A data transaction abnormal behavior detection method based on time sequence behavior modeling

Abstract

This invention discloses a method for detecting abnormal behavior in data transactions based on temporal behavior modeling, belonging to the field of data security technology. The method deconstructs transaction logs into continuous numerical and discrete text features, which are then normalized and semantically embedded to construct a temporal feature sequence. A cascaded temporal convolutional network and a masked multi-head attention encoder are used to extract temporal and global semantic features, outputting high-order semantic vectors and attention weights. The encoder is self-supervised and trained using only normal transaction data with future behavior prediction as the task. During the inference phase, scale diffusion, semantic diffusion, and transaction logic breakage are calculated from the features and weights, and after equal-weighted fusion, compared with a benchmark threshold to determine anomalies. This invention can accurately capture the temporal correlation and semantic patterns of transactions, achieving efficient detection without the need for abnormal samples, thus improving the accuracy and robustness of transaction anomaly identification.

Description

Technical Field

[0001] This invention relates to the fields of data security, data transaction supervision, and artificial intelligence anomaly detection technology, specifically to a method for detecting abnormal data transaction behavior based on time-series behavior modeling. Background Technology

[0002] As data transaction scenarios become increasingly complex, abnormal transaction behaviors exhibit characteristics such as concealed temporal sequences, ambiguous semantic relationships, and hidden logical breaks. Traditional detection methods often rely on rule matching and simple statistics, making it difficult to capture long-term temporal dependencies. Existing deep learning-based detection schemes often require a large number of labeled abnormal samples, limiting the model's generalization ability; moreover, they often focus only on numerical transaction features, ignoring textual semantics and the logical coherence of transaction behavior, easily leading to false positives and false negatives. Furthermore, conventional temporal models struggle to simultaneously consider multi-scale temporal features and global semantic relationships, resulting in insufficient quantitative assessment of the degree of anomaly diffusion and logical breaks, making it difficult to meet actual regulatory requirements in terms of the accuracy and reliability of data transaction anomaly detection. To address these issues, this invention aims to solve the challenge of detecting slow, gradual, cross-domain, and concealed data hoarding behavior by improving the ability to identify low-spectrum, slow-moving abnormal behaviors through temporal behavior modeling and three-dimensional diffusion quantification. Summary of the Invention

[0003] This invention provides a method for detecting abnormal data transaction behavior based on temporal behavior modeling, comprising: deconstructing user transaction logs into continuous numerical features and discrete text features; concatenating the continuous numerical features and the discrete text features to form a feature vector for a single transaction, and constructing a transaction behavior feature sequence in chronological order; inputting the transaction behavior feature sequence into a temporal convolutional network-masked multi-head attention temporal representation encoder to obtain a high-order semantic vector that integrates temporal features and global semantic features, as well as the corresponding attention weight distribution; in the inference stage of detecting the transaction behavior feature sequence to be detected, calculating the scale diffusion degree, semantic diffusion degree, and transaction logic break degree based on the high-order semantic vector and the attention weight distribution, and determining the abnormal data transaction behavior after normalization and fusion.

[0004] According to one embodiment of the present invention, constructing the temporal convolutional network-masked multi-head attention temporal representation encoder specifically includes: constructing a temporal convolutional network module and a masked multi-head attention module; cascading the temporal convolutional network module and the masked multi-head attention module to form the temporal convolutional network-masked multi-head attention temporal representation encoder; wherein, the temporal convolutional network module adopts causal convolution and dilated convolution structures to extract multi-scale long-period temporal features of the transaction behavior feature sequence; the masked multi-head attention module is used to capture the global historical semantic association of the transaction behavior feature sequence; the temporal convolutional network-masked multi-head attention temporal representation encoder outputs a high-order semantic vector that fuses temporal features and global semantic features, as well as the corresponding attention weight distribution.

[0005] According to one embodiment of the present invention, the method further includes a training step for the temporal convolutional network-masked multi-head attention temporal representation encoder, comprising: training the temporal convolutional network-masked multi-head attention temporal representation encoder using self-supervised learning based on future prediction, based on the high-order semantic vector and the attention weight distribution; wherein: using historical data containing only normal trading behavior, the temporal convolutional network-masked multi-head attention temporal representation encoder learns the temporal and semantic patterns of normal trading behavior.

[0006] According to one embodiment of the present invention, the method further includes performing logarithmic transformation and normalization on the continuous numerical features, specifically including: performing logarithmic smoothing transformation on the continuous numerical features to suppress extreme values, and performing standard deviation normalization to unify the dimensions.

[0007] According to one embodiment of the present invention, the method further includes semantic embedding of the discrete text features using a bidirectional encoder representation model, specifically including: semantic embedding of the discrete text features using a pre-trained bidirectional encoder representation model, mapping the discrete text features into a dense semantic vector of fixed dimensions, and capturing the semantic relationships between different text features.

[0008] According to one embodiment of the present invention, the step of concatenating continuous numerical features and discrete text features to form a feature vector of a single transaction and constructing a transaction behavior feature sequence in chronological order specifically includes: concatenating the processed continuous numerical features and discrete text features sequentially according to feature dimensions to form a feature vector of a single transaction of fixed length; and arranging them in ascending order according to the timestamp of the single transaction to construct a transaction behavior feature sequence.

[0009] According to one embodiment of the present invention, calculating the scale diffusion degree specifically includes: obtaining a high-order semantic vector output by the temporal convolutional network-masked multi-head attention temporal representation encoder of the transaction behavior feature sequence to be detected; extracting feature components representing transaction scale from the high-order semantic vector, wherein the transaction scale feature components correspond to the fusion features of transaction amount, number of transactions, and transaction frequency; calling a scale feature benchmark threshold constructed based on normal transaction data during the training phase, wherein the scale feature benchmark threshold is a reasonable range calculated from the statistical mean and standard deviation of the normal transaction scale feature components; calculating the deviation degree of the scale feature components of the transaction behavior feature sequence to be detected from the scale feature benchmark threshold, and using normalization processing to map the deviation degree to the [0,1] interval, the obtained normalization result being the scale diffusion degree.

