Intelligent identification and prevention method and system for abnormal behavior of financial transactions

Abstract

This invention discloses an intelligent identification and prevention method and system for abnormal financial transaction behavior, belonging to the field of financial anomaly prevention and control technology. The method includes: constructing a few-sample anomaly detection model based on a meta-learning framework, obtaining optimized initialization parameters through a dual-loop parameter update mechanism; constructing a task-level rapid adaptation mechanism, utilizing a Transformer encoder and parameter generator to quickly generate task-specific classifier weights based on new samples; achieving incremental learning by combining gradient smoothing strategies and elastic weight solidification; automatically classifying anomaly patterns using DBSCAN clustering and constructing a hierarchical pattern representation library; dynamically generating an incremental training sample pool based on confidence, representativeness, and diversity weighted scoring; and adaptively adjusting the detection threshold based on a proportional-integral-derivative control algorithm. This invention improves the accuracy and real-time performance of financial transaction risk control.

Description

Technical Field

[0001] This application belongs to the technical field of financial anomaly prevention and control, specifically involving intelligent identification and prevention methods and systems for abnormal financial transaction behaviors. Background Technology

[0002] With the rapid development of fintech, financial transactions are becoming more frequent, fragmented, and diversified in various scenarios. As fraud methods evolve and upgrade, they pose a serious challenge to the risk control systems of financial institutions. Machine learning-based anomaly detection methods, capable of automatically analyzing potential patterns in transaction data, have gradually become an important technological direction in the field of financial transaction security. These methods typically utilize historical transaction data to build detection models, analyzing multi-dimensional features such as transaction amount, time, frequency, and counterparty to determine whether a current transaction is abnormal.

[0003] However, existing technologies still have significant shortcomings in practical applications. On the one hand, traditional supervised learning models heavily rely on large-scale labeled samples for training, requiring the accumulation of a large amount of historical fraud cases and normal transaction data to obtain a reliable model. On the other hand, in real-world business scenarios, new fraud patterns often appear in the form of a small number of samples. Acquiring labeled samples is costly and time-consuming, resulting in a severe deficiency in the model's ability to identify new abnormal behaviors. More importantly, when new abnormal patterns emerge, existing models lack an effective and rapid adaptation mechanism. They cannot quickly adjust their parameters to adapt to new fraud patterns based on only a small number of new samples. Typically, it is necessary to re-collect and label a large number of samples and retrain the entire model, resulting in long model iteration cycles and slow response times, making it difficult to meet the rapid response requirements of real-time risk control.

[0004] Therefore, how to reduce the model's dependence on large-scale labeled samples while ensuring detection accuracy, and how to achieve rapid adaptation to novel anomaly patterns, are technical problems that urgently need to be solved in this field. Summary of the Invention

[0005] The purpose of this invention is to provide an intelligent identification and prevention method and system for abnormal financial transaction behavior, which can effectively solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A method for intelligent identification and prevention of abnormal financial transaction behavior includes the following specific steps: Step S1, Construct a few-shot anomaly detection model based on the meta-learning framework: The basic model is constructed using a model-independent meta-learning algorithm; Construct a meta-learning task distribution by extracting labeled samples from a historical abnormal transaction database; The base model is trained using a double-loop parameter update mechanism that includes an inner loop and an outer loop to obtain optimized initial parameters; The inner loop is used to perform gradient descent updates on the support set of each meta-learning task to simulate fast adaptation; The outer loop is used to minimize the generalization loss of all meta-learning tasks on the query set to optimize the initialization parameters; Step S2: Construct a task-level fast adaptation mechanism: When a new anomaly is detected, receive a support set containing 1 to 5 labeled samples; It will support task encoders that input sets into the Transformer architecture to extract task-level feature representations; Input the task-level feature representations into the parameter generator to generate task-specific classifier weights; The generated task-specific classifier weights are loaded into at least the classification layer of the sample anomaly detection model to achieve rapid adaptation to novel anomalies.

[0007] Furthermore, the double-loop parameter update mechanism in step S1 specifically includes: In the inner loop, for each task sampled from the task distribution... The algorithm in the support set According to Perform single or multiple gradient descent updates, where These are the initial parameters. The learning rate within the task. For the task loss function, The new parameters are obtained after adaptation; in the outer loop, the new parameters are obtained after adaptation. Then, the algorithm in the task query set The generalization loss is evaluated by minimizing the expected loss across all tasks. To update the initial parameters .

[0008] Furthermore, the task encoder in step S2 adopts the Transformer encoder architecture, which includes a 4-layer self-attention mechanism and a 2-layer feedforward neural network. The self-attention mechanism adopts a multi-head attention structure, setting up 8 attention heads, each with a dimension of 64; The Transformer architecture's task encoder receives a sequence of support set sample features from the transaction to be detected and outputs a 64-dimensional task-level feature representation that integrates information from all samples in the support set.

[0009] Furthermore, the parameter generator in step S2 comprises two fully connected layers; The first fully connected layer maps the 64-dimensional task embedding vector to a 256-dimensional hidden space; The second fully connected layer maps the 256-dimensional hidden layer vectors to a Gaussian distribution parameter space, outputting the mean vector of the classifier weights. and standard deviation vector ; Classifier weights are derived from a Gaussian distribution. Obtained by sampling from the middle; The parameter generator generates classifier weights during a single forward propagation, with inference latency kept within 10 milliseconds.

[0010] Furthermore, it also includes step S3, the incremental learning model update module: When a new anomalous pattern is detected, the model is incrementally updated based on 5 to 10 new samples; Maintain a historical sample buffer; Calculate the gradient of the loss function for the new task with respect to the model parameters. Preserving the gradient of the loss function with respect to model parameters, similar to historical tasks. ; Using the cosine value of the included angle Measure the similarity between the new and old gradient directions; When the cosine of the included angle is less than a preset threshold of 0.7, the gradient projection method is used to project the new gradient onto the neighborhood space of the historical gradient direction, according to... Adjust the gradient direction, where As a balance factor; Based on the adjusted gradient, combined with the elastic weight solidification loss function Update the model parameters, where As a measure of parameter importance, This is the fixed coefficient for the elastic weight.

[0011] Furthermore, it also includes step S4, the automatic clustering module for abnormal patterns: The DBSCAN density clustering algorithm is used to automatically classify newly emerging abnormal patterns, with a neighborhood radius. The initial setting is 0.5, the minimum number of samples. Set to 5; For each financial transaction detected as abnormal, a 512-dimensional deep feature representation is obtained from the feature extraction network of the few-sample anomaly detection model; Extract time series features of transaction time intervals, changes in transaction frequency, and trends in transaction amount; The 512-dimensional deep feature representation is concatenated with the time series features to obtain a 1024-dimensional fused feature vector, and then L2 normalization is performed to obtain the final abnormal pattern feature vector. A hierarchical pattern representation library is constructed, which includes a clustering index layer that stores clustering metadata information, a sample details layer that stores detailed information of specific abnormal samples, and a statistical feature layer that stores clustering statistical features.

[0012] Furthermore, it also includes step S5, the dynamic generation mechanism for the incremental training sample pool: High-value incremental samples are automatically selected based on the clustering results of step S4; Calculate the overall confidence score ,in To predict the confidence level of the model, The consistency coefficient between manual review and model prediction; Calculate representative scores ,in For sample feature vectors, The cluster center vector; Calculate diversity score ,in This represents the total number of samples in the sample pool. By weighted summation Receive a comprehensive value score; Comprehensive value score The selected samples are added to the incremental training sample pool.

