Abnormal transaction detection method, device, equipment, storage medium and program product

Abstract

The application discloses an abnormal transaction detection method and device, equipment, a storage medium and a program product, and relates to the technical field of financial risk control. The method comprises the following steps: acquiring first abnormal transaction correlation features of first transaction flow data in a first time period; determining a target sampling strategy according to a first drift distance between a feature distribution of the first abnormal transaction correlation features and a preset reference distribution; sampling second transaction flow data according to the target sampling strategy to obtain a transaction flow data training set; training an initial abnormal transaction detection model according to the transaction flow data training set to obtain an abnormal transaction detection model used for indicating whether abnormal transaction behavior exists in the abnormal transaction correlation features; the abnormal transaction detection model is used for obtaining an abnormal transaction detection result according to the abnormal transaction correlation features; and a first abnormal transaction detection result is obtained according to the first abnormal transaction correlation features and the abnormal transaction detection model. The scheme disclosed by the application can realize abnormal transaction detection.

Description

Technical Field

[0001] This application belongs to the field of financial risk control technology, specifically relating to an abnormal transaction detection method, device, equipment, storage medium, and program product. Background Technology

[0002] Existing technologies for anomaly detection can be broadly categorized into three types: Logistic Regression (LR), Gradient Boosted Decision Tree (GBDT), and a combination of LR and GBDT. These technologies primarily use the attribute information of transaction users as the object and anomaly detection as the prediction result. They extract features such as user age, occupation, average annual income, fixed asset amount, and weight of evidence (WOE) after binning as the features to be detected. Then, they select random forests, support vector machines, and neural networks to construct detection models for anomaly detection. Therefore, existing methods mainly rely on the attribute information of transaction users and expert experience to build detection models. However, these methods often face difficulties in detecting anomaly behavior, especially organized fraud. Summary of the Invention

[0003] This application provides an abnormal transaction detection method, apparatus, device, storage medium, and program product, which solves the problem of difficulty in detecting abnormal transaction behavior in the prior art.

[0004] In a first aspect, embodiments of this application provide an abnormal transaction detection method, including:

[0005] Obtain the first abnormal transaction association feature of the first transaction stream data within the first time period;

[0006] The target sampling strategy is determined based on the first drift distance between the feature distribution of the first abnormal transaction association features and the preset benchmark distribution;

[0007] According to the target sampling strategy, data sampling is performed on the second transaction stream data to obtain a transaction stream data training set; the second transaction stream data is the transaction stream data within the second time period.

[0008] The initial abnormal transaction detection model is trained based on the transaction flow data training set to obtain an abnormal transaction detection model; the abnormal transaction detection model is used to obtain abnormal transaction detection results based on abnormal transaction association features, and the abnormal transaction detection results are used to indicate whether the abnormal transaction association features contain abnormal transaction behavior;

[0009] Based on the first abnormal transaction association features and the abnormal transaction detection model, the first abnormal transaction detection result is obtained.

[0010] Optionally, in the abnormal transaction detection method, the target sampling strategy includes one of the following:

[0011] A first sampling strategy is used to indicate data sampling based on a first sampling intensity used to collect the first transaction stream data;

[0012] A second sampling strategy is used to indicate the use of a second sampling intensity for data sampling; the second sampling intensity is monotonically increasing with the first drift distance.

[0013] The third sampling strategy is used to instruct the use of a third sampling intensity to sample transaction flow data within the time period preceding the first time period.

[0014] Optionally, the abnormal transaction detection method, wherein determining the target sampling strategy based on a first drift distance between the feature distribution of the abnormal transaction association features and a preset benchmark distribution, includes:

[0015] If the first drift distance between the feature distribution of the abnormal transaction association features and the preset benchmark distribution is less than or equal to the preset starting drift distance, then the target sampling strategy is determined to be the first sampling strategy.

[0016] If the first drift distance is greater than the preset starting drift distance and less than the preset ending drift distance, then the target sampling strategy is determined to be the second sampling strategy;

[0017] If the first drift distance is greater than or equal to the preset end drift distance, then the target sampling strategy is determined to be the third sampling strategy.

[0018] Optionally, the abnormal transaction detection method further includes:

[0019] Based on the current load metrics, a load score is obtained, which includes at least one of the following: CPU utilization, memory usage, length of the pending transaction stream queue, and processing latency.

[0020] The sampling intensity indicated by the target sampling strategy is adjusted based on the load score to obtain the adjusted target sampling strategy;

[0021] According to the target sampling strategy, data sampling is performed on the second transaction stream data to obtain a transaction stream data training set, including:

[0022] According to the adjusted target sampling strategy, the second transaction stream data is sampled to obtain the transaction stream data training set.

[0023] Optionally, the abnormal transaction detection method, wherein adjusting the sampling intensity indicated by the target sampling strategy based on the load score to obtain the adjusted target sampling strategy includes:

[0024] If the load score is less than or equal to the first load score, the sampling intensity indicated by the target sampling strategy is increased to obtain the adjusted target sampling strategy.

[0025] If the load score is greater than the first load score and less than or equal to the second load score, then the sampling intensity indicated by the target sampling strategy is reduced to obtain the adjusted target sampling strategy.

[0026] If the load score is greater than the second load score, the sampling intensity indicated by the target sampling strategy is reduced to the preset minimum sampling intensity to obtain the adjusted target sampling strategy.

[0027] Optionally, the abnormal transaction detection method, wherein sampling the second transaction stream data according to the target sampling strategy to obtain a transaction stream data training set includes:

[0028] According to the target sampling strategy and the first sampling scheduling information, data sampling is performed on the first sub-transaction flow data associated with the second abnormal transaction association feature of the first type in the second transaction flow data, and data sampling is performed on the second sub-transaction flow data associated with the second abnormal transaction association feature of the second type in the second transaction flow data according to the target sampling strategy, the second sampling scheduling information and the sampling weight, so as to obtain a transaction flow data training set;

[0029] The first sampling scheduling information is determined based on at least one of the following: the density clustering result of the first transaction stream data; the expected execution time of the first sub-transaction stream data; and the expected resource consumption of the first sub-transaction stream data.

[0030] The second sampling scheduling information is determined based on at least one of the following: the importance score of the first feature of the first abnormal transaction association feature to the initial abnormal transaction detection model; the expected execution time of the second sub-transaction stream data; and the expected resource consumption of the second sub-transaction stream data.

[0031] Optionally, the abnormal transaction detection method further includes:

[0032] Determine the feature importance level and / or attenuation factor corresponding to the first feature importance score;

[0033] The sampling weights are determined based on the feature importance hierarchy and / or the attenuation factor.

[0034] Optionally, the abnormal transaction detection method, wherein training an initial abnormal transaction detection model based on the transaction stream data training set to obtain an abnormal transaction detection model includes:

[0035] The initial abnormal transaction detection model is trained based on the transaction flow data training set to obtain the parameter weights of each network layer within the initial abnormal transaction detection model.

[0036] The target network layer inside the initial abnormal transaction detection model is removed to obtain an abnormal transaction detection model, wherein the parameter weights of the target network layer are less than the weight threshold.

