Abnormal transaction detection method and device, and storage medium

Abstract

The application discloses a method and device for detecting abnormal transactions and a storage medium. The method relates to the field of artificial intelligence and comprises the following steps: acquiring a transaction data stream to be detected; inputting the transaction data stream into an abnormal transaction detection model, and outputting an abnormal transaction probability value corresponding to the transaction data stream by using the abnormal transaction detection model, wherein the abnormal transaction detection model is a model obtained by training based on simulation samples; and making a decision according to a preset threshold and the abnormal transaction probability value to obtain an abnormal transaction detection result for the transaction data stream. The application solves the problem of low accuracy of abnormal transaction detection in the related art.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and more specifically, to a method, apparatus, and storage medium for detecting abnormal transactions. Background Technology

[0002] Anomaly detection is one of the risk control measures of financial institutions. It mainly uses data analysis technology and machine learning algorithms to identify trading behaviors that deviate from normal patterns.

[0003] However, the sample ratio of datasets for abnormal transaction detection is usually unbalanced, with abnormal transaction samples accounting for a smaller proportion compared to normal samples. Although existing technologies usually obtain abnormal transaction detection models by manually annotating datasets and training the entire model, the annotation data cycle is long and the model iteration frequency is low, making it difficult to cope with new abnormal transaction patterns, thus affecting the accuracy of abnormal transaction detection.

[0004] There is currently no effective solution to the problem of low accuracy in abnormal transaction detection in related technologies. Summary of the Invention

[0005] The main objective of this application is to provide a method, apparatus, and storage medium for detecting abnormal transactions, in order to solve the problem of low accuracy in abnormal transaction detection in related technologies.

[0006] To achieve the above objectives, according to one aspect of this application, a method for detecting abnormal transactions is provided. The method includes: acquiring a transaction data stream to be detected; inputting the transaction data stream into an abnormal transaction detection model, and using the abnormal transaction detection model to output an abnormal transaction probability value corresponding to the transaction data stream, wherein the abnormal transaction detection model is a model trained based on simulation samples; and making a decision based on a preset threshold and the abnormal transaction probability value to obtain an abnormal transaction detection result for the transaction data stream.

[0007] Furthermore, the training steps of the abnormal transaction detection model include: acquiring simulation samples and acquiring newly added training samples, combining the simulation samples and the newly added training samples to obtain a training dataset; dividing the training dataset to obtain multiple training subsets, and incrementally training multiple preset detection models based on the multiple training subsets to obtain the abnormal transaction detection model.

[0008] Furthermore, obtaining simulation samples includes: training a generative adversarial neural network model using historical abnormal transaction data to obtain an adversarial sample generation model; obtaining multiple adversarial samples based on the adversarial sample generation model; and filtering the multiple adversarial samples using a preset detection model to obtain simulation samples, wherein the simulation samples are adversarial samples that cannot be correctly detected by the preset detection model among the multiple adversarial samples.

[0009] Furthermore, obtaining new training samples includes: obtaining unlabeled transaction samples, determining the Euclidean distance between labeled and unlabeled transaction samples, and determining the confidence score of the unlabeled transaction samples based on the Euclidean distance; if the confidence score is greater than a preset score, determining the label of the unlabeled transaction samples based on the label of the labeled transaction samples, thus obtaining new training samples.

[0010] Furthermore, after determining the confidence score of the unlabeled transaction sample based on Euclidean distance, the method also includes: adding the unlabeled transaction sample to the sample pool if the confidence score is less than the preset score; selecting multiple samples to be reviewed from the sample pool through uncertainty sampling, sending the multiple samples to be reviewed to the server of the annotator, and receiving the annotation results of the multiple samples to be reviewed; and determining the multiple samples to be reviewed as new training samples based on the annotation results.

[0011] Furthermore, after making a decision based on the preset threshold and the probability value of abnormal transactions, the method also includes: obtaining the detection quantity information and detection result information of the abnormal transaction detection model within a preset time range; determining the attack intensity index based on the detection quantity information and detection result information; and adjusting the preset threshold using the attack intensity index to obtain the adjusted preset threshold.