[0013] Furthermore, it also includes step S6, an adaptive detection threshold adjustment strategy: Set the target false positive rate cap at 5% and the target false negative rate cap at 3%; Maintain a sliding time window with a window length of 1 hour to calculate the false alarm rate and false negative rate; The threshold adjustment signal is generated using a proportional-integral-derivative (PI-DE) control algorithm, and the controller calculation formula is as follows: ,in The adjustment amount for the detection threshold, To account for the false alarm rate bias, , , For proportional, integral, and derivative controller parameters; The threshold update module adjusts the detection threshold using an incremental update strategy based on the controller output. Each adjustment does not exceed 10% of the current threshold, and the legal range of the detection threshold is set to 0.1 to 0.9.

[0014] Furthermore, in step S1, when constructing the meta-learning task distribution, the number of samples in the support set and query set for each meta-learning task is divided in a 7:3 ratio, with the number of samples in the support set set set being 3 to 8 and the number of samples in the query set set set being 10 to 20. In step S2, the total time of the task-level fast adaptation mechanism is controlled within 100 milliseconds. The inference time of the task encoder of the Transformer architecture is about 30 milliseconds, the inference time of the parameter generator is about 20 milliseconds, and the time of the weight loading and verification process is about 50 milliseconds.

[0015] A smart identification and prevention system for abnormal financial transaction behavior includes: The few-shot anomaly detection model building module is configured to use a model-independent meta-learning algorithm to build a basic model, extract labeled samples from the historical abnormal transaction database to build a meta-learning task distribution, and train the basic model through a double-loop parameter update mechanism containing inner and outer loops to obtain optimized initial parameters. The task-level fast adaptation module is configured to receive a support set containing 1 to 5 labeled samples when a new anomaly is detected, extract task-level feature representations using the task encoder of the Transformer architecture, generate task-specific classifier weights based on the task-level feature representations using the parameter generator, and load the generated task-specific classifier weights into at least the classification layer of the sample anomaly detection model to complete the fast adaptation. The incremental learning model update module is configured to incrementally update the model based on 5 to 10 new samples when a new abnormal pattern is detected, by measuring the similarity between the new and old gradient directions and using a gradient smoothing strategy and an elastic weight solidification mechanism. The abnormal pattern automatic clustering module is configured to use the DBSCAN density clustering algorithm to automatically classify newly emerging abnormal patterns, extract abnormal pattern feature vectors, and build a hierarchical pattern representation library. The incremental training sample pool dynamic generation module is configured to automatically select high-value incremental samples based on the clustering results of the abnormal pattern automatic clustering module, and maintain a dynamically updated incremental training sample pool. The adaptive detection threshold adjustment module is configured to dynamically adjust the anomaly detection threshold based on the proportional-integral-derivative control algorithm and online learning mechanism, according to the feedback of the real-time monitored false alarm rate and false negative rate.

[0016] In summary, this application includes at least one of the following beneficial technical effects: 1. The few-shot anomaly detection model based on the meta-learning framework of this invention breaks through the dependence of traditional methods on a large number of labeled samples. It can achieve rapid adaptation to new anomaly patterns under the condition of a small number of samples, significantly reducing the cost of obtaining labeled samples and the dependence of model training on historical data. It is suitable for rapid response scenarios when new fraud patterns first appear.

[0017] 2. The task-level rapid adaptation mechanism of this invention, combined with the incremental learning module, enables the model to quickly learn and update parameters for new abnormal patterns without the need for full data retraining. This significantly shortens the model iteration cycle, greatly reduces the consumption of human and computing resources, and effectively solves the technical problem of high model iteration costs in the prior art.

[0018] 3. The automatic clustering module for abnormal patterns in this invention works in conjunction with the dynamic generation mechanism of the incremental training sample pool. It automatically classifies and extracts features of novel abnormal patterns through dynamic clustering algorithms, and automatically selects high-value incremental samples by combining the sample value evaluation mechanism. This achieves automated screening and labeling of incremental training samples, reduces the need for manual intervention, and supports the continuous learning and capability improvement of the model in the deployment environment.

[0019] 4. The adaptive detection threshold adjustment strategy of this invention is based on an online learning mechanism and business feedback data to achieve dynamic optimization of the detection threshold, effectively controlling the false alarm rate while maintaining a low false alarm rate. The self-learning method further enhances the model's ability to continuously identify new fraudulent behaviors through the automatic replenishment of high-confidence prediction samples and the time decay-based sample pool maintenance mechanism, ensuring the long-term effectiveness of the risk control system in the face of continuous upgrades in fraud methods. Attached Figure Description

[0020] Figure 1 A schematic diagram of the overall technical solution for an intelligent identification and prevention method for abnormal financial transaction behavior; Figure 2 A schematic diagram illustrating the core principle of a few-shot anomaly detection model based on a meta-learning framework in an intelligent identification and prevention method for abnormal financial transaction behavior; Figure 3 A schematic diagram illustrating the logical flow of the collaborative operation of anomaly detection and incremental learning in an intelligent identification and prevention method for abnormal financial transaction behavior; Figure 4 A schematic diagram illustrating the multi-level interaction and data flow of manual review, model prediction, and self-learning mechanisms in an intelligent identification and prevention method for abnormal financial transaction behavior; Figure 5 A schematic diagram comparing the effects of adaptive detection threshold dynamic adjustment and detection accuracy improvement in intelligent identification and prevention methods for abnormal financial transaction behaviors. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the following description is provided in conjunction with the appendix. Figure 1 To be continued Figure 5 The present invention will be further described in detail below with reference to specific embodiments.

[0022] Firstly, this invention provides an intelligent identification and prevention method for abnormal financial transaction behaviors. This method constructs a few-sample anomaly detection model based on a meta-learning framework, combined with a task-level rapid adaptation mechanism, an incremental learning model update module, an automatic anomaly pattern clustering module, a dynamic generation mechanism for the incremental training sample pool, and an adaptive detection threshold adjustment strategy, to achieve adaptive detection and continuous optimization of novel anomaly patterns in financial transactions. The steps of this method are described in detail below.

[0023] In the above method, the first step, S1, involves constructing a few-sample anomaly detection model based on a meta-learning framework. This step builds a detection model capable of quickly adapting to new anomaly patterns under conditions of a small number of samples. A model-independent meta-learning algorithm is employed to enable the model to learn adaptability on historical anomaly detection tasks, thus achieving efficient adaptation with only a very small number of samples when facing new tasks. The specific implementation steps are as follows.

[0024] Step S101: Define the meta-learning algorithm framework and the basic model. This method uses a model-independent meta-learning algorithm as the core framework. The algorithm does not pre-define a specific model structure, but instead trains initial parameters that are insensitive to task changes through a general parameter optimization strategy.

[0025] Let the basic model be The parameter vector is . The dimensionality is determined by the network structure design. Basic Model It receives the feature vector of a financial transaction sample and outputs the probability that the transaction is abnormal.

[0026] Step S102 involves constructing a meta-learning task distribution. During the meta-learning training phase, labeled samples are extracted from the historical abnormal transaction database and stratified sampling is performed according to abnormality type. This ensures that each training batch contains multiple abnormality types, including account theft, credit card counterfeiting, fraudulent transactions, money laundering, and cash-out activities. The purpose of this is to expose the model to diverse anomaly detection sub-problems.

[0027] From the task distribution Mid-sampling specific tasks Each task is divided into two disjoint datasets: Support set ,Include A number of labeled samples are used to simulate a learning scenario with a small number of samples. It is the first The feature vector of each sample These are sample labels.