[0037] Secondly, embodiments of this application also provide an abnormal transaction detection device, comprising:

[0038] The acquisition module is used to acquire the first abnormal transaction association characteristics of the first transaction stream data within the first time period;

[0039] The determination module is used to determine the target sampling strategy based on the first drift distance between the feature distribution of the first abnormal transaction association features and the preset benchmark distribution;

[0040] The sampling module is used to sample the second transaction flow data according to the target sampling strategy to obtain a transaction flow data training set; the second transaction flow data is the transaction flow data within a second time period.

[0041] The training module is used to train the initial abnormal transaction detection model based on the transaction flow data training set to obtain the abnormal transaction detection model; the abnormal transaction detection model is used to obtain the abnormal transaction detection result based on the abnormal transaction association features, and the abnormal transaction detection result is used to indicate whether the abnormal transaction association features have abnormal transaction behavior.

[0042] The detection module is used to obtain the first abnormal transaction detection result based on the first abnormal transaction association features and the abnormal transaction detection model.

[0043] Thirdly, embodiments of this application also provide an abnormal transaction detection device, including: a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the processor executes the program or instructions to implement the abnormal transaction detection method as described in the first aspect.

[0044] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the abnormal transaction detection method as described in the first aspect.

[0045] Fifthly, embodiments of this application also provide a computer program product, including computer instructions, which, when executed by a processor, implement the abnormal transaction detection method as described in the first aspect.

[0046] Compared with existing technologies, this application provides an abnormal transaction detection method, apparatus, device, storage medium, and program product. The method involves: acquiring a first abnormal transaction association feature of a first transaction stream data within a first time period; determining a target sampling strategy based on a first drift distance between the feature distribution of the first abnormal transaction association feature and a preset benchmark distribution; sampling second transaction stream data according to the target sampling strategy to obtain a transaction stream data training set; the second transaction stream data being transaction stream data within a second time period; training an initial abnormal transaction detection model based on the transaction stream data training set to obtain an abnormal transaction detection model; the abnormal transaction detection model being used to obtain an abnormal transaction detection result based on the abnormal transaction association feature, and the abnormal transaction detection result being used to indicate whether the abnormal transaction association feature exhibits abnormal transaction behavior; and obtaining a first abnormal transaction detection result based on the first abnormal transaction association feature and the abnormal transaction detection model. This approach solves the problem of difficulty in detecting abnormal transaction behavior and also improves detection accuracy. Attached Figure Description

[0047] Figure 1 This is a flowchart illustrating the abnormal transaction detection method described in the embodiments of this application;

[0048] Figure 2 This is a flowchart illustrating one embodiment of the abnormal transaction detection method described in the embodiments of this application;

[0049] Figure 3 This is a schematic diagram of the modules of the abnormal transaction detection device described in the embodiments of this application;

[0050] Figure 4 This is a hardware block diagram of the abnormal transaction detection device described in the embodiments of this application. Detailed Implementation

[0051] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0052] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and are not used to describe a specified order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, not limited in number; for example, a first object can be one or more. Furthermore, in the specification and claims, "and" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0053] like Figure 1 As shown in the embodiment of this application, an abnormal transaction detection method is provided, which can be applied to edge nodes.

[0054] Furthermore, the method includes:

[0055] Step 101: Obtain the first abnormal transaction association feature of the first transaction stream data within the first time period;

[0056] The first time period can be the current time period.

[0057] The first transaction flow data includes, but is not limited to: payment request data; loan application data.

[0058] The first abnormal transaction association feature belongs to structured data; the first abnormal transaction association feature refers to transaction features associated with abnormal transaction behavior, including gang fraud, that is, the first abnormal transaction association feature includes gang-related features (GRF); specifically, the first abnormal transaction association feature includes, but is not limited to: the average transaction amount growth rate of the associated account cluster within a time window; the variance of transaction amount within the gang; the number of accounts sharing the same device fingerprint; and the frequency of occurrence of a specific Merchant Category Code (MCC) in the associated gang. The number of the first abnormal transaction association features can be one or more.

[0059] In this embodiment of the application, based on abnormal transaction behavior, the first abnormal transaction association feature is extracted from the first transaction stream data within the first time period, and the first abnormal transaction association feature is a multimodal abnormal transaction association feature, which can realize the extraction of multimodal abnormal transaction association features.

[0060] It should be noted that step 101 above can be applied to the data acquisition and feature engineering module on the edge node. By inputting the first transaction stream data within the first time period into the data acquisition and feature engineering module, the first abnormal transaction association feature can be output.

[0061] Step 102: Determine the target sampling strategy based on the first drift distance between the feature distribution of the first abnormal transaction association features and the preset benchmark distribution;

[0062] It should be noted that the drift distance in this embodiment can be the Wasserstein distance. Therefore, the first drift distance is used to quantify the minimum cost required to transform the first abnormal transaction association feature into the preset benchmark distribution. The preset benchmark distribution can be set according to actual conditions and is not limited here.

[0063] It should also be noted that step 102 above can be applied to the feature drift detection module and sampling decision-maker on the edge node. First, the feature distribution of the first abnormal transaction associated feature is input into the feature drift detection module, which can output the first drift distance. Then, the first drift distance is input into the sampling decision-maker, which can output the target sampling strategy.

[0064] Therefore, the embodiments of this application can perform real-time drift distance in an edge computing environment, and the computational efficiency is improved compared with the prior art. In addition, the drift distance method used in the embodiments of this application to process the feature distribution of the first abnormal transaction association feature is better able to handle subtle changes between the feature distribution of the first abnormal transaction association feature and the preset benchmark distribution compared with the prior art using KL divergence (Kullback-Leibler Divergence) or JS distance (Jensen-Shannon Divergence), especially for low-density area anomaly patterns commonly found in gang fraud, which have higher detection sensitivity.

[0065] In one implementation, optionally, the target sampling strategy includes one of the following:

[0066] (1) A first sampling strategy, used to indicate data sampling based on a first sampling intensity used to collect the first transaction stream data;

[0067] Here, the first sampling strategy is the same as the sampling strategy used for the first transaction stream data. Alternatively, the first sampling strategy can be other sampling strategies, which are not limited here.

[0068] (2) A second sampling strategy is used to indicate the use of a second sampling intensity for data sampling; the second sampling intensity is monotonically increasing with the first drift distance, that is, it is positively correlated and has hysteresis characteristics;

[0069] Here, since the second sampling intensity indicated by the second sampling strategy is monotonically increasing with the first drift distance, the second sampling strategy can be called a progressive sampling strategy, which gradually increases the sampling intensity based on the first drift distance.

[0070] Specifically, the second sampling intensity is monotonically increasing with the first drift distance, as shown in the sampling intensity function of formula (1) below:

[0071] (1);

[0072] in, Indicates the second sampling intensity; This represents the first drift distance; Indicates the preset starting drift distance; Indicates the preset end drift distance; This indicates the preset maximum sampling intensity, for example, twice the normal sampling intensity; This indicates the preset minimum sampling intensity, for example, 1.2 times the normal sampling intensity.

[0073] (3) The third sampling strategy is used to indicate that the transaction flow data in the time period before the first time period is sampled using the third sampling intensity.

[0074] The third sampling intensity includes at least one of the following: the first sampling intensity; the second sampling intensity; and other sampling intensities.