[0010] According to one embodiment of the present invention, calculating the semantic diffusion degree specifically includes: obtaining a high-order semantic vector output by the temporal convolutional network-masked multi-head attention temporal representation encoder of the transaction behavior feature sequence to be detected; extracting the feature components representing transaction semantics from the high-order semantic vector; calling a semantic feature benchmark library constructed based on normal transaction data during the training phase, wherein the semantic feature benchmark library is the semantic feature value range formed by calculating the statistical mean and standard deviation of the semantic feature components of normal transactions; calculating the cosine similarity between the semantic feature components of the transaction behavior feature sequence to be detected and the semantic feature benchmark library, and taking the complementary value of the cosine similarity as the semantic deviation degree; normalizing the semantic deviation degree, and obtaining the normalized result as the semantic diffusion degree.

[0011] According to one embodiment of the present invention, calculating the transaction logic breakage degree specifically includes: obtaining the high-order semantic vector and corresponding attention weight distribution output by the temporal convolutional network-masked multi-head attention temporal representation encoder of the transaction behavior feature sequence to be detected; extracting the weight components representing the temporal correlation of transactions in the attention weight distribution, wherein the weight components are used to reflect the logical correlation strength between adjacent transactions and related transactions in the transaction behavior feature sequence to be detected; calling the logical correlation weight benchmark interval constructed based on normal transaction data during the training phase, wherein the logical correlation weight benchmark interval is a reasonable interval formed by calculating the temporal correlation weight components of the normal transaction behavior feature sequence using statistical mean and standard deviation; calculating the deviation degree of the temporal correlation weight components of the transaction behavior feature sequence to be detected from the logical correlation weight benchmark interval, normalizing the deviation degree and mapping it to the [0,1] interval, and obtaining the normalized result as the transaction logic breakage degree.

[0012] According to one embodiment of the present invention, the determination of abnormal data transaction behavior after normalization fusion specifically includes: obtaining the calculated scale diffusion degree, semantic diffusion degree, and transaction logic break degree; performing normalization verification on the three indicators to ensure that each indicator is in the [0,1] interval; calculating the average value of the three indicators using an equal-weighted fusion method to obtain an anomaly determination fusion value; setting an anomaly determination threshold, wherein the anomaly determination threshold is a reasonable threshold obtained based on statistical analysis of normal transaction data during the training phase; comparing the anomaly determination fusion value with the anomaly determination threshold, and determining that the anomaly determination fusion value is greater than the anomaly determination threshold, thus determining that the transaction corresponding to the transaction behavior feature sequence to be detected is abnormal; and determining that the anomaly determination fusion value is less than or equal to the anomaly determination threshold, thus determining that the transaction corresponding to the transaction behavior feature sequence to be detected is normal.

[0013] This invention, through joint processing of transaction numerical values ​​and textual features, and employing a temporal convolutional network and a masked multi-head attention encoder, can simultaneously capture multi-scale long-term temporal features and global semantic associations, effectively improving feature representation capabilities. It utilizes self-supervised training with only normal transaction data, eliminating the need for labeled anomalous samples, reducing data dependence and enhancing model generalization. By quantitatively calculating and fusing scale diffusion, semantic diffusion, and transaction logic breakage, it can accurately identify numerical anomalies, semantic deviations, and temporal logic breakage-type anomalous behaviors, significantly reducing false positive and false negative rates. The overall solution is robust, highly efficient, and better suited to the real-time monitoring and anomaly identification needs in complex data transaction scenarios. This invention abandons the reliance on prior labeled anomalous samples, using only normal transaction behavior data for self-supervised training. By learning the temporal evolution patterns and semantic association patterns of normal behavior, it achieves accurate detection of hidden data hoarding behavior. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0015] Figure 1 This is a flowchart illustrating the data transaction anomaly detection method based on time-series behavior modeling provided by the present invention.

[0016] Figure 2 This is a schematic diagram of the process for constructing a temporal convolutional network-masked multi-head attention temporal representation encoder provided by the present invention.

[0017] Figure 3 This is a schematic diagram of the calculation scale diffusion provided by the present invention.

[0018] Figure 4 This is a schematic diagram of the process for calculating semantic diffusion degree provided by the present invention.

[0019] Figure 5 This is a schematic diagram of the process for calculating the breakage degree of transaction logic provided by the present invention.

[0020] Figure 6 This is a flowchart illustrating the process for determining abnormal data transaction behavior provided by the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0022] The following is combined with Figures 1 to 6 This invention describes a data transaction anomaly detection method based on time-series behavior modeling.

[0023] Figure 1 This is a flowchart illustrating the data transaction anomaly detection method based on time-series behavior modeling provided by the present invention, as shown below. Figure 1 As shown, the method includes the following steps: In step S100, the user transaction log is deconstructed into continuous numerical features and discrete text features; in step S200, the continuous numerical features and discrete text features are concatenated to form a feature vector for a single transaction, which is then arranged in chronological order to form a transaction behavior feature sequence; in step S300, the transaction behavior feature sequence is input into a temporal convolutional network-masked multi-head attention temporal representation encoder to obtain a high-order semantic vector that integrates temporal features and global semantic features, as well as the corresponding attention weight distribution; in step S400, during the inference stage of detecting the transaction behavior feature sequence to be detected, the scale diffusion degree, semantic diffusion degree, and transaction logic break degree are calculated based on the high-order semantic vector and attention weight distribution, and the abnormal data transaction behavior is determined after normalization and fusion.