[0028] query set ,Include A number of labeled samples were used to evaluate the generalization ability.

[0029] In each task, the number of samples in the support set and the query set are divided in a 7:3 ratio. The number of samples in the support set is set to 3 to 8, and the number of samples in the query set is set to 10 to 20.

[0030] Step S103: Perform meta-learning double-loop parameter update. The meta-learning parameter update consists of two parts: an inner loop and an outer loop.

[0031] The inner loop is used to simulate rapid adaptation to new tasks. For each sampled task... The algorithm in the support set Perform gradient descent updates on the above: In the formula: The model in the task The new parameters after adaptation; It is the in-task learning rate, which controls the step size of learning in a single task; Indicates the parameter Find the gradient; It is a task The loss function used in this method is cross-entropy loss, which measures the difference between the model's predictions on the support set and the true labels.

[0032] The outer loop is used to optimize the initial parameters of the model. It then obtains the task-adaptive parameters. Then, the algorithm in the task query set The generalization loss is evaluated, and the initial parameters are updated by minimizing the expected loss across all tasks: The complete parameter update rules for the model-independent meta-learning algorithm are as follows: In the formula: It is the meta-level learning rate, used to control the initial parameters. The direction and extent of the update.

[0033] The above update rules enable the model to learn good parameter initialization points. When faced with novel anomaly detection tasks, only 1 to 5 support samples and 3 to 5 gradient update steps are needed to achieve high detection accuracy.

[0034] Step S104: Construct the feature extraction network and task embedding generation. The feature extraction network adopts a deep residual network structure, which includes four residual stages, each containing three residual blocks. The jumper structure in the residual blocks alleviates the gradient vanishing problem during deep network training.

[0035] The input to the feature extraction network is a multi-dimensional feature vector of a financial transaction. This multi-dimensional feature vector includes: transaction amount, timestamp, transaction type encoding, counterparty information, account historical behavior characteristics, geographic location information, and device fingerprint features. The network outputs a 512-dimensional dense feature representation.

[0036] The 512-dimensional dense feature representation is fed into a fully connected layer, which maps it to a 64-dimensional task embedding space, resulting in a low-dimensional representation vector of the task, i.e., the task embedding vector. This task embedding vector serves as input to a subsequent parameter generator, used to generate task-specific classifier weights.

[0037] Step S105: Construct training data and set up the training process. The training data is constructed as follows: Extract all labeled samples from the historical abnormal transaction database, and perform stratified sampling according to abnormality type. Each training batch contains multiple abnormality types. For each abnormality type, treat it as an independent meta-learning task, and divide it into support set and query set according to the proportions in step S102.

[0038] The meta-learning training employs a multi-round iterative strategy, with each round consisting of two phases: inner layer update and outer layer update. During training, the learning rate is dynamically adjusted using a cosine annealing strategy, with an initial learning rate set to 0.001, a minimum learning rate set to 0.00001, and a decay period of 10 training rounds. After model training converges, the model parameters are saved as initialization parameters for few-shot anomaly detection, for use by subsequent task-level rapid adaptation mechanisms.

[0039] Step S106: Define the training objective and loss function design. The goal of model training in this step is to learn the optimal initialization parameters. This enables the model to achieve the lowest generalization error with very few gradient update steps when facing novel anomaly detection tasks that contain only a small number of labeled samples.

[0040] To achieve the above objectives, the following two loss functions need to be jointly optimized.

[0041] In-task loss function Used for inner layer updates, employing cross-entropy loss, specifically in the following form: in It is a sample The true label, This is the probability of anomalies predicted by the model. The in-task loss function measures how well the model fits the support set.

[0042] Meta-objective function This is used for outer layer updates, as shown in step S103. The meta-objective function is the sum of the intra-task losses of all sampled tasks on the query set. The purpose of optimizing the meta-objective function is to find initial parameters so that the model can quickly achieve good generalization on each new task.

[0043] By jointly optimizing the two loss functions mentioned above, the model learns discriminative features and also learns the ability to adapt to new tasks.

[0044] Step S1 introduces a model-independent meta-learning algorithm to complete the construction and training of the few-shot anomaly detection model. This section describes the task distribution construction, the dual-loop parameter update mechanism, the feature extraction network design, the training data organization method, and the loss function design. The model initialization parameters obtained through the above training process have the ability to quickly adapt to novel anomaly patterns under conditions of very few labeled samples, providing a foundational model for subsequent task-level rapid adaptation mechanisms.

[0045] The next step, S2, involves constructing a task-level fast adaptation mechanism. This step designs a task encoder and a parameter generator. When a new anomaly is detected, the parameter generator quickly generates adaptation model parameters based on a small number of new samples, completing the adaptation for the new task without retraining the entire model. The specific operation is as follows.

[0046] Step S201: Design the network structure of the task encoder, which adopts the Transformer encoder architecture. The encoder includes a 4-layer self-attention mechanism and a 2-layer feedforward neural network. The self-attention mechanism adopts a multi-head attention structure, setting 8 attention heads, each with a dimension of 64.

[0047] The mathematical expression for self-attention calculation is: In the formula: Represents a query matrix with dimensions of ,in The length of the input sequence; Represents the key matrix, with dimension . ; Represents a value matrix with dimension 1. ; It is the transpose of the key matrix; This represents the dimension of the key vector, which is 64 in this step; It is a normalized exponential function; This is a scaling factor used to control the magnitude of the dot product result.

[0048] The self-attention mechanism enables the task encoder to model long-range dependencies between different transaction features and capture complex interaction patterns in transaction sequences.

[0049] Step S202: Define the input and output of the task encoder. The task encoder receives the feature sequence of the support set samples of the transaction to be detected. The support set contains a small number of labeled samples, ranging from 1 to 5. The feature vector of each sample is consistent with the multi-dimensional feature vector of financial transactions defined in step S1, including transaction amount, timestamp, transaction type code, counterparty information, account historical behavior characteristics, geographical location information, and device fingerprint features.

[0050] The task encoder outputs a task-level feature representation. This representation integrates information from all samples in the support set, forming a global understanding of the current anomaly detection task. The output feature vector is set to 64 dimensions.

[0051] Step S203: Design the network structure of the parameter generator. The parameter generator is based on the task feature representation output by the task encoder and uses a conditional parameter generation mechanism to quickly generate task-specific model parameters.

[0052] The parameter generator's network structure consists of two fully connected layers: The first fully connected layer maps the 64-dimensional task embedding vector to a 256-dimensional hidden space.

[0053] The second fully connected layer maps the 256-dimensional hidden layer vectors to a Gaussian distributed parameter space.

[0054] Specifically, the parameter generator outputs the mean vector of the classifier weights. and standard deviation vector .in: It is a dimension of The mean matrix, where each element represents the Gaussian distribution mean of the corresponding classifier weights; It is a dimension of The standard deviation matrix, where each element represents the standard deviation of the Gaussian distribution of the corresponding classifier weights; Represents the real number field OK The matrix space of columns.

[0055] Classifier weights are derived from a Gaussian distribution. Obtained by sampling, i.e., each weight parameter .

[0056] For few-shot anomaly detection tasks, when the support set contains 1 to 5 labeled samples, the parameter generator can generate task-specific classifier weights in a single forward propagation. Inference latency is controlled within 10 milliseconds, meeting the response requirements of real-time detection scenarios.