[0075] Specifically, the third sampling strategy is used to instruct the use of a third sampling intensity to sample the transaction flow data in the time period before the first time period, the first transaction flow data, and the transaction flow data in the time period after the first time period.

[0076] Here, since the third sampling strategy is used to instruct the use of a third sampling intensity to sample the transaction flow data in the time period before the first time period, the first transaction flow data, and the transaction flow data in the time period after the first time period, the third sampling strategy can be called a full sampling strategy.

[0077] It should be noted that the sampling intensity in the embodiments of this application, including the first sampling intensity, the second sampling intensity, and the third sampling intensity, can all be a sampling ratio or a sampling frequency; wherein, the sampling ratio is an oversampling factor; and the sampling frequency is the number of times a sampling operation is triggered per unit time.

[0078] In one implementation, optionally, a target sampling strategy is determined based on a first drift distance between the feature distribution of the abnormal transaction association features and a preset benchmark distribution, including:

[0079] If the first drift distance between the feature distribution of the abnormal transaction association features and the preset benchmark distribution is less than or equal to the preset starting drift distance, then the target sampling strategy is determined to be the first sampling strategy.

[0080] If the first drift distance is greater than the preset starting drift distance and less than the preset ending drift distance, then the target sampling strategy is determined to be the second sampling strategy;

[0081] If the first drift distance is greater than or equal to the preset end drift distance, then the target sampling strategy is determined to be the third sampling strategy.

[0082] In this embodiment, a mapping relationship between drift distance and sampling strategy is pre-set, as follows:

[0083] A1. Drift distance is within the safe range: Drift distance ( ) less than or equal to the preset starting drift distance ( ),Right now Mapped to the first sampling strategy;

[0084] A2. Drift distance is within the critical range: drift distance ( ) greater than the preset starting drift distance ( And less than the preset end drift distance ( ),Right now Mapped to the second sampling strategy;

[0085] A3. Drift distance is within a significant drift range: Drift distance ( ) greater than or equal to the preset end drift distance ( ),Right now This is mapped to the third sampling strategy.

[0086] The aforementioned drift thresholds, including preset start drift distances and preset end drift distances, can be dynamically adjusted according to the time period in which the transaction flow data is located. Specifically, they are dynamically adjusted according to the second time period in which the second transaction flow data is located in subsequent step 103. For example, since the nighttime period corresponds to different businesses than the early morning period (peak transaction flow business, early morning period corresponding to off-peak transaction flow business), the drift thresholds for the nighttime period and the early morning period need to be different, and the drift thresholds for the nighttime period should be more stringent than those for the early morning period. Here, the dynamic adjustment of the drift thresholds can accommodate different businesses and respond in real time to changes in the feature distribution of abnormal transaction association characteristics.

[0087] Therefore, the embodiments of this application provide a time-adaptive dynamic drift threshold adjustment strategy, which can solve the problem of poor adaptability of fixed drift threshold. Compared with the prior art that uses a fixed sampling frequency or ratio, it can achieve the optimal balance between detection accuracy and computational efficiency, and avoid the waste of resources caused by oversampling.

[0088] Furthermore, based on the first drift distance between the feature distribution of the abnormal transaction association features and the preset benchmark distribution, and the mapping relationship between the preset drift distance and the sampling strategy, the target sampling strategy can be determined. Specifically, if the first drift distance is within the aforementioned safe range, the target sampling strategy is determined to be the first sampling strategy; if the second drift distance is within the aforementioned critical range, the target sampling strategy is determined to be the second sampling strategy; and if the third drift distance is within the aforementioned significant drift range, the target sampling strategy is determined to be the third sampling strategy.

[0089] It is understandable that the first drift distance being in the critical range means that the abnormal transaction association features have drifted to a certain extent, but have not yet reached the level of obvious conceptual drift. In order to avoid wasting resources, the second sampling strategy can be used for data sampling.

[0090] It should be noted that if the target sampling strategy is determined to be the first sampling strategy, then in subsequent step 103, the second transaction flow data is sampled using the first sampling intensity indicated by the first sampling strategy to obtain a transaction flow data training set; if the target sampling strategy is determined to be the second sampling strategy, then in subsequent step 103, the second transaction flow data is sampled using the second sampling intensity indicated by the second sampling strategy to obtain a transaction flow data training set; if the target sampling strategy is determined to be the third sampling strategy, then in subsequent step 103, the second transaction flow data is sampled using the third sampling intensity indicated by the third sampling strategy to obtain a transaction flow data training set. In this case, the second transaction flow data includes transaction flow data within the time period prior to the first time period.

[0091] It should also be noted that, to avoid system oscillations caused by drastic fluctuations in sampling intensity, hysteresis control is employed: when the first drift distance crosses the critical interval from low to high, the sampling intensity gradually increases, with each increase not exceeding 20% ​​of the preset maximum step size; when the first drift distance returns to the critical interval from high to low, the sampling intensity slowly decays, with the decay factor set to 0.9 instead of immediately dropping to a low value. This avoids an either-or sampling strategy, allowing for the capture of abnormal patterns at a lower cost in the early drift phase, while preventing the system from frequently switching sampling strategies at boundary states.

[0092] Step 103: According to the target sampling strategy, sample the second transaction flow data to obtain a transaction flow data training set; the second transaction data is the transaction flow data within the second time period.

[0093] The second time period includes at least one of the following: the first time period; the time period before the first time period; and the time period after the first time period.

[0094] It should be noted that step 103 above can be applied to the multimodal sampling engine on the edge node. By inputting the target sampling strategy into the multimodal sampling engine, a transaction flow data training set can be output.

[0095] In one embodiment, optionally, the method further includes:

[0096] A load score is obtained based on the current load metrics, which include at least one of the following: Central Processing Unit (CPU) utilization, memory usage, length of the pending transaction stream queue, and processing latency.

[0097] The sampling intensity indicated by the target sampling strategy is adjusted based on the load score to obtain the adjusted target sampling strategy;

[0098] According to the target sampling strategy, data sampling is performed on the second transaction stream data to obtain a transaction stream data training set, including:

[0099] According to the adjusted target sampling strategy, the second transaction stream data is sampled to obtain the transaction stream data training set.

[0100] The load metric is the current load metric of the edge node.

[0101] Since the CPU utilization, memory usage, network bandwidth, and queue length of the pending transaction streams are dynamically changing when the edge nodes process transaction stream data, this embodiment uses the current load metric as a constraint on the target sampling strategy to achieve a balance between sampling intensity and system health, thereby ensuring system stability.

[0102] Optionally, a load score can be obtained based on current load metrics, including:

[0103] The load score is obtained by weighting the following factors: CPU utilization, memory usage, the ratio of the length of the pending transaction stream queue to the upper limit of the queue capacity, and the ratio of the processing latency to the target latency. The specific formula is shown in formula (2) below:

[0104] (2);

[0105] in, Indicates load score; Indicates CPU utilization; Indicates memory usage; Indicates the length of the queue of transactions to be processed; Indicates the maximum queue capacity; This indicates a processing delay; Indicates the target delay (e.g., 50ms); , , , All weights are pre-set and must meet certain conditions. The specific values ​​of each weight are not restricted here.