[0024] Specifically, in step S100, a comprehensive feature deconstruction is performed on the user transaction logs. First, the original transaction records undergo field parsing and data cleaning. Then, the features are classified and split according to their representation and actual physical meaning. Items such as the amount, data volume, and transaction frequency generated during the transaction process have continuously changing numerical attributes and are classified as continuous numerical features. Items such as the business type, industry classification, and data tags involved in the transaction process have textual descriptive attributes and are classified as discrete text features. This splitting method distinguishes different feature types, providing a stable data foundation for subsequent targeted feature processing.

[0025] In step S200, continuous numerical features and discrete text features are concatenated and fused according to feature dimensions to form a feature vector that can completely represent all information of a single transaction, satisfying the following formula: ; in, For the final unified representation vector; It is a continuous numerical feature; An embedding vector for discrete category features; " is a feature splicing symbol; To ultimately unify the dimension of the representation vector, the transaction behavior feature sequence is then constructed by arranging the transactions sequentially according to their timestamps. This ensures that the temporal information is not destroyed during subsequent feature extraction, enabling the model to learn and detect based on a complete and ordered sequence.

[0026] Through the above process, the original transaction text and digital log data are reconstructed into a unified floating-point tensor containing rich scale and semantic information. This tensor sequence Subsequently, it will be used as standard input, flowing sequentially into the bottom-level Temporal Convolutional Network (TCN) and the top-level Masked Multi-Head Attention (MHA) to extract latent space features of its temporal physical laws and global business logic.

[0027] In step S300, the completed transaction behavior feature sequence is input into the temporal convolutional network-masked multi-head attention temporal representation encoder. This encoder is composed of TCN and MHA cascaded. It completes the extraction of multi-scale temporal features and global semantic features through the internal structure of the network, and outputs a high-order semantic vector that integrates multi-dimensional information. At the same time, it outputs the attention weight distribution that can reflect the degree of correlation within the transaction sequence, providing key feature support for subsequent model training and anomaly detection.

[0028] In step S400, the transaction behavior feature sequence to be detected is input into the trained TCN-MHA temporal representation encoder to obtain the corresponding high-order semantic vector and attention weight distribution. Based on the above output, the scale diffusion degree, semantic diffusion degree and transaction logic break degree are calculated respectively. After normalization of the three indicators, they are fused with equal weights to obtain the anomaly judgment fusion value. The fusion value is compared with the threshold obtained based on the statistics of normal transaction data. Based on the comparison result, it is determined whether the transaction corresponding to the transaction behavior feature sequence to be detected is abnormal.

[0029] Figure 2 This is a schematic diagram illustrating the process of constructing a temporal convolutional network-masked multi-head attention temporal representation encoder provided by the present invention. Figure 2 As shown, according to an embodiment of the present invention, a temporal convolutional network-masked multi-head attention temporal representation encoder is constructed, specifically including: in step S310, constructing a temporal convolutional network module and a masked multi-head attention module; in step S320, cascading the temporal convolutional network module and the masked multi-head attention module to form a temporal convolutional network-masked multi-head attention temporal representation encoder; wherein, the temporal convolutional network module adopts causal convolution and dilated convolution structure to extract multi-scale long-period temporal features of the transaction behavior feature sequence; the masked multi-head attention module is used to capture the global historical semantic association of the transaction behavior feature sequence; in step S330, the temporal convolutional network-masked multi-head attention temporal representation encoder outputs a high-order semantic vector that fuses temporal features and global semantic features, as well as the corresponding attention weight distribution.

[0030] Specifically, in step S310, the TCN module and the MHA module are constructed respectively. The two modules complete the hierarchical construction and parameter initialization according to their respective network structures, forming basic network units that can independently complete feature extraction.

[0031] In step S320, the TCN module and the MHA module are cascaded according to the data propagation order to form a complete temporal convolutional network-masked multi-head attention temporal representation encoder. The TCN module adopts a causal convolution and dilated convolution structure. Causal convolution ensures that the feature calculation at the current time moment only uses the feature information from the historical time moment, avoiding interference from future information on historical features, and making the feature extraction process conform to the temporal constraints of transaction behavior. This design can meet the causal constraints of the temporal prediction task, prevent the leakage of information from the future time moment to the historical time moment, and ensure the authenticity and rationality of the model's learning behavior. Dilated convolution can gradually expand the feature perception range without significantly increasing the computational cost, realizing multi-scale long-period temporal feature extraction of transaction behavior feature sequences. The convolution operation of the l-th layer residual block in the TCN module satisfies the following expression.

[0032] ; In the formula, Represents the hierarchical number of the network. It represents the current time sequence position. The feature vector representing the output of the network layer. This represents the kernel size, which controls the range of local features extracted. The convolution weight parameters represent the current layer. The bias parameter represents the current level. This represents the expansion coefficient, which grows exponentially with network depth and is used to expand the temporal perception range. This represents weight normalization, used to suppress abnormal gradient changes during network training. Representing a non-linear activation function, it is used to enhance the feature representation capability of the network. The MHA module can take a global perspective to further process the information extracted from temporal features, capturing the global historical semantic associations in the transaction behavior feature sequence. Among them, the kernel size... The expansion coefficient is usually taken as 2 or 3; As network depth increases exponentially, it satisfies: ; In the formula, This refers to the number of network layers. This mechanism ensures deep features... Only A network depth of level 1 can achieve an extremely large receptive field covering a historical window spanning several months. Furthermore, weight normalization effectively suppresses the gradient explosion problem caused by deep network stacking, ensuring the model's convergence stability in the early stages of training. The constraints are as follows: ; In the formula, For gradient norm, This is the stable threshold constant.

[0033] By combining causal convolution and dilated convolution, we can achieve efficient capture of long temporal dependencies.

