correlation strength). The system calculates the numerical deviation (amount anomaly) and structural deviation (device-country decoupling) separately, merges them to generate a high initial anomaly value, maps it to an initial anomaly probability of 0.92, and triggers the behavior analysis phase. This mechanism effectively identifies "low-frequency, highly disguised" theft behaviors that would be missed by traditional methods that only consider the amount threshold.

[0064] In one embodiment, the transaction behavior characteristic data of suspected abnormal transactions includes changes in transaction amount, transaction frequency, and transaction fund flow characteristics of suspected abnormal transactions at different times within the current preset transaction window.

[0065] The current preset transaction window can be a sliding or fixed time period used to limit the time range for extracting behavioral features. It can constrain the time boundary of transaction behavior analysis, focusing behavioral features on recent dynamics and enhancing sensitivity to sudden anomalies. In this embodiment, the current preset transaction window can be one or more of, including but not limited to, a rolling time window, an event-triggered window, and a business cycle window. Different time periods can be multiple continuous or discrete time sub-intervals further divided within the current preset transaction window. This can support fine-grained modeling of transaction behavior at the temporal granularity level, capturing the dynamic evolution of behavioral patterns. For example, different time periods can be hourly time periods, day / night segments, or weekday and non-working day segments. Transaction amount changes can be the numerical change patterns or statistical characteristics of suspected abnormal transactions in different time periods. This can reflect the fluctuation characteristics of user consumption or transfer amounts and identify abnormal spending or income behaviors that deviate from historical habits. Furthermore, transaction amount changes can be obtained by calculating indicators such as the mean, variance, maximum value, abrupt change point, or relative deviation from the historical period for each time period.

[0066] Transaction operation frequency can be defined as the number of operations or transactions initiated by suspected abnormal transactions within a unit of time. It can be used to characterize the temporal distribution of user transaction activity and detect abnormal behaviors such as high-frequency probing, order brushing, or automated attacks. In an exemplary embodiment, the transaction operation frequency is statistically analyzed by the number of transaction records in different time periods, and further derived indicators such as frequency growth rate and peak duration can be calculated. Transaction fund flow characteristics can be structural features describing the path and direction of transaction funds transfer between accounts, merchants, or regions. They can be used to reveal potential money laundering or theft patterns such as fund aggregation, dispersion, and cross-domain transfer. In a specific embodiment, transaction fund flow characteristics construct a fund flow graph based on information such as counterparty, receiving account type, and IP address location, and extract graph features such as in-degree / out-degree, path length, and loop structure.

[0067] Determining the transaction amount changes of suspected abnormal transactions within different time periods of the current preset transaction window can be achieved by dividing the current preset transaction window into multiple time periods and calculating the statistical characteristics or trends of transaction amounts in each time period. Further, this operation can be achieved by using a sliding window to calculate a moving average amount and comparing it with a historical baseline, or by using piecewise linear regression to detect significant inflection points or slope changes in the amount sequence, thereby enabling time-sensitive detection of abnormal amount fluctuations and distinguishing between occasional large transactions and systemic anomalies. Determining the transaction frequency of suspected abnormal transactions within different time periods of the current preset transaction window can be achieved by statistically analyzing the number of transactions per unit time period at a preset time granularity, forming a frequency time series. Further, this operation can be achieved by constructing a Poisson process model to assess the deviation of the observed frequency from historical expectations, or by calculating the entropy value of adjacent transaction intervals, enabling the identification of behaviors with abnormally high transaction density in a short period, such as tentative small transactions after account theft.

[0068] Determining the flow characteristics of suspected abnormal transactions across different time periods within a preset transaction window can be achieved by constructing fund flow relationships and extracting structural features based on counterparty, account type, and geographic location information for each time period. Furthermore, this operation can be accomplished by constructing a directed fund flow graph within each time period to calculate node centrality or community structure changes, or by tracing the multi-hop path of a single fund transaction to identify whether there is a closed-loop backflow or high-risk entity transfer, thereby capturing typical money laundering or fraud paths such as rapid fund aggregation followed by transfer out, and multi-level hops.