[0012] To achieve the above objectives, according to another aspect of this application, an abnormal transaction detection device is provided. The device includes: a data receiving unit for acquiring a transaction data stream to be detected; a probability output unit for inputting the transaction data stream into an abnormal transaction detection model and outputting an abnormal transaction probability value corresponding to the transaction data stream using the abnormal transaction detection model, wherein the abnormal transaction detection model is a model trained based on simulation samples; and a result acquisition unit for making a decision based on a preset threshold and the abnormal transaction probability value to obtain an abnormal transaction detection result for the transaction data stream.

[0013] Furthermore, the device also includes: a sample set unit, used to acquire simulation samples and newly added training samples, and to combine the simulation samples and newly added training samples to obtain a training dataset; and an incremental learning unit, used to divide the training dataset to obtain multiple training subsets, and to incrementally train multiple preset detection models based on the multiple training subsets to obtain an abnormal transaction detection model.

[0014] Furthermore, the sample set unit includes: a generative adversarial training module, used to train the generative adversarial neural network model using abnormal transaction historical data to obtain an adversarial sample generation model; an adversarial sample acquisition module, used to acquire multiple adversarial samples based on the adversarial sample generation model; and a sample screening module, used to screen multiple adversarial samples using a preset detection model to obtain simulation samples, wherein the simulation samples are adversarial samples that cannot be correctly detected by the preset detection model among the multiple adversarial samples.

[0015] Furthermore, the sample set unit includes: a confidence determination module, used to acquire unlabeled transaction samples, determine the Euclidean distance between labeled transaction samples and unlabeled transaction samples, and determine the confidence score of unlabeled transaction samples based on the Euclidean distance; and a first determination module, when the confidence score is greater than a preset score, determines the label of unlabeled transaction samples based on the label of labeled transaction samples, thereby obtaining newly added training samples.

[0016] Furthermore, the sample set unit also includes: a sample pool addition module, used to add unlabeled transaction samples to the sample pool after determining the confidence score of unlabeled transaction samples based on Euclidean distance, if the confidence score is less than a preset score; a sampling module, used to select multiple samples to be reviewed from the sample pool through uncertainty sampling, and send the multiple samples to be reviewed to the server of the annotator, and receive the annotation results of the multiple samples to be reviewed; and a second determination module, used to determine the multiple samples to be reviewed as new training samples based on the annotation results.

[0017] Furthermore, after making a decision based on a preset threshold and an abnormal transaction probability value, the device also includes: an information acquisition unit for acquiring the detection quantity information and detection result information of the abnormal transaction detection model within a preset time range; an intensity determination unit for determining an attack intensity index based on the detection quantity information and detection result information; and a threshold adjustment unit for adjusting the preset threshold using the attack intensity index to obtain the adjusted preset threshold.

[0018] According to another aspect of this application, a computer-readable storage medium is provided, which includes a stored program, wherein, when the program is running, it controls the device where the computer-readable storage medium is located to execute a method for detecting any kind of abnormal transaction.

[0019] According to another aspect of this application, an electronic device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include a detection method for performing any kind of abnormal transaction.

[0020] According to another aspect of this application, a computer program product is provided, including computer instructions, which, when executed by a processor, implement the steps of an abnormal transaction detection method for any of the above-mentioned items.

[0021] In this embodiment, the transaction data stream to be detected is acquired; the transaction data stream is input into an abnormal transaction detection model, and the abnormal transaction probability value corresponding to the transaction data stream is output by the abnormal transaction detection model. The abnormal transaction detection model is a model trained based on simulation samples. A decision is made based on a preset threshold and the abnormal transaction probability value to obtain the abnormal transaction detection result for the transaction data stream, which solves the technical problem of low accuracy of abnormal transaction detection in the prior art.

[0022] An abnormal transaction detection model is obtained by training with simulated samples. Then, the transaction data stream is acquired and the abnormal transaction detection model is used to detect abnormal transactions and obtain abnormal transaction probability values. The abnormal transaction detection results are determined based on preset thresholds and abnormal transaction probability values. The use of simulated samples improves the robustness of abnormal transaction prediction and increases the accuracy of abnormal transaction detection. Attached Figure Description

[0023] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0024] Figure 1 A hardware structure block diagram of a computer terminal for implementing a method for detecting abnormal transactions is shown.

