Fraud account identification method and system based on feature engineering and XGBoost

Abstract

The application discloses a fraud account identification method and system based on feature engineering and XGBoost, and belongs to the field of financial technology and information security. The method comprises the following steps: obtaining transaction flow data of a target account and preprocessing the transaction flow data to obtain a standard transaction sequence; based on a preset time window, the standard transaction sequence is divided to construct multiple sample units, and each sample unit is labeled; the explicit business behavior features and time sequence statistical features of the transaction flow data in each sample unit are extracted and fused, and the fused features are screened to obtain a target feature set; the target feature set and the corresponding label are used to train an XGBoost classification model to obtain a fraud risk identification model; the transaction flow data of an account to be identified is input into the fraud risk identification model, and the fraud risk probability and level of the account are output, and the importance scores of the features are output. The application improves the accuracy, robustness and interpretability of the fraud suspect account identification.

Description

Technical Field

[0001] This invention belongs to the field of financial technology and information security technology, specifically relating to a method and system for identifying fraudulent accounts based on feature engineering and XGBoost. Background Technology

[0002] With the rapid development of financial technology, illegal and criminal activities such as telecommunications and internet fraud are occurring frequently, posing a serious threat to public property security and financial order. Accurate and efficient identification of accounts belonging to suspected fraudsters is a crucial step in cutting off the fraudulent funding chain and implementing countermeasures.

[0003] In existing technologies, the identification of fraudulent accounts mainly relies on two types of methods: First, identification methods based on manually preset rules, such as setting hard indicators like transaction frequency and amount thresholds. These methods depend on expert experience, have long rule-making cycles, and struggle to cope with the rapidly changing transaction patterns of fraudsters, resulting in low identification accuracy, high false positive rates, and weak generalization ability. Second, identification methods based on traditional machine learning models, such as those disclosed in some patents and papers using algorithms like XGBoost to build risk identification models. However, existing solutions generally suffer from the following technical shortcomings: 1. Limited feature mining dimensions: Most solutions rely on only a small number of basic statistical features or human experience features, failing to fully explore the deep and non-linear time-series patterns contained in transaction flows, resulting in insufficient ability of the model to characterize complex abnormal patterns.

[0004] 2. Poor scenario adaptability: Existing solutions are mostly general-purpose risk identification, which do not fully consider the essential differences in transaction behavior patterns between personal ordinary accounts and corporate operating accounts. They adopt a "one-size-fits-all" model structure, which affects the accuracy of identification in specific scenarios.

[0005] 3. Weak interpretability: Many models are “black boxes” and cannot output the key evidence that leads to high-risk judgments, making it difficult to meet the practical needs of risk control business for manual review and traceability of decision results.

[0006] 4. Low standardization: The lack of a standardized and reusable technical process from data preprocessing to feature engineering, and then to model training and deployment results in high secondary development costs when the technical solution is implemented in different institutions or scenarios.

[0007] Therefore, how to provide a method for identifying accounts of suspected fraudsters that has high recognition accuracy, strong adaptability to different scenarios, interpretable results, and is easy to scale up has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0008] The purpose of this invention is to provide a method and system for identifying fraudulent accounts based on feature engineering and XGBoost. By combining manual business features with automated time-series statistical features, a scenario-based gradient boosting decision tree model is constructed to improve the accuracy, robustness, and interpretability of identifying suspected fraudulent accounts.

[0009] In a first aspect, the present invention provides a method for identifying fraudulent accounts based on feature engineering and XGBoost, comprising the following steps: Obtain the raw transaction data of the target account and preprocess the raw transaction data to obtain a standard transaction sequence; Based on a preset time window, the standard trading sequence is divided into multiple sample units, and each sample unit is labeled with a label to indicate whether it is a high-risk account or a normal account. Feature extraction is performed on the transaction flow data within each sample unit to obtain explicit business behavior features and time-series statistical features in multiple dimensions. Specifically, based on preset abnormal fund flow behavior rules, explicit business behavior features in multiple dimensions are extracted from the transaction flow data; and an automated time-series feature extraction tool is used to generate time-series statistical features in multiple dimensions from the transaction flow data. The explicit business behavior features are fused with time-series statistical features, and the fused features are then filtered to obtain the target feature set. Using the target feature set and the corresponding labels, an XGBoost classification model is trained to obtain a fraud risk identification model. The transaction data of the account to be identified is input into the fraud risk identification model, which outputs the probability and risk level of fraud risk of the account, and outputs the importance score of each feature based on the XGBoost classification model.