[0069] Taking real-time monitoring of bank account theft as an example, the transaction data anomaly analysis and processing method based on feature association dimensionality reduction in this embodiment can be as follows: A user account suddenly initiates multiple small transfers to an unfamiliar third-party payment account at 2:00 AM. The system first divides the current preset transaction window (e.g., the past 6 hours) into two different time periods: 0-2:00 AM and 2-6:00 AM. During the 2-6:00 AM period, the frequency of transaction operations increases sharply from an average of 3 transactions per day to 28 transactions, and the transaction amount changes in a pattern of first small-scale trials (50 yuan) and then concentrated transfers (5000 yuan per transaction); at the same time, the "transaction fund flow characteristics" show that the funds are quickly transferred to overseas wallets through two newly registered shell merchant accounts. These behavioral characteristics deviate significantly from the user's historical normal behavior (mainly local consumption during weekdays), resulting in a significant increase in the probability of abnormal behavior. Based on this, the system determines it as a high-risk abnormal transaction and triggers manual review. After the review confirms the theft, the sample is used to update the historical normal behavior characteristic data to strengthen the ability to identify high-frequency cross-border fund flows at night.

[0070] In one embodiment, the method for determining the probability of abnormal behavior in suspected abnormal transactions is as follows: The average daily transaction amount and average transaction frequency for different time periods are determined by using historical normal transaction behavior data to identify the corresponding transaction types of suspected abnormal transactions. Based on transaction behavior characteristic data, determine the total transaction amount and transaction volume of suspected abnormal transactions within the current preset transaction window, and combine the average daily transaction amount of the corresponding transaction type and the average transaction frequency of different time periods to determine the abnormal behavior value of the current transaction. The probability of abnormal behavior in suspected abnormal transactions is obtained by mapping the abnormal behavior values ​​of the current transactions.

[0071] The corresponding transaction type can be the business category to which the suspected abnormal transaction belongs, used to distinguish normal behavior benchmarks under different transaction models. In this embodiment, the corresponding transaction type can provide a basis for classification calculation of behavioral indicators such as average daily transaction amount and time period frequency, realizing anomaly judgment based on type adaptation. For example, the corresponding transaction type can include, but is not limited to, one or more of online shopping payments, cross-border remittances, and virtual goods top-ups. The behavioral characteristic data of historical normal transactions can be behavioral pattern data statistically derived from historically confirmed normal transactions, divided by transaction type. Further, the behavioral characteristic data of historical normal transactions can be used to calculate the average daily transaction amount and average transaction frequency in different time periods under a specific transaction type, as a dynamic behavioral benchmark. In an exemplary embodiment, the behavioral characteristic data of historical normal transactions can be obtained by grouping historical normal transactions by transaction type and statistically analyzing their amount and time-series frequency distribution.

[0072] The average daily transaction amount can be the average transaction amount of historical normal transactions within a single calendar day for a specific transaction type. In one specific embodiment, the average daily transaction amount can serve as a benchmark to measure whether the current transaction amount is abnormal, reflecting the typical consumption level of a user under that type. Further, the average daily transaction amount can be obtained by aggregating historical normal transactions by transaction type and date and then taking the average. The average transaction frequency for different time periods can be the average number of transactions of historical normal transactions within a day for a specific transaction type, across various preset time periods (e.g., morning, noon, and evening). In this embodiment, the average transaction frequency for different time periods can reflect the typical activity patterns of users in different time periods, used to identify behavioral abrupt changes over time. For example, the average transaction frequency for different time periods can be obtained by dividing a day into multiple fixed time periods, statistically analyzing the frequency of historical normal transactions within each time period, and then averaging the results.

[0073] The current preset transaction window can be a time range used to evaluate current transaction behavior, typically a sliding time window (such as the most recent 1 hour or 24 hours). Furthermore, the current preset transaction window can define the time context for abnormal behavior analysis, making the anomaly judgment timely. In a specific embodiment, the current preset transaction window can be a rolling 24-hour window, a real-time 5-minute window, or a daily cumulative window. The total transaction amount within the current preset transaction window can be the sum of all similar transactions by the account or user to which the suspected abnormal transaction belongs within the current preset transaction window. In this embodiment, the total transaction amount within the current preset window can quantify the intensity of capital flow within the current behavior window, used for deviation comparison with the daily average transaction amount.

