Risk transaction identification method and device, electronic equipment and storage medium

Abstract

The application provides a transaction risk identification method, which can be applied to the fields of artificial intelligence technology and financial technology. The method comprises the following steps: in response to a large amount of fund transfer request, collecting voice data of a transaction requester; performing text content-based verification on the voice data to generate a first identification result; performing voiceprint feature-based verification on the voice data to generate a second identification result; performing artificial intelligence voice change detection on the voice data to generate a third identification result and an abnormal score; determining a transaction risk result according to the first identification result, the second identification result, the third identification result and the abnormal score; and performing a transaction based on the transaction risk result.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, specifically to the field of financial technology, and more specifically to a risk transaction identification method, device, electronic device, and storage medium. Background Technology

[0002] In financial transactions, especially large-sum transfers, it is necessary to verify the identity of the transaction requester to prevent fraud. Common technologies for this include password verification, SMS verification codes, or voiceprint recognition-based authentication. However, these technologies struggle to effectively distinguish between genuine human voices and AI-synthesized speech, allowing them to bypass traditional voiceprint recognition systems and jeopardizing transaction security. Summary of the Invention

[0003] In view of the above problems, embodiments of this application provide a transaction risk identification method, apparatus, electronic device, storage medium, and program product.

[0004] According to a first aspect of this application, a method for identifying transaction risks is provided, comprising: in response to a request for a large-sum fund transfer, collecting voice data of the transaction requester; performing text-based verification on the voice data to generate a first recognition result; performing voiceprint-based verification on the voice data to generate a second recognition result; performing artificial intelligence voice changer detection on the voice data to generate a third recognition result and an anomaly score; determining a transaction risk result based on the first recognition result, the second recognition result, the third recognition result, and the anomaly score; and executing a transaction based on the transaction risk result.

[0005] According to embodiments of this application, performing AI voice-changing detection on speech data to generate a third recognition result and anomaly score includes: segmenting the speech data to obtain a speech data segment sequence; extracting Mel-frequency cepstral coefficient features and original time-domain waveform data for each speech data segment; extracting a first feature vector corresponding to the Mel-frequency cepstral coefficient features and a second feature vector corresponding to the original time-domain waveform data through a parallel convolutional network; fusing the first and second feature vectors to obtain a fused feature vector; inputting the fused feature vector sequence into a time-series prediction network to generate a segment-level anomaly score for each speech data segment; calculating the percentage of anomalies in the speech data segment sequence whose segment-level anomaly scores exceed a preset threshold; if the percentage of anomalies exceeds the preset threshold, determining that the speech data is AI-synthesized speech or a playback attack, and generating a corresponding attack type classification result.

[0006] According to an embodiment of this application, performing text-based verification on voice data to generate a first recognition result includes: performing voice recognition on the voice data to extract basic information of the transaction requester; comparing the extracted basic information of the transaction requester with a pre-built information database to generate a first recognition result.

[0007] According to an embodiment of this application, performing voiceprint feature-based verification on speech data to generate a second recognition result includes: performing voiceprint recognition on the speech data to extract voiceprint features; comparing the extracted voiceprint features with a pre-built voiceprint database to generate a second recognition result.

[0008] According to an embodiment of this application, determining the transaction risk result based on the first identification result, the second identification result, the third identification result, and the anomaly score includes: if the first identification result, the second identification result, and the third identification result all indicate that the verification is passed, and the anomaly score is less than a preset threshold, then the transaction risk result is determined to be a normal transaction; if any identification result indicates that the verification is failed, or the anomaly score is greater than or equal to the preset threshold, then the transaction risk result is determined to be an abnormal transaction.

[0009] According to an embodiment of this application, executing a transaction based on the transaction risk result includes: if the transaction risk result is determined to be a normal transaction, then allowing the transfer transaction; if the transaction risk result is determined to be an abnormal transaction, then blocking the transfer transaction and sending a transaction blocking prompt to the transaction requester.

[0010] According to an embodiment of this application, the method further includes: comparing the voice data with a risk voiceprint feature database to obtain a comparison result; if the comparison result indicates that the voiceprint feature of the voice data matches the risk voiceprint feature database, the transaction risk result is determined to be an abnormal transaction.

[0011] According to a second aspect of this application, a transaction risk identification device is provided, comprising: a collection module for collecting voice data of the transaction requester in response to a large-amount fund transfer request; a first identification module for performing text-based verification on the voice data and generating a first identification result; a second identification module for performing voiceprint-based verification on the voice data and generating a second identification result; a third identification module for performing artificial intelligence voice changer detection on the voice data and generating a third identification result and an anomaly score; a determination module for determining a transaction risk result based on the first identification result, the second identification result, the third identification result, and the anomaly score; and an execution module for executing a transaction based on the transaction risk result.

