Abnormality evaluation method, device, apparatus, and storage medium

Abstract

This application provides an anomaly assessment method, apparatus, device, and storage medium. The method includes: acquiring multiple resource transfer datasets associated with the operation object to be assessed, with each resource transfer dataset associated with one transfer object; based on a resource transfer dataset, extracting the initial transfer features of the corresponding transfer object in multiple transfer periods; by aggregating the initial transfer features of the same transfer object in different transfer periods, learning the dynamic changes and trends of resource transfer data in the time dimension, and obtaining the local association features of the corresponding transfer object; by further aggregating the local association features of multiple transfer objects, deeply analyzing the specific impact of different transfer objects on the occurrence of transfer anomalies in the operation object, and applying this to the prediction of default probability, comprehensively assessing the credit status and default anomalies of the operation object, and improving the accuracy of anomaly assessment.

Description

Technical Field

[0001] This application relates to the field of computer technology, and provides an anomaly assessment method, apparatus, device, and storage medium. Background Technology

[0002] With the continuous advancement of science and technology and the sustained development of the economy, online payment has become an important way for people to consume in their daily lives. Whether it is shopping, dining or traveling, these payment behaviors record people's important consumption habits and reflect their spending power and credit status.

[0003] Currently, based on the experience of business experts, multi-dimensional statistics (such as the number of transactions, the amount of transactions, and the category of transactions) are often performed on the payment behavior of users to obtain multi-dimensional statistical features. These multi-dimensional statistical features are then input into the XGBoost model for training to obtain a classification model. The trained classification model then performs anomaly assessment tasks to predict the potential anomalies and default probabilities of users.

[0004] The construction method based on human experience is easily affected by subjective factors. Different people's experience and subjective judgment may lead to inconsistencies in the constructed features, lack of objective standards, and the construction of statistical features relies too much on the experience of specific individuals, which may ignore broader data and objective facts. If experts do not have a deep understanding of the business, their assessment of anomalies in constructed features will also be poor.

[0005] Secondly, features constructed based on the experience of business experts are coarse-grained and cannot effectively learn the volatility and habituality of features over time.

[0006] Furthermore, the XGBoost model is not good at fusing multiple heterogeneous features, resulting in mediocre classification performance and reduced anomaly assessment accuracy. Summary of the Invention

[0007] This application provides an anomaly assessment method, apparatus, device, and storage medium to address the problem of the inability to accurately assess potential anomalies of users using objective standards.

[0008] In a first aspect, embodiments of this application provide an anomaly assessment method, including:

[0009] Obtain multiple resource transfer datasets associated with the operation object to be evaluated, with each resource transfer dataset associated with one transfer object;

[0010] For each resource transfer dataset, the following steps are performed: Based on a resource transfer dataset, the initial transfer features of the corresponding transfer objects in multiple transfer cycles are extracted, and based on the first attention weight of each initial transfer feature, the local association features of the corresponding transfer objects are obtained. Each first attention weight represents the degree of association between the initial transfer features of the corresponding transfer object in one transfer cycle and the initial transfer features of all transfer cycles.

[0011] Based on the second attention weight of each local association feature, the global association feature of each transfer object is obtained. Each second attention weight represents the degree of association between the local association feature of a transfer object and the local association features of all transfer objects.

[0012] Anomaly assessment is performed based on multiple globally related features to obtain the anomaly assessment result of the operation object.

[0013] Secondly, embodiments of this application also provide an anomaly assessment device, including:

[0014] The data acquisition module is used to acquire multiple resource transfer datasets associated with the operation object to be evaluated, with each resource transfer dataset associated with one transfer object;

[0015] The local association module is used to perform the following for each resource transfer dataset: Based on a resource transfer dataset, extract the initial transfer features of the corresponding transfer object in multiple transfer cycles, and obtain the local association features of the corresponding transfer object based on the first attention weight of each initial transfer feature. Each first attention weight represents the degree of association between the initial transfer features of the corresponding transfer object in one transfer cycle and the initial transfer features of all transfer cycles.

[0016] The global association module is used to obtain the global association features of each transfer object based on the second attention weight of each local association feature. Each second attention weight represents the degree of association between the local association features of a transfer object and the local association features of all transfer objects.

[0017] The anomaly assessment module is used to perform anomaly assessment based on multiple globally related features obtained, and to obtain the anomaly assessment result of the operation object.

[0018] Optionally, the local association module is used for:

[0019] The initial transfer characteristics of the corresponding transfer objects in each transfer cycle are linearly transformed to obtain the corresponding query vector, key vector and value vector;

[0020] For each obtained query vector, the following steps are performed: based on the similarity between each key vector and a query vector, the first attention weight of the corresponding initial transfer feature is obtained;

[0021] For each obtained value vector, the following steps are performed: weighting a value vector using the corresponding first attention weights to obtain the corresponding target transfer features;

[0022] The obtained multiple target transfer features are aggregated to obtain the local association features of the corresponding transfer objects.

[0023] Optionally, the initial transfer characteristics for each transfer cycle are obtained by the local association module in the following manner:

[0024] From the aforementioned resource transfer dataset, obtain a set of resource transfer data collected within a transfer cycle;

[0025] Feature extraction is performed on the text data, time data, and numerical data in the resource transfer data group to obtain corresponding text features, time features, and numerical features. The text data represents the basic information of the resource transfer products transferred within a transfer cycle. The time data represents the time range of the transfer behavior. The numerical data represents the transfer frequency and the amount of transfer generated within a transfer cycle.

[0026] By concatenating text features, time features, and numerical features, the initial transfer features of the operation object and the corresponding resource transfer object within the transfer cycle are obtained.

[0027] Optionally, the text features of the resource transfer data group are obtained by the local association module in the following manner:

[0028] The text data of the resource transfer data group is segmented to obtain a segmentation set;

[0029] Feature extraction is performed on the word segmentation set to obtain the initial semantic features of each word in the word segmentation set; and position encoding is performed on the word segmentation set to obtain the position features of each word. Each position feature represents the relative position information of a word in the word segmentation set.

[0030] Each initial semantic feature is fused with its corresponding positional feature to obtain the target semantic features of each word.

[0031] Based on the third attention weight of each target semantic feature, the text features of the resource transfer data group are obtained. Each third attention weight represents the degree of correlation between the target semantic features of a word and the target semantic features of all words.

[0032] Optionally, the global association module is used for:

[0033] Perform linear transformations on the local association features of each transfer object to obtain the corresponding query vector, key vector, and value vector;

[0034] For each obtained query vector, the following steps are performed: based on the similarity between each key vector and a query vector, the second attention weight of the corresponding local association feature is obtained;

[0035] For each obtained value vector, the following steps are performed: the corresponding second attention weight is applied to weight the value vector to obtain the global association features of the corresponding transfer object.

[0036] Optionally, the anomaly assessment module is used for:

[0037] Obtain preset evaluation features; the preset evaluation features are used to evaluate the probability that the operation object will experience a transfer anomaly when performing a transfer behavior;

[0038] Based on the similarity between the multiple global association features and the preset evaluation features, the preset evaluation features are dynamically adjusted to obtain the corresponding target evaluation features;

[0039] Anomaly assessment is performed based on the target assessment features to obtain an anomaly assessment result that predicts the occurrence of a transfer anomaly when the operation object performs a transfer behavior.

[0040] Optionally, after obtaining the local association features of the corresponding transfer object, the global association module is further used to:

[0041] Feature extraction is performed on the total amount and total frequency of transfers of the operation object and the corresponding transfer object in multiple transfer cycles to obtain numerical supplementary features; and feature extraction is performed on the object name of the corresponding transfer object to obtain text supplementary features.

[0042] The numerical supplementary features, text supplementary features, and local association features of the corresponding transfer object are concatenated to obtain the optimized association features of the corresponding transfer object;

[0043] Each of the aforementioned global association features is obtained by the global association module in the following manner:

[0044] Based on the fourth attention weights of each optimized association feature, the global association features of each transfer object are obtained. Each fourth attention weight represents the degree of association between the optimized association features of a transfer object and the optimized association features of all transfer objects.