[0057] Step S204: Define the training method for the parameter generator. The parameter generator needs to be pre-trained to generate effective classifier weights based on the task feature representation. The training data is constructed as follows: Multiple meta-learning tasks are extracted from the historical abnormal transaction database. Each task has the same task structure as defined in step S1, including a support set and a query set. For each training task, the following operations are performed: The support set samples are input into the task encoder to obtain the task feature representation; The task features are used to represent the input parameters to generate classifier weights. The generated classifier weights are loaded into the classification layer of the base model, and the classification loss is calculated on the query set.

[0058] The training loss function of the parameter generator is defined as: In the formula: It is the training loss of the parameter generator; This represents the expectation operation, which takes the average over all sampling tasks; From task distribution The specific meta-learning task in mid-sampling; It is a task Query set; It is the first in the query set Feature vectors of each sample; It is a sample The true label; This indicates that under the weights generated by the parameter generator, the model will... Predicted as The probability of; It is the task feature representation extracted by the task encoder from the support set; This represents the mapping function by which the parameter generator generates classifier weights based on task features.

[0059] The training objective of the parameter generator is to minimize the above loss. This ensures that the generated classifier weights achieve the lowest possible classification error across all query sets. During training, the parameters of the task encoder and parameter generator are jointly optimized through backpropagation.

[0060] Step S205 describes the workflow of task-level rapid adaptation. The task-level rapid adaptation mechanism is executed in the following order: Step 1 involves receiving a small number of labeled samples corresponding to the novel anomaly type to be detected, which serve as the support set for task-level adaptation. The number of samples in the support set ranges from 1 to 5.

[0061] Step 2 involves inputting the support set samples into the task encoder to extract task-level feature representations. The task encoder outputs a 64-dimensional task embedding vector.

[0062] Step 3 involves inputting the task feature representation into the parameter generator to generate task-specific classifier weights. The parameter generator outputs a mean vector. and standard deviation vector The classifier weights are obtained by sampling from a Gaussian distribution.

[0063] Step 4 involves loading the generated classifier weights into the classification layer of the base model, completing the rapid adaptation of the model. The base model is the few-shot anomaly detection model trained in step S1.

[0064] Step 5: Verify the detection performance of the adapted model on the support set samples. If the performance meets the preset threshold requirements, such as a detection accuracy of not less than 90% on the support set, the adapted model will be used for anomaly detection on the query set samples; if the performance does not meet the requirements, proceed to step S3, the incremental learning module, for further optimization.

[0065] The total time for the task-level rapid adaptation process is controlled within 100 milliseconds. Specifically, the inference time for the task encoder is approximately 30 milliseconds, the inference time for the parameter generator is approximately 20 milliseconds, and the time for the weight loading and verification process is approximately 50 milliseconds.

[0066] Step S206: Supplement the inference usage of the adapted model. After adaptation, the model receives the query set samples to be detected. The query set samples are unlabeled real-time transaction data. The model uses the newly generated classifier weights to calculate the anomaly probability score for each sample. If the anomaly probability score exceeds the current detection threshold, it is determined to be an abnormal transaction; otherwise, it is determined to be a normal transaction. The detection threshold is dynamically determined by the adaptive adjustment strategy in step S6.

[0067] In summary, step S2 achieves rapid adaptation to novel anomaly detection tasks through the collaborative work of the task encoder and parameter generator. The task encoder uses a Transformer architecture to extract task-level global features, and the parameter generator dynamically generates classifier weights based on these features. This step details the network structure of the encoder, the self-attention calculation formula, the network structure and training loss function of the parameter generator, and the complete workflow. Through this mechanism, the model can complete adaptation within 100 milliseconds with only 1 to 5 labeled samples, providing a foundation for rapid response to subsequent incremental learning updates and adaptive threshold adjustments.

[0068] The next step is step S3, the incremental learning model update module. In this step, when a new abnormal pattern is detected, the model is incrementally updated based on 5 to 10 new samples using a gradient smoothing strategy. This maintains the model's ability to identify historical anomalies while absorbing the features of the new pattern and avoiding catastrophic forgetting. The details are as follows.

[0069] Step S301: Construct the historical sample buffer and the basic data for the gradient smoothing strategy. This method maintains a historical sample buffer with a capacity of 5000 samples. The historical sample buffer uses a first-in-first-out replacement strategy to manage its storage content and is used to store historical abnormal transaction samples and their annotation information.

[0070] Before each incremental update, perform the following two gradient calculation operations: First, calculate the gradient of the loss function for the new task with respect to the model parameters, denoted as... The new task loss function is calculated based on the detected novel anomalous samples.

[0071] Second, calculate the gradient of the historical task-preserving loss function with respect to the model parameters, denoted as... The historical task retention loss function is obtained by mini-sampling the historical training samples. The sampling strategy adopts a memory replay mechanism, randomly selecting 64 samples from the historical sample buffer to calculate the retention loss.

[0072] Step S302: Measure the similarity between the new and old gradient directions. Gradient similarity is measured by the cosine of the included angle, and the formula is as follows: In the formula: It is the gradient vector of the historical task-preserving loss function with respect to the model parameters; It is the gradient vector of the new task loss function with respect to the model parameters; Represents the dot product operation of vectors; It is the gradient vector The Euclidean norm; It is the gradient vector The Euclidean norm.

[0073] The preset cosine threshold for the angle is set to 0.7, which corresponds to an angle between the old and new gradient directions not exceeding 45 degrees.

[0074] When the calculated cosine value of the included angle When the value is not less than 0.7, it indicates that the direction of the new task's update is consistent with the direction of historical knowledge, and no gradient adjustment is needed; it can be used directly. Update the parameters.

[0075] Step S303: Adjust the bias gradient direction. When the calculated cosine of the angle is less than 0.7, it indicates a deviation between the new task update direction and historical knowledge. In this case, the gradient direction needs to be adjusted. The adjustment strategy uses the gradient projection method, projecting the new gradient onto the neighborhood space of the historical gradient direction. The adjusted gradient calculation formula is as follows: In the formula: It is the adjusted gradient vector, used to finally update the model parameters; It is the projected gradient obtained by projecting the new gradient onto the neighborhood of the historical gradient direction; It is a balancing factor, with a value range of 0.3 to 0.7.

[0076] The specific value is dynamically determined based on the deviation of the cosine of the included angle from the threshold of 0.7. When the cosine of the included angle is significantly lower than the threshold, for example, if the cosine is lower than 0.5, A smaller value, such as 0.3, is chosen to strengthen the protection of historical knowledge; when the cosine of the included angle approaches the threshold, such as 0.68, Choose a larger value, such as 0.6 to 0.7, to allow for the learning of more new knowledge.

[0077] Step S304: Construct hybrid training batches. The incremental update process employs an experience replay strategy based on memory replay. During each incremental update, the following operations are performed: 64 samples were randomly sampled from the historical sample buffer.

[0078] Acquire 5 to 10 novel abnormal samples.

[0079] The two groups of samples are combined into a mixed training batch. The ratio of historical samples to new samples in the mixed training batch is approximately 6:4, that is, 64 historical samples correspond to approximately 42 to 43 new samples, and 5 to 10 new samples correspond to approximately 10 new samples. The actual ratio can be slightly adjusted according to the number of new samples.

[0080] The loss function for mixed training batches is defined as: In the formula: It is the total loss of incremental updates; This is the classification loss for the new task, which uses cross-entropy loss and is calculated in the same way as the intra-task loss in step S1. It is a distillation loss of historical mission; This is the weighting coefficient for the loss of the new task, set to 0.6; This is the weighting coefficient for historical mission distillation losses, set to 0.4.