[0034] Regardless of the layer, the hidden state vector output by the Temporal Convolutional Network (TCN) implicitly encodes three types of information: first, the intensity and density characteristics of transaction behavior, reflecting the frequency and scale of transaction behavior per unit time; second, decaying memory characteristics, which assign higher weights to recent historical behavior through the weighted superposition mechanism of causal convolution, reflecting the decaying characteristics of temporal memory; and third, industry-domain smoothing characteristics, which achieve a smooth representation of transaction behavior in the industry dimension through temporal convolution operation on industry embedding vectors, enabling transaction patterns in different industries to have distinguishable semantic features.

[0035] In step S330, the transaction behavior feature sequence is processed layer by layer by the temporal convolutional network-masked multi-head attention temporal representation encoder to achieve deep fusion of temporal features and global semantic features, and finally outputs a high-order semantic vector that integrates multi-dimensional information, while also outputting the attention weight distribution that reflects the degree of correlation within the sequence.

[0036] According to an embodiment of the present invention, the implementation further includes a training step of a temporal convolutional network-masked multi-head attention temporal representation encoder, including: training the temporal convolutional network-masked multi-head attention temporal representation encoder based on high-order semantic vectors and attention weight distribution, using self-supervised learning based on future prediction. Specifically, historical data containing only normal trading behavior is used to enable the temporal convolutional network-masked multi-head attention temporal representation encoder to learn the temporal and semantic patterns of normal trading behavior.

[0037] Specifically, during the training phase, only historical data containing normal trading behavior is used, without introducing abnormal labeled samples. The feature sequence of normal trading behavior is input into the TCN-MHA temporal representation encoder, and a high-order semantic vector for the corresponding temporal position is obtained through forward propagation. Based on this high-order semantic vector, the trading behavior features for the next time step are predicted, and the prediction process satisfies the following expression.

[0038] ; In the formula, Indicates the first High-order semantic vectors of each temporal position This represents the weight matrix of the prediction layer. This represents the bias vector of the prediction layer. This represents the model's prediction vector for the transaction behavior features at the next time step. Through a linear mapping layer, the higher-order semantic vector is projected back into the original feature space, generating a prediction result consistent with the input feature dimension. and This represents the learnable weight matrix and bias terms of the prediction head. Due to the prediction vector... With the true vector All are in a unified representation space composed of continuous numerical features and embedded discrete features, so the model does not need to structurally decouple the physical features of different dimensions at the top level.

[0039] Based on this, a loss calculation process for self-supervised learning is constructed. The loss value is obtained by measuring the error between the predicted vector and the true vector, and satisfies the following expression.

[0040] ; In the formula, This represents the loss value for self-supervised learning. This represents the total length of the time sequence during training. This represents the feature vector of the actual trading behavior at the next moment. The model's prediction error is quantified by calculating the L2 distance between the predicted and true vectors. The training process iterates parameters by continuously minimizing the loss value. Gradient signals are propagated back from the prediction layer to the TCN-MHA temporal representation encoder layer by layer, constantly adjusting the weight parameters within the network. After multiple rounds of iterative optimization, the TCN-MHA temporal representation encoder can fully learn the temporal variation patterns and semantic associations of normal trading behavior, stably outputting high-order features that conform to the distribution of normal behavior, providing a reliable model foundation for anomaly detection in the subsequent inference stage.

[0041] The training phase is based solely on normal transaction data and does not rely on anomaly labeled samples. It is a self-supervised learning mode that can adapt to the actual regulatory needs of data transaction scenarios where anomaly samples are scarce and labeling is difficult.

[0042] According to an embodiment of the present invention, the method further includes performing logarithmic transformation and normalization on the continuous numerical features, specifically including: Logarithmic smoothing is applied to continuous numerical features to suppress extreme values, and then standard deviation normalization is performed to unify the dimensions.

[0043] Specifically, continuous numerical features in real-world trading scenarios typically exhibit a long-tailed distribution, with most samples concentrated in the lower numerical range and a small number in the higher numerical range, resulting in a large range between high and low values, which can negatively impact model training. Therefore, a logarithmic smoothing transformation is first performed on continuous numerical features, and the transformation process satisfies the following expression.

[0044] ; In the formula, This represents the original continuous numerical characteristics before the transformation. This represents the numerical features after logarithmic smoothing. Logarithmic smoothing effectively compresses the larger numerical ranges, suppressing the influence of extreme values ​​on the feature space and making the feature distribution more stable. After logarithmic smoothing, normalization is performed on the features to unify the numerical ranges of different features and eliminate dimensional differences between different continuous numerical features. Through logarithmic smoothing and normalization, the distribution of continuous numerical features is more balanced, effectively eliminating the adverse effects of long-tailed distributions on the training process of the TCN-MHA temporal representation encoder, and improving the stability of model training and the balance of feature learning.

[0045] According to an embodiment of the present invention, the implementation further includes semantic embedding of discrete text features using a Bidirectional Encoder Representations from Transformers (BERT) model. Specifically, this includes: semantic embedding of discrete text features using a pre-trained bidirectional encoder representation model, mapping discrete text features into dense semantic vectors of fixed dimensions, and capturing semantic relationships between different text features.

[0046] Specifically, discrete text features contain information such as transaction-related business types and industry descriptions, which need to be converted into numerical values ​​at the semantic level using a pre-trained language model. This implementation uses BERT for semantic embedding, mapping discrete text features into dense semantic vectors of fixed dimensions. First, the discrete text features... After word segmentation, a pre-trained BERT model is used to extract the global semantic vector at the [CLS] position. The semantic embedding process is represented as follows: ; in, for Time-discrete text features. For word segmentation operation, This indicates that the [CLS] labeled output vector of the last layer of the BERT model is taken. This represents the semantic embedding dimension. Through the above mapping process, the originally unstructured discrete text features are transformed into numerical vector representations. Different text features form a discriminative distribution relationship in the vector space, enabling the model to effectively capture the semantic associations between different text features. This provides stable and semantically expressive input data for subsequent temporal feature extraction and anomaly detection, thereby eliminating the adverse effects of long-tail distribution on the training of the temporal convolutional network-mask multi-head attention temporal representation encoder.