[0010] As an alternative implementation method, explicit business behavior characteristics include one or more of the following: small-amount exploratory behavior characteristics, large-amount abnormal characteristics, abnormal capital turnover characteristics, transaction characteristics during unusual periods, abnormal balance characteristics, and counterparty account concentration characteristics.

[0011] As an alternative implementation method, the automated time series feature extraction tool is the TSFresh tool, which generates time series statistical features including time domain features, frequency domain features, autocorrelation features, and interval distribution features of transaction amounts.

[0012] As an alternative implementation method, the fused features are screened, specifically including: calculating the importance contribution score of each feature based on the model pre-training results, and selecting features whose cumulative contribution reaches a first preset percentage in descending order of contribution score to form a target feature set.

[0013] As an alternative implementation method, the target account types include ordinary personal accounts and operating company accounts; for operating company accounts, explicit business behavior characteristics further include one or more exclusive characteristics among corporate transaction ratio, upstream and downstream concentration, bill matching degree, holiday transaction ratio, and fund settlement cycle.

[0014] As an alternative implementation, an XGBoost classification model is trained using a target feature set and corresponding labels, and further includes adaptively adjusting the sample balancing weight parameters in the XGBoost classification model according to the sample distribution of the target account type.

[0015] As an optional implementation, the risk identification step also includes configuring a dynamically adjustable risk judgment threshold, which includes a first threshold corresponding to the high accuracy priority mode and a second threshold corresponding to the high recall priority mode.

[0016] Secondly, the present invention provides a fraudulent account identification system based on feature engineering and XGBoost, comprising: The data acquisition and preprocessing module is configured to: acquire the raw transaction data of the target account and preprocess the raw transaction data to obtain a standard transaction sequence; The sample construction module is configured to: divide the standard trading sequence based on a preset time window, construct multiple sample units, and label each sample unit with a label used to indicate high-risk or normal accounts; The feature extraction module is configured to: extract features from the transaction flow data within each sample unit to obtain multiple dimensions of explicit business behavior features and multiple dimensions of time-series statistical features. Specifically, it extracts multiple dimensions of explicit business behavior features from the transaction flow data based on preset abnormal fund flow behavior rules; and uses an automated time-series feature extraction tool to generate multiple dimensions of time-series statistical features from the transaction flow data. The feature fusion module is configured to fuse explicit business behavior features with time-series statistical features, and then filter the fused features to obtain a target feature set. The model training module is configured to: use the target feature set and the corresponding labels to train the XGBoost classification model to obtain the fraud risk identification model; The risk identification module is configured to: input the transaction data of the account to be identified into the fraud risk identification model, output the probability and risk level of fraud risk of the account, and output the importance score of each feature based on the XGBoost classification model.

[0017] Thirdly, the present invention provides an electronic device including a memory and a processor, and computer instructions stored in the memory and running on the processor, wherein the computer instructions, when executed by the processor, perform the method described in the first aspect.

[0018] Fourthly, the present invention provides a computer-readable storage medium for storing computer instructions, which, when executed by a processor, perform the method described in the first aspect.

[0019] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention proposes a method and system for identifying fraudulent accounts based on feature engineering and XGBoost. By constructing a dual-fusion feature engineering system of "business features + temporal features," it utilizes business features based on practical experience to capture explicit abnormal transaction patterns, while simultaneously employing automated temporal feature extraction tools to uncover deep, non-linear temporal patterns that are difficult for the human eye to discern. These two complementary approaches significantly improve the ability to characterize and identify complex fraudulent transaction patterns. Furthermore, this invention performs scenario-based feature adaptation and model optimization for individual and business accounts respectively, enhancing the scenario-specificity and generalization ability of the technical solution. Simultaneously, this invention leverages the inherent feature importance output capability of the XGBoost model to provide clear and traceable evidence for risk assessment, addressing the interpretability pain point of "black box" models in risk control practice. Finally, this invention provides a standardized technical process from data input to risk output, supporting dynamic threshold adjustment, significantly reducing the cost of technology implementation and reuse. Experiments demonstrate that this invention significantly outperforms traditional rule-based methods and existing conventional gradient boosting algorithms in key indicators such as precision and recall. Attached Figure Description