[0081] The historical task distillation loss employs a knowledge distillation mechanism. Specifically, the current model before the incremental update is used as the teacher model, and the model to be updated is used as the student model. The output probability distribution of the teacher model for historical samples serves as the soft label, and the student model learns and fits the soft label. The distillation loss is calculated using KL divergence.

[0082] Step S305: Apply an elastic weighting solidification mechanism to protect critical parameters. This step also includes a parameter protection mechanism based on elastic weight solidification. This mechanism introduces an importance metric for each parameter, imposing stronger regularization constraints on more important parameters during incremental updates.

[0083] The parameter importance metric is approximated using the diagonal elements of the Fisher information matrix, and the formula is as follows: In the formula: It is the first The importance measure of each parameter; This represents the expectation operation, which is approximated in actual calculations by averaging a batch of historical samples. Represents partial derivatives; The model parameters are When given input Predict the correct label The logarithmic probability; It is the first One parameter.

[0084] The elastic weight solidification loss function is defined as: In the formula: It is the total loss after adding the flexible weight solidification regularization term; It is the mixed training batch loss defined in step S304; This is the elastic weighting coefficient, set to 1000, used to control the strength of the regularization term; This represents the summation over all model parameters; It is the first The importance measure of each parameter; This is the current number to be updated. Each parameter value; It is the first one saved before the incremental update. The historical best parameter value.

[0085] Step S306 involves performing incremental parameter updates. This method uses the adjusted gradient or directly uses the new gradient, combined with the elastic weight solidification loss function, to update the model parameters through one or more gradient descent updates. During each incremental update, the model absorbs new anomaly pattern features while maintaining its ability to identify historical anomaly types through gradient smoothing strategies and elastic weight solidification mechanisms.

[0086] After the update is complete, the new abnormal samples and their annotation information will be added to the historical sample buffer. If the historical sample buffer has reached its capacity limit of 5000, the oldest stored sample will be evicted according to the first-in-first-out rule before the new sample is added.

[0087] Step S3 achieves incremental model updates with a small number of new samples through gradient smoothing strategies and elastic weight fixation mechanisms. This step details the maintenance method of the historical sample buffer, the cosine similarity measurement method for new and old gradients, the projection strategy for gradient direction adjustment, the construction of mixed training batches and the design of the loss function, and the mathematical definition and parameter settings of the elastic weight fixation regularization term. These mechanisms enable the model to absorb new anomaly pattern features while avoiding catastrophic forgetting of historical knowledge, providing a foundation for continuous optimization of the model for subsequent automatic anomaly pattern clustering and dynamic sample pool generation.

[0088] For step S4, the automatic clustering module for abnormal patterns, this step uses the DBSCAN density clustering algorithm to automatically classify newly emerging abnormal patterns, extract pattern feature vectors, and establish a pattern representation library to support incremental sample screening.

[0089] Step S401: Determine the clustering algorithm and set the core parameters. This method selects the DBSCAN density clustering algorithm as the core clustering method. The DBSCAN algorithm does not require pre-specifying the number of clusters, can automatically discover clusters of arbitrary shapes, and is robust to noisy samples.

[0090] The core parameters of the DBSCAN algorithm include the neighborhood radius. and minimum sample size In this method, the neighborhood radius... The initial setting is 0.5, the minimum number of samples. Set to 5.

[0091] In practical applications, the neighborhood radius is dynamically adjusted based on the statistical distribution of anomalous features, and the K-distance graph method is used to determine the optimal neighborhood radius. The calculation process of the K-distance graph method is as follows: for each sample, calculate its distance from the first sample to the second sample. The distances to the nearest neighbor samples are calculated, and all distances are sorted in ascending order and plotted. The distance value corresponding to the inflection point of the curve is the optimal neighborhood radius.

[0092] Step S402: Extract the feature vector of the abnormal pattern. For each financial transaction detected as abnormal, extract its feature vector according to the following process.

[0093] First, deep feature representations are obtained from the feature extraction network of the few-shot anomaly detection model. The feature extraction network is the deep residual network constructed in step S1, which outputs a dense feature vector with a dimension of 512.

[0094] Second, extract the time series features of this abnormal transaction. These features include: transaction time interval, transaction frequency variation, and transaction amount variation trend. Specifically, the transaction time interval refers to the time difference between the current transaction and the previous transaction; the transaction frequency variation refers to the rate of change in the number of transactions per unit time; and the transaction amount variation trend refers to the fluctuation range of the amounts in multiple consecutive transactions.

[0095] Third, the 512-dimensional deep feature representation is concatenated with the aforementioned time series features to obtain a fused anomaly feature vector. The fused anomaly feature vector has its dimension expanded to 1024.

[0096] Fourth, the fused abnormal feature vectors are subjected to L2 normalization to obtain the final abnormal pattern feature vectors. The L2 normalization formula is as follows: In the formula: It is the fused 1024-dimensional anomaly feature vector; It is a vector The Euclidean norm; It is the normalized feature vector of the abnormal pattern.

[0097] Step S403: Construct the hierarchical storage structure of the pattern representation library. The pattern representation library adopts a hierarchical storage structure design, which is divided into three layers.

[0098] The first layer is the clustering index layer. The clustering index layer stores the metadata information of each cluster, including: the unique identifier of the cluster, the cluster center vector, the estimated cluster radius, and the number of samples in the cluster.

[0099] The second layer is the sample details layer. This layer stores detailed information about the specific outlier samples within each cluster, including: complete feature vectors, timestamps, annotation information, and confidence scores.

[0100] The third layer is the statistical feature layer. This layer stores the statistical features of each cluster, including: the mean and variance of the feature dimensions, transaction amount distribution parameters, and transaction time distribution parameters. These statistical features are used to quickly determine the degree of matching between new anomalies and each cluster.

[0101] The maximum capacity of the pattern representation library is set at 10,000 clusters. When the capacity limit is reached, clusters are sorted according to their activity level, and the clusters with the lowest activity level are removed to free up storage space. Cluster activity is defined as the number of new samples added in the last 90 days.

[0102] Step S404: The pattern representation library is maintained using an incremental update mechanism. The construction and maintenance of the pattern representation library adopts an incremental update mechanism. Whenever a new abnormal transaction is detected, it is processed according to the following procedure.

[0103] Step 1: Extract the abnormal pattern feature vector of the new abnormal transaction and obtain the final abnormal pattern feature vector in the manner described in step S402.

[0104] Step 2 involves searching the pattern representation library for the cluster center closest to the new anomaly. The distance metric used is Euclidean distance.

[0105] Step 3: Determine whether the distance between the nearest cluster center and the new anomaly is less than the neighborhood radius. If less than If the new anomaly is found, it will be assigned to that cluster, and the cluster center and sample count of that cluster will be updated. The cluster center update uses the mean update method: new cluster center = original cluster center × original sample count + new anomaly feature vector / new sample count.

[0106] Step 4: If the distance between the new anomaly and all existing cluster centers is greater than... Then, it is further determined whether the density requirement is met around the new anomaly. The density requirement is: with the new anomaly as the center, the radius is... The number of samples in the neighborhood is not less than If the density requirement is met, a new cluster is created, the new anomaly is made the first member of the cluster, and the information of the new cluster is added to the pattern representation library.

[0107] Step 5: If a new anomaly does not meet the density requirements, it is marked as a noise sample, stored separately, and not included in the subsequent incremental sample screening.