[0106] In one implementation, optionally, adjusting the sampling intensity indicated by the target sampling strategy based on the load score to obtain the adjusted target sampling strategy includes:

[0107] If the load score is less than or equal to the first load score, the sampling intensity indicated by the target sampling strategy is increased to obtain the adjusted target sampling strategy.

[0108] If the load score is greater than the first load score and less than or equal to the second load score, then the sampling intensity indicated by the target sampling strategy is reduced to obtain the adjusted target sampling strategy.

[0109] If the load score is greater than the second load score, the sampling intensity indicated by the target sampling strategy is reduced to the preset minimum sampling intensity to obtain the adjusted target sampling strategy.

[0110] In this embodiment, a mapping relationship between load scoring and sampling strategy adjustment rules is pre-set, as follows:

[0111] B1. Load is at a low load state: Load score ( If the score is less than or equal to the first load score (e.g., 0.5), then... 0.5, mapped to the first adjustment rule, is used to indicate an increase in the sampling intensity indicated by the sampling strategy in order to collect more representative transaction flow data;

[0112] B2. Load is at a medium load state: Load score ( A score greater than the first load score (e.g., 0.5) and less than or equal to the second load score (e.g., 0.8) is considered a load score of 0.5. 0.8, mapped to the second adjustment rule, is used to indicate a reduction in the sampling intensity indicated by the sampling strategy. Specifically, the preset maximum sampling intensity in the second sampling strategy is reduced, which is equivalent to reducing the second sampling intensity indicated by the second sampling strategy. Here, the reduction method of the preset maximum sampling intensity is shown in the following formula (3), and it can be reduced by up to 50%.

[0113] (3);

[0114] in, This indicates the preset maximum sampling intensity after reduction; Indicates the preset maximum sampling intensity; This indicates the load score.

[0115] B3. The load is under high load: Load score ( If the score is greater than the second load score (e.g., 0.8), then... 0.8, mapped to the third adjustment rule, is used to indicate that the sampling intensity indicated by the sampling strategy should be reduced to the preset minimum sampling intensity. In addition, under high load conditions, it is necessary to delay the triggering of subsequent step 103, and at the same time adjust the collection object in the sampling strategy. Specifically, it is adjusted to only collect data on transaction flow data within the time period before the first time period.

[0116] Furthermore, based on the load score and the pre-set mapping relationship between the load score and the adjustment rules of the sampling strategy, the sampling intensity indicated by the target sampling strategy can be adjusted to obtain the adjusted target sampling strategy. Specifically, if the load score is less than or equal to the first load score, the sampling intensity indicated by the target sampling strategy is increased to obtain the adjusted target sampling strategy; if the load score is greater than the first load score and less than or equal to the second load score, the sampling intensity indicated by the target sampling strategy is decreased to obtain the adjusted target sampling strategy; if the load score is greater than the second load score, the sampling intensity indicated by the target sampling strategy is reduced to a preset minimum sampling intensity to obtain the adjusted target sampling strategy.

[0117] It should be noted that this application embodiment provides a feedback closed-loop mechanism: after each adjustment of the sampling strategy, the actual resource consumption increment is fed back to the load assessment module on the edge node for updating the threshold parameters. If multiple consecutive samplings cause the load score to continuously increase, the load trigger threshold is automatically increased or the smoothing coefficient is increased. This ensures that the system does not crash or increase latency due to oversampling when resources are scarce, and fully utilizes computing power to improve detection capabilities when resources are abundant. This mechanism enables robust deployment in real edge production environments.

[0118] In one implementation, optionally, data sampling is performed on the second transaction stream data according to the target sampling strategy to obtain a transaction stream data training set, including:

[0119] According to the target sampling strategy and the first sampling scheduling information, data sampling is performed on the first sub-transaction flow data associated with the second abnormal transaction association feature of the first type in the second transaction flow data, and data sampling is performed on the second sub-transaction flow data associated with the second abnormal transaction association feature of the second type in the second transaction flow data according to the target sampling strategy, the second sampling scheduling information and the sampling weight, so as to obtain a transaction flow data training set;

[0120] The first sampling scheduling information is determined based on at least one of the following: the density clustering result of the first transaction stream data; the expected execution time of the first sub-transaction stream data; and the expected resource consumption of the first sub-transaction stream data.

[0121] The second sampling scheduling information is determined based on at least one of the following: the importance score of the first feature of the first abnormal transaction association feature to the initial abnormal transaction detection model; the expected execution time of the second sub-transaction stream data; and the expected resource consumption of the second sub-transaction stream data.

[0122] The first type of second abnormal transaction association feature is a continuous type, such as the average transaction amount growth rate of the associated account cluster within a time window, or the variance of transaction amounts within the group. The second type of second abnormal transaction association feature is a discrete type. The sampling weight refers to the probability of data being sampled, such as the number of accounts sharing the same device fingerprint, or the frequency of occurrence of a specific Merchant Category Code (MCC) within the associated group.

[0123] The above sampling scheduling information includes the first sampling scheduling information and the second sampling scheduling information, which are used to indicate the sampling order.

[0124] It should be noted that the first sub-transaction stream data is the sub-transaction stream data used to extract the second abnormal transaction association features of the first type from the second transaction stream data.

[0125] In this embodiment, joint sampling is performed on first sub-transaction stream data associated with the second abnormal transaction association feature of the first type and second sub-transaction stream data associated with the second abnormal transaction association feature of the second type to achieve multimodal (or multi-type) fusion. Here, the second abnormal transaction association feature of the first type is extracted from the first sub-transaction stream data; and the second abnormal transaction association feature of the second type is extracted from the second sub-transaction stream data.

[0126] Specifically, the density clustering result includes anomaly degree or feature variance. The first sampling scheduling information is equal to one of the following:

[0127] The ratio of the degree of anomaly in the density clustering results to the expected execution time of the first sub-transaction stream data;

[0128] The ratio of the degree of anomaly in the density clustering results to the expected resource consumption of the first sub-transaction stream data;

[0129] The ratio of the feature variance in the density clustering result to the expected execution time of the first sub-transaction stream data;

[0130] The ratio of the feature variance in the density clustering result to the expected resource consumption of the first sub-transaction stream data.

[0131] Specifically, the second sampling scheduling information is equal to one of the following:

[0132] The ratio of the importance score of the first feature to the expected execution time of the second sub-transaction flow data;

[0133] The ratio of the importance score of the first feature to the expected resource consumption of the second sub-transaction flow data.

[0134] Therefore, both the first sampling scheduling information and the second sampling scheduling information can be quantified into a ratio. The sampling execution order is arranged in descending order according to this ratio, that is, the sub-transaction stream data with the smaller ratio is sampled first.

[0135] Specifically, for the first sub-transaction stream data, density clustering is used to identify the density clustering results of the first transaction stream data. The density clustering results include density distribution and / or scale characteristics. Based on the density clustering results, the sampling intensity indicated by the target sampling strategy can be adjusted; and / or, the expected execution time and / or expected resource consumption of the first sub-transaction stream data can be obtained.

[0136] Here, density clustering methods (such as DBSCAN) are used to focus on finding outliers in high-density abnormal regions, which can effectively capture group fraud patterns such as abnormal concentration of funds.