[0012] According to an embodiment of this application, the third recognition module is further configured to segment the speech data to obtain a speech data segment sequence; extract Mel-frequency cepstral coefficient features and original time-domain waveform data for each speech data segment; extract the first feature vector corresponding to the Mel-frequency cepstral coefficient features and the second feature vector corresponding to the original time-domain waveform data through a parallel convolutional network; fuse the first feature vector and the second feature vector to obtain a fused feature vector; input the fused feature vector sequence into a time-series prediction network to generate a segment-level anomaly score for each speech data segment; count the percentage of anomalies in the speech data segment sequence whose segment-level anomaly scores exceed a preset threshold; if the percentage of anomalies exceeds the preset threshold, determine that the speech data is artificial intelligence synthesized speech or a playback attack, and generate the corresponding attack type classification result.

[0013] According to an embodiment of this application, the first recognition module includes a speech recognition submodule and a first comparison submodule.

[0014] The speech recognition submodule is used to perform speech recognition on speech data and extract basic information of the transaction requester; the first comparison submodule is used to compare the extracted basic information of the transaction requester with a pre-built information database and generate a first recognition result.

[0015] According to an embodiment of this application, the first identification module includes a voiceprint recognition submodule and a second comparison submodule.

[0016] The voiceprint recognition submodule is used to perform voiceprint recognition on speech data and extract voiceprint features; the second comparison submodule is used to compare the extracted voiceprint features with a pre-built voiceprint database and generate a second recognition result.

[0017] According to an embodiment of this application, the determining module further includes: a first determining submodule and a second determining submodule.

[0018] The first determining submodule is used to determine the transaction risk result as a normal transaction if the first identification result, the second identification result, and the third identification result all indicate that the verification has passed and the abnormal score is less than a preset threshold. The second determining submodule is used to determine the transaction risk result as an abnormal transaction if any identification result indicates that the verification has failed or the abnormal score is greater than or equal to the preset threshold.

[0019] According to an embodiment of this application, the execution module is further configured to compare the voice data with the risk voiceprint feature database to obtain a comparison result; if the comparison result indicates that the voiceprint feature of the voice data matches the risk voiceprint feature database, the transaction risk result is determined to be an abnormal transaction.

[0020] According to a third aspect of this application, an electronic device is provided, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0021] According to a fourth aspect of this application, a computer-readable storage medium is also provided, on which a computer program or instructions are stored, wherein the computer program or instructions, when executed by a processor, implement the steps of the above-described method.

[0022] According to a fifth aspect of this application, a computer program product is also provided, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0023] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0024] Figure 1 The diagram illustrates an application scenario of the transaction risk identification method according to an embodiment of this application.

[0025] Figure 2 The diagram illustrates the system architecture of a transaction risk identification device according to an embodiment of this application.

[0026] Figure 3 A flowchart illustrating a transaction risk identification method according to an embodiment of this application is shown.

[0027] Figure 4 A schematic block diagram of a transaction risk identification device according to an embodiment of this application is shown.

[0028] Figure 5 A block diagram of an electronic device suitable for implementing a transaction risk identification method according to an embodiment of this application is shown schematically. Detailed Implementation

[0029] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0030] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0031] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0032] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0033] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0034] In scenarios where personal information is used for automated decision-making, the methods, devices, and systems provided in this application all provide users with corresponding operation entry points for users to choose to agree to or reject the automated decision results; if the user chooses to reject, the process proceeds to the expert decision-making process.

[0035] Figure 1 The diagram illustrates an application scenario of the transaction risk identification method according to an embodiment of this application. For example... Figure 1As shown, application scenario 100 according to an embodiment of this application may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables. For example, a user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send information, etc.

[0036] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be electronic devices such as smartphones, wearable devices, personal computers, intelligent voice interaction devices, smart home appliances, intelligent vehicles, in-vehicle terminals, aircraft, unmanned vending terminals, and extended reality devices. Extended reality devices can include virtual reality devices, augmented reality devices, and mixed reality devices. A client application for the target application can be installed and run on the terminal devices. This target application can include, but is not limited to, financial transaction applications, payment applications, shopping applications, web browser applications, search applications, instant messaging tools, email clients, and social media platform software (these are just examples). Furthermore, this application embodiment does not limit the form of the target application, and it can include, but is not limited to, applications, mini-programs, etc., installed on the terminal devices, and can also be in the form of web pages.

[0037] Server 105 can be a server providing various services, such as a backend management server supporting websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process received user requests and other data, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services such as cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks, and basic cloud computing services such as big data. The server can be the backend server of the aforementioned target application, used to provide backend services to the clients of the target application.

[0038] It should be noted that the transaction risk identification method provided in this application embodiment can generally be executed by server 105 and / or terminal devices 101-103. Accordingly, the transaction risk identification device provided in this application embodiment can generally be set in server 105 and / or terminal devices 101-103.

[0039] It should be noted that the transaction risk identification method provided in this application embodiment can be used in the field of artificial intelligence technology, and can also be applied to the front-end page development scenario in the field of financial technology. It can also be used in any field other than the field of financial technology. The application field of the transaction risk identification method provided in this application embodiment is not limited.