[0047] According to an embodiment of the present invention, continuous numerical features and discrete text features are concatenated to form a feature vector of a single transaction, which is then arranged in chronological order to constitute a transaction behavior feature sequence, specifically including: The processed continuous numerical features and discrete text features are concatenated sequentially according to feature dimensions to form a feature vector of a single transaction of fixed length; these features are then arranged in ascending order according to the timestamp of each transaction to form a sequence of transaction behavior features.

[0048] Specifically, the standardized continuous numerical features and the semantically embedded discrete text features are concatenated sequentially according to a preset feature dimension. Let the first... The continuous numerical feature vector corresponding to each transaction is The semantic vector corresponding to the discrete text features is The splicing process then satisfies the following expression: ; In the formula, Indicates the first The feature vector after concatenation of a transaction. The concatenation process fully integrates different types of feature information within the same vector space, concentrating all attribute information of a single transaction into a single feature vector structure. The final feature vector dimension satisfies: ; in, For continuous numerical feature dimensions, This is the semantic embedding dimension for text. The single-transaction feature vector obtained after concatenation has a fixed length and can simultaneously reflect the numerical and semantic features of the transaction. The feature vectors are arranged in ascending order according to the timestamps corresponding to each transaction, following the actual chronological order of the transactions to avoid temporal misalignment or omissions. By integrating all single-transaction feature vectors in chronological order, a complete and temporally consistent transaction behavior feature sequence is constructed. This sequence can fully preserve the dynamic changes in transaction behavior over time, providing a standardized input data foundation for the subsequent TCN-MHA temporal representation encoder to accurately extract the temporal features and semantic associations of transaction behavior.

[0049] Figure 3 This is a schematic diagram of the calculation process for scale diffusion provided by the present invention. For example... Figure 3 As shown, according to an embodiment of the present invention, the calculation of the scale diffusion degree specifically includes: in step S711, obtaining the high-order semantic vector output by the temporal convolutional network-masked multi-head attention temporal representation encoder of the transaction behavior feature sequence to be detected, and extracting the feature components representing the transaction scale in the high-order semantic vector, wherein the transaction scale feature components correspond to the fusion features of transaction amount, number of transactions, and transaction frequency; in step S712, calling the scale feature benchmark threshold constructed based on normal transaction data during the training phase, wherein the scale feature benchmark threshold is a reasonable range calculated from the statistical mean and standard deviation of the normal transaction scale feature components; in step S713, calculating the deviation degree between the scale feature components of the transaction behavior feature sequence to be detected and the scale feature benchmark threshold, and using normalization processing to map the deviation degree to the [0,1] interval, the obtained normalization result is the scale diffusion degree.

[0050] Specifically, in step S711, the transaction behavior feature sequence to be detected is input into the trained TCN-MHA temporal representation encoder, which outputs the corresponding high-order semantic vector. From this vector, the transaction scale feature component, which is used to represent the comprehensive information of transaction amount, number of transactions and transaction frequency, is extracted. This component can comprehensively reflect the scale attribute of the transaction.

[0051] Let the higher-order semantic vector be: ; The extracted transaction size feature components are denoted as: .

[0052] In step S712, the scale characteristic benchmark threshold obtained from the statistics of normal transaction data is called. This threshold is a reasonable range formed by the mean and standard deviation of the normal transaction scale characteristic components, which is used to measure whether the scale characteristic components are within the normal mode range.

[0053] Let the mean of the scale characteristic components in the normal mode be: The standard deviation is: Then the threshold range for scale characteristics is: ;in, is the confidence coefficient, used to control the tightness of the interval.

[0054] In step S713, the deviation between the scale feature component of the transaction to be detected and the baseline threshold is calculated, and normalized and mapped to the [0,1] interval to obtain the scale diffusion degree. The scale diffusion degree ranges from [0,1], with values ​​closer to 1 indicating a more significant deviation of the scale feature of the transaction from the normal pattern, and a higher corresponding anomaly risk.

[0055] The formula for calculating scale diffusivity is: ; in, Indicates the degree of scale diffusion. Represents the scale feature components to be detected. This represents the mean of the normal pattern. This represents the standard deviation of the normal pattern. This represents the confidence coefficient. The closer the scale diffusion is to 1, the more significantly the scale characteristics of the transaction being tested deviate from the normal pattern, and the higher the corresponding anomaly risk.

[0056] The advantage of TCN lies in its ability to construct a continuous temporal receptive field feature spectrum covering high-frequency transients to low-frequency steady states through an exponentially expanding causal convolutional structure. Shallow layers correspond to short-term, immediate behavior, while deeper layers correspond to long-term steady-state patterns, with each layer representing behavioral features at different time scales. Based on the multi-level intermediate hidden states of TCN, this architecture further proposes a quantization method for inter-layer cross-scale difference. By calculating the feature mutation rate between adjacent layers, it achieves a precise characterization of the entire process of behavioral patterns from gradual, stable changes to sudden, abrupt shifts.

[0057] Figure 4 This is a schematic diagram of the flowchart for calculating semantic diffusion degree provided by the present invention. For example... Figure 4 As shown, according to an embodiment of the present invention, calculating semantic diffusion degree specifically includes: in step S721, obtaining the high-order semantic vector output by the temporal convolutional network-masked multi-head attention temporal representation encoder of the transaction behavior feature sequence to be detected, and extracting the feature components representing transaction semantics from the high-order semantic vector; in step S722, calling the semantic feature benchmark library constructed based on normal transaction data during the training phase, wherein the semantic feature benchmark library is the semantic feature value range formed by calculating the statistical mean and standard deviation of the semantic feature components of normal transactions; in step S723, calculating the cosine similarity between the semantic feature components of the transaction behavior feature sequence to be detected and the semantic feature benchmark library, and taking the complementary value of the cosine similarity as the semantic deviation degree; in step S724, normalizing the semantic deviation degree, and obtaining the normalized result as the semantic diffusion degree.