[0074] The transaction volume at different times can be the number of transactions by the account to which the suspected abnormal transaction belongs within the current preset transaction window, divided into preset time periods. Furthermore, the transaction volume at different times can characterize the user's activity rhythm within the current window, used for comparison with historical frequency benchmarks. The behavioral anomaly value can be a comprehensive deviation measure calculated by comparing the current transaction behavior indicator with a historical normal benchmark. In an exemplary embodiment, the behavioral anomaly value can serve as an intermediate quantitative indicator for subsequent mapping to a behavioral anomaly probability. For example, the behavioral anomaly value can be obtained by fusing the deviation between amount and frequency using standardized residuals, Z-scores, or weighted relative deviations. The behavioral anomaly probability can be a probabilistic risk score obtained by transforming the behavioral anomaly value through a monotonic mapping function. In this embodiment, the behavioral anomaly probability can provide a probabilistically interpretable measure of behavioral anomaly, facilitating fusion with the initial anomaly probability and threshold determination. Furthermore, the behavioral anomaly probability can be obtained by mapping the behavioral anomaly value to the [0, 1] interval using a Sigmoid, Softmax, or empirical cumulative distribution function.

[0075] Determining the average daily transaction amount and average transaction frequency for suspected abnormal transactions across different time periods using historical normal transaction behavior data can be achieved by retrieving and calculating the average daily transaction amount and average transaction frequency for each time period from historical normal transaction behavior data based on the suspected abnormal transaction type. Furthermore, this operation can be implemented either by offline pre-calculating the average daily amount and time period frequency for each transaction type and storing it as a lookup table, or by online on-demand real-time aggregation and statistics of the historical normal transaction database to respond to the current transaction type. This allows for the establishment of a dynamic behavioral benchmark matching the current transaction type, avoiding cross-type misjudgments. Determining the total transaction amount and transaction volume for suspected abnormal transactions within the current preset transaction window based on transaction behavior data can be achieved by extracting all transactions within the current preset transaction window that belong to the same account and transaction type as the suspected abnormal transaction, summarizing their amounts, and statistically analyzing the number of operations by time period. In one specific embodiment, this operation can be achieved by using streaming state storage to maintain the sliding window aggregate value for each user-type combination, or by querying transaction records from a real-time database by time range and user ID and aggregating them on-site, thereby accurately characterizing the actual transaction intensity and rhythm within the current behavior window.

[0076] Determining the behavioral anomaly value of a current transaction by combining the average daily transaction amount for the corresponding transaction type and the average transaction frequency for different time periods can be achieved by comparing the total transaction amount of the current window with the average daily transaction amount, and simultaneously comparing the transaction volume for each time period with the average frequency for the corresponding time period, and generating a behavioral anomaly value by combining the deviations of the two. For example, this operation can be achieved by calculating the Z-scores of the amount and frequency separately and then weighting and summing them as the behavioral anomaly value, or by constructing a two-dimensional deviation vector and measuring its distance from the normal center using Mahalanobis distance, thereby achieving joint sensitive detection of sudden increases in amount and time pattern shifts. Mapping the behavioral anomaly value of the current transaction to obtain the behavioral anomaly probability of suspected abnormal transactions can be achieved by inputting the behavioral anomaly value into a preset monotonic mapping function, outputting a probability value between 0 and 1. Furthermore, this operation can be achieved by using the Sigmoid function to compress the behavioral anomaly value into a probability, or by constructing a quantile mapping table based on the empirical distribution of historical abnormal samples for lookup transformation, thereby giving the behavioral anomaly measurement probabilistic semantics, supporting integration with other probabilistic indicators and unified threshold management.

[0077] For example, in the scenario of money laundering identification in cross-border remittances, the transaction data anomaly analysis and processing method based on feature association dimensionality reduction in this embodiment can be as follows: A user account typically makes 1-2 small cross-border remittances per month, with each remittance amounting to approximately $500 USD, mostly occurring in the afternoon on weekdays. The system categorizes this as a cross-border remittance transaction type and calculates the average daily transaction amount for this type to be $30 USD based on historical normal transactions, with an average frequency of 0.8 times / day in the afternoon. In the early morning of a certain day, this account initiated 5 remittances in one hour, totaling $8,000 USD. The system calculates the total transaction amount to be $8,000 USD within the current preset transaction window (1 hour), with 5 transaction operations in the early morning; compared to the historical benchmark, the amount deviates by more than 260 times, and the frequency deviates by more than 6 times; the comprehensive calculation shows an extremely high abnormal behavior value, with an abnormal behavior probability of 0.97 after Sigmoid mapping, far exceeding the threshold, and is judged as an abnormal behavior transaction, triggering a high-risk review process.