[0040] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0041] Figure 2 A schematic diagram illustrating the system architecture of a transaction risk identification device according to an embodiment of this application is provided. Figure 2 As shown, the transaction risk identification device is deployed at the bank's end and communicates with both the bank's terminal and the customer's terminal. It is used to perform multi-dimensional identity verification of the transaction requester in large-value transfer scenarios. The device includes: a bank terminal, a customer terminal, a communication module, a voice information recording and slicing module, a user basic information confirmation module, a voiceprint recognition module, an artificial intelligence (AI) voice changer detection module, and a database. The bank terminal is the terminal equipment used by bank customer service personnel or automated outbound calling systems to initiate large-value transfer alert calls and receive the system's risk identification results. The customer terminal is the communication equipment used by the transaction requester, including mobile phones, landlines, or VoIP phones, to receive incoming calls from the bank and transmit voice data. The communication module establishes a voice call channel between the bank terminal and the customer terminal, supports two-way real-time voice transmission, and is responsible for routing the customer terminal's voice data to the various processing modules within the cardholder identity verification system. The voice information recording and slicing module is responsible for receiving the raw voice data from the customer terminal and performing the following operations:

[0042] The voice data is recorded and archived for future auditing; the voice stream is sliced ​​in real time and divided into multiple voice data segment sequences according to a fixed time length (e.g., 1 second) or a fixed number of sampling points; each voice segment is preprocessed with noise reduction, pre-emphasis, etc.; the preprocessed voice segments are sent to the user basic information confirmation module, the voiceprint recognition module, and the AI ​​voice changer detection module respectively.

[0043] The user basic information verification module performs text-based verification. This module integrates an automatic speech recognition engine that converts speech segments into text, extracting the identity information proactively declared by the transaction requester (such as name, ID number, and the last four digits of bank card number). The extracted information is then compared with the customer basic information database to generate a first recognition result. This result is output as a Boolean value or similarity score, indicating whether the text content matches the pre-registered information.

[0044] The voiceprint recognition module performs voiceprint feature-based verification. This module integrates a voiceprint feature extractor to extract a unique voiceprint embedding vector from a speech segment. This vector is then compared to a voiceprint database to calculate the similarity with the target user's registered voiceprint template, generating a second recognition result. This result indicates whether the current speaker is the legitimate user corresponding to the voiceprint database.

[0045] The AI ​​voice changer detection module is used to perform artificial intelligence voice changer detection. This module uses a deep learning model (such as a parallel convolutional network + temporal prediction network) to analyze the spectral and temporal features of speech segments, determine whether there is AI-synthesized speech or playback attack, and generate a third recognition result and anomaly score.

[0046] The database comprises four sub-databases: Voiceprint Database: stores voiceprint feature templates reserved by legitimate users during account opening or registration, used for voiceprint comparison; Voiceprint (Text Database): stores acoustic feature indexes of common text content in user speech, assisting the user basic information confirmation module in rapid matching; Customer Basic Information Database: stores each customer's name, ID number, reserved mobile phone number, account number, and other identity information, used for text content comparison; Risk Voiceprint Feature Database: stores voiceprint features of known fraudsters or abnormal traders, used for rapid interception.

[0047] The decision engine (which can be integrated into the determination module) receives the first identification result, the second identification result, the third identification result, and the anomaly score. It determines the transaction risk outcome according to preset rules (if all results pass and the anomaly score is below a threshold, the transaction is considered normal; otherwise, it is considered an abnormal transaction) and sends the result to the bank terminal. The bank terminal approves or blocks the transfer transaction based on the result, and sends a notification message to the customer terminal if necessary.

[0048] In response to a large transfer request, the bank terminal initiates a voice call to the customer terminal via the communication module. After the call is connected, the voice information recording and slicing module collects the customer's voice in real time and slices it. The sliced ​​voice is then sent in parallel to the user basic information confirmation module, the voiceprint recognition module, and the AI ​​voice changer detection module. These three modules work independently, generating the first, second, and third recognition results and anomaly scores, respectively. The decision engine integrates the above results to determine the transaction risk outcome. Based on the risk outcome, the bank terminal either approves or blocks the transaction and records the information in the log.

[0049] pass Figure 2 The architecture shown enables multimodal and parallel transaction risk identification, improving the system's real-time performance and accuracy.

[0050] Figure 3 A flowchart illustrating a transaction risk identification method according to an embodiment of this application is shown.

[0051] like Figure 3 As shown, it includes steps S310 to S340.

[0052] In step S310, in response to a large fund transfer request, voice data of the transaction requester is collected.

[0053] In one example, in response to a large fund transfer request, the voice data of the requester is first collected. The large fund transfer request may be triggered by the banking system; for example, when the system detects a user initiating a transfer exceeding a preset amount, it automatically initiates a risk identification process. Methods for collecting voice data include, but are not limited to, proactively calling the contact number provided by the requester and recording their voice during the call. It should be noted that in the embodiments of this application, the user's consent or authorization can be obtained before acquiring the user's information. For example, before step S210, a request to obtain the user's information can be sent to the user. Step S210 is executed only if the user consents or authorizes the acquisition of user information.