[0020] Figure 1 This is an overall flowchart of the fraudulent account identification method based on feature engineering and XGBoost disclosed in the embodiments of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0022] The technical solutions disclosed in the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0023] Terminology Explanation: XGBoost (Extreme Gradient Boosting): A highly efficient ensemble machine learning algorithm that iteratively trains multiple decision trees and weights and fuses the prediction results. It has strong generalization ability, high training efficiency, and feature contribution output capability, and is used to build a high-risk account identification and classification model.

[0024] TSFresh: A feature extraction tool based on time series hypothesis testing, which can automatically generate massive statistical features from transaction time series data and filter effective dimensions to uncover hidden transaction patterns.

[0025] High-risk related accounts: Accounts that are associated with abnormal fund transfer activities and require key identification and control, serving as positive samples for machine learning.

[0026] Normal accounts: Accounts whose trading behavior follows normal patterns and has no abnormal characteristics are negative samples for machine learning.

[0027] Transaction history: A detailed record of account fund transactions, including core fields such as transaction identifier, time, amount, direction, counterparty, and balance, which serve as the original input data for the model.

[0028] Time window: A defined continuous trading interval used to divide the time series flow into sample units that the model can process.

[0029] Feature engineering: The entire process of cleaning, transforming, extracting, and screening raw data to form structured features, which directly affects model performance.

[0030] Business behavior characteristics: Based on practical experience in risk control, typical behavioral indicators of abnormal fund flows are summarized to reflect explicit abnormal patterns.

[0031] Time series statistical features: Periodic, volatile, and implicit correlation features generated through time series analysis supplement the blind spots of manual features.

[0032] Small-scale exploratory behavior: a low-amount verification transaction model before a large-scale fund transfer.

[0033] Abnormal cash flow: An abnormal cash flow pattern characterized by rapid inflow and outflow of funds within a short period of time and a short retention period.

[0034] Feature importance: Quantify the contribution weight of each feature to the model's judgment, providing a basis for manual judgment.

[0035] Accuracy: The percentage of truly high-risk accounts among those identified as high-risk by the model.

[0036] Recall rate: The proportion of real high-risk accounts that are correctly identified by the model.

[0037] LightGBM and CatBoost: mainstream gradient boosting algorithms, used as benchmarks for performance comparison in this solution.

[0038] Example 1 like Figure 1 As shown, this embodiment provides a method for identifying fraudulent accounts based on feature engineering and XGBoost, including the following steps: Obtain the raw transaction data of the target account and preprocess the raw transaction data to obtain a standard transaction sequence; Based on a preset time window, the standard trading sequence is divided into multiple sample units, and each sample unit is labeled with a label to indicate whether it is a high-risk account or a normal account. Feature extraction is performed on the transaction flow data within each sample unit to obtain explicit business behavior features and time-series statistical features in multiple dimensions. Specifically, based on preset abnormal fund flow behavior rules, explicit business behavior features in multiple dimensions are extracted from the transaction flow data; and an automated time-series feature extraction tool is used to generate time-series statistical features in multiple dimensions from the transaction flow data. The explicit business behavior features are fused with time-series statistical features, and the fused features are then filtered to obtain the target feature set. Using the target feature set and the corresponding labels, an XGBoost classification model is trained to obtain a fraud risk identification model. The transaction data of the account to be identified is input into the fraud risk identification model, which outputs the probability and risk level of fraud risk of the account, and outputs the importance score of each feature based on the XGBoost classification model.

[0039] The specific solution of the present invention is as follows: (a) Methods for identifying high-risk personal ordinary accounts.

[0040] This section details how to use the method of this invention to identify fraud risks in ordinary personal accounts. It includes the following steps: Step S101: Transaction data collection.

[0041] Collect full transaction records of individual ordinary accounts from the core systems of banks or payment institutions. To ensure the completeness of subsequent analysis, the collected raw data should at least include the following core fields: transaction ID, transaction time, transaction amount, transaction direction (transfer in / transfer out), counterparty account, and post-transaction account balance.