[0108] Step S405: Define the representative feature vector for each cluster, and extract the representative feature vector for each cluster. The representative feature vector is the cluster center vector, which is the average of the feature vectors of all samples within the cluster. The cluster center vector has a dimension of 1024, consistent with the dimension of the anomaly pattern feature vector.

[0109] Representative feature vectors are integrated into the clustering index layer of the pattern representation library for subsequent rapid matching of the cluster to which new anomalies belong, and to provide clustering basis for the dynamic generation mechanism of the incremental training sample pool in step S5.

[0110] In summary, step S4 utilizes the DBSCAN density clustering algorithm to automatically classify novel anomaly patterns. This step details the parameter setting and dynamic adjustment methods of the DBSCAN algorithm, the four-step extraction process of anomaly pattern feature vectors, the hierarchical storage structure of the pattern representation library, the five-step processing flow of the incremental update mechanism, and the calculation method of the cluster center vector. This mechanism can automatically discover and cluster novel anomaly patterns, providing a structured pattern knowledge base for subsequent incremental sample selection and continuous model optimization.

[0111] The next step is S5, the dynamic generation mechanism for the incremental training sample pool. In this step, S5 automatically selects high-value incremental samples based on the clustering results and maintains a dynamically updated incremental training sample pool. The selection process employs a sample value assessment mechanism, comprehensively considering three dimensions: sample confidence, representativeness, and diversity, and is implemented according to the following steps.

[0112] Step S501: Calculate the confidence score, which is based on a combination of model predictions and manual review results. Model prediction confidence score. The value ranges from 0 to 1. Consistency coefficient The value rules are as follows: 1.0 when the manual review matches the model prediction, 0.5 when the manual review overturns the prediction, and 0.0 when there is no manual review. The overall confidence score is defined as: Step S502: Calculate the representativeness score and diversity score. The representativeness score measures how representative a sample is of its cluster. The calculation formula is as follows: in For sample feature vectors, The cluster center vector, The distance is Euclidean. A score closer to 1 indicates that the sample is closer to the cluster center.

[0113] The diversity score measures the contribution of a sample to the overall diversity of the sample pool, and is calculated using the following formula: in For the first in the sample pool The feature vector of each sample This represents the total number of samples in the sample pool. A higher score indicates a greater difference between the sample and the existing samples.

[0114] Step S503, Weighted Fusion and Screening: The comprehensive value score is defined as the weighted sum of the scores across the three dimensions. Weighting ensures that confidence scores dominate. A value score threshold of 0.6 is set, with only... Only samples that meet the minimum requirements are selected for the incremental training sample pool.

[0115] Step S504, Sample Pool Structure and Maintenance: The incremental training sample pool adopts a circular buffer structure with a total capacity of 10,000 samples. The sample pool is divided into an active pool with a capacity of 6,000 samples and an archive pool with a capacity of 4,000 samples. The active pool stores recently added samples and samples with high value scores, while the archive pool stores historically accumulated samples. When the active pool reaches its limit, samples are eliminated according to their value scores from low to high. Samples in the archive pool are periodically re-evaluated to determine whether to transfer them to the active pool or permanently delete them.

[0116] Step S505: Dynamic Expansion and Clustering Coupling. The dynamic expansion mechanism of the sample pool is coupled with the automatic clustering module for abnormal patterns in step S4. When the Euclidean distance between a new sample and all existing cluster centers exceeds the threshold of 0.5, a new cluster is automatically created, with the new sample as its first member. Representative samples in the new cluster, i.e., those closest to the cluster center, are preferentially selected into the sample pool, and the cluster center vector of the new cluster is synchronously updated to the pattern representation library.

[0117] Step S506, Explanation of the purpose of the sample pool: The samples stored in the incremental training sample pool are used for updating the incremental learning model in step S3. When mixed training batches are required, 64 historical samples are randomly sampled from this sample pool. In addition, high-value samples can assist the manual review process, prioritizing the review of samples with higher overall scores.

[0118] Step S5 uses a weighted scoring mechanism based on three dimensions—confidence, representativeness, and diversity—to automate the value assessment and selection of incremental samples. The sample pool adopts a hierarchical circular buffer structure and collaborates with the anomaly pattern clustering module to ensure that the sample pool can continuously accumulate high-quality and diverse anomaly samples, providing reliable data support for the model's incremental learning.

[0119] Finally, step S6 involves an adaptive detection threshold adjustment strategy. This step dynamically adjusts the anomaly detection threshold based on an online learning mechanism, combining false positive and false negative rate feedback to achieve adaptive threshold optimization. The adaptive threshold optimization employs an online learning algorithm to analyze the false positive and false negative rates of recent transaction data in real time. Based on the feedback information, it dynamically adjusts the anomaly detection threshold parameters, allowing the threshold to adaptively adjust to the evolution of anomaly patterns and changes in the business environment. This is implemented according to the following steps.

[0120] Step S601: Set target indicators and construct indicator monitoring modules. This method sets the upper limit of the target false alarm rate to 5% and the upper limit of the target false alarm rate to 3%. When the actual monitored indicator deviates from the target range, the threshold adjustment is triggered.

[0121] The indicator monitoring module maintains a sliding time window with a length of 1 hour to collect transaction data and detection results within that time period. The false positive rate is calculated using the following formula: The formula for calculating the false negative rate is: In the formula: Indicates the false alarm rate; Indicates the false negative rate; This is the number of incorrect samples that misclassify normal transactions as abnormal. This is the number of correct samples that correctly classify normal transactions as normal. This is the number of incorrect samples that misclassify abnormal transactions as normal. It is the number of correct samples that correctly identify abnormal transactions as abnormal.

[0122] The indicator monitoring module outputs the false alarm rate within the current time window every 5 minutes. and underreporting rate Estimated value.

[0123] Step S602: Design a threshold controller. The threshold controller generates a threshold adjustment signal based on the deviation between the monitored index and the target value. The controller adopts a proportional-integral-derivative control algorithm, and the calculation formula is as follows: In the formula: It is the adjustment amount of the detection threshold; This is the false alarm rate bias, among which For the target false alarm rate, This represents the actual false alarm rate. , , For proportional, integral, and derivative controller parameters; The integral term representing the deviation; The differential term representing the deviation.

[0124] The control deviation for the false negative rate is ,in The overall threshold adjustment is based on a weighted average of false alarm rate control and false negative rate control, with the weights dynamically determined according to the current primary challenge: when the false alarm rate deviates significantly from the target, the weight of false alarm rate control is increased; when the false negative rate deviates significantly from the target, the weight of false negative rate control is increased.

[0125] Step S603: Implement the threshold update module, which adjusts the detection threshold based on the controller output. The update employs an incremental update strategy, with each adjustment not exceeding 10% of the current threshold to ensure smoothness and stability. The valid range for the detection threshold is set to 0.1 to 0.9; if the adjusted threshold exceeds this range, boundary truncation is performed. After the threshold update, the new threshold is used for anomaly detection within the next time window, and the adjustment effect continues to be monitored, forming a closed-loop feedback control.

[0126] Step S604 adds an active adjustment mechanism based on the evolution of abnormal patterns. This method continuously monitors the activity and size changes of each cluster in the pattern representation library. When a rapid increase or sudden emergence of a certain type of abnormal pattern is detected, it indicates the possible existence of a new type of fraud attack. At this time, the detection threshold is automatically lowered to improve detection sensitivity and prevent false negatives. When the activity of a certain type of abnormal pattern continues to decline or its size shrinks, it indicates that this type of anomaly may have become outdated or been effectively contained. At this time, the detection threshold is appropriately increased to reduce the false positive rate and improve the user experience.