[0078] In one embodiment, when the probability of abnormal behavior of a suspected abnormal transaction is not less than a preset limit value for abnormal behavior, the suspected abnormal transaction is determined to be an abnormal behavior transaction.

[0079] The preset abnormal behavior probability limit can be a probability threshold used to determine whether a suspected abnormal transaction constitutes an abnormal behavior transaction. It can be used as a decision boundary for the probability of abnormal behavior, realizing the transformation from continuous risk scoring to binary anomaly judgment. In this embodiment, the preset abnormal behavior probability limit can be set or adaptively adjusted based on the trade-off between false positive and false negative rates of historical review results, business risk tolerance, or dynamic risk environment. For example, the preset abnormal behavior probability limit can be a static threshold, set offline by the risk control strategy team based on historical data; or it can be a dynamic threshold, automatically adjusting the limit based on the real-time overall transaction risk level or time period characteristics.

[0080] When the probability of a suspected abnormal transaction is not less than a preset abnormality probability limit, the suspected abnormal transaction is determined to be an abnormal transaction. This can be achieved by comparing the calculated abnormality probability with the preset abnormality probability limit; if the former is greater than or equal to the latter, the transaction is marked as an abnormal transaction. Furthermore, this operation can be implemented using static or dynamic thresholds, thereby enabling accurate screening of high-confidence abnormal samples to support subsequent risk aggregation and response decisions.

[0081] Taking the identification of fraudulent transactions on payment platforms at night as an example, the transaction data anomaly analysis and processing method based on feature association dimensionality reduction in this embodiment can be as follows: A user typically makes small-amount QR code payments during the day, with a historical daily average transaction amount of 80 yuan for this type of QR code payment. The average transaction frequency at night (22:00–6:00) is close to 0. At 2:00 AM one day, the account completed 3 large-amount transfers within 10 minutes. The system calculated the probability of its abnormal behavior to be 0.92 through behavioral analysis. The platform's current preset abnormal behavior probability limit is 0.85 (dynamically lowered due to the high risk sensitivity at night). Since 0.92 ≥ 0.85, this transaction is identified as an abnormal behavior transaction, enters the high-risk queue, and triggers manual review and temporary account freezing strategies.

[0082] In one embodiment, when the overall transaction risk meets the requirements, it is not necessary to review all transaction data of the transaction management platform; only suspected abnormal transactions and transactions with abnormal behavior need to be reviewed and marked.

[0083] The review marking process can be an operation that applies a risk review label to a specific transaction and records its review status. It can be used to perform lightweight confirmation and status labeling of a high-risk subset without triggering a full review, supporting subsequent tracking or manual intervention. In this embodiment, the review marking process can assign temporary or final risk labels to suspected abnormal transactions and transactions with abnormal behavior through an automatic rule engine or a lightweight review model, and write them into the transaction metadata. For example, the review marking process can include, but is not limited to, labeling suspected abnormal transactions as "requires manual review" or directly marking transactions with abnormal behavior as "high-risk level," or one or more of these methods.

[0084] When the overall transaction risk meets the requirements, there is no need to review all transaction data on the transaction management platform. Instead, it can be determined whether the overall transaction risk is below or equal to a preset threshold. If so, the deep review process for all transaction data is skipped. Furthermore, this operation can be achieved by the system calculating transaction risk indicators in real time for the current period and comparing them with preset thresholds, thus avoiding the high-cost full review when system risk is controllable, saving computational and human resources. Only suspected abnormal transactions and transactions with abnormal behavior need to be reviewed and marked. This can be done by limiting the review scope to a subset of high-risk transactions identified through a two-stage screening mechanism and marking them accordingly. In one exemplary embodiment, this operation can be achieved by labeling suspected abnormal transactions as "requiring manual review" and pushing them to the risk control queue, and by directly marking abnormal transactions as "high-risk" and freezing related operations. In a specific embodiment, a lightweight verification model (such as rules + simple classifier) ​​can also be invoked to perform secondary scoring on the two types of transactions, and update their transaction risk label status based on the results. This allows resources to be focused on high-confidence abnormal candidates, improving review efficiency and accuracy, while maintaining risk monitoring coverage.