[0042] Step S102: Data preprocessing.

[0043] The collected raw data is cleaned and standardized, specifically including: Deduplication: Identify and remove duplicate transaction records based on a combination of transaction ID, transaction time, amount, and counterparty account.

[0044] Time standardization: unify all transaction time fields to a standard time zone (e.g., UTC+8) and a unified format (e.g., YYYY-MM-DD HH:MM:SS).

[0045] Outlier removal: Delete invalid records with empty, zero, or negative transaction amounts, or transaction times that are outside a reasonable range (such as 1970 or future times).

[0046] Serialization: Group by account number and sort in ascending order by transaction time within each group to form a standard time-series transaction sequence for each account.

[0047] Step S103: Construct time window samples.

[0048] Select a time window that fits the transaction cycle of an individual account, such as a continuous interval of calendar days or three days. Combine all transactions of an account within this time window into one sample unit. Simultaneously, label each sample unit based on authoritative annotation information from public security or risk control departments. For example, label accounts confirmed to be associated with fraud cases as "high-risk" (positive sample), and label accounts with consistently normal transaction behavior and no criminal record as "normal" (negative sample), thus forming a labeled dataset. Alternatively, the time window can be a sliding window based on the number of transactions, for example, every 50 transactions constitute one sample.

[0049] Step S104: Extraction of business behavior features.

[0050] Based on frontline anti-fraud experience, explicit business behavior features that directly reflect abnormal fund transfer patterns are extracted from each sample unit. The features extracted in this embodiment include, but are not limited to: Small-amount trial behavior characteristics: Calculate the frequency of transactions below a preset threshold (e.g., 1 yuan, 5 yuan) within a given window and the proportion of these transactions to the total number of transactions. This feature is used to identify the behavior of fraudsters verifying account validity before making large transfers.

[0051] Large-amount anomaly characteristics: This feature calculates the frequency of transactions exceeding a preset threshold within a given window, analyzing whether the counterparties to these large transactions are highly concentrated in a few accounts. High-risk accounts often engage in frequent large-amount fund transfers with a fixed number of counterparties, which may be a characteristic of fund aggregation or transfer. This feature is used to identify abnormal patterns of "short-term, high-frequency, large-amount transfers, and large-amount fund flows to specific counterparties."

[0052] Abnormal fund turnover characteristics: Calculate the ratio of total funds transferred in within a short period (e.g., within 1 hour) to total funds transferred out, as well as the average length of time funds remain in the account. This feature is used to identify typical money laundering patterns of "rapid in and out, clearing out overnight."

[0053] Abnormal trading time period characteristics: Calculate the percentage of transactions that occur during unusual trading hours such as early morning (e.g., 00:00-06:00).

[0054] Abnormal Balance Characteristics: The ratio of the ending balance to the cumulative amount transferred in during the period is calculated to identify whether the account is being used as a "bridging" fund pool.

[0055] Counterparty clustering characteristics: Calculate the concentration of trading counterparties, such as the proportion of the total transaction amount of the top three counterparties to the total outflow amount.

[0056] Step S105: Extraction of time-series statistical features.

[0057] In parallel, an automated time-series feature extraction tool (TSFresh in this embodiment) is used to perform in-depth mining of transaction flow data within the same time window. Based on scalable hypothesis testing theory, TSFresh can automatically generate massive amounts of statistical features from time series data. In this embodiment, TSFresh primarily generates the following categories of features: Time-domain characteristics: such as the mean, variance, peak value, and skewness of transaction amounts.

[0058] Frequency domain characteristics: The periodic main frequency and spectral energy of the transaction amount change are extracted by Fourier transform.

[0059] Autocorrelation characteristics: Calculate the autocorrelation coefficient of transaction amount or interval under different time lags to discover the rhythmicity of transactions.

[0060] Distribution and interval characteristics: the maximum, minimum, average and quantile of the transaction interval.

[0061] Subsequently, the TSFresh tool performs a significance test, automatically selecting the most relevant valid features to the target label (high risk / normal) and removing meaningless noise features.

[0062] Step S106: Feature fusion and filtering.