[0127] Step S6 achieves adaptive dynamic adjustment of the detection threshold through the coordinated operation of the indicator monitoring module, the proportional-integral-derivative threshold controller, and the threshold update module. The indicator monitoring module calculates the false alarm rate and false negative rate in real time using a sliding time window; the threshold controller generates adjustment signals based on the deviation; and the threshold update module smoothly adjusts the threshold and forms a closed-loop control. Furthermore, an active adjustment mechanism based on the clustering activity in the pattern representation library further enhances the threshold's responsiveness to the evolution of abnormal patterns. These mechanisms enable the detection threshold to dynamically optimize in response to changes in fraudulent methods, effectively controlling the false alarm rate while maintaining a low false negative rate.

[0128] To enable those skilled in the art to more clearly understand the technical solution of the present invention, a specific application example is provided below for detailed explanation.

[0129] Suppose a commercial bank has deployed the intelligent identification and prevention system for abnormal financial transactions provided by this invention to monitor customers' transaction behavior in real time. One day, the system detects a batch of abnormal transactions, characterized by multiple credit cards making small-amount swipes on the same merchant's POS machine within a short period, each transaction amounting to 199.99 yuan, with a time interval of 30 seconds between transactions.

[0130] In step S1, the system first invokes a few-shot anomaly detection model built on a meta-learning framework to perform a preliminary screening of the batch of transactions. This model has been trained using meta-learning on historical anomaly detection tasks and possesses the ability to quickly adapt to new tasks. The model receives the feature vector of each transaction, including the transaction amount of 199.99 yuan, the transaction timestamp, merchant code, device terminal number, cardholder information, etc., and outputs an anomaly probability score for each transaction. The preliminary screening results show that the anomaly probability score of this batch of transactions is between 0.65 and 0.78, falling within the moderately high suspicious range.

[0131] In step S2, due to the detection of suspicious signals from a novel anomaly pattern, the system activates a task-level rapid adaptation mechanism. The task encoder receives the support set samples of the batch of transactions, including 5 transaction samples labeled as suspicious, and extracts task-level feature representations. The parameter generator quickly generates adapted classifier weights based on the task feature representations under limited sample conditions, without retraining the entire model. After adaptation, the model re-scores the batch of transactions, and the anomaly probability score improves to between 0.82 and 0.91, enhancing the ability to identify novel anomaly patterns.

[0132] In step S3, the system triggers the incremental learning model update module to incrementally update the model based on the detected novel anomaly samples. The system randomly samples 64 historical anomaly samples from the historical sample buffer and mixes them with 5 to 10 novel anomaly samples to form a mixed training batch. A gradient smoothing strategy controls the cosine of the angle between the old and new gradient directions to be no less than 0.7, ensuring that the incremental update direction is consistent with historical knowledge. After the incremental update, the model maintains a high level of accuracy in identifying historical anomaly types, while its ability to identify novel anomaly patterns is improved.

[0133] In step S4, the automatic clustering module for abnormal patterns automatically categorizes this batch of novel anomalies. The system extracts the fusion feature vector of each abnormal transaction and uses the DBSCAN density clustering algorithm to identify the cluster structure in the feature space. The clustering results show that this batch of transactions forms a new cluster containing 23 samples, and the cluster center vector is stored in the pattern representation library. Cluster feature analysis indicates that this type of anomaly has significant pattern features of a fixed amount of 199.99 yuan, a fixed time interval of 30 seconds, and the same merchant terminal, which is initially judged to be a suspected credit card cash-out gang crime.

[0134] In step S5, the incremental training sample pool dynamic generation mechanism evaluates the value of this batch of novel anomalous samples. The confidence score is calculated based on the model prediction confidence and consistency with manual review, with a comprehensive score of 0.78. The representativeness score is calculated based on the distance between the sample and the cluster center; the average normalized distance between the sample and the cluster center is 0.15, resulting in a representativeness score of 0.87. The diversity score is calculated based on the difference between the sample and existing samples in the sample pool; the average difference between this batch of samples and existing samples is 0.42, resulting in a diversity score of 0.42. The overall sample value score is 0.68, which is higher than the preset threshold of 0.6, and the system automatically selects this batch of samples into the incremental training sample pool.

[0135] In step S6, the adaptive detection threshold adjustment strategy optimizes the threshold based on detection performance feedback. The system calculates the false positive rate and false negative rate of the detection results over the past hour, both of which are within the target range. Considering that newly detected abnormal credit card cash-out patterns may represent more potential cases, the system proactively lowers the detection threshold to improve detection sensitivity and expand the screening scope for this type of anomaly.

[0136] A manual review process then intervenes to verify the suspected abnormal transactions identified by the system. The review results are fed back to the incremental learning module for continuous optimization of the detection model. The consistency between the review results and the model predictions serves as an important calibration factor for evaluating sample confidence; samples with a consistency rate reaching a preset consistency threshold are automatically added to the high-value sample pool. In subsequent model updates and iterations, samples from the high-value pool are given priority in training, further enhancing the model's ability to identify this type of anomaly.

[0137] On the other hand, the intelligent identification and prevention system for abnormal financial transaction behavior provided by the present invention includes: The few-shot anomaly detection model building module is configured to use a model-independent meta-learning algorithm to build a basic model, extract labeled samples from the historical abnormal transaction database to build a meta-learning task distribution, and train the basic model through a double-loop parameter update mechanism containing inner and outer loops to obtain optimized initial parameters. The task-level fast adaptation module is configured to receive a support set containing 1 to 5 labeled samples when a new anomaly is detected, extract task-level feature representations using the task encoder of the Transformer architecture, generate task-specific classifier weights based on the task-level feature representations using the parameter generator, and load the generated task-specific classifier weights into at least the classification layer of the sample anomaly detection model to complete the fast adaptation. The incremental learning model update module is configured to incrementally update the model based on 5 to 10 new samples when a new abnormal pattern is detected, by measuring the similarity between the new and old gradient directions and using a gradient smoothing strategy and an elastic weight solidification mechanism. The abnormal pattern automatic clustering module is configured to use the DBSCAN density clustering algorithm to automatically classify newly emerging abnormal patterns, extract abnormal pattern feature vectors, and build a hierarchical pattern representation library. The incremental training sample pool dynamic generation module is configured to automatically select high-value incremental samples based on the clustering results of the abnormal pattern automatic clustering module, and maintain a dynamically updated incremental training sample pool. The adaptive detection threshold adjustment module is configured to dynamically adjust the anomaly detection threshold based on the proportional-integral-derivative control algorithm and online learning mechanism, according to the feedback of the real-time monitored false alarm rate and false negative rate.

[0138] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention. Therefore, the embodiments should be regarded as exemplary and non-limiting in all respects.

[0139] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A method for intelligent identification and prevention of abnormal financial transaction behavior, characterized in that, Includes the following steps: Step S1, Construct a few-shot anomaly detection model based on the meta-learning framework: The basic model is constructed using a model-independent meta-learning algorithm; Extract labeled samples from a historical abnormal transaction database to construct a meta-learning task distribution; The base model is trained using a double-loop parameter update mechanism that includes an inner loop and an outer loop to obtain optimized initial parameters; The inner loop is used to perform gradient descent updates on the support set of each meta-learning task to simulate fast adaptation; The outer loop is used to minimize the generalization loss of all meta-learning tasks on the query set to optimize the initialization parameters; Step S2: Construct a task-level fast adaptation mechanism: When a new anomaly is detected, receive a support set containing 1 to 5 labeled samples; It will support task encoders that input sets into the Transformer architecture to extract task-level feature representations; Input the task-level feature representations into the parameter generator to generate task-specific classifier weights; The generated task-specific classifier weights are loaded into at least the classification layer of the sample anomaly detection model to achieve rapid adaptation to novel anomalies.