[0025] Figure 2 This is a flowchart of an abnormal transaction detection method provided according to an embodiment of this application;

[0026] Figure 3 This is a schematic diagram of an abnormal transaction detection device provided according to an embodiment of this application;

[0027] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, do not violate public order and good morals, and provide corresponding access points for users to choose to authorize or refuse. For example, this system has interfaces with relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0031] Example 1

[0032] According to an embodiment of this application, a method embodiment for detecting abnormal transactions is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0033] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a method for detecting abnormal transactions is shown. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0034] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0035] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal transaction detection method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the above-mentioned abnormal transaction detection method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0036] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0037] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0038] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for detecting abnormal transactions is shown. Figure 2 This is a flowchart of an abnormal transaction detection method according to Embodiment 1 of this application.

[0039] Step S201: Obtain the transaction data stream to be detected.

[0040] Optionally, the target financial institution can continuously collect transaction data streams from the transaction system in real time through program interfaces, database queries, or log file reading. The transaction data streams may include at least one of the following: transaction timestamp, transaction device information, IP address, and transaction amount.

[0041] Step S202: Input the transaction data stream into the abnormal transaction detection model, and use the abnormal transaction detection model to output the abnormal transaction probability value corresponding to the transaction data stream. The abnormal transaction detection model is a model trained based on simulation samples.

[0042] Optionally, the abnormal transaction detection model can be a model trained using simulated samples on supervised learning models such as support vector machines, random forests, gradient boosting trees, or deep neural networks. For example, a recurrent neural network model can be selected for training to learn deep feature representations from simulated samples, thereby capturing new patterns of abnormal transactions that are not present in existing samples. The abnormal transaction model can consist of an input layer, multiple hidden layers based on a bidirectional long short-term memory neural network, and an output layer. The output layer can be a fully connected softmax layer to output the probability value of the abnormal transaction corresponding to the transaction data stream, representing the probability that the transaction is abnormal. The simulated samples can be samples generated using a generative adversarial neural network to simulate real abnormal transaction patterns.

[0043] Step S203: Make a decision based on the preset threshold and the probability value of abnormal transactions to obtain the abnormal transaction detection results for the transaction data stream.

[0044] For example, if the probability value of an abnormal transaction is 0.88, and the preset threshold is 0.85, meaning the probability value of an abnormal transaction is greater than the preset threshold, then the abnormal transaction detection result is an abnormal transaction. If the probability value of an abnormal transaction is less than the preset threshold, then the abnormal transaction detection result is a normal transaction. It should be noted that, in this embodiment, an abnormal transaction can refer to a transaction mode other than a normal transaction caused by accidental touch operation, system failure, or other similar behavior.

[0045] In summary, an abnormal transaction detection model is obtained by training with simulated samples. Then, transaction data streams are acquired and the abnormal transaction detection model is used to detect abnormal transactions and obtain abnormal transaction probability values. Based on preset thresholds and abnormal transaction probability values, the abnormal transaction detection results are determined. Using simulated samples improves the robustness of abnormal transaction prediction and increases the accuracy of abnormal transaction detection.

[0046] To improve the accuracy of abnormal transaction detection, the training steps of the abnormal transaction detection model may optionally include: acquiring simulation samples and acquiring new training samples, combining the simulation samples and the new training samples to obtain a training dataset; dividing the training dataset to obtain multiple training subsets, and incrementally training multiple preset detection models based on the multiple training subsets to obtain the abnormal transaction detection model.

[0047] Optionally, the model training process in this embodiment uses a lightweight incremental architecture. For the training dataset consisting of simulation samples and newly added training samples, the data in the training dataset can be divided into a preset number of parts, and the multiple training subsets are stored in a Kafka queue through distributed storage. Multiple preset detection models constitute multiple training sub-nodes in this embodiment. The corresponding preset detection model can be trained independently on each sub-node through federated training to obtain the local parameter changes of each preset detection model. The central server then merges the local parameter changes of multiple sub-nodes through federated averaging to update the global model (i.e., the whole consisting of multiple preset detection models, whose initial parameters are distributed from the parameters of the global model) to obtain the abnormal transaction detection model. Optionally, after each batch of training, the importance score of each feature can be calculated using the SHAP value (feature contribution value), and the features can be filtered using the importance score to remove low-contribution features (i.e., features with importance scores lower than the preset score).

[0048] In summary, by acquiring simulation samples and newly added training samples, and combining the simulation samples and the newly added training samples, a training dataset is obtained. The training dataset is then divided into multiple training subsets, and multiple preset detection models are trained incrementally based on these multiple training subsets to obtain an abnormal transaction detection model, thereby improving the accuracy of abnormal transaction detection.