[0063] The business behavior features generated in step S104 and the time-series statistical features generated in step S105 are fused to form a high-dimensional joint feature vector. To avoid the curse of dimensionality and overfitting, features need to be screened. This embodiment uses an embedded screening method: based on a pre-trained XGBoost model, the "feature importance" of all features (e.g., based on weights or information gain) is calculated to obtain a feature importance contribution score. Then, features are sorted from high to low according to their feature importance contribution scores, and their contribution scores are accumulated sequentially until the cumulative score reaches 99% of the total score. These features are retained, while redundant features at the bottom with a cumulative contribution of less than 1% are removed. The top k most influential core features are retained, achieving feature dimensionality reduction.

[0064] Step S107: XGBoost model training.

[0065] The target feature set and corresponding labels obtained after step S106 are divided into training and test sets in a 7:3 or 8:2 ratio. This embodiment uses the XGBoost algorithm for model training. To address the imbalance of positive and negative samples in personal accounts (high-risk accounts are far fewer than normal accounts), the model's hyperparameters are configured as follows: "scale_pos_weight" is set to balance sample weights, "max_depth" is set to 6-10 to control tree complexity, "learning_rate" is set to 0.01-0.3, and "n_estimators" is set to 100-500. The model uses binary logistic regression as the objective function and iteratively trains multiple decision trees to learn the nonlinear mapping relationship between features and fraud risk.

[0066] Step S108: Offline evaluation of the model.

[0067] The trained model is evaluated using a test set. Evaluation metrics include accuracy, precision, recall, and F1 score. Experimental results in this embodiment show that the proposed solution achieves precision and recall rates both above 90%, significantly outperforming traditional algorithms such as LightGBM and CatBoost, as well as manual rule-based methods, thus demonstrating the effectiveness of the invention.

[0068] Step S109: Model deployment and online inference.

[0069] The trained and evaluated fraud risk identification model is deployed to the online risk control system. The system receives new transaction data in real time and extracts features from the accounts to be identified following the same process (S102-S106), then calls the model for real-time inference. To adapt to different risk control strategies, this embodiment provides a configurable risk threshold interface, supporting two modes: high accuracy mode (threshold set to 0.9 to ensure low false positives) and high recall mode (threshold set to 0.5 to ensure no high-risk cases are missed).

[0070] Step S110: Output of risk results.

[0071] The model outputs the probability of fraud risk for each account (a value between 0 and 1) and determines the risk level (e.g., high, medium, low) based on preset thresholds. Simultaneously, the model outputs the features with the highest contribution (such as "morning-night transaction percentage" and "opponent concentration") and their importance scores. The system pushes information on high-risk accounts and key assessment criteria to human reviewers, while allowing normal accounts to proceed.

[0072] (ii) Methods for identifying high-risk accounts of operating companies.

[0073] This section follows the same basic process and principles as Part 1, but it has been adapted to the specific transaction characteristics of corporate accounts (corporate accounts). The specific steps are as follows: Step S201: Data acquisition.

[0074] Based on step S101 of Example 1, additional transaction-specific fields unique to corporate accounts are collected, such as: corporate transaction flag, bill settlement information, transaction remarks / contract number, operating cycle identifier, etc.

[0075] Step S202: Sample construction.

[0076] Given that business accounts typically trade less frequently than personal accounts, but with larger individual transaction amounts, the length of the time window needs to be adjusted. For example, the time window could be extended from "days" to "weeks" or "months" to ensure that sufficient transaction information is included within each sample unit.

[0077] Step S203: Feature extraction.

[0078] Based on the general business features extracted in step S104 of Part 1, additional abnormal pattern features specific to operating accounts are added: Corporate transaction ratio: The ratio of the total amount of corporate transactions within the window to the total transaction amount. An abnormal ratio may indicate that the account purpose is inconsistent with business operations.

[0079] Upstream and downstream concentration: Analyze the number of accounts and transaction volume distribution of upstream suppliers and downstream customers among trading partners. Abnormal concentration or dispersion may pose risks.

[0080] Bill matching degree: An indicator that measures the logical consistency between account transaction records and bill settlement behavior. It is used to detect anomalies where there is a mismatch between the flow of funds and the flow of bills in a transaction.

[0081] Fund retention period: Since operating accounts have fixed payment terms, their fund retention period should be relatively stable. Significant deviations from this stable period may be considered abnormal.