[0058] Specifically, in step S721, the sequence of transaction behavior features to be detected is input into the trained TCN-MHA temporal representation encoder, which outputs a corresponding high-order semantic vector. From this vector, transaction semantic feature components representing the transaction business type, transaction scenario, and transaction attributes are extracted. These components fully reflect the semantic attribute information of the transaction. Let the high-order semantic vector be H, and the extracted transaction semantic feature components be denoted as: .

[0059] In step S722, the semantic feature benchmark library obtained from the statistics of normal transaction data is called. This benchmark library consists of the mean of the semantic feature components of normal transactions. with standard deviation The composition is used to measure whether semantic feature components are within the normal semantic pattern range.

[0060] In step S723, the cosine similarity between the semantic feature component to be detected and the center vector of the semantic feature benchmark library is calculated, and the complementary value of the similarity is used as the degree of semantic deviation. The calculation formula is as follows: ; in, This indicates the degree of semantic deviation; the closer the value is to 1, the greater the difference between the semantic features and the normal pattern.

[0061] Context semantic vector These are high-order semantic features, obtained by a masked multi-head attention mechanism that weights and sums the value matrix of historical moments according to attention weights. They are used to represent the semantics of transaction behavior that integrates global historical business logic. Compared to the local features within the temporal window extracted by TCN, the contextual semantic vector... It is a semantic reconstruction of current transaction behavior based on the similarity of historical behavior. When the user's business domain remains stable, the attention mechanism can match highly relevant behavioral nodes in the historical sequence, and the context semantic vector... The feature distribution remains consistent; however, when users migrate across industries, due to the lack of matching historical behavior support, the attention mechanism will fuse a large number of irrelevant background features, making the context semantic vector... A significant shift occurs in the high-dimensional feature space. This is achieved by computing the context semantic vector. The cosine distance from historical benchmark features can effectively quantify the semantic diffusion of trading behavior.

[0062] In step S724, the semantic deviation degree is normalized and mapped to obtain the semantic diffusion degree, calculated using the following formula: ; Semantic diffusion The value ranges from [0,1]. The closer it is to 1, the more significantly the semantic features of the transaction being detected deviate from the normal pattern, and the higher the corresponding risk of anomaly.

[0063] Based on the high-order latent vectors output by the multi-head attention mechanism, this invention further constructs a semantic diffusion index to quantify the degree of semantic drift of data during cross-industry and cross-domain migration, so as to identify whether there is unreasonable cross-domain data hoarding and cross-industry semantic mutation behavior.

[0064] By performing sliding comparisons of latent vectors across different time scale windows, the model can simultaneously capture two types of anomalies: instantaneous mutations and gradual drifts. The former corresponds to sudden changes in data aggregation across a wide range of domains within a short period of time, while the latter corresponds to slow, covert drifts across industries over a long period of time.

[0065] Ultimately, through multi-scale weighted fusion, a unified representation of the degree of semantic diffusion is achieved, providing a quantitative basis for the subsequent legality determination of cross-domain data behavior.

[0066] Figure 5 This is a schematic diagram of the process for calculating the breakage degree of transaction logic provided by the present invention. For example... Figure 5As shown, according to an embodiment of the present invention, the calculation of transaction logic breakage specifically includes: in step S731, obtaining the high-order semantic vector and corresponding attention weight distribution output by the temporal convolutional network-masked multi-head attention temporal representation encoder of the transaction behavior feature sequence to be detected; in step S732, extracting the weight components representing the temporal correlation of transactions in the attention weight distribution, the weight components being used to reflect the strength of logical correlation between adjacent transactions and related transactions in the transaction behavior feature sequence to be detected; in step S733, calling the logical correlation weight benchmark interval constructed based on normal transaction data during the training phase, the logical correlation weight benchmark interval being a reasonable interval formed by calculating the statistical mean and standard deviation of the temporal correlation weight components of the normal transaction behavior feature sequence; in step S734, calculating the degree of deviation between the temporal correlation weight components of the transaction behavior feature sequence to be detected and the logical correlation weight benchmark interval, normalizing the degree of deviation and mapping it to the [0,1] interval, the obtained normalized result being the transaction logic breakage.

[0067] Specifically, in step S731, the transaction behavior feature sequence to be detected is input into the trained TCN-MHA temporal representation encoder, which outputs the corresponding high-order semantic vector and attention weight distribution. The attention weight distribution is used to characterize the degree of correlation between each temporal position within the transaction sequence.

[0068] In step S732, weight components representing the temporal correlation of transactions are extracted from the attention weight distribution. These weight components can intuitively reflect the logical dependence and temporal correlation strength between adjacent and related transactions.

[0069] Attention weight distribution matrix Let be the attention probability matrix after Softmax activation, satisfying This directly reflects the model's internal decision-making basis and possesses strong interpretability, used to quantify the strength of the logical connection between current transaction behavior and historical transactions. When the weight distribution is concentrated (low information entropy), the weights are highly focused on a small number of historical behavior nodes, indicating that the current transaction behavior has clear historical continuity and coherent business logic; when the weight distribution is uniform (high information entropy), the weights are widely dispersed in the historical sequence, indicating that the current behavior lacks an effective connection with the historical sequence. In data transaction scenarios, the nonlinear surge of information entropy usually characterizes users conducting random data transactions without business support or logical connection, and can be used to quantify the degree of logical breakage in transactions.

[0070] In step S733, the logical correlation weight benchmark interval obtained from the statistical analysis of normal transaction data during the training phase is invoked. This interval is composed of the mean of the temporal correlation weight components of the normal transaction behavior feature sequence. with standard deviation The calculated range of reasonable values ​​is used to define the logical association of normal transaction time sequences.