[0137] For the second sub-transaction stream data, a LIME (Local Interpretable Model-agnostic Explanation) weighted hierarchical sampling method is used to obtain the first feature importance score of the discrete abnormal transaction association features in the first abnormal transaction association features on the initial abnormal transaction detection model. Based on the first feature importance score, the sampling weight can be obtained; and / or, the expected execution time and / or expected resource consumption of the second sub-transaction stream data can be obtained.

[0138] Here, a LIME-weighted hierarchical sampling method is used to interpret the initial abnormal transaction detection model in real time, calculating the first feature importance score of each discrete abnormal transaction association feature (such as a specific IP address) in the first abnormal transaction association features on the initial abnormal transaction detection model. This first feature importance score is used as the sampling weight, thereby oversampling abnormal transaction features with high sampling weights to ensure that key fraud patterns are not overlooked.

[0139] Furthermore, the first feature importance score can dynamically determine the sampling start sequence of different types of sub-transaction stream data (e.g., sub-transaction stream data associated with abnormal transaction association features with a first feature importance score greater than 0.6 are sampled first), thereby optimizing resource allocation and improving sampling efficiency.

[0140] Furthermore, this application provides a parallel sampling scheduling algorithm based on time priority: joint sampling scheduling is performed on all types of abnormal transaction association features (including continuous and discrete types) to achieve multimodal fusion, rather than targeting only one type of abnormal transaction association feature. Sampling tasks (including first sub-transaction stream data and second sub-transaction stream data) are arranged in descending order of feature importance and / or computational complexity ratio, with priority given to executing the modality with the highest unit computational cost benefit. At the same time, thread resources are dynamically allocated according to the real-time CPU utilization and memory occupancy of the edge nodes to ensure that high-value, low-overhead sampling tasks are completed first, while low-value or high-overhead sampling tasks are executed or down-frequency processed when resources are idle.

[0141] Specifically, for the continuous second abnormal transaction association features, the aforementioned feature importance refers to the first feature importance score of the discrete abnormal transaction association features in the first abnormal transaction association features to the initial abnormal transaction detection model, obtained by using LIME-weighted hierarchical sampling; the aforementioned computational complexity refers to the expected execution time and expected resource consumption of the first sub-transaction stream data associated with the continuous second abnormal transaction association features.

[0142] For the discrete second abnormal transaction association features, the aforementioned feature importance refers to the density clustering results of the first transaction stream data identified using density clustering, where the density clustering results include anomaly degree or feature variance. The aforementioned computational complexity refers to the expected execution time and expected resource consumption of the second sub-transaction stream data associated with the discrete second abnormal transaction association features.

[0143] Therefore, based on feature importance and computational complexity, the execution order and resource allocation for different modal sampling can be dynamically determined.

[0144] Furthermore, the embodiments of this application employ an asynchronous parallel processing architecture to achieve efficient coordination of multimodal sampling.

[0145] In one embodiment, optionally, the method further includes:

[0146] Determine the feature importance level and / or attenuation factor corresponding to the first feature importance score;

[0147] The sampling weights are determined based on the feature importance hierarchy and / or the attenuation factor.

[0148] In this embodiment of the application, the sampling ratio of each feature importance level is dynamically adjusted based on the adaptive stratification rule of the first feature importance score. That is, in the LIME weighted stratification sampling method, different feature importance levels are divided according to the first feature importance score. For example, the first feature importance score is divided into three feature importance levels from high to low: high, medium, and low. The adaptive stratification rule dynamically adjusts the sampling ratio of each feature importance level, that is, higher sampling weights are given to the high feature importance level.

[0149] Meanwhile, a decay factor is introduced to ensure that the sampling weight can reflect changes in feature importance in a timely manner. In the LIME-weighted stratified sampling method, the feature importance score is multiplied by the decay factor (e.g., 0.9) to obtain the decay value, and then weighted and fused with the feature importance score calculated in the next time period to obtain the sampling weight. For example, the sampling weight = decay factor × feature importance score in the first time period + (1 - decay factor) × feature importance score in the second time period (referring to the time period after the first time period). This makes the feature importance score decay over time, thereby ensuring that the sampling weight can quickly reflect the latest changes in feature importance and avoid outdated fraudulent patterns dominating the sampling decision.

[0150] Step 104: Train the initial abnormal transaction detection model based on the transaction flow data training set to obtain the abnormal transaction detection model; the abnormal transaction detection model is used to obtain the abnormal transaction detection result based on the abnormal transaction association features, and the abnormal transaction detection result is used to indicate whether the abnormal transaction association features have abnormal transaction behavior.

[0151] In one implementation method, optionally, the initial abnormal transaction detection model is trained based on the transaction flow data training set to obtain the abnormal transaction detection model, including:

[0152] The initial abnormal transaction detection model is trained based on the transaction flow data training set to obtain the parameter weights of each network layer within the initial abnormal transaction detection model.

[0153] The target network layer inside the initial abnormal transaction detection model is removed to obtain an abnormal transaction detection model, wherein the parameter weights of the target network layer are less than the weight threshold.

[0154] It is understood that the abnormal transaction detection model is a trained, compressed, or lightweight abnormal transaction detection model. The abnormal transaction detection result includes an anomaly probability score.

[0155] Specifically, L1 regularized pruning technology is used to remove the target network layer inside the initial abnormal transaction detection model to obtain an abnormal transaction detection model, thereby compressing the model size to 30%-40% of the original size and controlling the accuracy loss to within 2%, significantly reducing computation and storage overhead, and solving the shortcomings of model complexity, high computational overhead and inability to be efficiently deployed on edge devices.

[0156] Therefore, this application proposes a collaborative pruning method for sampling models. Instead of simple general model compression, it performs targeted optimization based on the feature distribution characteristics of the trained model. It adopts L1-L2 hybrid regularization pruning to maintain the sparsity of the model while preserving its stability. It also designs an importance-aware pruning threshold adjustment mechanism to provide special protection for the connections of important features.

[0157] It should be noted that step 104 above can be applied to the model lightweighting module on the edge node. By inputting the transaction flow data training set into the model lightweighting module, the abnormal transaction detection model can be output.

[0158] Step 105: Obtain the first abnormal transaction detection result based on the first abnormal transaction association features and the abnormal transaction detection model.

[0159] It is understood that the first abnormal transaction detection result is used to indicate whether there is abnormal transaction behavior in the first abnormal transaction associated feature.

[0160] In this embodiment, high-performance inference is achieved by inputting the first abnormal transaction association features into the lightweight abnormal transaction detection model for real-time inference. The end-to-end latency of the entire process is strictly controlled within 50ms, which meets the stringent requirements of real-time risk control scenarios such as payment.

[0161] Meanwhile, a closed-loop learning system for detection, feedback, and optimization was constructed to monitor the detection effect in real time, dynamically adjust the sampling strategy parameters, and continuously optimize the sampling weights and model parameters based on online learning technology, achieving a real-time response within 50ms from end to end.

[0162] It should be noted that the abnormal transaction detection model can detect the correlation features of abnormal transactions in real time and determine whether there are abnormal transaction behaviors.

[0163] It should also be noted that step 105 above can be applied to the lightweight inference engine on the edge node. By inputting the first abnormal transaction association feature into the strong inference engine, the first abnormal transaction detection result can be output.