[0045] Optionally, before obtaining the global association features of each transfer object based on the second attention weights of each local association feature, the global association module is further configured to:

[0046] When the number of transferred objects exceeds a set threshold, all transferred objects are sorted according to the total amount of resources transferred, and attention operations are performed on the local correlation features of the top N transferred objects, where N is a positive integer greater than or equal to 1.

[0047] Optionally, after obtaining the anomaly assessment result of the operation object, the anomaly assessment module is used to:

[0048] When the anomaly assessment result marks the operation object as an abnormal object, the resource transfer request of the operation object is intercepted, and anomaly assessment is performed on each transfer object associated with the operation object.

[0049] Thirdly, embodiments of this application also provide a computer device, including a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor performs the steps of any of the above-described anomaly assessment methods.

[0050] Fourthly, embodiments of this application also provide a computer-readable storage medium including program code, which, when the program product is run on a computer device, is used to cause the computer device to perform the steps of any of the above-described anomaly assessment methods.

[0051] Fifthly, embodiments of this application also provide a computer program product, including computer instructions, which are executed by a processor using the steps of any of the above-described anomaly assessment methods.

[0052] The beneficial effects of this application are as follows:

[0053] This application provides an anomaly assessment method, apparatus, device, and storage medium. The method includes:

[0054] This paper obtains multiple resource transfer datasets associated with the operation object to be evaluated, with each resource transfer dataset associated with one transfer object. For each resource transfer dataset, the following steps are performed: based on a resource transfer dataset, the initial transfer features of the corresponding transfer object in multiple transfer cycles are extracted. Based on the first attention weight of each initial transfer feature, the local association features of the corresponding transfer object are obtained. Each first attention weight represents the degree of association between the initial transfer features of the corresponding transfer object in one transfer cycle and the initial transfer features of all transfer cycles. By aggregating the initial transfer features of the same transfer object in different transfer cycles, this application captures the temporal dependency of transfer behavior and the dependency between features. This allows the local association features to include the correlation of the initial transfer features generated in multiple transfer cycles, learning the dynamic changes and trends of resource transfer data in the time dimension, which helps to identify key information for predicting abnormal transfers of the operation object.

[0055] Then, based on the second attention weights of each local correlation feature, the global correlation features of each transfer object are obtained. Each second attention weight represents the degree of correlation between the local correlation features of a transfer object and the local correlation features of all transfer objects. This application further aggregates the local correlation features of multiple transfer objects to deeply analyze the specific impact of transfer behavior on the operation object when different transfer objects perform transfer behavior, captures the behavior patterns of the operation object among different transfer objects, identifies the complex dependency relationship between these resource transfer data and default anomalies, and applies it to the prediction of default probability. Based on the obtained multiple global correlation features, the credit status and default anomalies of the operation object are comprehensively evaluated, improving the accuracy of anomaly assessment, enhancing the flexibility and robustness of the system, reducing default anomalies in online payment business, better managing business anomalies, and improving user experience.

[0056] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0057] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0058] Figure 1 This is an optional schematic diagram of an application scenario in the embodiments of this application;

[0059] Figure 2AThis is a schematic diagram of a process for anomaly assessment of an operational object provided in an embodiment of this application;

[0060] Figure 2B This is a schematic diagram illustrating the logic for performing anomaly evaluation on the operated object, provided in an embodiment of this application.

[0061] Figure 2C A schematic diagram illustrating the process of generating an initial transfer feature provided for an embodiment of this application;

[0062] Figure 2D A schematic diagram illustrating feature addition provided in an embodiment of this application;

[0063] Figure 2E This is a schematic diagram of the structure of a fully connected network provided in an embodiment of this application;

[0064] Figure 2F A schematic diagram of the structure of the Transformer model for a single transition object provided in an embodiment of this application;

[0065] Figure 2G A schematic diagram illustrating the process of generating a local association feature of a transfer object, provided in an embodiment of this application;

[0066] Figure 2H A logical diagram illustrating the generation of local association features of a transfer object, provided in an embodiment of this application;

[0067] Figure 2I A logical diagram illustrating the generation of query vectors, key vectors, and value vectors provided in the embodiments of this application;

[0068] Figure 2J A logical diagram illustrating attention crossover provided in an embodiment of this application;

[0069] Figure 2K A schematic diagram illustrating the process of generating a global association feature of a transfer object, provided in an embodiment of this application;

[0070] Figure 2L This is a logical diagram illustrating the anomaly evaluation of the operation object when a new feature is introduced, as provided in an embodiment of this application.

[0071] Figure 3A A schematic diagram illustrating the process of assessing user breach of contract in a dining scenario, provided as an embodiment of this application;

[0072] Figure 3B A schematic diagram illustrating the logic for assessing user breach of contract in a dining scenario, provided as an embodiment of this application.

[0073] Figure 4 This is a schematic diagram of the structure of an anomaly assessment device provided in an embodiment of this application;

[0074] Figure 5 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of this application;

[0075] Figure 6 This is a schematic diagram of the hardware structure of another computer device that applies an embodiment of this application. Detailed Implementation

[0076] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0077] The design concept of the embodiments of this application is briefly introduced below:

[0078] With the continuous advancement of science and technology and the sustained development of the economy, online payment has become an important way for people to consume in their daily lives. Whether it is shopping, dining or traveling, these payment behaviors record people's important consumption habits and reflect their spending power and credit status.

[0079] Currently, based on the experience of business experts, multi-dimensional statistics (such as the number of transactions, the amount of transactions, and the category of transactions) are often performed on the payment behavior of users to obtain multi-dimensional statistical features. These multi-dimensional statistical features are then input into the XGBoost model for training to obtain a classification model. The trained classification model then performs anomaly assessment tasks to predict the potential anomalies and default probabilities of users.

[0080] The construction method based on human experience is easily affected by subjective factors. Different people's experience and subjective judgment may lead to inconsistencies in the constructed features, lack of objective standards, and the construction of statistical features relies too much on the experience of specific individuals, which may ignore broader data and objective facts. If experts do not have a deep understanding of the business, their assessment of anomalies in constructed features will also be poor.

[0081] Secondly, features constructed based on the experience of business experts are coarse-grained and cannot effectively learn the volatility and habituality of features over time.

[0082] Furthermore, the XGBoost model is not good at fusing multiple heterogeneous features, resulting in mediocre classification performance and reduced anomaly assessment accuracy.

[0083] Therefore, to address the aforementioned issues, this application proposes an anomaly assessment method. This method includes: acquiring multiple resource transfer datasets associated with the operation object to be assessed, with each resource transfer dataset associated with one transfer object; for each resource transfer dataset, performing the following steps: based on a resource transfer dataset, extracting the initial transfer features of the corresponding transfer object across multiple transfer cycles, and obtaining the local association features of the corresponding transfer object based on the first attention weight of each initial transfer feature, where each first attention weight represents the degree of association between the initial transfer features of the corresponding transfer object in one transfer cycle and the initial transfer features of all transfer cycles; then, based on the second attention weight of each local association feature, obtaining the global association features of each transfer object, where each second attention weight represents the degree of association between the local association features of one transfer object and the local association features of all transfer objects; finally, obtaining the anomaly assessment result of the operation object based on the obtained multiple global association features.

[0084] This application captures the temporal dependency of transfer behavior and the dependency between features by aggregating the initial transfer features of the same transfer object in different transfer cycles. This allows the local correlation features to include the correlation of the initial transfer features generated in multiple transfer cycles, and learns the dynamic changes and trends of resource transfer data in the time dimension. This helps to identify key information for predicting abnormal transfers of the target object.