[0049] To improve the accuracy of abnormal transaction detection, optionally, obtaining simulation samples includes: training a generative adversarial neural network model using historical abnormal transaction data to obtain an adversarial sample generation model; obtaining multiple adversarial samples based on the adversarial sample generation model; and filtering the multiple adversarial samples using a preset detection model to obtain simulation samples, wherein the simulation samples are adversarial samples that cannot be correctly detected by the preset detection model among the multiple adversarial samples.

[0050] For example, a generative adversarial neural network (GAN) can include a generator and a discriminator. The generator includes multiple hidden layers (256 dimensions, using ReLU activation) and three fully connected layers, while the discriminator is a convolutional neural network. After generating multiple adversarial examples using the adversarial example generation model, the effectiveness of these multiple adversarial examples can be verified. That is, any pre-set detection model before parameter updates can be used to detect multiple adversarial examples. For any adversarial example, if the pre-set detection model detects an abnormal transaction, then the adversarial example can be correctly detected by the pre-set detection model and is not considered a missed detection. If the pre-set detection model detects a normal transaction, then the adversarial example can mislead the pre-set detection model. Using this adversarial example as a simulation sample corresponding to the pre-set detection model can effectively improve the robustness of the pre-set detection model.

[0051] In summary, by training a generative adversarial neural network model using historical data of abnormal transactions, an adversarial sample generation model is obtained; multiple adversarial samples are obtained based on the adversarial sample generation model; and simulated samples are obtained by screening multiple adversarial samples using a preset detection model. Among these, the simulated samples are adversarial samples that cannot be correctly detected by the preset detection model, thereby improving the accuracy of abnormal transaction detection.

[0052] To improve the accuracy of abnormal transaction detection, optionally, obtaining new training samples includes: obtaining unlabeled transaction samples, determining the Euclidean distance between labeled and unlabeled transaction samples, and determining the confidence score of the unlabeled transaction samples based on the Euclidean distance; if the confidence score is greater than a preset score, determining the label of the unlabeled transaction samples based on the label of the labeled transaction samples, thus obtaining new training samples.

[0053] Optionally, this embodiment achieves automated sample labeling through confidence propagation and active learning. Confidence propagation involves determining the Euclidean distance between labeled and unlabeled transaction samples after obtaining unlabeled transaction samples, and then determining the confidence score of the unlabeled transaction samples based on the Euclidean distance. The Euclidean distance can be obtained using the following formula:

[0054]

[0055] In this context, the RBF kernel represents the radial basis function, which maps the original data to a higher-dimensional space before calculating the Euclidean distance. exp represents the natural exponential function, γ represents the hyperparameter (used to determine the width of the RBF kernel), xi represents unlabeled transaction samples, and xj represents labeled transaction samples. Multiple labeled transaction samples with an Euclidean distance less than a preset distance can be selected as neighbors of the unlabeled transaction samples. The confidence score (the proportion of a particular label among the neighbors) is determined by weighted voting based on the labels of these neighbors. For example, if the neighbors have 9 abnormal transactions and 1 normal transaction, the confidence score is 0.9. The preset score can be 0.88. In this case, the label of the unlabeled transaction sample can be determined as an abnormal transaction and used as a new training sample.

[0056] In summary, by acquiring unlabeled transaction samples, the Euclidean distance between labeled and unlabeled transaction samples is determined, and the confidence score of the unlabeled transaction samples is determined based on the Euclidean distance. If the confidence score is greater than the preset score, the label of the unlabeled transaction samples is determined based on the label of the labeled transaction samples, thus obtaining new training samples. This improves the efficiency of sample labeling and thereby improves the accuracy of abnormal transaction detection.

[0057] To improve the accuracy of abnormal transaction detection, optionally, after determining the confidence score of the unlabeled transaction sample based on Euclidean distance, the method further includes: adding the unlabeled transaction sample to the sample pool if the confidence score is less than a preset score; selecting multiple samples to be reviewed from the sample pool through uncertainty sampling, sending the multiple samples to be reviewed to the server of the annotator, receiving the annotation results of the multiple samples to be reviewed; and determining the multiple samples to be reviewed as new training samples based on the annotation results.