[0164] Furthermore, this application embodiment also provides a historical backtracking and supplementary sampling mechanism to counteract sampling evasion, which can be applied to the anti-evasion module on the edge node. It inputs the drift distance of the abnormal transaction association characteristics of a certain account group and outputs a supplementary sampling instruction.

[0165] Specifically, this historical backtracking and data collection mechanism is a security protection mechanism. When the drift distance fluctuation of a certain account group is detected to be greater than or equal to a preset proportion (e.g., 50%) for a preset number of consecutive tests (e.g., 3 times), it is determined that the account group may be testing the system boundaries and deliberately avoiding sampling. At this time, the backtracking and data collection mechanism is triggered to collect the historical transaction flow data (e.g., transaction flow data of the past 24 hours) of the account group (e.g., the collection ratio is 1.5 times the normal ratio), and re-input it into the abnormal transaction detection model for training and inference. This thwarts the fraud group's evasion attempts, solves the blind spot problem of existing technology lacking adversarial capabilities and being unable to deal with fraudsters' active evasion, and greatly improves the robustness of the system.

[0166] Furthermore, this application also provides an active defense strategy based on behavioral pattern analysis. By analyzing the temporal evolution pattern of group behavior, it identifies evasion attempts, adopts multi-timescale backtracking analysis to capture evasion behavior from different time dimensions, and designs an adaptive supplementary sampling mechanism to intelligently determine the scope and intensity of supplementary sampling based on the degree of evasion, thereby reducing the false negative rate by more than 25% and significantly improving the robustness of the system.

[0167] Figure 2 This is a flowchart illustrating one embodiment of the abnormal transaction detection method described in this application. Figure 2 As shown, the method includes:

[0168] Step 201: Obtain the first abnormal transaction association feature of the first transaction stream data within the current time period;

[0169] Step 202: Obtain the feature distribution of the first abnormal transaction association features;

[0170] Step 203: Obtain the drift distance between the feature distribution and the preset baseline distribution, and determine whether the drift distance is greater than the preset initial drift distance;

[0171] If step 203 determines that the drift distance is greater than the preset starting drift distance, then proceed to step 204 to trigger the second or third sampling strategy;

[0172] If step 203 determines that the drift distance is less than or equal to the preset starting drift distance, then proceed to step 205 and trigger the first sampling strategy;

[0173] Step 206: In the case of the second or third sampling strategy, density clustering is used to sample the first sub-transaction stream data associated with the continuous second abnormal transaction association features.

[0174] Step 207: In the case of the second or third sampling strategy, for the second sub-transaction stream data associated with the discrete second abnormal transaction association features, LIME-weighted hierarchical sampling method is used for sampling.

[0175] Step 208: Obtain the transaction flow data training set;

[0176] Step 209: Train the initial abnormal transaction detection model based on the transaction flow data training set to obtain the abnormal transaction detection model;

[0177] Step 210: Input the first abnormal transaction association feature into the abnormal transaction detection model;

[0178] Step 211: Obtain the first abnormal transaction detection result output by the abnormal transaction detection model;

[0179] Step 212: Determine whether the drift distance fluctuation amplitude is detected, and whether the drift distance fluctuation amplitude is greater than or equal to a preset ratio;

[0180] If the judgment result of step 212 is that the drift distance fluctuation amplitude is detected and the drift distance fluctuation amplitude is greater than or equal to the preset ratio, then proceed to step 213 to trigger the retrospective collection of historical transaction flow data.

[0181] If the judgment result of step 212 is that no drift distance fluctuation amplitude is detected, or the drift distance fluctuation amplitude is less than the preset ratio, then proceed to step 214, end the current abnormal transaction detection process, and take the first abnormal transaction detection result as the abnormal transaction detection result of the current abnormal transaction detection process.

[0182] In summary, the abnormal transaction detection method described in this application can detect gang fraudulent activities. It includes a dynamic sampling mechanism based on multimodal gang feature recognition, proposing bimodal abnormal transaction association features (continuous and discrete) and corresponding sampling strategies in the field of financial risk control technology. This mechanism overcomes the limitations of existing sampling methods that only target a single feature dimension or use a uniform sampling method, achieving accurate adaptation and efficient capture of multi-dimensional features of gang fraud. Specifically, it accurately captures numerical distribution anomalies of continuous features (such as transaction amount and frequency) through density clustering; and focuses on pattern anomalies of discrete features (such as IP address and device fingerprint) through LIME-weighted hierarchical sampling, greatly improving the representativeness and effectiveness of the sampled data.

[0183] Furthermore, a dynamic weight allocation technique based on LIME is employed, transforming LIME from a post-analysis tool into a pre-sampling decision engine. This technique dynamically adjusts sampling weights using real-time feature importance scores calculated by LIME, replacing traditional methods based on fixed statistics such as frequency and variance. This allows the sampling process to adapt to the latest state of the model and changes in fraud patterns. Before each sampling strategy is determined, LIME is used to locally interpret the initial abnormal transaction detection model, quantifying the contribution of each feature (especially discrete features) to the initial abnormal transaction detection model. This contribution is then used as a core parameter in the sampling weight calculation formula, achieving precise model provisioning.

[0184] Furthermore, it includes a lightweight collaborative optimization framework for edge computing, proposing a lightweight design that combines sampling and pruning. Instead of simply compressing the abnormal transaction detection model, it considers subsequent model complexity during the sampling stage, reducing data redundancy through sampling strategies. Combined with targeted model pruning, it achieves end-to-end lightweighting from data to model, solving the fundamental challenge of deploying complex gang detection models on edge nodes. Specifically, multimodal sampling significantly compresses the dataset size while retaining key information; L1 regularization-based pruning removes redundant connections based on the feature distribution of the sampled model. Together, these two techniques achieve a 70% reduction in model size while minimizing accuracy loss (less than 2%).

[0185] Additionally, it includes an anti-evasion self-healing mechanism for adversarial environments. Based on behavioral pattern recognition, this proactive anti-evasion system can actively detect the probing and attack patterns employed by fraud groups to evade detection. It then performs self-healing replenishment through historical transaction flow data backtracking, elevating defense from passive response to proactive countermeasures, significantly enhancing the system's robustness and anti-attack capabilities. Specifically, by monitoring the drift distance fluctuations of abnormal transaction association characteristics of account groups (e.g., three consecutive drift distance fluctuations greater than or equal to 50%), it intelligently determines whether the behavior is normal fluctuation or malicious probing. Once malicious behavior is identified, it triggers enhanced replenishment of transaction flow data from the past 24 hours, thwarting the evasion attempt and essentially giving the detection system an immune memory function.

[0186] Therefore, the embodiments of this application have the following advantages:

[0187] (1) The detection accuracy has been significantly improved:

[0188] Through a multimodal dynamic adaptive sampling mechanism, accurate capture and sample optimization of gang fraud characteristics are achieved. Compared with existing technologies, the false positive rate of gang fraud identification is reduced by more than 35%, while maintaining a high recall rate. For example, on a standard test set containing 100,000 accounts and 500 known fraud gangs, the false positive rate of existing benchmark models (such as XGBoost on fixed sampling) is about 15%, while the embodiments of this application can stably reduce the false positive rate to below 9.7%. More importantly, due to the adoption of a LIME-weighted hierarchical sampling method, the ability to detect emerging and covert fraud patterns (F1-Score) is improved by about 40%, solving the pain points of insufficient characterization of gang association features and poor sampling representativeness in existing technologies.