[0054] In step S320, text-based verification is performed on the speech data to generate a first recognition result.

[0055] In one example, three different dimensions of verification are performed on the collected voice data: First, text-based verification is performed. This verification method analyzes the semantic information contained in the voice, extracts the identity information (such as name, ID number, account number, etc.) actively declared by the transaction requester during the call, and compares it with pre-stored customer information to generate a first recognition result, which indicates whether the text content is consistent with the reserved information.

[0056] In step S330, a voiceprint-based verification is performed on the speech data to generate a second recognition result.

[0057] In one example, voiceprint-based verification is performed. This verification method analyzes the acoustic features in the speech, extracts the unique voiceprint features of the transaction requester, and compares them with a pre-registered voiceprint template to generate a second recognition result. This result indicates whether the current speaker matches the voiceprint template.

[0058] In step S340, artificial intelligence voice change detection is performed on the voice data to generate a third recognition result and an anomaly score.

[0059] In one example, AI-powered voice modulation detection is performed. This verification method analyzes the speech signal for traces of AI synthesis or playback attacks, generating a third-party identification result and an anomaly score. The third-party identification result indicates whether the speech was generated by AI synthesis or playback attacks, while the anomaly score quantifies the suspiciousness of the speech.

[0060] In step S350, the transaction risk result is determined based on the first identification result, the second identification result, the third identification result, and the anomaly score.

[0061] In step S360, the transaction is executed based on the transaction risk outcome.

[0062] After obtaining three identification results and an anomaly score, the transaction risk outcome is determined based on this information. For example, a decision rule can be set: if all three identification results indicate successful verification and the anomaly score is low, the transaction is judged as normal; otherwise, it is judged as abnormal. Based on the determined transaction risk outcome, the corresponding transaction operation is executed. If it is a normal transaction, the transfer is allowed; if it is an abnormal transaction, the transfer is blocked and a notification message is sent to the transaction requester.

[0063] This application's embodiments comprehensively utilize three verification methods—text-based verification, voiceprint-based verification, and AI-generated voice changer detection—to address the issue of single verification methods being easily bypassed by AI-synthesized speech, leveraging the complementary nature of multi-source information. Since the three verification methods rely on semantic information, biometric features, and forgery traces respectively, they are independent and do not interfere with each other. Even if an attacker breaches one verification method, the others can still detect the anomaly, significantly improving the accuracy of identifying AI voice changer attacks and reducing the probability of mistakenly allowing abnormal transactions. Furthermore, by comprehensively judging before executing a transaction, risk identification and transaction control are linked, enabling timely blocking of transactions upon detecting risk and preventing financial losses.

[0064] According to embodiments of this application, performing AI voice-changing detection on speech data to generate a third recognition result and anomaly score includes: segmenting the speech data to obtain a speech data segment sequence; extracting Mel-frequency cepstral coefficient features and original time-domain waveform data for each speech data segment; extracting a first feature vector corresponding to the Mel-frequency cepstral coefficient features and a second feature vector corresponding to the original time-domain waveform data through a parallel convolutional network; fusing the first and second feature vectors to obtain a fused feature vector; inputting the fused feature vector sequence into a time-series prediction network to generate a segment-level anomaly score for each speech data segment; calculating the percentage of anomalies in the speech data segment sequence whose segment-level anomaly scores exceed a preset threshold; if the percentage of anomalies exceeds the preset threshold, determining that the speech data is AI-synthesized speech or a playback attack, and generating a corresponding attack type classification result.

[0065] In one example, when performing AI-based voice changer detection on speech data, the acquired speech data is first segmented into multiple segments of equal or unequal length, resulting in a sequence of speech data segments. Two types of features are extracted from each speech data segment: Mel-frequency cepstral coefficients (MFCCs) and the original time-domain waveform data. MFCCs are artificially designed spectral features that simulate human hearing characteristics; the original time-domain waveform data is the raw sampled signal without any transformation. These two types of features are processed separately using parallel convolutional networks: the MFCCs are input into a two-dimensional convolutional network to extract the first feature vector; the original time-domain waveform data is input into a one-dimensional convolutional network to extract the second feature vector. The two convolutional networks work in parallel without interference. The first and second feature vectors are then fused to obtain a fused feature vector. Fusion can be achieved through vector concatenation, weighted summation, or fully connected layers. The fused feature vectors corresponding to each speech data segment are arranged in chronological order to form a sequence of fused feature vectors. The sequence is input into a temporal prediction network (such as a Long Short-Term Memory network or a gated recurrent unit) to generate a segment-level anomaly score for each speech data segment. This score represents the probability that the segment is an AI-synthesized speech or a replay attack. The percentage of segments in the entire speech data segment sequence whose segment-level anomaly scores exceed a preset threshold is counted. If this percentage exceeds a preset proportion, the entire speech data is determined to be either AI-synthesized speech or a replay attack, and the attack type classification result is further output (e.g., distinguishing between speech synthesis and replay attacks).