[0071] In step S734, the deviation between the time-series correlation weight component to be detected and the logical correlation weight baseline interval is calculated, and the deviation is mapped to the [0,1] interval through normalization to obtain the transaction logic breakage degree. The calculation formula is as follows: ; In the formula, Indicates the degree of break in the transaction logic. This represents the time-series correlation weight component to be detected. This represents the mean of the weighted components of the normal time-series correlation. This represents the standard deviation of the weighted components of a normal time series association. This represents the confidence coefficient. The closer the transaction logic break is to 1, the more significant the deviation of the temporal logical correlation of the detected transaction behavior feature sequence from the normal pattern, and the higher the risk of transaction logic break.

[0072] To deeply characterize the inherent logical coherence of trading behavior, this invention introduces a trading logic breakpoint (…). This indicator does not directly focus on the numerical changes of the feature vector, but rather delves into the internal decision-making process of MHA. It aims to measure the strength of the causal relationship between current transaction behavior and historical transaction records—that is, whether current transaction behavior can be traced back to reasonable business support in historical transaction records. Even if a violating user attempts to evade detection by disguising transaction size or slowly engaging in cross-border procurement, their behavior will still be exposed in the historical context due to the lack of genuine business logic support, thus achieving accurate identification of unrelated transaction behavior.

[0073] Figure 6 This is a flowchart illustrating the process for determining abnormal data transaction behavior provided by the present invention. Figure 6 As shown, the determination of abnormal data transaction behavior after normalization fusion specifically includes: in step S741, obtaining the calculated scale diffusion degree, semantic diffusion degree, and transaction logic break degree, and performing normalization verification on the three indicators to ensure that each indicator is in the [0,1] range; in step S742, using an equal-weight fusion method, calculating the average value of the three indicators to obtain the abnormal judgment fusion value; in step S743, setting the abnormal judgment threshold, which is a reasonable threshold obtained based on the statistical analysis of normal transaction data during the training phase; in step S744, comparing the abnormal judgment fusion value with the abnormal judgment threshold, determining that the transaction corresponding to the transaction behavior feature sequence to be detected is abnormal if the abnormal judgment fusion value is greater than the abnormal judgment threshold; and determining that the transaction corresponding to the transaction behavior feature sequence to be detected is normal if the abnormal judgment fusion value is less than or equal to the abnormal judgment threshold.

[0074] Specifically, in step S741, the calculated scale diffusion degree, semantic diffusion degree, and transaction logic break degree are obtained, and normalization verification is performed on the three indicators respectively. The value of each indicator is confirmed to be within the valid range of 0 to 1, invalid values ​​are eliminated, and the stability and accuracy of subsequent fusion calculation are ensured.

[0075] In step S742, the complementary probability fusion calculation is performed using three verified indicators. The fusion calculation formula is as follows: ; In the formula, , , These represent the normalized scale diffusion, semantic diffusion, and transaction logic breakage, respectively, all with values ​​in the range [0,1]. This indicates the final comprehensive anomaly score. This represents the normalized scale diffusivity. Indicates the normalized semantic diffusion degree. This represents the normalized transaction logic breakpoint. This fusion method can fully superimpose multi-dimensional abnormal information, improving the ability to identify weak and complex anomalies.

[0076] In step S743, an anomaly judgment threshold obtained from statistical analysis of normal transaction data is determined and invoked. This threshold is obtained by statistically calculating the comprehensive anomaly score distribution of a large number of normal transaction samples, which can objectively divide the boundary between normal transactions and abnormal transactions and provide a unified standard for the final judgment.

[0077] In step S744, the calculated final comprehensive anomaly score is compared with the anomaly judgment threshold. When the final comprehensive anomaly score is greater than the anomaly judgment threshold, it is determined that the transaction corresponding to the transaction behavior feature sequence to be detected has anomalies related to scale deviation, semantic deviation, or temporal logic break. When the final comprehensive anomaly score is less than or equal to the anomaly judgment threshold, it is determined that the transaction corresponding to the transaction behavior feature sequence to be detected conforms to the normal behavior distribution characteristics and is in a legal and compliant normal transaction state.

[0078] This invention significantly improves the accuracy and stability of data transaction behavior identification by objectively quantifying and comprehensively judging scale diffusion, semantic diffusion, and temporal correlation, effectively avoiding misjudgments and omissions caused by single feature analysis. By organically integrating multi-dimensional diffusion features, the inherent correlations and changing patterns of data transaction behavior can be fully explored, enhancing the perception and judgment reliability of complex, hidden, and abnormal transaction behaviors. This, in turn, improves the standardization, security, and traceability of the entire data transaction process, providing more accurate, efficient, and reliable technical support for data transaction supervision.

[0079] The above embodiments of the present invention are only used to clearly and completely illustrate the technical solutions and do not constitute a limitation on the scope of protection. Any obvious modifications, substitutions, and combinations made by those skilled in the art to the embodiments without departing from the concept and principle of the present invention should fall within the scope of protection of the present invention.

[0080] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting abnormal data transaction behavior based on time-series behavior modeling, characterized in that, include: User transaction logs are deconstructed into features, which are divided into continuous numerical features and discrete text features. The continuous numerical features and the discrete text features are concatenated to form a feature vector for a single transaction, which is then arranged in chronological order to form a sequence of transaction behavior features. The transaction behavior feature sequence is input into a temporal convolutional network-masked multi-head attention temporal representation encoder to obtain a high-order semantic vector that integrates temporal features and global semantic features, as well as the corresponding attention weight distribution. In the inference stage of detecting the transaction behavior feature sequence to be detected, the scale diffusion degree, semantic diffusion degree, and transaction logic break degree are calculated based on the higher-order semantic vector and the attention weight distribution. After normalization and fusion, abnormal data transaction behavior is determined.