[0058] For example, if the confidence score is 0.55 and the preset score is 0.88, unlabeled transaction samples can be added to the sample pool, which stores multiple unlabeled transaction samples that meet the above criteria. Every 5 minutes, 100 samples can be selected from the sample pool as review samples through uncertainty sampling. These review samples, in JSON format, can then be labeled by labelers via a webpage. The labeling results are obtained through a program interface, and the labeling results and the corresponding review samples are used as new training samples.

[0059] Optionally, the preset score can be adjusted based on the annotation results. For example, initially, the preset score for both abnormal and normal transactions is 0.9. When it is found that the number of normal transaction samples in the annotation results is more than 50% of the number of abnormal transactions, the preset score for normal transactions can be lowered to 0.8 (that is, out of 10 adjacent samples, there are 9 normal transactions and 2 abnormal transactions).

[0060] In summary, by adding unlabeled transaction samples to the sample pool when the confidence score is lower than the preset score, selecting multiple samples to be reviewed from the sample pool through uncertainty sampling, sending these multiple samples to the server of the annotators, receiving the annotation results of the multiple samples to be reviewed, and determining the multiple samples to be reviewed as new training samples based on the annotation results, the accuracy of abnormal transaction detection is improved.

[0061] To improve the accuracy of abnormal transaction detection, the method may optionally include, after making a decision based on a preset threshold and the probability value of abnormal transactions: obtaining the detection quantity information and detection result information of the abnormal transaction detection model within a preset time range; determining the attack intensity index based on the detection quantity information and detection result information; and adjusting the preset threshold using the attack intensity index to obtain the adjusted preset threshold.

[0062] Optionally, the attack frequency can be determined based on the detection quantity information, detection result information, and a preset time range (e.g., the proportion of abnormal transactions in the detection quantity information). The abnormal transaction detection model can be a multi-label classification model, meaning the abnormal transaction detection model can output the probability value of an abnormal transaction data stream belonging to multiple different abnormal transaction patterns (e.g., there are five categories: A, E, and F, and the probability value of the transaction corresponding to the data stream being a category A abnormal transaction is 0.3). The total number of abnormal transaction patterns can be calculated based on the detection quantity information and detection result information (e.g., three categories: A, B, and C) to obtain the number of types. The attack intensity index is obtained by weighted summing of the attack frequency and the number of types. If the attack intensity index is greater than a preset index, the preset threshold is reduced (e.g., reduced by 0.05) to obtain the adjusted preset threshold.

[0063] In summary, by acquiring the detection quantity and results information of the abnormal transaction detection model within a preset time range; determining the attack intensity index based on the detection quantity and results information; and adjusting the preset threshold using the attack intensity index to obtain the adjusted preset threshold, the system achieves dynamic adjustment of the preset threshold according to the detection situation, thereby improving the accuracy of abnormal transaction detection.

[0064] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0065] Example 2

[0066] This application also provides an abnormal transaction detection device. It should be noted that the abnormal transaction detection device of this application can be used to execute the abnormal transaction detection method provided in this application. The abnormal transaction detection device provided in this application will be described below.

[0067] According to embodiments of this application, an apparatus for implementing the above-described method for detecting abnormal transactions is also provided, such as... Figure 3 As shown, the device includes:

[0068] The data receiving unit 301 is used to acquire the transaction data stream to be detected.

[0069] The probability output unit 302 is used to input the transaction data stream into the abnormal transaction detection model and output the abnormal transaction probability value corresponding to the transaction data stream using the abnormal transaction detection model, wherein the abnormal transaction detection model is a model trained based on simulation samples.

[0070] The result acquisition unit 303 is used to make a decision based on a preset threshold and the abnormal transaction probability value to obtain the abnormal transaction detection result for the transaction data stream.

[0071] The abnormal transaction detection device provided in this application embodiment acquires the transaction data stream to be detected through a data receiving unit 301, inputs the transaction data stream into an abnormal transaction detection model through a probability output unit 302, and outputs the abnormal transaction probability value corresponding to the transaction data stream using the abnormal transaction detection model. The abnormal transaction detection model is a model trained based on simulated samples. A result acquisition unit 303 makes a decision based on a preset threshold and the abnormal transaction probability value to obtain the abnormal transaction detection result for the transaction data stream, thus solving the problem of low accuracy in abnormal transaction detection in related technologies. This achieves the effect of improving the accuracy of abnormal transaction detection.