[0085] Taking the daily risk control operations of a cross-border payment platform as an example, the transaction data anomaly analysis and processing method based on feature association dimensionality reduction in this embodiment can be as follows: A cross-border payment platform processes an average of one million transactions per day during non-promotional periods. After the system completes two-stage anomaly detection, it calculates the overall transaction risk to be 0.8% (below the preset threshold of 1%), determining that the risk is controllable. At this point, the system does not initiate a full review, but only performs review and marking processing on approximately 3,000 suspected abnormal transactions (initial anomaly probability exceeding the standard) and approximately 800 of them with abnormal behavior (significant behavioral deviations): the former are marked as "required for review" and enter the low-priority review queue, while the latter are immediately marked as "high-risk level" and trigger temporary account restrictions. This strategy reduces the daily manual review volume from millions to thousands, while ensuring that genuine fraudulent transactions (mostly manifested as abnormal behavior) are intercepted in a timely manner. The review results are then used to update the historical normal feature library and continuously optimize the initial screening model.

[0086] In addition, refer to Figure 2 To achieve the above objectives, the present invention also provides a transaction data anomaly analysis and processing system based on feature correlation dimensionality reduction, the system comprising: The feature dimensionality reduction module 10 is used to determine the multi-dimensional original features of different types of transaction data based on the transaction management platform, and to perform feature dimensionality reduction processing based on the degree of correlation between the original features to obtain the dimensionality-reduced target features. The initial anomaly probability of the transaction data is determined based on the deviation between the target features and the historical normal features of the transaction data. When the initial anomaly probability of the transaction data does not meet the requirements, the process proceeds to the next step. The behavior analysis module 20 is used to identify transaction data whose initial abnormal probability does not meet the requirements as suspected abnormal transactions, determine the transaction behavior feature data of the suspected abnormal transactions through the dimensionality-reduced target features of the suspected abnormal transactions, and determine the behavior abnormal probability and behavior abnormal transactions of the suspected abnormal transactions based on the deviation between the transaction behavior feature data and the historical normal behavior feature data. The risk assessment module 30 is used to determine the overall transaction risk of the transaction management platform based on the initial abnormal probability of different suspected abnormal transactions and the behavioral abnormal probability of different behavioral abnormal transactions. When the overall transaction risk does not meet the requirements, the next step is initiated. The review and update module 40 is used to perform anomaly review on all transaction data of the transaction management platform and update the transaction risk label status of the transaction management platform according to the review results.

[0087] Other embodiments or specific implementations of the transaction data anomaly analysis and processing system based on feature correlation dimensionality reduction described in this invention can be referred to the above-mentioned method embodiments, and will not be repeated here.

[0088] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for anomaly analysis and processing of transaction data based on feature correlation dimensionality reduction, characterized in that, The method includes: The transaction management platform determines the multi-dimensional original features of different types of transaction data, and performs feature dimensionality reduction based on the correlation between the original features to obtain the target features after dimensionality reduction. The initial anomaly probability of the transaction data is determined based on the deviation between the target features and the historical normal features of the transaction data. If the initial anomaly probability of the transaction data does not meet the requirements, proceed to the next step. Transaction data whose initial abnormal probability does not meet the requirements are identified as suspected abnormal transactions. The transaction behavior feature data of the suspected abnormal transactions are determined by the target features after dimensionality reduction of the suspected abnormal transactions. The abnormal probability of the suspected abnormal transactions and the abnormal transaction behavior are determined based on the deviation between the transaction behavior feature data and the historical normal behavior feature data. The overall transaction risk of the transaction management platform is determined based on the initial abnormal probability of different suspected abnormal transactions and the behavioral abnormal probability of different behavioral abnormal transactions. When the overall transaction risk does not meet the requirements, proceed to the next step. Anomaly review is performed on all transaction data of the transaction management platform, and the transaction risk label status of the transaction management platform is updated based on the review results. The method for determining the initial anomaly probability of the transaction data is as follows: Based on the target features after dimensionality reduction, the feature values ​​of each dimension of the transaction data within the current preset transaction window are determined, and the feature association similarity between the current transaction and different historical normal transactions is determined by combining the correlation weights between the features. The initial anomaly score of the current transaction is determined by the similarity of its features with those of different historical normal transactions, and the initial anomaly probability of the transaction data is obtained by mapping the initial anomaly score of the current transaction.

2. The transaction data anomaly analysis and processing method based on feature correlation dimensionality reduction as described in claim 1, characterized in that, The multi-dimensional original features of the transaction data include the transaction frequency within the most recent preset transaction window, the time interval between different transaction operations, the transaction amount, the counterparty association attributes, and the transaction channel type.