[0085] This application further aggregates the local correlation features of multiple transfer objects to deeply analyze the specific impact of transfer behavior on the operation object when different transfer objects are executed, captures the behavioral patterns of the operation object among different transfer objects, identifies the complex dependency relationship between these resource transfer data and default anomalies, and applies it to the prediction of default probability. Based on the obtained multiple global correlation features, it comprehensively evaluates the credit status and default anomalies of the operation object, improves the accuracy of anomaly assessment, enhances the flexibility and robustness of the system, reduces default anomalies in online payment business, better manages business anomalies, and improves the user experience.

[0086] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0087] The anomaly assessment method provided in this application can be widely applied to online payment scenarios such as shopping, dining, and travel. This method, through comprehensive analysis of multiple resource transfer datasets between the operating object and multiple transfer objects, can accurately determine whether there is a possibility of transfer anomalies during the transfer process. Once a potentially high-anomaly behavior is detected, the system will automatically activate an audit and interception mechanism to prevent these high-anomaly operations from continuing, thereby effectively reducing default anomalies in online payment transactions. This method not only improves the accuracy of anomaly identification but also enhances the system's real-time response capabilities, providing a more secure and reliable payment experience.

[0088] Figure 1 One application scenario is shown, which includes two terminal devices 110 and a server 130. The terminal devices 110 establish a communication connection with the server 130 through a wired network or a wireless network.

[0089] Among them, terminal devices 110 include, but are not limited to: mobile phones, computers (such as tablets, laptops, desktop computers, etc.), smart home appliances, smart voice interaction devices (such as smartwatches, smart speakers, etc.), vehicle terminals, aircraft, etc.

[0090] The server 130 in this application embodiment can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. This application does not impose any restrictions on these services.

[0091] When a user triggers a request on terminal device 110, terminal device 110 sends a request to server 130 to obtain relevant resources from the shopping website. These resources include webpage content, product information, images, and scripts. After receiving the request, server 130 returns the corresponding resources to terminal device 110. Terminal device 110 loads these resources, generates the shopping website page, and finally displays the complete shopping website page to the user through display screen 120.

[0092] During the browsing process, users can view various product details, prices, product reviews, and other information. They can also add products of interest to their shopping cart and adjust the quantity of products in the cart or delete unwanted products in real time as needed.

[0093] When the user completes the product selection and is ready to make payment, a payment request will be triggered on the terminal device 110. At this time, before processing the payment-related operations, the terminal device 110 will generate an exception evaluation request for the user and send it to the server 130.

[0094] After receiving an anomaly assessment request, server 130 retrieves resource transfer data of the target object over the past M days (e.g., 7 days, 30 days, etc.) from the database. This data may include the transfer amount, payment method, and historical default records of the target object. The anomaly assessment model deployed on server 130 analyzes the above data and uses machine learning algorithms to predict default anomalies when the target object undertakes new transfer activities.

[0095] Based on the anomaly assessment results from the model, server 130 will determine the default anomaly of the operation target. If the anomaly assessment results indicate that the operation target has highly abnormal behavior, such as abnormally high transfer amounts, frequent small transfers, or other suspicious activities, server 130 will issue an instruction to terminal device 110 to prohibit the current transfer behavior of the operation target. At the same time, it may also provide the operation target with further identity verification methods (such as SMS verification or facial recognition), or prompt the operation target to contact customer service to resolve potential problems.

[0096] If the anomaly assessment results indicate that the user does not exhibit any highly abnormal behavior, server 130 will issue an instruction to terminal device 110, allowing the user to continue the transfer process. Terminal device 110 will guide the user through the payment process, such as selecting a payment method and entering a payment password. After successful payment, the user will receive an order confirmation notification and view the order status on the shopping website, awaiting delivery of the goods.

[0097] Next, combined Figures 2A-2B The schematic diagram illustrates the specific process of performing anomaly assessment on the operational object to be evaluated using the method provided in the embodiments of this application.

[0098] S201: Obtain multiple resource transfer datasets associated with the operation object to be evaluated, with each resource transfer dataset associated with one transfer object.

[0099] Payment behavior not only records people's important consumption habits, but also reflects their spending power and creditworthiness. In order to comprehensively assess the creditworthiness and default anomalies of the target, the system retrieves resource transfer data generated by the target and multiple transfer targets over the past few days from the database.

[0100] This application defines resource transfer data in the following form: <operation object identifier, time of execution of transfer behavior on resource transfer product, transfer object identifier, transfer object name, resource transfer product name, transfer unit price generated by transferring resource transfer product, payment method>.

[0101] Among these, the operation object identifier is a unique number identifying the operation object, the transfer object identifier is a unique number identifying the transfer object, and the payment method is the payment method used by the operation object, such as credit card, debit card, e-wallet, etc. The time of execution of the transfer action on the resource transfer product is the precise time when the action occurred, which can be further expressed as <the month number, the day of the month, the week number, the day of the week, the hour, and the number of days between the transfer action and the assessment of the default anomaly>. This detailed definition allows for a more precise description and analysis of each resource transfer data point, providing a solid foundation for subsequent anomaly assessment and behavioral analysis.

[0102] S202: For each resource transfer dataset, perform the following: Based on a resource transfer dataset, extract the initial transfer features of the corresponding transfer object in multiple transfer cycles, and obtain the local association features of the corresponding transfer object based on the first attention weight of each initial transfer feature. Each first attention weight represents the degree of association between the initial transfer features of the corresponding transfer object in one transfer cycle and the initial transfer features of all transfer cycles.

[0103] For a sequence containing tens of thousands of resource transfer data points, it means that more preprocessing steps such as cleaning, normalization, and feature extraction are required. The significant increase in the complexity and computational cost of these operations not only increases the time cost of data processing but also easily leads to gradient vanishing or exploding problems, making it difficult for the model to converge to the optimal solution and affecting the model's training performance. Moreover, the large data stream of long sequences requires more memory and computing resources during model training and application. If hardware resources are limited, memory overflow problems can occur, significantly slowing down the training speed or even causing the model to crash and fail to operate normally.

[0104] In summary, long sequences lead to a series of problems, including increased data processing complexity, higher computational resource requirements, and the vanishing or exploding of gradients. These combined issues pose significant challenges to the model during both training and application phases, ultimately resulting in poorer evaluation performance. Therefore, effectively processing long sequences is crucial for improving model performance.

[0105] In this application, during data preprocessing, multiple resource transfer data for the same transfer object are aggregated at a fine-grained hourly level, dividing a single resource transfer dataset into multiple resource transfer data groups for multiple transfer periods. Each resource transfer data group is defined in the following form: <Operation object identifier, time range for executing transfer actions on resource transfer products, transfer object identifier, transfer object name, set of resource transfer product names, transfer frequency and amount generated within a transfer period, payment method>.

[0106] A resource transfer dataset comprises multiple resource transfer data sets from different transfer cycles, combined with... Figure 2C The flowchart shown illustrates the operations performed for each resource transfer data group to obtain the corresponding initial transfer characteristics:

[0107] S2021: Obtain a set of resource transfer data collected within a transfer cycle from a resource transfer dataset.

[0108] S2022: Extract features from the text data, time data, and numerical data in a resource transfer data set to obtain the corresponding text features, time features, and numerical features. Among them, the text data represents the basic information of the resource transfer products transferred within a transfer cycle, the time data represents the time range of the transfer behavior, and the numerical data represents the transfer frequency and the amount of transfer generated within a transfer cycle.

[0109] A resource transfer data set takes the following form: <Operation object identifier, time range for performing transfer actions on resource transfer products, transfer object identifier, transfer object name, set of resource transfer product names, transfer frequency and transfer amount performed within a transfer cycle>.

[0110] The set of resource transfer product names serves as text data, representing the basic information of the resource transfer products. The timeframe for executing transfer actions on the resource transfer products serves as time data, representing the time when the transfer actions were executed. The frequency of transfers and the resulting transfer amount within a transfer cycle serve as numerical data, representing the frequency and amount of transfer actions executed on the operating object and the corresponding transfer object within a transfer cycle.