[0072] Optionally, in the abnormal transaction detection device provided in the embodiments of this application, the device further includes: a sample set unit, used to acquire simulation samples and newly added training samples, and to combine the simulation samples and newly added training samples to obtain a training dataset; and an incremental learning unit, used to divide the training dataset to obtain multiple training subsets, and to incrementally train multiple preset detection models based on the multiple training subsets to obtain an abnormal transaction detection model.

[0073] Optionally, in the abnormal transaction detection device provided in this application embodiment, the sample set unit includes: a generative adversarial training module, used to train a generative adversarial neural network model using historical abnormal transaction data to obtain an adversarial sample generation model; an adversarial sample acquisition module, used to acquire multiple adversarial samples based on the adversarial sample generation model; and a sample screening module, used to screen multiple adversarial samples using a preset detection model to obtain simulated samples, wherein the simulated samples are adversarial samples that cannot be correctly detected by the preset detection model among the multiple adversarial samples.

[0074] Optionally, in the abnormal transaction detection device provided in this application embodiment, the sample set unit includes: a confidence determination module, used to acquire unlabeled transaction samples, determine the Euclidean distance between labeled transaction samples and unlabeled transaction samples, and determine the confidence score of unlabeled transaction samples based on the Euclidean distance; and a first determination module, when the confidence score is greater than a preset score, determines the label of unlabeled transaction samples based on the label of labeled transaction samples, thereby obtaining newly added training samples.

[0075] Optionally, in the abnormal transaction detection device provided in this application embodiment, the sample set unit further includes: a sample pool addition module, used to add unlabeled transaction samples to the sample pool after determining the confidence score of unlabeled transaction samples based on Euclidean distance, if the confidence score is less than a preset score; a sampling module, used to select multiple samples to be reviewed from the sample pool through uncertainty sampling, and send the multiple samples to be reviewed to the server of the annotator, and receive the annotation results of the multiple samples to be reviewed; and a second determination module, used to determine the multiple samples to be reviewed as new training samples based on the annotation results.

[0076] Optionally, in the abnormal transaction detection device provided in this application embodiment, after making a decision based on a preset threshold and an abnormal transaction probability value, the device further includes: an information acquisition unit, used to acquire detection quantity information and detection result information of the abnormal transaction detection model within a preset time range; an intensity determination unit, used to determine an attack intensity index based on the detection quantity information and detection result information; and a threshold adjustment unit, used to adjust the preset threshold using the attack intensity index to obtain the adjusted preset threshold.

[0077] It should be noted that the data receiving unit 301, probability output unit 302, and result acquisition unit 303 mentioned above correspond to steps S201 to S204 in Embodiment 1. The instances and application scenarios implemented by the units and corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be part of the device and run in the computer terminal 10 provided in Embodiment 1.

[0078] Example 3

[0079] Embodiments of this application may provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (Only one is shown) Processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0080] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0081] The processor can access the information and application programs stored in the memory via the transmission device to perform the following steps: acquiring the transaction data stream to be detected; inputting the transaction data stream into the abnormal transaction detection model, and using the abnormal transaction detection model to output the abnormal transaction probability value corresponding to the transaction data stream, wherein the abnormal transaction detection model is a model trained based on simulation samples; making a decision based on a preset threshold and the abnormal transaction probability value to obtain the abnormal transaction detection result for the transaction data stream.

[0082] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: acquire simulation samples and acquire newly added training samples, combine the simulation samples and newly added training samples to obtain a training dataset; divide the training dataset to obtain multiple training subsets, and train multiple preset detection models incrementally based on the multiple training subsets to obtain an abnormal transaction detection model.

[0083] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: train the generative adversarial neural network model using abnormal transaction history data to obtain an adversarial sample generation model; obtain multiple adversarial samples based on the adversarial sample generation model; and filter the multiple adversarial samples using a preset detection model to obtain simulated samples, wherein the simulated samples are adversarial samples that cannot be correctly detected by the preset detection model among the multiple adversarial samples.

[0084] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: obtain unlabeled transaction samples, determine the Euclidean distance between labeled transaction samples and unlabeled transaction samples, and determine the confidence score of unlabeled transaction samples based on the Euclidean distance; if the confidence score is greater than the preset score, determine the label of unlabeled transaction samples based on the label of labeled transaction samples to obtain new training samples.

[0085] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: when the confidence score is less than the preset score, add the unlabeled transaction sample to the sample pool; select multiple samples to be reviewed from the sample pool through uncertainty sampling, send the multiple samples to be reviewed to the server of the annotator, and receive the annotation results of the multiple samples to be reviewed; determine the multiple samples to be reviewed as new training samples based on the annotation results.