2. The intelligent identification and prevention method for abnormal financial transaction behavior according to claim 1, characterized in that, The double-loop parameter update mechanism in step S1 specifically includes: In the inner loop, for each task sampled from the task distribution... The algorithm in the support set According to Perform single or multiple gradient descent updates, where These are the initial parameters. The learning rate within the task. For the task loss function, The new parameters are obtained after adaptation; in the outer loop, the new parameters are obtained after adaptation. Then, the algorithm in the task query set The generalization loss is evaluated by minimizing the expected loss across all tasks. To update the initial parameters .

3. The intelligent identification and prevention method for abnormal financial transaction behavior according to claim 1, characterized in that, The Transformer architecture task encoder in step S2 adopts the Transformer encoder architecture, which includes 4 layers of self-attention mechanism and 2 layers of feedforward neural network; The self-attention mechanism adopts a multi-head attention structure, setting up 8 attention heads, each with a dimension of 64; The Transformer architecture's task encoder receives a sequence of support set sample features from the transaction to be detected and outputs a 64-dimensional task-level feature representation that integrates information from all samples in the support set.

4. The intelligent identification and prevention method for abnormal financial transaction behavior according to claim 1, characterized in that, The parameter generator in step S2 consists of two fully connected layers; The first fully connected layer maps the 64-dimensional task embedding vector to a 256-dimensional hidden space; The second fully connected layer maps the 256-dimensional hidden layer vectors to a Gaussian distribution parameter space, outputting the mean vector of the classifier weights. and standard deviation vector ; Classifier weights are derived from a Gaussian distribution. Obtained by sampling from the middle; The parameter generator generates classifier weights during a single forward propagation, with inference latency kept within 10 milliseconds.

5. The intelligent identification and prevention method for abnormal financial transaction behavior according to claim 1, characterized in that, It also includes step S3, the incremental learning model update module: When a new anomalous pattern is detected, the model is incrementally updated based on 5 to 10 new samples; Maintain a historical sample buffer; Calculate the gradient of the loss function for the new task with respect to the model parameters. Preserving the gradient of the loss function with respect to model parameters, similar to historical tasks. ; Using the cosine value of the included angle Measure the similarity between the new and old gradient directions; When the cosine of the included angle is less than a preset threshold of 0.7, the gradient projection method is used to project the new gradient onto the neighborhood space of the historical gradient direction, according to... Adjust the gradient direction, where As a balance factor; Based on the adjusted gradient, combined with the elastic weight solidification loss function Update the model parameters, where As a measure of parameter importance, This is the fixed coefficient for the elastic weight.

6. The intelligent identification and prevention method for abnormal financial transaction behavior according to claim 1, characterized in that, It also includes step S4, the automatic clustering module for abnormal patterns: The DBSCAN density clustering algorithm is used to automatically classify newly emerging abnormal patterns, with a neighborhood radius. The initial setting is 0.5, the minimum number of samples. Set to 5; For each financial transaction detected as abnormal, a 512-dimensional deep feature representation is obtained from the feature extraction network of the few-sample anomaly detection model; Extract time series features of transaction time intervals, changes in transaction frequency, and trends in transaction amount; The 512-dimensional deep feature representation is concatenated with the time series features to obtain a 1024-dimensional fused feature vector, and then L2 normalization is performed to obtain the final abnormal pattern feature vector. A hierarchical pattern representation library is constructed, which includes a clustering index layer that stores clustering metadata information, a sample details layer that stores detailed information of specific abnormal samples, and a statistical feature layer that stores clustering statistical features.

7. The intelligent identification and prevention method for abnormal financial transaction behavior according to claim 6, characterized in that, It also includes step S5, the dynamic generation mechanism for the incremental training sample pool: High-value incremental samples are automatically selected based on the clustering results of step S4; Calculate the overall confidence score ,in To predict the confidence level of the model, The consistency coefficient between manual review and model prediction; Calculate representative scores ,in For sample feature vectors, The cluster center vector; Calculate diversity score ,in This represents the total number of samples in the sample pool. By weighted summation Receive a comprehensive value score; Comprehensive value score The selected samples are added to the incremental training sample pool.

8. The intelligent identification and prevention method for abnormal financial transaction behavior according to claim 1, characterized in that, It also includes step S6, an adaptive detection threshold adjustment strategy: Set the target false positive rate cap at 5% and the target false negative rate cap at 3%; Maintain a sliding time window with a window length of 1 hour to calculate the false alarm rate and false negative rate; The threshold adjustment signal is generated using a proportional-integral-derivative (PI-DE) control algorithm, and the controller calculation formula is as follows: ,in The adjustment amount for the detection threshold, To account for the false alarm rate bias, , , For proportional, integral, and derivative controller parameters; The threshold update module adjusts the detection threshold using an incremental update strategy based on the controller output. Each adjustment does not exceed 10% of the current threshold, and the legal range of the detection threshold is set to 0.1 to 0.

9.

9. The intelligent identification and prevention method for abnormal financial transaction behavior according to claim 1, characterized in that, In step S1, when constructing the meta-learning task distribution, the number of samples in the support set and query set for each meta-learning task is divided in a 7:3 ratio, with the number of samples in the support set set set being 3 to 8 and the number of samples in the query set set being 10 to 20. In step S2, the total time of the task-level fast adaptation mechanism is controlled within 100 milliseconds. The inference time of the task encoder of the Transformer architecture is about 30 milliseconds, the inference time of the parameter generator is about 20 milliseconds, and the time of the weight loading and verification process is about 50 milliseconds.

10. A smart identification and prevention system for abnormal financial transaction behavior, used to execute the smart identification and prevention method for abnormal financial transaction behavior as described in any one of claims 1 to 9, characterized in that, include: The few-shot anomaly detection model building module is configured to use a model-independent meta-learning algorithm to build a basic model, extract labeled samples from the historical abnormal transaction database to build a meta-learning task distribution, and train the basic model through a double-loop parameter update mechanism containing inner and outer loops to obtain optimized initial parameters. The task-level fast adaptation module is configured to receive a support set containing 1 to 5 labeled samples when a new anomaly is detected, extract task-level feature representations using the task encoder of the Transformer architecture, generate task-specific classifier weights based on the task-level feature representations using the parameter generator, and load the generated task-specific classifier weights into at least the classification layer of the sample anomaly detection model to complete the fast adaptation. The incremental learning model update module is configured to incrementally update the model based on 5 to 10 new samples when a new abnormal pattern is detected, by measuring the similarity between the new and old gradient directions and using a gradient smoothing strategy and an elastic weight solidification mechanism. The abnormal pattern automatic clustering module is configured to use the DBSCAN density clustering algorithm to automatically classify newly emerging abnormal patterns, extract abnormal pattern feature vectors, and build a hierarchical pattern representation library. The incremental training sample pool dynamic generation module is configured to automatically select high-value incremental samples based on the clustering results of the abnormal pattern automatic clustering module, and maintain a dynamically updated incremental training sample pool. The adaptive detection threshold adjustment module is configured to dynamically adjust the anomaly detection threshold based on the proportional-integral-derivative control algorithm and online learning mechanism, according to the feedback of the real-time monitored false alarm rate and false negative rate.

Images