[0111] Next, we will introduce the data processing procedures for different types of data.

[0112] (1) Feature extraction process for text data.

[0113] First, obtain a large number of resource transfer product names in text format without annotation. Define the size of the word segmentation dictionary as R (R is a positive integer greater than or equal to 1, such as the default setting R=20000, which can also be adjusted in real time according to actual business needs). Input the above text data into common word segmentation models or word segmentation tools to build a word segmentation dictionary.

[0114] Then, using the constructed word segmentation dictionary, the text data of a resource transfer data group is segmented. Each word is mapped to a unique word vector (token id), forming a word segmentation set of length R. For parts with fewer than this length, zeros are padded. For example, the word segmentation set ["I", "went", "to", "the", "bank"] is mapped to the word segmentation set [101, 102, 103, 104, 105].

[0115] Next, the word segmentation set is input into a fully connected feature mapping layer for feature extraction. The feature mapping layer undergoes a series of linear transformations and non-linear activation functions to convert the low-dimensional word vectors of R words into R higher-dimensional D-dimensional initial semantic features. Each initial semantic feature represents the semantic information of a word, helping the model better understand and learn the relationships between words. For example, the original token id "101" has initial semantic features of [0.2, 0.5, -0.1].

[0116] The same word in different positions within a sentence can have different meanings. Therefore, capturing the relative positional information of words in a sentence is crucial for understanding their contextual relationships. Furthermore, the Bidirectional Encoder Representation from Transformer (BERT) model captures the positional information of words in a sentence by introducing position embeddings. In this embodiment, the BERT model is used to perform positional encoding on the word segmentation set to obtain the D-dimensional positional features of each word. Each positional feature represents the relative positional information of a word within the word segmentation set.

[0117] like Figure 2D As shown, a positional addition method is used to fuse each initial semantic feature with its corresponding positional feature to obtain the target semantic features of each word. The output representation of each word not only contains rich semantic information but also retains its positional information in the sentence. This not only enhances the model's ability to understand word semantics but also improves its ability to capture contextual information, enabling the model to perform well in various natural language processing tasks.

[0118] Each target semantic feature is input into the corresponding Transformer model of the transfer object. Utilizing the Transformer model's attention mechanism, the dependencies between features in the input sequence are dynamically captured. By measuring the importance of different features in the input sequence and assigning different weights based on their importance, a third attention weight is obtained for each target semantic feature. Each third attention weight represents the degree of correlation between the target semantic features of a word and the target semantic features of all words. Then, based on the third attention weights of each target semantic feature, the corresponding target semantic features are weighted, and the weighted features are subjected to average pooling to obtain the text features of a resource transfer data set, i.e., the text embedding in the figure.

[0119] (2) Feature extraction process for time data.

[0120] To enhance the model's understanding and processing of time information in resource transfer datasets, the time data of a resource transfer dataset is input into a 6*D fully connected network, transforming the original low-dimensional time data into higher-dimensional D-dimensional time features, i.e., time embedding in the figure, thereby improving the model's ability to capture time series information.

[0121] Figure 2E The fully connected network shown consists of multiple layers of linear transformations and nonlinear activation functions, with each layer containing a weight matrix and a bias term. This structure allows the model to learn complex mapping relationships. Each layer performs further linear transformations and nonlinear activations on the output of the previous layer. Through this layer-by-layer propagation, the model can progressively refine and combine features from the input data, ultimately transforming the low-dimensional input into a high-dimensional feature representation. These high-dimensional features not only contain the original information of the temporal data but also capture more implicit temporal patterns and complex relationships through the model's learning process. This enables the model to better understand the behavioral patterns of the manipulated objects, identify potential abnormal behaviors, and make more accurate predictions.

[0122] (3) Feature extraction process for numerical data.

[0123] Since numerical data may have large range differences, directly using the original numerical values ​​may lead to unstable model training or poor results. Therefore, in order to better handle the numerical data in the resource transfer data set, this application first normalizes these numerical data by mapping with a log function.

[0124] Specifically, the log function y′ = ReLU(y) = max(0,y) is used to transform each numerical data y to obtain the standardized data y′. This transformation not only compresses the dynamic range of the values ​​but also makes the data distribution closer to a normal distribution, which is helpful for the subsequent model learning process.

[0125] Then, the normalized data is input into a 2*D fully connected network. Through layer-by-layer transmission, the model gradually extracts and combines features from the input data, transforming the low-dimensional numerical data into higher-dimensional D-dimensional numerical features, i.e., number embeddings in the diagram. These high-dimensional features not only contain the original information of the numerical data but also capture more implicit numerical patterns and complex relationships through the model's learning process. This enables the model to better understand the behavioral patterns of the manipulated objects, identify potential abnormal behaviors, and make more accurate predictions.

[0126] S2023: Combine text features, time features, and numerical features to obtain the initial transfer features of the operation object and the corresponding resource transfer object within a transfer cycle.

[0127] To further enhance feature quality, the initial transition features with positional encoding are input into sequence learning models such as Transformer and Long Short-Term Memory (LSTM) networks to obtain local association features between the corresponding transition objects.

[0128] The Transformer model is a sequence processing network based on an attention mechanism. It abandons the recursive structure and relies entirely on the attention mechanism to explore the relationship between input and output. It shifts from "global attention" to "local attention", allowing the feedforward neural network to focus more on important features during decoding. This not only allows for flexible capture of global and local relationships, but also enables fast parallel computation and reduces network training time.

[0129] In cognitive neuroscience, attention is an indispensable and complex cognitive function, referring to the ability to select information while focusing on others. In daily life, people receive a large amount of sensory input through sight, hearing, and touch, yet the brain can continue to function methodically despite this influx of external information. This is because the brain can consciously or unconsciously select a small portion of useful information from a large amount of input for focused processing, while ignoring other information. For example, when reading, people typically only pay attention to and process a small number of words.

[0130] Attention mechanisms originate from research on human vision. By measuring the importance of different features in the input sequence and assigning different weights according to their importance, the model has the ability to focus on some input features. With limited computing power, it allocates computing resources to more important features, effectively solving the problem of information overload.

[0131] Figure 2F The Transformer model for a single transition object shown consists of a multi-layer self-attention mechanism and a feed-forward neural network. The self-attention mechanism allows each feature in the input sequence to focus on all features in the sequence and dynamically adjust its feature representation based on the dependencies between each feature and all other features, helping the model understand the dependencies between features in the input sequence. The feed-forward neural network further processes this information. Furthermore, self-attention can be extended to obtain a multi-head attention mechanism, capturing diverse dependencies, enhancing the model's expressive power, and improving its generalization and robustness.

[0132] Combination Figures 2G-2H The diagram shown illustrates the process of generating local association features for a transfer object.

[0133] S2021': Perform linear transformations on the initial transfer features of the corresponding transfer objects in each transfer cycle to obtain the corresponding query vector, key vector, and value vector.

[0134] The self-attention mechanism includes three pre-defined weight matrices W. Q W K W V These three weight matrices are used to generate the query vector, key vector, and value vector, respectively.

[0135] The query vector represents the element of interest. It is typically associated with a specific position in the input sequence and is used to compare with the key vectors of other positions to determine which other positions' information should be of interest at that position. The key vector represents an identifier or label for each position in the input sequence. It is used to match the query vector to determine which positions' information the query vector should focus on. The value vector contains the actual content information. Once the positions that the query vector should focus on are determined, the value vector provides the specific content for those positions to generate a new representation.

[0136] Combination Figure 2I The diagram shown illustrates the initial transfer characteristics of the corresponding transfer object within a transfer cycle and the weight matrix W. Q Multiply to obtain the query vector Q; combine the initial transfer features of the corresponding transfer object within a transfer cycle with the weight matrix W.K Multiply to obtain the key vector K; combine the initial transfer features of the corresponding transfer object within a transfer cycle with the weight matrix W. V Multiplying them together yields the value vector V.