[0189] (2) Leapfrog optimization of resource utilization efficiency:

[0190] Through a lightweight design that combines sampling and pruning, an order-of-magnitude reduction in model computation and storage overhead is achieved, enabling the efficient deployment of complex fraud detection models in resource-constrained edge environments. Using techniques such as L1 regularization pruning, the model size is compressed to 30% of its original size. When deployed on edge nodes, average CPU utilization drops from 80% of existing solutions to below 40%, and memory usage is reduced by more than 50%. Overall power consumption is reduced by approximately 60%, significantly extending the battery life of edge devices, expanding application scenarios, and addressing the core shortcomings of bulky models that cannot be deployed to edge environments.

[0191] (3) Enhanced real-time performance:

[0192] End-to-end optimization ensures extremely low latency response, fully meeting the stringent requirements of high-frequency real-time trading risk control scenarios. End-to-end processing latency, from feature extraction to fraud inference, is strictly controlled within 50ms, a four-fold reduction compared to existing solutions. Even during peak nighttime trading hours, P99 latency remains consistently below 100ms, forming a highly optimized processing pipeline.

[0193] (4) The system's robustness and resistance to attacks are substantially enhanced:

[0194] The historical backtracking and supplementary sampling mechanism to counter sampling evasion enables the system to proactively defend against malicious probing and adaptive attacks by fraud groups, significantly improving system stability and reliability. In simulated adversarial testing, the embodiments of this application reduced the false negative rate of fraud groups by more than 25%. For fraud groups attempting to evade detection through low-intensity, high-frequency attacks, the attack success rate decreased by more than 60%, solving the blind spot problem of existing technologies being unable to address fraudster evasion behaviors.

[0195] (5) Business adaptability and automation level have been greatly improved:

[0196] The system is highly adaptive, reducing reliance on manual parameter tuning and automatically adapting to business changes and data drift, thus lowering operation and maintenance costs. It features time-based adaptation: dynamically adjusting detection thresholds based on transaction times without manual intervention; feature adaptation: dynamically adjusting the sampling strategy based on feature importance scores calculated by LIME, automatically focusing on the most important risk features; and pattern adaptation: automatically learning and adapting to new fraud patterns, reducing the frequency of model retraining, thus forming a self-optimizing intelligent system.

[0197] like Figure 3 As shown in the illustration, this application also provides an abnormal transaction detection device, comprising:

[0198] The acquisition module 301 is used to acquire the first abnormal transaction association feature of the first transaction stream data within the first time period;

[0199] The determining module 302 is used to determine the target sampling strategy based on the first drift distance between the feature distribution of the first abnormal transaction association feature and the preset benchmark distribution;

[0200] The sampling module 303 is used to sample the second transaction flow data according to the target sampling strategy to obtain a transaction flow data training set; the second transaction flow data is the transaction flow data within a second time period.

[0201] Training module 304 is used to train an initial abnormal transaction detection model based on the transaction flow data training set to obtain an abnormal transaction detection model; the abnormal transaction detection model is used to obtain an abnormal transaction detection result based on abnormal transaction association features, and the abnormal transaction detection result is used to indicate whether the abnormal transaction association features contain abnormal transaction behavior.

[0202] The detection module 305 is used to obtain the first abnormal transaction detection result based on the first abnormal transaction association features and the abnormal transaction detection model.

[0203] Optionally, in the abnormal transaction detection device, the target sampling strategy includes one of the following:

[0204] A first sampling strategy is used to indicate data sampling based on a first sampling intensity used to collect the first transaction stream data;

[0205] A second sampling strategy is used to indicate the use of a second sampling intensity for data sampling; the second sampling intensity is monotonically increasing with the first drift distance.

[0206] The third sampling strategy is used to instruct the use of a third sampling intensity to sample transaction flow data within the time period preceding the first time period.

[0207] Optionally, in the aforementioned abnormal transaction detection device, the determining module 302 is specifically used for:

[0208] If the first drift distance between the feature distribution of the abnormal transaction association features and the preset benchmark distribution is less than or equal to the preset starting drift distance, then the target sampling strategy is determined to be the first sampling strategy.

[0209] If the first drift distance is greater than the preset starting drift distance and less than the preset ending drift distance, then the target sampling strategy is determined to be the second sampling strategy;

[0210] If the first drift distance is greater than or equal to the preset end drift distance, then the target sampling strategy is determined to be the third sampling strategy.

[0211] Optionally, the abnormal transaction detection device further includes:

[0212] The acquisition module is used to obtain a load score based on the current load metrics, which include at least one of the following: CPU utilization, memory usage, length of the pending transaction stream queue, and processing latency.

[0213] An adjustment module is used to adjust the sampling intensity indicated by the target sampling strategy based on the load score, so as to obtain the adjusted target sampling strategy;

[0214] The sampling module 303 is specifically used for:

[0215] According to the adjusted target sampling strategy, the second transaction stream data is sampled to obtain the transaction stream data training set.

[0216] Optionally, in the aforementioned abnormal transaction detection device, the adjustment module is specifically used for:

[0217] If the load score is less than or equal to the first load score, the sampling intensity indicated by the target sampling strategy is increased to obtain the adjusted target sampling strategy.

[0218] If the load score is greater than the first load score and less than or equal to the second load score, then the sampling intensity indicated by the target sampling strategy is reduced to obtain the adjusted target sampling strategy.

[0219] If the load score is greater than the second load score, the sampling intensity indicated by the target sampling strategy is reduced to the preset minimum sampling intensity to obtain the adjusted target sampling strategy.

[0220] Optionally, in the aforementioned abnormal transaction detection device, the sampling module 303 is specifically used for:

[0221] According to the target sampling strategy and the first sampling scheduling information, data sampling is performed on the first sub-transaction flow data associated with the second abnormal transaction association feature of the first type in the second transaction flow data, and data sampling is performed on the second sub-transaction flow data associated with the second abnormal transaction association feature of the second type in the second transaction flow data according to the target sampling strategy, the second sampling scheduling information and the sampling weight, so as to obtain a transaction flow data training set;

[0222] The first sampling scheduling information is determined based on at least one of the following: the density clustering result of the first transaction stream data; the expected execution time of the first sub-transaction stream data; and the expected resource consumption of the first sub-transaction stream data.

[0223] The second sampling scheduling information is determined based on at least one of the following: the importance score of the first feature of the first abnormal transaction association feature to the initial abnormal transaction detection model; the expected execution time of the second sub-transaction stream data; and the expected resource consumption of the second sub-transaction stream data.

[0224] Optionally, the abnormal transaction detection device further includes:

[0225] The factor determination module is used to determine the feature importance level and / or attenuation factor corresponding to the first feature importance score;

[0226] A weight determination module is used to determine the sampling weights based on the feature importance level and / or the attenuation factor.

[0227] Optionally, in the aforementioned abnormal transaction detection device, the training module 304 is specifically used for:

[0228] The initial abnormal transaction detection model is trained based on the transaction flow data training set to obtain the parameter weights of each network layer within the initial abnormal transaction detection model.