[0066] This application's embodiments segment long speech into short segments, enabling the detection model to focus on local acoustic features and avoiding information dilution issues in long sequence modeling. Simultaneously, two complementary features are extracted: manually designed Mel-frequency cepstral coefficients and original time-domain waveform data. The former incorporates prior knowledge of human hearing, while the latter preserves lossless signal information; their combination improves the completeness of feature representation. Parallel convolutional networks process these two types of features separately, and feature fusion achieves information complementarity. Compared to single feature input, this approach can simultaneously capture spectral structure information and subtle temporal perturbations, making it particularly sensitive to phase discontinuities and high-frequency artifacts present in AI-synthesized speech. Using a temporal prediction network to model the segment sequence allows for the suppression of misjudgments of single segments by leveraging contextual information. Finally, the judgment result for the entire speech is determined by statistically analyzing the proportion of abnormal segments. Compared to directly outputting a single score for the entire speech, this method is more robust to local forgery attacks (such as only partial segment replacement), avoiding the problem of misjudging the entire speech due to a few abnormal segments.

[0067] According to an embodiment of this application, performing text-based verification on voice data to generate a first recognition result includes: performing voice recognition on the voice data to extract basic information of the transaction requester; comparing the extracted basic information of the transaction requester with a pre-built information database to generate a first recognition result.

[0068] In one example, when performing text-based verification, the collected voice data is first subjected to speech recognition to convert it into text. Speech recognition can employ a deep learning-based automatic speech recognition model to decode the voice signal into a text sequence. Basic information about the transaction requester is extracted from the recognized text. This basic information includes, but is not limited to, the name, ID number, last few digits of the bank card number, and registered mobile phone number declared by the transaction requester during the call—information that uniquely identifies them. The extracted basic information is then compared with a pre-built information database. This pre-built database can be a customer basic information database stored in a bank system, containing the real identity information of each customer. The comparison can use exact matching or fuzzy matching to determine whether the extracted information matches the information in the database, thus generating a first recognition result. The first recognition result can be a Boolean value of "match" or "dismatch," or a similarity score.

[0069] This application's embodiments convert speech into text through speech recognition, then extract the identity information and compare it with a pre-stored information database, achieving automated verification of the identity actively declared by the transaction requester. This verification method does not rely on biometric features such as voiceprints, but is based on static identity information known to the user (such as ID card number, bank card number). Even if an attacker clones a voiceprint, they cannot accurately state the target user's complete identity information simultaneously (unless obtained beforehand), thus forming an effective supplementary defense against AI voice-changing attacks. Furthermore, this verification method works in parallel with voiceprint recognition and AI voice-changing detection; all three operate independently, and any anomalies in any one of them will be captured by the system, improving the overall depth of anti-fraud defense capabilities.

[0070] According to an embodiment of this application, performing voiceprint feature-based verification on speech data to generate a second recognition result includes: performing voiceprint recognition on the speech data to extract voiceprint features; comparing the extracted voiceprint features with a pre-built voiceprint database to generate a second recognition result.

[0071] In one example, when performing voiceprint feature-based verification, the first step is to perform voiceprint recognition on the collected speech data to extract voiceprint features. Voiceprint features can be based on filter banks, Mel-frequency cepstral coefficients, perceptual linear prediction coefficients, etc., or they can be embedding vectors learned through deep neural networks. The extracted voiceprint features are then compared with a pre-built voiceprint database. This database stores voiceprint templates left by legitimate users during registration. During the comparison, the similarity (such as cosine similarity or Euclidean distance) between the extracted voiceprint features and the target user's voiceprint template in the database is calculated, and it is determined whether this similarity exceeds a preset threshold, thus generating a second recognition result. This second recognition result indicates whether the current speaker is the legitimate user corresponding to the voiceprint database.

[0072] This application's embodiments extract unique biometric features of the speaker using voiceprint recognition technology and compare them with pre-stored voiceprint templates, achieving individual identity authentication based on physiological and behavioral characteristics. Because voiceprint features are unique and relatively stable, even if an attacker obtains the identity information of the transaction requester (such as an ID number), it is difficult to imitate their voiceprint features. This verification method complements text-based verification: text verification ensures "knowing what," while voiceprint verification ensures "who is who," and the combination of the two significantly increases the difficulty of forgery for attackers. Simultaneously, the result of voiceprint verification can also serve as an important reference for AI voice-changing detection—if voiceprint verification passes but AI voice-changing detection alarms, it may be a voiceprint cloning attack, and the system can still identify the risk.

[0073] According to an embodiment of this application, determining the transaction risk result based on the first identification result, the second identification result, the third identification result, and the anomaly score includes: if the first identification result, the second identification result, and the third identification result all indicate that the verification is passed, and the anomaly score is less than a preset threshold, then the transaction risk result is determined to be a normal transaction; if any identification result indicates that the verification is failed, or the anomaly score is greater than or equal to the preset threshold, then the transaction risk result is determined to be an abnormal transaction.