[0137] S2022': For each obtained query vector, perform the following: Based on the similarity between each key vector and a query vector, obtain the first attention weight of the corresponding initial transfer feature.

[0138] S2023': For each obtained value vector, perform the following: use the corresponding first attention weight to weight a value vector to obtain the corresponding target transfer feature.

[0139] Figure 2J This illustration provides an example of attention crossover in an embodiment of this application. For each query vector, the following steps are performed: Each 8*1 key vector is compared with a 1*8 query vector to calculate multiple 1*1 similarity values. These similarity values ​​are then concatenated to obtain an 8*1 first attention weight. Each weight value represents the degree of association between a key vector and a query vector. The 8*1 weight values ​​are then weighted and summed with the value vector associated with the query vector to obtain the target transfer feature of the transfer object. This application employs an attention mechanism that dynamically allocates weights, assigning high weights to vectors with high similarity and low weights to vectors with low similarity. This allows the model to focus on more important features and ignore less important features, thereby improving model performance.

[0140] Resource transfer datasets involving the same object are typically distributed across different time periods. Inputting initial transfer features extracted from these different time periods into a Transformer model allows for the capture of temporal dependencies between resource transfer data and dependencies within features. For example, a user's consumption frequency, amount, and payment method may vary over time; the Transformer model can learn these temporal patterns and apply them to the prediction of default anomalies.

[0141] S2024': Aggregate the obtained multiple target transfer features to obtain the local association features of the corresponding transfer objects.

[0142] Through multi-layered self-attention mechanisms and feedforward neural networks, the model generates richer local correlation features. These features not only contain the original information recorded in the resource transfer data but also capture more implicit patterns and complex relationships through model learning. This enhances the model's ability to understand the transfer behavior between the operating object and the same transfer object, helping to identify key information and understand the operating object's consumption habits or potential high-abnormal behavior within a specific time period, such as which time periods have the greatest impact on default anomalies.

[0143] S203: Based on the second attention weight of each local association feature, obtain the global association feature of each transfer object. Each second attention weight represents the degree of association between the local association feature of a transfer object and the local association features of all transfer objects.

[0144] Operational objects typically engage in transfer activities with multiple transfer objects. The resulting resource transfer data is widely distributed and diverse. By inputting the local correlation features of each of these transfer objects into a Transformer model, the model learns the operational object's behavioral patterns across different transfer objects, captures the feature dependencies between them, understands the operational object's consumption behavior and preferences at different transfer objects, and applies this knowledge to the prediction of default anomalies. For example, a user's spending habits at merchant A differ significantly from their spending habits at merchant B. The user transacts more frequently with merchant A, primarily using credit cards, while transactions with merchant B involve larger sums, primarily using debit cards.

[0145] Similar to the steps for extracting target transfer features using an attention mechanism, this application performs the following steps for each query vector: First, it performs vector calculations on each 8*1 key vector and a 1*8 query vector to obtain multiple 1*1 similarity values. These multiple similarity values ​​are then concatenated to obtain an 8*1 second attention weight, where each weight represents the degree of association between a key vector and a query vector. Next, the 8*1 weight values ​​are weighted and summed with the value vector associated with the query vector to obtain the global association features of the transfer object. This application employs an attention mechanism to dynamically allocate weights, assigning high weights to vectors with high similarity and low weights to vectors with low similarity. This allows the model to focus on more important features and ignore less important ones, thereby improving model performance.

[0146] As sequence length increases, the computational complexity of the model also increases significantly. This is especially true in self-attention mechanisms, where calculating attention weights requires performing a dot product operation between the features at each position and the features at all positions, significantly increasing memory consumption and easily leading to memory overflow issues. Furthermore, excessively long sequences result in extremely large attention matrices, increasing the computational burden and potentially preventing the attention mechanism from effectively focusing on key information, thus impacting model performance. Processing long sequences takes more time, posing a significant challenge for applications requiring real-time responses.

[0147] Therefore, before performing step 203, when the number of transferred objects exceeds a set threshold, this application sorts all transferred objects according to the total amount of resource transfer, selects the local association features of the top N transferred objects for attention operation, where N is a positive integer greater than or equal to 1.

[0148] Combination Figure 2K The diagram shown illustrates the process of generating global association features for a transfer object.

[0149] S2031: Perform linear transformations on the local association features of each transferred object to obtain the corresponding query vector, key vector, and value vector;

[0150] S2032: For each obtained query vector, perform the following: Based on the similarity between each key vector and a query vector, obtain the second attention weight of the corresponding local association feature;

[0151] S2033: For each obtained value vector, perform the following: use the corresponding second attention weight to weight a value vector to obtain the global association features of the corresponding transfer object.

[0152] The local association features of each transfer object are input into the Transformer model. Based on three preset weights of the self-attention mechanism, the local association features are linearly transformed to obtain the corresponding query vector, key vector, and value vector. Then, by performing an attention cross-operation on the query vector and key vector, it is determined which positions of information the query vector should focus on. Finally, a weighted sum is performed on the value vector to generate the global association features of the corresponding transfer object.

[0153] Different features often represent different unread information. To enable the model to capture more dimensions of information, better understand the content and structure of the data, and enhance the model's performance, this application, after obtaining the local association features of the corresponding transfer objects, also extracts features from the total transfer amount and total transfer frequency of the operation object and the corresponding transfer object in multiple transfer cycles to obtain numerical supplementary features. Additionally, it extracts features from the object name of the corresponding transfer object to obtain text supplementary features. The numerical supplementary features, text supplementary features, and local association features of the corresponding transfer object are then concatenated to obtain the optimized association features of the corresponding transfer object. The methods for feature extraction for numerical data and for text data have been described previously and will not be repeated here.

[0154] Furthermore, such as Figure 2L As shown, based on the fourth attention weights of each optimized correlation feature, the global correlation features of each transfer object are obtained. Each fourth attention weight represents the degree of correlation between the optimized correlation features of a transfer object and the optimized correlation features of all transfer objects.

[0155] S204: Perform anomaly assessment based on multiple globally related features to obtain the anomaly assessment results of the operation object.

[0156] Although a Transformer model across multiple transfer objects is used to fuse feature representations of these objects, problems remain, such as a lack of interpretability, difficulty in targeted optimization, and difficulty in identifying potential issues, because the weights of different transfer objects in the abnormal evaluation results cannot be intuitively displayed. To address these issues, this application adds a Vit attention module to the front end of the Transformer model across multiple transfer objects. Through a pre-defined evaluation feature in this module, namely the CLS token in the diagram, the weights of multiple transfer objects are aggregated, resulting in a model with higher interpretability and practical application value.

[0157] This improvement not only enables the model to generate accurate anomaly assessment results, but also clearly demonstrates the contribution of each transition object to the prediction results, helping users to better understand and trust the model's output. This is particularly important for application scenarios such as anomaly assessment, and can effectively improve the model's practicality and reliability.

[0158] Preset evaluation features are obtained from the trained anomaly evaluation model. These preset evaluation features are used to evaluate the probability of a transfer anomaly occurring when the operation object performs a transfer behavior.

[0159] In the initial stages of building the anomaly assessment model, a preset assessment feature is set within the model. Initially, the feature value of this feature is randomly assigned. During training, the model continuously adjusts all parameters, including the feature value of the preset assessment feature, through the backpropagation algorithm to optimize model performance. Finally, when the model training is complete, this feature value will converge to a fixed value. When a new round of iterative training is initiated, the preset assessment feature is also updated accordingly.

[0160] Using a Transformer encoder, vector calculations are performed on multiple globally correlated features and preset evaluation features to obtain the similarity between each globally correlated feature and the preset evaluation feature. Then, based on the similarity between the multiple globally correlated features and the preset evaluation feature, weights are dynamically assigned: high weights are given to vectors with high similarity, and low weights are given to vectors with low similarity. Finally, the preset evaluation features are weighted and dynamically adjusted to obtain the corresponding target evaluation features.