[0229] The target network layer inside the initial abnormal transaction detection model is removed to obtain an abnormal transaction detection model, wherein the parameter weights of the target network layer are less than the weight threshold.

[0230] It should be noted that the abnormal transaction detection device provided in this application embodiment can implement all the method steps implemented in the above abnormal transaction detection method embodiment and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0231] This application also provides an abnormal transaction detection device, such as... Figure 4 As shown, it includes:

[0232] The processor 401, memory 402, transceiver 403, and a program or instructions stored in the memory 402 and executable on the processor 401; when the processor 401 executes the program or instructions, it implements the various processes of the above-described abnormal transaction detection method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0233] The transceiver 403 is used to receive and send data under the control of the processor 401.

[0234] Among them, Figure 4 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically connecting various circuits of one or more processors represented by processor 401 and memory represented by memory 402. The bus architecture can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. Transceiver 403 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. For different user equipment, the user interface 404 can also be an interface capable of connecting external or internal devices, including but not limited to keypads, displays, speakers, microphones, joysticks, etc.

[0235] The processor 401 is responsible for managing the bus architecture and general processing, while the memory 402 can store the data used by the processor 401 when performing operations.

[0236] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the above-described abnormal transaction detection method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0237] This application also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, they implement the various processes of the above-described abnormal transaction detection method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0238] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0239] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0240] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. An abnormal transaction detection method, characterized in that, include: Obtain the first abnormal transaction association feature of the first transaction stream data within the first time period; The target sampling strategy is determined based on the first drift distance between the feature distribution of the first abnormal transaction association features and the preset benchmark distribution; According to the target sampling strategy, data sampling is performed on the second transaction stream data to obtain a transaction stream data training set; the second transaction stream data is the transaction stream data within the second time period. The initial abnormal transaction detection model is trained based on the transaction flow data training set to obtain an abnormal transaction detection model; the abnormal transaction detection model is used to obtain abnormal transaction detection results based on abnormal transaction association features, and the abnormal transaction detection results are used to indicate whether the abnormal transaction association features contain abnormal transaction behavior; Based on the first abnormal transaction association features and the abnormal transaction detection model, the first abnormal transaction detection result is obtained.

2. The method according to claim 1, characterized in that, The target sampling strategy includes one of the following: A first sampling strategy is used to indicate data sampling based on a first sampling intensity used to collect the first transaction stream data; A second sampling strategy is used to indicate the use of a second sampling intensity for data sampling; the second sampling intensity is monotonically increasing with the first drift distance. The third sampling strategy is used to instruct the use of a third sampling intensity to sample transaction flow data within the time period preceding the first time period.

3. The method according to claim 2, characterized in that, Based on the first drift distance between the feature distribution of the abnormal transaction association features and the preset benchmark distribution, a target sampling strategy is determined, including: If the first drift distance between the feature distribution of the abnormal transaction association features and the preset benchmark distribution is less than or equal to the preset starting drift distance, then the target sampling strategy is determined to be the first sampling strategy. If the first drift distance is greater than the preset starting drift distance and less than the preset ending drift distance, then the target sampling strategy is determined to be the second sampling strategy; If the first drift distance is greater than or equal to the preset end drift distance, then the target sampling strategy is determined to be the third sampling strategy.

4. The method according to claim 3, characterized in that, The method further includes: Based on the current load metrics, a load score is obtained, which includes at least one of the following: CPU utilization, memory usage, length of the pending transaction stream queue, and processing latency. The sampling intensity indicated by the target sampling strategy is adjusted based on the load score to obtain the adjusted target sampling strategy; According to the target sampling strategy, data sampling is performed on the second transaction stream data to obtain a transaction stream data training set, including: According to the adjusted target sampling strategy, the second transaction stream data is sampled to obtain the transaction stream data training set.

5. The method according to claim 4, characterized in that, Adjusting the sampling intensity indicated by the target sampling strategy based on the load score to obtain the adjusted target sampling strategy includes: If the load score is less than or equal to the first load score, the sampling intensity indicated by the target sampling strategy is increased to obtain the adjusted target sampling strategy. If the load score is greater than the first load score and less than or equal to the second load score, then the sampling intensity indicated by the target sampling strategy is reduced to obtain the adjusted target sampling strategy. If the load score is greater than the second load score, the sampling intensity indicated by the target sampling strategy is reduced to the preset minimum sampling intensity to obtain the adjusted target sampling strategy.

6. The method according to claim 1, characterized in that, According to the target sampling strategy, data sampling is performed on the second transaction stream data to obtain a transaction stream data training set, including: According to the target sampling strategy and the first sampling scheduling information, data sampling is performed on the first sub-transaction flow data associated with the second abnormal transaction association feature of the first type in the second transaction flow data, and data sampling is performed on the second sub-transaction flow data associated with the second abnormal transaction association feature of the second type in the second transaction flow data according to the target sampling strategy, the second sampling scheduling information and the sampling weight, so as to obtain a transaction flow data training set; The first sampling scheduling information is determined based on at least one of the following: the density clustering result of the first transaction stream data; the expected execution time of the first sub-transaction stream data; and the expected resource consumption of the first sub-transaction stream data. The second sampling scheduling information is determined based on at least one of the following: the importance score of the first feature of the first abnormal transaction association feature to the initial abnormal transaction detection model; the expected execution time of the second sub-transaction stream data; and the expected resource consumption of the second sub-transaction stream data.

7. The method according to claim 6, characterized in that, The method further includes: Determine the feature importance level and / or attenuation factor corresponding to the first feature importance score; The sampling weights are determined based on the feature importance hierarchy and / or the attenuation factor.

8. The method according to claim 1, characterized in that, The initial abnormal transaction detection model is trained based on the transaction flow data training set to obtain the abnormal transaction detection model, including: The initial abnormal transaction detection model is trained based on the transaction flow data training set to obtain the parameter weights of each network layer within the initial abnormal transaction detection model. The target network layer inside the initial abnormal transaction detection model is removed to obtain an abnormal transaction detection model, wherein the parameter weights of the target network layer are less than the weight threshold.

9. An abnormal transaction detection device, characterized in that, include: The acquisition module is used to acquire the first abnormal transaction association characteristics of the first transaction stream data within the first time period; The determination module is used to determine the target sampling strategy based on the first drift distance between the feature distribution of the first abnormal transaction association features and the preset benchmark distribution; The sampling module is used to sample the second transaction flow data according to the target sampling strategy to obtain a transaction flow data training set; the second transaction flow data is the transaction flow data within a second time period. The training module is used to train the initial abnormal transaction detection model based on the transaction flow data training set to obtain the abnormal transaction detection model; the abnormal transaction detection model is used to obtain the abnormal transaction detection result based on the abnormal transaction association features, and the abnormal transaction detection result is used to indicate whether the abnormal transaction association features have abnormal transaction behavior. The detection module is used to obtain the first abnormal transaction detection result based on the first abnormal transaction association features and the abnormal transaction detection model.

10. An abnormal transaction detection device, characterized in that, include: A processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the processor, when executing the program or instructions, implements the abnormal transaction detection method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the abnormal transaction detection method as described in any one of claims 1 to 8.

12. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the abnormal transaction detection method as described in any one of claims 1 to 8.

Images