[0074] In one example, the process first checks whether the first, second, and third recognition results all indicate successful verification. Successful verification of the first recognition result means the extracted text information matches the database; successful verification of the second recognition result means the voiceprint features match the voiceprint database; and successful verification of the third recognition result means the voice was not identified as AI-generated or a playback attack. Next, the process checks if the anomaly score is below a preset threshold. The lower the anomaly score, the higher the probability that the voice is a genuine human voice. If all the above conditions are met—that is, all three recognition results pass and the anomaly score is below the threshold—the transaction risk result is determined to be a normal transaction, indicating that the current transaction request is trustworthy. If any recognition result indicates failed verification (e.g., text information mismatch, voiceprint mismatch, or voice being identified as AI-generated), or the anomaly score reaches or exceeds the preset threshold, the transaction risk result is determined to be an abnormal transaction, indicating that the current transaction request carries a fraud risk.

[0075] This application embodiment achieves logical AND fusion of multiple verification results by setting a decision rule that only determines a transaction as normal if "all verifications pass and the anomaly score is below a threshold". This decision mechanism avoids misjudgments caused by technical limitations or attacks on a single verification method. For example, if AI voice-changing detection produces a false alarm due to insufficient model accuracy, but text verification and voiceprint verification both pass and the anomaly score is low, the system may still allow the transaction; conversely, if AI voice-changing detection detects obvious forgery traces, even if text and voiceprint verifications pass, the system will still determine it as an abnormal transaction. This comprehensive decision-making method balances security and user experience, avoiding frequent blocking of normal transactions due to the low probability of false alarms from a single verification method, while decisively intercepting transactions when multiple verification methods simultaneously trigger alarms, significantly reducing the false alarm rate and the missed alarm rate.

[0076] According to an embodiment of this application, executing a transaction based on the transaction risk result includes: if the transaction risk result is determined to be a normal transaction, then allowing the transfer transaction; if the transaction risk result is determined to be an abnormal transaction, then blocking the transfer transaction and sending a transaction blocking prompt to the transaction requester.

[0077] In one example, if the determined transaction risk outcome is a normal transaction, the transfer transaction is allowed. Allowing the transfer may include sending an authorization instruction to the transaction processing system, permitting the transfer of funds from the requester's account to the target account. If the determined transaction risk outcome is an abnormal transaction, the transfer transaction is blocked. Blocking the transfer may include intercepting the transaction request and preventing the funds from being transferred. Simultaneously, a transaction blocking notification is sent to the requester. This notification can be sent via SMS, app push notification, or voice message, informing the user that the transaction has been blocked and suggesting they contact their bank or undergo offline identity verification.

[0078] By directly linking risk identification results with transaction execution actions, automated and real-time transaction risk handling is achieved. When a transaction is determined to be normal, it is automatically allowed, ensuring the trading efficiency and experience for normal users; when a transaction is determined to be abnormal, it is immediately blocked and a notification is sent to the user, preventing financial losses. Compared with traditional post-event investigations, this solution can block risks before or during a transaction, offering higher timeliness and stronger fund security. Simultaneously, sending notifications to users helps them promptly become aware of abnormal situations and take subsequent measures (such as changing passwords or reporting lost accounts), further mitigating the impact on normal transactions.

[0079] According to an embodiment of this application, the method further includes: comparing the voice data with a risk voiceprint feature database to obtain a comparison result; if the comparison result indicates that the voiceprint feature of the voice data matches the risk voiceprint feature database, the transaction risk result is determined to be an abnormal transaction.

[0080] In one example, before or simultaneously with AI voice-changing detection, the collected voice data is compared with a pre-built risk voiceprint feature library. This library stores the voiceprint features of known fraudsters or abnormal traders. During the comparison, voiceprint features are extracted from the voice data and matched one by one with voiceprint templates in the blacklist. If a match is found—meaning the voiceprint features of the voice data belong to a template in the blacklist—the transaction risk is directly determined as an abnormal transaction. Subsequent text-based verification, voiceprint verification, or AI voice-changing detection is unnecessary, and the transaction blocking operation is triggered. By introducing the risk voiceprint feature library mechanism, rapid interception of known fraud sources is achieved. Since blacklist matching only requires one voiceprint comparison, eliminating the need for complete speech recognition, voiceprint verification, and AI voice-changing detection processes, the risk assessment time for abnormal transactions is significantly shortened, reducing system computational overhead. Simultaneously, this step acts as a pre-filter, prioritizing the interception of already flagged fraudsters and avoiding the waste of subsequent complex computational resources. Transactions that are on the blacklist are directly identified as abnormal transactions and blocked, which improves the system's response speed to repeated fraudulent activities and effectively prevents the same fraudster from attempting to commit crimes multiple times.