[0161] The target evaluation features are input into a classifier for anomaly assessment, obtaining anomaly assessment results indicating that the predicted operation object will experience a transfer anomaly during the execution of the transfer behavior. The global association features of each transfer object output by the Transformer model across transfer objects, combined with the optimized target evaluation features, serve as a representation of the correlation between whether the operation object has a default anomaly and the degree of association with different transfer objects. This makes the model interpretable, clearly demonstrating the contribution of each transfer object to the prediction results, helping users better understand and trust the model's output.

[0162] When the anomaly assessment results mark the operation object as an anomaly object with high anomaly behavior, in addition to intercepting the operation object's resource transfer request and further managing the operation object itself, anomaly assessments can also be performed on each transfer object closely related to the operation object to identify potential anomaly sources and prevent the anomaly from spreading among the transfer objects.

[0163] Among these, highly unusual behaviors include, but are not limited to: frequent large transactions, unusual transaction patterns, a sudden increase in transaction frequency, and transactions involving highly unusual regions.

[0164] For transfer targets exhibiting high anomalies, measures such as reducing transaction limits, adding review processes, and suspending certain types of transactions will be implemented to restrict transactions. More stringent real-time monitoring will be conducted to promptly detect and address any suspicious transactions. Information on high-anomaly transfer targets can also be shared with other platforms to jointly implement preventative measures. For transfer targets exhibiting low to medium anomalies, periodic reviews can be conducted to ensure their business activities remain normal.

[0165] The anomaly assessment method provided in this application can be widely applied in online payment scenarios such as shopping, dining, and travel. This method, through comprehensive analysis of multiple resource transfer datasets between the operating object and multiple transfer objects, can accurately determine whether there is a possibility of transfer anomalies when the operating object performs transfer behavior. Once a potentially high-anomaly behavior is detected, the system will automatically activate the review and interception mechanism. In addition to further managing the operating object itself, it can also perform anomaly assessments on each transfer object closely related to the operating object, identify potential sources of anomalies, and prevent the spread of anomalies among the transfer objects.

[0166] Combination Figures 3A-3B The diagram illustrates how, using the method provided in this application, a user's transaction history with multiple restaurant merchants over the past few days is used to assess the likelihood of the user committing an abnormal breach of contract.

[0167] S301: Obtain multiple transaction records of a user with 3 merchants in the past 5 days, and aggregate multiple transaction records of the same merchant in fine granularity by day. Each merchant corresponds to 5 sets of transaction data. One set of transaction data is defined in the following form: <User, January 17, Merchant 1, 001, Steamed buns, dumplings, 2 times, 20 yuan>.

[0168] S302: For each merchant, perform the following: extract features from the five sets of transaction data to obtain their respective initial transition features, and input the obtained initial transition features into the Transformer model of a single merchant to obtain the local association features of the corresponding merchant.

[0169] S303: For each merchant, perform the following: extract features from the total transaction amount and total transaction frequency of the corresponding merchant in the past 5 days to obtain numerical supplementary features, and extract features from the merchant name of the corresponding merchant to obtain text supplementary features; concatenate the numerical supplementary features, text supplementary features and local correlation features of the corresponding merchant to obtain the optimized correlation features of the corresponding merchant.

[0170] S304: Input the optimized association features of multiple merchants into the cross-merchant Transformer model to obtain the global association features of each merchant.

[0171] S305: Input multiple global correlation features into the Vit attention module, dynamically assign weights based on the similarity between the multiple global correlation features and the preset evaluation features in the module, and weight the preset evaluation features to obtain the corresponding target evaluation features;

[0172] S306: Input the target evaluation features into the classifier to perform anomaly evaluation and obtain the anomaly evaluation result that predicts the user's default anomaly during the transaction.

[0173] Furthermore, it should be noted that in the specific implementation of this application, multiple resource transfer datasets and other related object data associated with the object of the collection operation are involved. When the above embodiments of this application are applied to specific products or technologies, permission or consent from the object is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0174] Based on the same inventive concept as the above-described method embodiments, this application also provides an anomaly assessment device. For example... Figure 4 As shown, the anomaly assessment device 400 may include:

[0175] Data acquisition module 401 is used to acquire multiple resource transfer datasets associated with the operation object to be evaluated, with each resource transfer dataset associated with one transfer object;

[0176] The local association module 402 is used to perform the following for each resource transfer dataset: Based on a resource transfer dataset, extract the initial transfer features of the corresponding transfer object in multiple transfer cycles, and obtain the local association features of the corresponding transfer object based on the first attention weight of each initial transfer feature. Each first attention weight represents the degree of association between the initial transfer features of the corresponding transfer object in one transfer cycle and the initial transfer features of all transfer cycles.

[0177] The global association module 403 is used to obtain the global association features of each transfer object based on the second attention weight of each local association feature. Each second attention weight represents the degree of association between the local association features of a transfer object and the local association features of all transfer objects.

[0178] The anomaly assessment module 404 is used to perform anomaly assessment based on multiple globally related features obtained, and to obtain the anomaly assessment result of the operation object.

[0179] Optionally, the local association module 402 is used for:

[0180] The initial transfer characteristics of the corresponding transfer objects in each transfer cycle are linearly transformed to obtain the corresponding query vector, key vector and value vector;

[0181] For each obtained query vector, perform the following: based on the similarity between each key vector and a query vector, obtain the first attention weight of the initial transfer feature;

[0182] For each obtained value vector, the following steps are performed: weighting a value vector using the corresponding first attention weight to obtain the corresponding target transfer feature;

[0183] The obtained multiple target transfer features are aggregated to obtain the local association features of the corresponding transfer objects.

[0184] Optionally, the initial transfer characteristics for each transfer cycle are obtained by the local association module 402 in the following manner:

[0185] Extract a set of resource transfer data collected within a transfer cycle from a resource transfer dataset;

[0186] Feature extraction is performed on text data, time data, and numerical data in a resource transfer data set to obtain corresponding text features, time features, and numerical features. Among them, text data represents the basic information of the resource transfer products transferred within a transfer cycle, time data represents the time range of the transfer behavior, and numerical data represents the transfer frequency and the amount of transfer generated within a transfer cycle.

[0187] By combining text features, time features, and numerical features, the initial transfer features of the operation object and the corresponding resource transfer object within a transfer cycle are obtained.

[0188] Optionally, the textual features of a resource transfer data set are obtained by the local association module 402 in the following manner:

[0189] Perform word segmentation on the text data of a resource transfer data group to obtain a word segmentation set;

[0190] Feature extraction is performed on the word segmentation set to obtain the initial semantic features of each word in the word segmentation set. Additionally, position encoding is performed on the word segmentation set to obtain the position features of each word. Each position feature represents the relative position information of a word in the word segmentation set.

[0191] Each initial semantic feature is fused with its corresponding positional feature to obtain the target semantic features of each word.

[0192] Based on the third attention weights of each target semantic feature, the text features of a resource transfer data set are obtained. Each third attention weight represents the degree of correlation between the target semantic features of a word and the target semantic features of all words.

[0193] Optionally, the global association module 403 is used for:

[0194] Perform linear transformations on the local association features of each transfer object to obtain the corresponding query vector, key vector, and value vector;

[0195] For each obtained query vector, the following steps are performed: based on the similarity between each key vector and a query vector, a second attention weight for a local association feature is obtained;

[0196] For each obtained value vector, the following steps are performed: weighting a value vector using the corresponding second attention weight to obtain the global association features of the corresponding transfer object.