3. The transaction data anomaly analysis and processing method based on feature correlation dimensionality reduction as described in claim 1, characterized in that, The initial anomaly probability of the transaction data ranges from 0 to 1. When the initial anomaly probability of the transaction data is greater than a preset initial probability threshold, it is determined that the initial anomaly probability of the transaction data does not meet the requirements.

4. The transaction data anomaly analysis and processing method based on feature correlation dimensionality reduction as described in claim 1, characterized in that, The method for determining the initial anomaly probability of the transaction data is as follows: The benchmark feature values ​​for each dimension of all normal transactions are determined by using the feature data of historical normal transactions, as well as the benchmark correlation between different features, and these are used as benchmark features and benchmark correlation strength. The initial outliers of the current transaction are determined based on the deviations of the current transaction's feature values ​​from the benchmark features and the deviations of the current transaction's feature correlation strength from the benchmark correlation strength. The initial anomaly probability of the transaction data is obtained by mapping the initial outlier of the current transaction.

5. The transaction data anomaly analysis and processing method based on feature correlation dimensionality reduction as described in claim 1, characterized in that, The transaction behavior characteristic data of the suspected abnormal transaction includes the transaction amount changes, transaction operation frequency, and transaction fund flow characteristics of the suspected abnormal transaction at different time periods within the current preset transaction window.

6. The transaction data anomaly analysis and processing method based on feature correlation dimensionality reduction as described in claim 1, characterized in that, The method for determining the probability of abnormal behavior in the suspected abnormal transactions is as follows: The average daily transaction amount and average transaction frequency for different time periods are determined by using historical normal transaction behavior data; Based on the transaction behavior characteristic data, the total transaction amount and transaction volume of the suspected abnormal transaction within the current preset transaction window are determined, and the behavior abnormality value of the current transaction is determined by combining the average daily transaction amount of the corresponding transaction type and the average transaction frequency of different time periods. The probability of abnormal behavior of the suspected abnormal transaction is obtained by mapping the abnormal behavior values ​​of the current transaction.

7. The transaction data anomaly analysis and processing method based on feature correlation dimensionality reduction as described in claim 6, characterized in that, If the probability of abnormal behavior of the suspected abnormal transaction is not less than the preset limit value of abnormal behavior probability, then the suspected abnormal transaction is determined to be an abnormal behavior transaction.

8. The transaction data anomaly analysis and processing method based on feature correlation dimensionality reduction as described in claim 1, characterized in that, When the overall transaction risk meets the requirements, it is not necessary to review all transaction data of the transaction management platform; only suspected abnormal transactions and transactions with abnormal behavior need to be reviewed and marked.

9. A transaction data anomaly analysis and processing system based on feature correlation dimensionality reduction, characterized in that, The system includes: The feature dimensionality reduction module is used to determine the multi-dimensional original features of different types of transaction data based on the transaction management platform, and to perform feature dimensionality reduction processing based on the degree of correlation between the original features to obtain the dimensionality-reduced target features. The module determines the initial anomaly probability of the transaction data based on the deviation between the target features and the historical normal features of the transaction data. If the initial anomaly probability of the transaction data does not meet the requirements, the module proceeds to the next step. The behavior analysis module is used to identify transaction data whose initial abnormal probability does not meet the requirements as suspected abnormal transactions, determine the transaction behavior feature data of the suspected abnormal transactions through the dimensionality-reduced target features of the suspected abnormal transactions, and determine the behavior abnormal probability and behavior abnormal transactions of the suspected abnormal transactions based on the deviation between the transaction behavior feature data and historical normal behavior feature data. The risk assessment module is used to determine the overall transaction risk of the transaction management platform based on the initial abnormal probability of different suspected abnormal transactions and the behavioral abnormal probability of different behavioral abnormal transactions. When the overall transaction risk does not meet the requirements, the process proceeds to the next step. The review and update module is used to perform anomaly review on all transaction data of the transaction management platform and update the transaction risk label status of the transaction management platform according to the review results. The method for determining the initial anomaly probability of the transaction data is as follows: Based on the target features after dimensionality reduction, the feature values ​​of each dimension of the transaction data within the current preset transaction window are determined, and the feature association similarity between the current transaction and different historical normal transactions is determined by combining the correlation weights between the features. The initial anomaly score of the current transaction is determined by the similarity of its features with those of different historical normal transactions, and the initial anomaly probability of the transaction data is obtained by mapping the initial anomaly score of the current transaction.

Images