[0081] Based on the above-described transaction risk identification method, embodiments of this application also provide a transaction risk identification device. The following will be combined with... Figure 4 The device is described in detail.

[0082] Figure 4 A schematic block diagram of a transaction risk identification device according to an embodiment of this application is shown.

[0083] like Figure 4 As shown, the transaction risk identification device 400 of this embodiment includes a data acquisition module 410, a first identification module 420, a second identification module 430, a third identification module 440, a determination module 450, and an execution module 460.

[0084] The acquisition module 410 is used to acquire voice data from the transaction requester in response to a large fund transfer request. In one embodiment, the acquisition module 410 can be used to perform step S310 described above, which will not be repeated here.

[0085] The first recognition module 420 is used to perform text-content-based verification on the voice data and generate a first recognition result. In one embodiment, the first repair module 420 can be used to perform step S320 described above, which will not be repeated here.

[0086] The second recognition module 430 is used to perform voiceprint feature-based verification on the voice data and generate a second recognition result. In one embodiment, the second recognition module 430 can be used to perform step S230 described above, which will not be repeated here.

[0087] The third recognition module 440 is used to perform artificial intelligence voice change detection on the speech data and generate a third recognition result and an anomaly score. In one embodiment, the third recognition module 440 can be used to perform step S340 described above, which will not be repeated here.

[0088] The determining module 450 is used to determine the transaction risk result based on the first identification result, the second identification result, the third identification result, and the anomaly score. In one embodiment, the determining module 450 can be used to perform step S350 described above, which will not be repeated here.

[0089] The execution module 460 is used to execute a transaction based on the transaction risk outcome. In one embodiment, the execution module 460 can be used to execute step S360 described above, which will not be repeated here.

[0090] According to an embodiment of this application, the third recognition module is further configured to segment the speech data to obtain a speech data segment sequence; extract Mel-frequency cepstral coefficient features and original time-domain waveform data for each speech data segment; extract the first feature vector corresponding to the Mel-frequency cepstral coefficient features and the second feature vector corresponding to the original time-domain waveform data through a parallel convolutional network; fuse the first feature vector and the second feature vector to obtain a fused feature vector; input the fused feature vector sequence into a time-series prediction network to generate a segment-level anomaly score for each speech data segment; count the percentage of anomalies in the speech data segment sequence whose segment-level anomaly scores exceed a preset threshold; if the percentage of anomalies exceeds the preset threshold, determine that the speech data is artificial intelligence synthesized speech or a playback attack, and generate the corresponding attack type classification result.

[0091] According to an embodiment of this application, the first recognition module includes a speech recognition submodule and a first comparison submodule.

[0092] The speech recognition submodule is used to perform speech recognition on speech data and extract basic information of the transaction requester; the first comparison submodule is used to compare the extracted basic information of the transaction requester with a pre-built information database and generate a first recognition result.

[0093] According to an embodiment of this application, the first identification module includes a voiceprint recognition submodule and a second comparison submodule.

[0094] The voiceprint recognition submodule is used to perform voiceprint recognition on speech data and extract voiceprint features; the second comparison submodule is used to compare the extracted voiceprint features with a pre-built voiceprint database and generate a second recognition result.

[0095] According to an embodiment of this application, the determining module further includes: a first determining submodule and a second determining submodule.

[0096] The first determining submodule is used to determine the transaction risk result as a normal transaction if the first identification result, the second identification result, and the third identification result all indicate that the verification has passed and the abnormal score is less than a preset threshold. The second determining submodule is used to determine the transaction risk result as an abnormal transaction if any identification result indicates that the verification has failed or the abnormal score is greater than or equal to the preset threshold.

[0097] According to an embodiment of this application, the execution module is further configured to compare the voice data with the risk voiceprint feature database to obtain a comparison result; if the comparison result indicates that the voiceprint feature of the voice data matches the risk voiceprint feature database, the transaction risk result is determined to be an abnormal transaction.

[0098] According to embodiments of this application, any multiple modules among the acquisition module 410, the first identification module 420, the second identification module 430, the third identification module 440, the determination module 450, and the execution module 460 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the acquisition module 410, the first identification module 420, the second identification module 430, the third identification module 440, the determination module 450, and the execution module 460 can be at least partially implemented as hardware circuits, such as field-programmable gate arrays, programmable logic arrays, systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits, or implemented by any other reasonable means of integrating or packaging circuits, or implemented by any one of software, hardware, and firmware, or by any appropriate combination of any of these. Alternatively, at least one of the acquisition module 410, the first identification module 420, the second identification module 430, the third identification module 440, the determination module 450, and the execution module 460 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0099] Figure 5 A block diagram of an electronic device suitable for implementing a transaction risk identification method according to an embodiment of this application is shown schematically.

[0100] like Figure 5 As shown, an electronic device 500 according to an embodiment of this application includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory 502 or a program loaded from a storage portion 508 into a random access memory 503. The processor 501 may include, for example, a general-purpose microprocessor, an instruction set processor and / or an associated chipset and / or a dedicated microprocessor. The processor 501 may also include onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for executing different steps of the method flow according to an embodiment of this application.