[0197] Optionally, the anomaly assessment module 404 is used for:

[0198] Obtain preset evaluation features; preset evaluation features are used to evaluate the probability of a transfer anomaly occurring when the operation object performs a transfer behavior;

[0199] Based on the similarity between multiple global correlation features and preset evaluation features, the preset evaluation features are dynamically adjusted to obtain the corresponding target evaluation features;

[0200] Anomaly assessment is performed based on target evaluation features to obtain anomaly assessment results for predicted operation objects that may experience transfer anomalies when performing transfer behaviors.

[0201] Optionally, after obtaining the local association features of the corresponding transfer object, the global association module 403 is further used to:

[0202] Feature extraction is performed on the total amount and frequency of transfers of the operation object and the corresponding transfer object in multiple transfer cycles to obtain numerical supplementary features; and feature extraction is performed on the object name of the corresponding transfer object to obtain text supplementary features.

[0203] The numerical supplementary features, text supplementary features, and local association features of the corresponding transfer object are concatenated to obtain the optimized association features of the corresponding transfer object;

[0204] Each global association feature is obtained by the global association module 403 in the following way:

[0205] Based on the fourth attention weights of each optimized correlation feature, the global correlation features of each transfer object are obtained. Each fourth attention weight represents the degree of correlation between the optimized correlation features of a transfer object and the optimized correlation features of all transfer objects.

[0206] Optionally, before obtaining the global association features of each transfer object based on the second attention weights of each local association feature, the global association module 403 is further configured to:

[0207] When the number of transferred objects exceeds a set threshold, all transferred objects are sorted according to the total amount of resources transferred, and attention operations are performed on the local correlation features of the top N transferred objects, where N is a positive integer greater than or equal to 1.

[0208] Optionally, after obtaining the anomaly assessment result of the operation object, the anomaly assessment module 404 is used to:

[0209] When the anomaly assessment result marks the operation object as an anomaly object, the resource transfer request of the operation object is intercepted, and anomaly assessment is performed on each transfer object associated with the operation object.

[0210] For ease of description, the above sections are divided into modules (or units) according to their functions and described separately. Of course, in implementing this application, the functions of each module (or unit) can be implemented in one or more software or hardware components.

[0211] Having introduced the anomaly evaluation method and apparatus according to exemplary embodiments of this application, we will now introduce a computer device according to another exemplary embodiment of this application.

[0212] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0213] Based on the same inventive concept as the above-described method embodiments, this application also provides a computer device. In one embodiment, the computer device may be a server, such as... Figure 1 The server 130 is shown. In this embodiment, the computer device is structured as follows: Figure 5 As shown, it may include at least a memory 501, a communication module 503, and at least one processor 502.

[0214] The memory 501 is used to store computer programs executed by the processor 502. The memory 501 may mainly include a program storage area and a data storage area. The program storage area may store the operating system and programs required to run instant messaging functions, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0215] Memory 501 may be volatile memory, such as random-access memory (RAM); memory 501 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 501 may be any other medium capable of carrying or storing a desired computer program having the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 501 may be a combination of the above-described memories.

[0216] Processor 502 may include one or more central processing units (CPUs) or digital processing units, etc. Processor 502 is used to implement the above-described exception evaluation method when calling computer programs stored in memory 501.

[0217] The communication module 503 is used to communicate with terminal devices and other servers.

[0218] This application embodiment does not limit the specific connection medium between the memory 501, communication module 503, and processor 502 described above. This application embodiment... Figure 5 The memory 501 and the processor 502 are connected via a bus 504, and the bus 504 is in Figure 5 The diagram uses thick lines to describe the connections between other components; these are for illustrative purposes only and should not be considered limiting. The 504 bus can be divided into address bus, data bus, control bus, etc. For ease of description, Figure 5 It is described using only a thick line, but does not indicate that there is only one bus or one type of bus.

[0219] The memory 501 stores a computer storage medium, which stores computer-executable instructions for implementing the anomaly assessment method of this application embodiment. The processor 502 is used to execute the above-described anomaly assessment method, such as... Figure 2A As shown.

[0220] In another embodiment, the computer device can also be other computer devices, such as... Figure 1 The terminal device 110 is shown. In this embodiment, the structure of the computer device can be as follows: Figure 6 As shown, it includes components such as a communication component 610, a memory 620, a display unit 630, a camera 640, a sensor 650, an audio circuit 660, a Bluetooth module 670, and a processor 680.

[0221] The communication component 610 is used to communicate with the server. In some embodiments, it may include a Wireless Fidelity (WiFi) module, which is a short-range wireless transmission technology, and the electronic device can send and receive information through the WiFi module.

[0222] The memory 620 can be used to store software programs and data. The processor 680 executes various functions of the terminal device 110 and performs data processing by running the software programs or data stored in the memory 620. The memory 620 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. The memory 620 stores an operating system that enables the terminal device 110 to run. In this application, the memory 620 may store the operating system and various application programs, and may also store a computer program that executes the anomaly evaluation method of the embodiments of this application.

[0223] The display unit 630 can also be used to display information input by the object or information provided to the object, as well as a graphical user interface (GUI) of various menus of the terminal device 110. Specifically, the display unit 630 may include a display screen 632 disposed on the front of the terminal device 110. The display screen 632 may be configured as a liquid crystal display, a light-emitting diode, or the like. The display unit 630 can be used to display shopping website pages, anomaly evaluation results, etc., as shown in the embodiments of this application.

[0224] The display unit 630 can also be used to receive input digital or character information and generate signal inputs related to object settings and function control of the terminal device 110. Specifically, the display unit 630 may include a touch screen 631 disposed on the front of the terminal device 110, which can collect touch operations on or near the object, such as clicking a button, dragging a scroll bar, etc.

[0225] The touchscreen 631 can be placed on top of the display screen 632, or the touchscreen 631 and the display screen 632 can be integrated to realize the input and output functions of the terminal device 110. After integration, it can be referred to as a touch display screen. In this application, the display unit 630 can display the application and the corresponding operation steps.

[0226] Camera 640 can be used to capture still images, and objects can publish images captured by camera 640 through an application. There can be one or multiple cameras 640. An object generates an optical image through a lens, which is projected onto a photosensitive element. The photosensitive element can be a charge-coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the light signal into an electrical signal, which is then transmitted to processor 680 to be converted into a digital image signal.

[0227] The terminal device may also include at least one sensor 650, such as an accelerometer 651, a proximity sensor 652, a fingerprint sensor 653, and a temperature sensor 654. The terminal device may also be equipped with other sensors such as a gyroscope, barometer, hygrometer, thermometer, infrared sensor, light sensor, and motion sensor.

[0228] Audio circuitry 660, speaker 661, and microphone 662 provide an audio interface between the device and terminal device 110. Audio circuitry 660 converts received audio data into electrical signals, which are then transmitted to speaker 661, where they are converted into sound signals for output. Terminal device 110 may also be equipped with volume buttons for adjusting the volume of the sound signal. Conversely, microphone 662 converts collected sound signals into electrical signals, which are then received by audio circuitry 660, converted back into audio data, and output to communication component 610 for transmission to, for example, another terminal device 110, or to memory 620 for further processing.

[0229] The Bluetooth module 670 is used to interact with other Bluetooth devices that also have a Bluetooth module via the Bluetooth protocol. For example, a terminal device can establish a Bluetooth connection with a wearable electronic device (such as a smartwatch) that also has a Bluetooth module through the Bluetooth module 670, thereby exchanging data.

[0230] The processor 680 is the control center of the terminal device, connecting various parts of the terminal through various interfaces and lines. It executes various functions and processes data by running or executing software programs stored in the memory 620 and calling data stored in the memory 620. In some embodiments, the processor 680 may include one or more processing units; the processor 680 may also integrate an application processor and a baseband processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the baseband processor mainly handles wireless communication. It is understood that the baseband processor may not be integrated into the processor 680. In this application, the processor 680 can run the operating system, applications, user interface display and touch response, as well as the anomaly evaluation method of the embodiments of this application. Furthermore, the processor 680 is coupled to the display unit 630.