[0082] Holiday transaction characteristics: Large, high-frequency corporate transactions that occur on non-working days or statutory holidays may be abnormal behavior.

[0083] Step S204: Model training and adaptation.

[0084] Using a target feature set that integrates general and business-specific features, a new XGBoost model specifically designed for business accounts is retrained. Since the positive and negative sample distributions for business accounts differ from those for individual accounts, sample balancing parameters such as "scale_pos_weight" need to be readjusted to achieve optimal fitting.

[0085] Step S205: Risk Output.

[0086] Because the management of operating accounts needs to be more prudent, this embodiment refines the output of risk levels, for example, it is divided into three levels: high, medium and low. Each level corresponds to a different management strategy (e.g.: high risk is immediately frozen, medium risk is strengthened monitoring, and low risk is only recorded), so as to ensure normal business operations while effectively controlling risks.

[0087] This invention is not limited to the specific implementation methods described in the above embodiments. Any variation following the core process of "data acquisition - preprocessing - feature engineering (business features + time series features) - model training - deployment and output" falls within the protection scope of this invention. For example: 1. Algorithm Alternatives: Although XGBoost is the preferred algorithm in this solution, deep learning models such as CNN-LSTM and Transformer can also be used to replace XGBoost as the core classifier. Their recognition performance is comparable to or slightly different from this solution, but they still utilize the dual-feature fusion concept of this invention. Alternatively, sampling and fusing models such as LightGBM, CatBoost, Random Forest, and Logistic Regression can be used, and the output can be integrated through weighted voting / Stacking to improve model stability and achieve slightly better recognition accuracy than a single model.

[0088] 2. Alternatives to feature extraction tools: TSFresh is an effective means of generating time-series statistical features, but those skilled in the art can also use other similar toolkits, such as "tsfeatures" (an R package) or autoencoders, to perform unsupervised learning and dimensionality reduction of time-series features.

[0089] 3. Alternatives to feature selection methods: In addition to selection based on model importance, filtering methods (such as correlation coefficient method, chi-square test) or wrapping methods (such as recursive feature elimination) can also be used for feature selection.

[0090] Example 2 This embodiment provides a fraudulent account identification system based on feature engineering and XGBoost, including: The data acquisition and preprocessing module is configured to: acquire the raw transaction data of the target account and preprocess the raw transaction data to obtain a standard transaction sequence; The sample construction module is configured to: divide the standard trading sequence based on a preset time window, construct multiple sample units, and label each sample unit with a label used to indicate high-risk or normal accounts; The feature extraction module is configured to: extract features from the transaction flow data within each sample unit to obtain multiple dimensions of explicit business behavior features and multiple dimensions of time-series statistical features. Specifically, it extracts multiple dimensions of explicit business behavior features from the transaction flow data based on preset abnormal fund flow behavior rules; and uses an automated time-series feature extraction tool to generate multiple dimensions of time-series statistical features from the transaction flow data. The feature fusion module is configured to fuse explicit business behavior features with time-series statistical features, and then filter the fused features to obtain a target feature set. The model training module is configured to: use the target feature set and the corresponding labels to train the XGBoost classification model to obtain the fraud risk identification model; The risk identification module is configured to: input the transaction data of the account to be identified into the fraud risk identification model, output the probability and risk level of fraud risk of the account, and output the importance score of each feature based on the XGBoost classification model.

[0091] It should be noted that the above modules correspond to the steps in Embodiment 1, and the examples and application scenarios implemented by the above modules and their corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should also be noted that the above modules can be executed in a computer system as part of the system.

[0092] In further embodiments, the following is also provided: An electronic device includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the method described in Embodiment 1. For brevity, further details are omitted here.

[0093] It should be understood that in this embodiment, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0094] A computer-readable storage medium for storing computer instructions that, when executed by a processor, perform the method of Embodiment 1.

[0095] The method in Example 1 can be directly executed by a hardware processor, or it can be executed by a combination of hardware and software modules within the processor. The software modules can reside in readily available storage media in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, a detailed description is not provided here.