2. The method according to claim 1, characterized in that, The construction of the temporal convolutional network-masked multi-head attention temporal representation encoder specifically includes: Construct a temporal convolutional network module and a masked multi-head attention module; The temporal convolutional network module is cascaded with the masked multi-head attention module to form the temporal convolutional network-masked multi-head attention temporal representation encoder. The temporal convolutional network module employs causal convolution and dilated convolution structures to extract multi-scale long-period temporal features of the transaction behavior feature sequence; the masked multi-head attention module is used to capture the global historical semantic associations of the transaction behavior feature sequence. The temporal convolutional network-masked multi-head attention temporal representation encoder outputs a high-order semantic vector that fuses temporal features and global semantic features, along with the corresponding attention weight distribution.

3. The method according to claim 1, characterized in that, It also includes the training steps of the temporal convolutional network-masked multi-head attention temporal representation encoder, including: Based on the higher-order semantic vectors and the attention weight distribution, the temporal convolutional network-masked multi-head attention temporal representation encoder is trained using self-supervised learning based on future prediction. Specifically, historical data containing only normal transaction behavior is used to enable the temporal convolutional network-masked multi-head attention temporal representation encoder to learn the temporal and semantic patterns of normal transaction behavior.

4. The method according to claim 1, characterized in that, It also includes performing logarithmic transformation and normalization on the continuous numerical features, specifically including: Logarithmic smoothing is applied to the continuous numerical features to suppress extreme values, and standard deviation normalization is performed to unify the dimensions.

5. The method according to claim 1, characterized in that, It also includes semantic embedding of the discrete text features using a bidirectional encoder representation model, specifically including: The discrete text features are semantically embedded using a pre-trained bidirectional encoder representation model, which maps the discrete text features into dense semantic vectors of fixed dimensions, thereby capturing the semantic relationships between different text features.

6. The method according to claim 1, characterized in that, The process of concatenating continuous numerical features and discrete textual features to form a feature vector for a single transaction, and then constructing a transaction behavior feature sequence in chronological order, specifically includes: The processed continuous numerical features and discrete text features are concatenated sequentially according to the feature dimensions to form a feature vector of a single transaction of fixed length. Arranged in ascending order by the timestamp of each individual transaction, they form a sequence of transaction behavior characteristics.

7. The method according to claim 1, characterized in that, The calculation of the scale diffusivity specifically includes: The high-order semantic vector output by the temporal convolutional network-masked multi-head attention temporal representation encoder is obtained from the transaction behavior feature sequence to be detected. The feature components representing the transaction scale in the high-order semantic vector are extracted. The transaction scale feature components correspond to the fusion features of transaction amount, number of transactions and transaction frequency. The scale feature benchmark threshold constructed based on normal transaction data during the training phase is invoked. The scale feature benchmark threshold is a reasonable range calculated from the statistical mean and standard deviation of the normal transaction scale feature components. The deviation of the scale feature component of the transaction behavior feature sequence to be detected from the scale feature benchmark threshold is calculated, and the deviation is mapped to the [0,1] interval by normalization. The normalized result is the scale diffusion.

8. The method according to claim 1, characterized in that, Calculating the semantic diffusion degree specifically includes: The high-order semantic vector of the transaction behavior feature sequence to be detected is obtained by passing it through the temporal convolutional network-masked multi-head attention temporal representation encoder, and the feature components representing transaction semantics in the high-order semantic vector are extracted. The semantic feature benchmark library, which was built based on normal transaction data during the training phase, is invoked. The semantic feature benchmark library is the range of semantic feature values ​​formed by calculating the statistical mean and standard deviation of the semantic feature components of normal transactions. Calculate the cosine similarity between the semantic feature components of the transaction behavior feature sequence to be detected and the semantic feature benchmark library, and use the complementary value of the cosine similarity as the degree of semantic deviation; The semantic deviation degree is normalized, and the normalized result is the semantic diffusion degree.

9. The method according to claim 1, characterized in that, The calculation of the transaction logic fracture degree specifically includes: The high-order semantic vector and corresponding attention weight distribution of the transaction behavior feature sequence to be detected are obtained by passing it through the temporal convolutional network-mask multi-head attention temporal representation encoder. Extract the weight components that characterize the temporal correlation of transactions from the attention weight distribution. These weight components are used to reflect the strength of the logical correlation between adjacent and related transactions in the transaction behavior feature sequence to be detected. The training phase calls the logical correlation weight benchmark interval constructed based on normal transaction data. The logical correlation weight benchmark interval is a reasonable interval formed by calculating the time-series correlation weight components of the normal transaction behavior feature sequence using statistical mean and standard deviation. The deviation of the temporal correlation weight component of the transaction behavior feature sequence to be detected from the logical correlation weight benchmark interval is calculated. The deviation is normalized and mapped to the [0,1] interval. The normalized result is the transaction logic breakage degree.

10. The method according to claim 1, characterized in that, The determination of abnormal data transaction behavior after normalization and fusion specifically includes: Obtain the calculated scale diffusion degree, semantic diffusion degree, and transaction logic breakage degree, and perform normalization verification on the three indicators to ensure that each indicator is in the [0,1] range. An average of the three indicators is calculated using an equal-weighted fusion method to obtain the anomaly judgment fusion value; An anomaly detection threshold is set, which is a reasonable threshold obtained based on statistical analysis of normal transaction data during the training phase. The anomaly determination fusion value is compared with the anomaly determination threshold. If the anomaly determination fusion value is greater than the anomaly determination threshold, the transaction corresponding to the transaction behavior feature sequence to be detected is determined to be abnormal. If the anomaly determination fusion value is less than or equal to the anomaly determination threshold, the transaction corresponding to the transaction behavior feature sequence to be detected is determined to be normal.

Images