[0231] In some possible implementations, various aspects of the anomaly assessment method provided in this application can also be implemented in the form of a program product, which includes a computer program. When the program product is run on a computer device, the computer program causes the computer device to perform the steps in the anomaly assessment method according to the various exemplary embodiments of this application described above. For example, the computer device can perform actions such as... Figure 2A The steps are shown in the figure.

[0232] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0233] The program product of the embodiments of this application may employ a portable compact disc read-only memory (CD-ROM) and include a computer program, and may run on an electronic device. However, the program product of this application is not limited thereto. In this document, the readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with a command execution system, apparatus, or device.

[0234] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a readable computer program. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with a command execution system, apparatus, or device.

[0235] Computer programs contained on readable media may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0236] Computer programs for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The computer program can execute entirely on the user's computer device, partially on the user's computer device, as a standalone software package, partially on the user's computer device and partially on a remote computer device, or entirely on a remote computer device. In cases involving remote computer devices, the remote computer device can be connected to the user's computer device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer device (e.g., via the Internet using an Internet service provider).

[0237] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0238] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0239] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing a computer-usable computer program.

[0240] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce a machine for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0241] These computer program commands may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the commands stored in the computer-readable storage medium produce an article of manufacture including command means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0242] These computer program commands can also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing the commands executed on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0243] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0244] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An anomaly assessment method, characterized in that, include: Obtain multiple resource transfer datasets associated with the operation object to be evaluated, with each resource transfer dataset associated with one transfer object; For each resource transfer dataset, the following steps are performed: Based on a resource transfer dataset, the initial transfer features of the corresponding transfer objects in multiple transfer cycles are extracted, and based on the first attention weight of each initial transfer feature, the local association features of the corresponding transfer objects are obtained. Each first attention weight represents the degree of association between the initial transfer features of the corresponding transfer object in one transfer cycle and the initial transfer features of all transfer cycles. Based on the second attention weight of each local association feature, the global association feature of each transfer object is obtained. Each second attention weight represents the degree of association between the local association feature of a transfer object and the local association features of all transfer objects. Anomaly assessment is performed based on multiple globally related features to obtain the anomaly assessment result of the operation object.

2. The method as described in claim 1, characterized in that, The process of obtaining the local association features of the corresponding transfer object based on the first attention weight of each initial transfer feature includes: The initial transfer characteristics of the corresponding transfer objects in each transfer cycle are linearly transformed to obtain the corresponding query vector, key vector and value vector; For each obtained query vector, the following steps are performed: based on the similarity between each key vector and a query vector, the first attention weight of the corresponding initial transfer feature is obtained; For each obtained value vector, the following steps are performed: weighting a value vector using the corresponding first attention weights to obtain the corresponding target transfer features; The obtained multiple target transfer features are aggregated to obtain the local association features of the corresponding transfer objects.

3. The method as described in claim 1, characterized in that, Based on a resource transfer dataset, the initial transfer features of the operation object in multiple transfer cycles are extracted; wherein, the initial transfer features of each transfer cycle are obtained in the following manner: From the aforementioned resource transfer dataset, obtain a set of resource transfer data collected within a transfer cycle; Feature extraction is performed on the text data, time data, and numerical data in the resource transfer data group to obtain corresponding text features, time features, and numerical features. The text data represents the basic information of the resource transfer products transferred within a transfer cycle. The time data represents the time range of the transfer behavior. The numerical data represents the transfer frequency and the amount of transfer generated within a transfer cycle. By concatenating text features, time features, and numerical features, the initial transfer features of the operation object and the corresponding resource transfer object within the transfer cycle are obtained.

4. The method as described in claim 3, characterized in that, The textual features of the resource transfer data group are obtained in the following manner: The text data of the resource transfer data group is segmented to obtain a segmentation set; Feature extraction is performed on the word segmentation set to obtain the initial semantic features of each word in the word segmentation set; and position encoding is performed on the word segmentation set to obtain the position features of each word. Each position feature represents the relative position information of a word in the word segmentation set. Each initial semantic feature is fused with its corresponding positional feature to obtain the target semantic features of each word. Based on the third attention weight of each target semantic feature, the text features of the resource transfer data group are obtained. Each third attention weight represents the degree of correlation between the target semantic features of a word and the target semantic features of all words.

5. The method as described in claim 1, characterized in that, The process of obtaining the global association features of each transfer object based on the second attention weights of each local association feature includes: Perform linear transformations on the local association features of each transfer object to obtain the corresponding query vector, key vector, and value vector; For each obtained query vector, the following steps are performed: based on the similarity between each key vector and a query vector, the second attention weight of the corresponding local association feature is obtained; For each obtained value vector, the following steps are performed: the corresponding second attention weight is applied to weight the value vector to obtain the global association features of the corresponding transfer object.

6. The method according to any one of claims 1-5, characterized in that, The anomaly assessment based on multiple globally related features to obtain the anomaly assessment result of the operation object includes: Obtain preset evaluation features; the preset evaluation features are used to evaluate the probability that the operation object will experience a transfer anomaly when performing a transfer behavior; Based on the similarity between the multiple global association features and the preset evaluation features, the preset evaluation features are dynamically adjusted to obtain the corresponding target evaluation features; Anomaly assessment is performed based on the target assessment features to obtain an anomaly assessment result that predicts the occurrence of a transfer anomaly when the operation object performs a transfer behavior.

7. The method according to any one of claims 1-5, characterized in that, After obtaining the local association features of the corresponding transfer object, the following is also included: Feature extraction is performed on the total amount and total frequency of transfers of the operation object and the corresponding transfer object in multiple transfer cycles to obtain numerical supplementary features; and feature extraction is performed on the object name of the corresponding transfer object to obtain text supplementary features. The numerical supplementary features, text supplementary features, and local association features of the corresponding transfer object are concatenated to obtain the optimized association features of the corresponding transfer object; Each of the aforementioned global association features is obtained in the following manner: Based on the fourth attention weights of each optimized association feature, the global association features of each transfer object are obtained. Each fourth attention weight represents the degree of association between the optimized association features of a transfer object and the optimized association features of all transfer objects.

8. The method as described in claim 5, characterized in that, Before obtaining the global association features of each transfer object based on the second attention weights of each local association feature, the process also includes: When the number of transferred objects exceeds a set threshold, all transferred objects are sorted according to the total amount of resources transferred, and attention operations are performed on the local correlation features of the top N transferred objects, where N is a positive integer greater than or equal to 1.

9. The method according to any one of claims 1-5, characterized in that, After obtaining the anomaly assessment result of the operation object, the following is also included: When the anomaly assessment result marks the operation object as an abnormal object, the resource transfer request of the operation object is intercepted, and anomaly assessment is performed on each transfer object associated with the operation object.

10. An image retrieval device, characterized in that, include: The data acquisition module is used to acquire multiple resource transfer datasets associated with the operation object to be evaluated, with each resource transfer dataset associated with one transfer object; The local association module is used to perform the following for each resource transfer dataset: Based on a resource transfer dataset, extract the initial transfer features of the corresponding transfer object in multiple transfer cycles, and obtain the local association features of the corresponding transfer object based on the first attention weight of each initial transfer feature. Each first attention weight represents the degree of association between the initial transfer features of the corresponding transfer object in one transfer cycle and the initial transfer features of all transfer cycles. The global association module is used to obtain the global association features of each transfer object based on the second attention weight of each local association feature. Each second attention weight represents the degree of association between the local association features of a transfer object and the local association features of all transfer objects. The anomaly assessment module is used to perform anomaly assessment based on multiple globally related features obtained, and to obtain the anomaly assessment result of the operation object.

11. A computer device, characterized in that, It includes a processor and a memory, wherein the memory stores program code that, when executed by the processor, causes the processor to perform the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, It includes program code that, when run on a computer device, causes the computer device to perform the steps of the method according to any one of claims 1 to 9.

13. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1 to 9.

Images