[0101] Random access memory 503 stores various programs and data required for the operation of electronic device 500. Processor 501, read-only memory 502, and random access memory 503 are interconnected via bus 504. Processor 501 executes various steps of the method flow according to embodiments of this application by executing programs stored in read-only memory 502 and / or random access memory 503. It should be noted that programs may also be stored in one or more memories other than read-only memory 502 and random access memory 503. Processor 501 may also execute various steps of the method flow according to embodiments of this application by executing programs stored in one or more memories.

[0102] According to embodiments of this application, the electronic device 500 may further include an input / output interface 505, which is also connected to a bus 504. The electronic device 500 may also include one or more of the following components connected to the input / output interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube, liquid crystal display, etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card, such as a local area network card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 510 as needed so that computer programs read from it can be installed into the storage section 508 as needed.

[0103] Embodiments of this application also provide a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0104] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof. In embodiments of this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include the read-only memory 502, and / or random access memory 503, and / or one or more memories other than read-only memory 502 and random access memory 503 described above.

[0105] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this application.

[0106] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 509, and / or installed from a removable medium 511. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0107] In embodiments of this application, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by processor 501, it performs the functions defined in the system of this application embodiment. According to embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0108] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0109] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0110] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A method for identifying transaction risks, characterized in that, include: In response to requests for large fund transfers, voice data of the requesting party is collected; Perform text-content-based verification on the voice data to generate a first recognition result; The voice data is subjected to verification based on voiceprint features to generate a second recognition result; The voice data is subjected to artificial intelligence voice change detection to generate a third recognition result and an anomaly score; Based on the first identification result, the second identification result, the third identification result, and the anomaly score, the transaction risk result is determined; as well as Execute the transaction based on the aforementioned transaction risk outcome.

2. The method according to claim 1, characterized in that, The step of performing AI voice changer detection on the speech data to generate a third recognition result and an anomaly score includes: The speech data is segmented to obtain a sequence of speech data segments; Extract Mel-frequency cepstral coefficient features and raw time-domain waveform data for each speech data segment; The first feature vector corresponding to the Mel frequency cepstral coefficient features and the second feature vector corresponding to the original time-domain waveform data are extracted by a parallel convolutional network. The first feature vector and the second feature vector are fused to obtain a fused feature vector. The fused feature vector sequence is input into the temporal prediction network to generate segment-level anomaly scores for each speech data segment. The percentage of anomalies in a speech data segment sequence whose segment-level anomaly scores exceed a preset threshold is counted. If the percentage of abnormalities exceeds a preset threshold, the voice data is determined to be either AI-generated synthesized speech or a playback attack, and a corresponding attack type classification result is generated.

3. The method according to claim 1, characterized in that, The step of performing text-content-based verification on the speech data to generate a first recognition result includes: Perform speech recognition on the voice data to extract basic information of the transaction requester; The extracted basic information of the transaction requester is compared with a pre-built information database to generate the first identification result.

4. The method according to claim 1, characterized in that, The step of performing voiceprint feature-based verification on the speech data to generate a second recognition result includes: Perform voiceprint recognition on the voice data and extract voiceprint features; The extracted voiceprint features are compared with a pre-built voiceprint database to generate a second recognition result.

5. The method according to claim 1, characterized in that, The determination of transaction risk results based on the first identification result, the second identification result, the third identification result, and the anomaly score includes: If the first identification result, the second identification result, and the third identification result all indicate that the verification is successful, and the abnormal score is less than the preset threshold, then the transaction risk result is determined to be a normal transaction. If any identification result indicates that the verification fails, or the abnormal score is greater than or equal to the preset threshold, the transaction risk result is determined to be an abnormal transaction.

6. The method according to claim 1, characterized in that, The execution of transactions based on the transaction risk outcome includes: If the transaction risk outcome is determined to be a normal transaction, the transfer transaction will be approved. If the transaction risk result is determined to be an abnormal transaction, the transfer transaction will be blocked, and a transaction blocking notification will be sent to the transaction requester.

7. The method according to claim 1, characterized in that, The method further includes: The voice data is compared with the risk voiceprint feature database to obtain the comparison results; If the comparison result indicates that the voiceprint features of the voice data match the risk voiceprint feature database, the transaction risk result is determined to be an abnormal transaction.

8. A transaction risk identification device, characterized in that, include: The data acquisition module is used to collect voice data from the transaction requester in response to large fund transfer requests. The first recognition module is used to perform text-content-based verification on the voice data and generate a first recognition result; The second recognition module is used to perform voiceprint feature-based verification on the voice data and generate a second recognition result; The third recognition module is used to perform artificial intelligence voice change detection on the voice data and generate a third recognition result and an anomaly score. The determination module is used to determine the transaction risk result based on the first identification result, the second identification result, the third identification result, and the anomaly score; as well as The execution module is used to execute transactions based on the transaction risk results.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images