[0096] Those skilled in the art will recognize that the units and algorithm steps described in conjunction with the embodiments herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0097] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A fraud account identification method based on feature engineering and XGBoost, characterized in that, Includes the following steps: Obtain the original transaction data of the target account and preprocess the original transaction data to obtain a standard transaction sequence; Based on a preset time window, the standard transaction sequence is segmented to construct multiple sample units, and each sample unit is labeled with a tag, which is used to indicate high-risk accounts or normal accounts. Feature extraction is performed on the transaction flow data within each sample unit to obtain explicit business behavior features and time-series statistical features in multiple dimensions. Specifically, based on preset abnormal fund flow behavior rules, explicit business behavior features in multiple dimensions are extracted from the transaction flow data; and an automated time-series feature extraction tool is used to generate time-series statistical features in multiple dimensions from the transaction flow data. The explicit business behavior features are fused with the time-series statistical features, and the fused features are then filtered to obtain the target feature set. Using the target feature set and the corresponding labels, an XGBoost classification model is trained to obtain a fraud risk identification model. The transaction data of the account to be identified is input into the fraud risk identification model, which outputs the fraud risk probability and risk level of the account, and outputs the importance score of each feature based on the XGBoost classification model.

2. The method of claim 1, wherein the method is based on feature engineering and XGBoost for fraud account identification. The explicit business behavior characteristics include one or more of the following: small-amount exploratory behavior characteristics, large-amount abnormal characteristics, abnormal capital turnover characteristics, transaction characteristics during unusual periods, abnormal balance characteristics, and counterparty account concentration characteristics.

3. The method for identifying fraudulent accounts based on feature engineering and XGBoost as described in claim 1, characterized in that, The automated time-series feature extraction tool is TSFresh, which generates time-series statistical features including time-domain features, frequency-domain features, autocorrelation features, and interval distribution features of transaction amounts.

4. The method for identifying fraudulent accounts based on feature engineering and XGBoost as described in claim 1, characterized in that, The fused features are screened, specifically including: calculating the importance contribution score of each feature based on the model pre-training results, and selecting features whose cumulative contribution reaches a first preset percentage in descending order of contribution score to form the target feature set.

5. The method for identifying fraudulent accounts based on feature engineering and XGBoost as described in claim 1, characterized in that, The target account types include ordinary personal accounts and operating company accounts; for operating company accounts, the explicit business behavior characteristics further include one or more exclusive characteristics among corporate transaction ratio, upstream and downstream concentration, bill matching degree, holiday transaction ratio, and fund settlement cycle.

6. The method for identifying fraudulent accounts based on feature engineering and XGBoost as described in claim 1, characterized in that, Using the target feature set and corresponding labels, an XGBoost classification model is trained, which further includes adaptively adjusting the sample balance weight parameters in the XGBoost classification model according to the sample distribution of the target account type.

7. The method for identifying fraudulent accounts based on feature engineering and XGBoost as described in claim 1, characterized in that, The risk identification step also includes configuring dynamically adjustable risk judgment thresholds, which include a first threshold corresponding to the high accuracy priority mode and a second threshold corresponding to the high recall priority mode.

8. A fraudulent account identification system based on feature engineering and XGBoost, characterized in that, include: The data acquisition and preprocessing module is configured to: acquire the original transaction flow data of the target account, and preprocess the original transaction flow data to obtain a standard transaction sequence; The sample construction module is configured to: divide the standard transaction sequence based on a preset time window, construct multiple sample units, and label each sample unit with a label used to indicate high-risk accounts or normal accounts; The feature extraction module is configured to: extract features from the transaction flow data within each sample unit to obtain multiple dimensions of explicit business behavior features and multiple dimensions of time-series statistical features. Specifically, it extracts multiple dimensions of explicit business behavior features from the transaction flow data based on preset abnormal fund flow behavior rules; and uses an automated time-series feature extraction tool to generate multiple dimensions of time-series statistical features from the transaction flow data. The feature fusion module is configured to: fuse the explicit business behavior features with the time-series statistical features, and filter the fused features to obtain a target feature set; The model training module is configured to: use the target feature set and the corresponding labels to train an XGBoost classification model to obtain a fraud risk identification model; The risk identification module is configured to: input the transaction flow data of the account to be identified into the fraud risk identification model, output the fraud risk probability and risk level of the account, and output the importance score of each feature based on the XGBoost classification model.

9. An electronic device, characterized in that, It includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, Used to store computer instructions, which, when executed by a processor, perform the method described in any one of claims 1-7.

Images