[0086] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: obtain the detection quantity information and detection result information of the abnormal transaction detection model within a preset time range; determine the attack intensity index based on the detection quantity information and detection result information; adjust the preset threshold using the attack intensity index to obtain the adjusted preset threshold.

[0087] This application provides a scheme for detecting abnormal transactions. It involves acquiring a transaction data stream to be detected; inputting the transaction data stream into an abnormal transaction detection model; and using the abnormal transaction detection model to output the abnormal transaction probability value corresponding to the transaction data stream. The abnormal transaction detection model is a model trained based on simulated samples. A decision is made based on a preset threshold and the abnormal transaction probability value to obtain the abnormal transaction detection result for the transaction data stream, thus solving the technical problem of low accuracy in abnormal transaction detection in the prior art.

[0088] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0089] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0090] Example 4

[0091] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the abnormal transaction detection method provided in Embodiment 1.

[0092] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0093] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: acquiring the transaction data stream to be detected; inputting the transaction data stream into an abnormal transaction detection model, and using the abnormal transaction detection model to output the abnormal transaction probability value corresponding to the transaction data stream, wherein the abnormal transaction detection model is a model trained based on simulation samples; making a decision based on a preset threshold and the abnormal transaction probability value to obtain the abnormal transaction detection result for the transaction data stream.

[0094] Optionally, in this embodiment, the computer-readable storage medium is further configured to store program code for performing the following steps: acquiring simulation samples and acquiring newly added training samples, combining the simulation samples and the newly added training samples to obtain a training dataset; dividing the training dataset to obtain multiple training subsets, and training multiple preset detection models incrementally based on the multiple training subsets to obtain an abnormal transaction detection model.

[0095] Optionally, in this embodiment, the computer-readable storage medium is further configured to store program code for performing the following steps: training a generative adversarial neural network model using abnormal transaction history data to obtain an adversarial sample generation model; obtaining multiple adversarial samples based on the adversarial sample generation model; and filtering the multiple adversarial samples using a preset detection model to obtain simulated samples, wherein the simulated samples are adversarial samples that cannot be correctly detected by the preset detection model among the multiple adversarial samples.

[0096] Optionally, in this embodiment, the computer-readable storage medium is further configured to store program code for performing the following steps: obtaining unlabeled transaction samples, determining the Euclidean distance between labeled transaction samples and unlabeled transaction samples, and determining the confidence score of the unlabeled transaction samples based on the Euclidean distance; if the confidence score is greater than a preset score, determining the label of the unlabeled transaction samples based on the labels of the labeled transaction samples, and obtaining new training samples.

[0097] Optionally, in this embodiment, the computer-readable storage medium is further configured to store program code for performing the following steps: adding unlabeled transaction samples to the sample pool when the confidence score is less than a preset score; selecting multiple samples to be reviewed from the sample pool through uncertainty sampling, sending the multiple samples to be reviewed to the server of the annotator, and receiving the annotation results of the multiple samples to be reviewed; determining the multiple samples to be reviewed as new training samples based on the annotation results.

[0098] Optionally, in this embodiment, the computer-readable storage medium is further configured to store program code for performing the following steps: obtaining detection quantity information and detection result information of the abnormal transaction detection model within a preset time range; determining an attack intensity index based on the detection quantity information and detection result information; and adjusting a preset threshold using the attack intensity index to obtain an adjusted preset threshold.

[0099] This application also provides a computer program product, which, when executed on a data processing device, is suitable for performing steps of a method for detecting abnormal transactions.

[0100] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0101] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0102] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0103] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0104] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0105] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0106] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting abnormal transactions, characterized in that, include: Obtain the transaction data stream to be inspected; The transaction data stream is input into the abnormal transaction detection model, and the abnormal transaction probability value corresponding to the transaction data stream is output by the abnormal transaction detection model. The abnormal transaction detection model is a model trained based on simulation samples. A decision is made based on a preset threshold and the probability value of the abnormal transaction, resulting in an abnormal transaction detection result for the transaction data stream.

2. The method according to claim 1, characterized in that, The training steps for the abnormal transaction detection model include: Obtain the simulation samples and the newly added training samples, and combine the simulation samples and the newly added training samples to obtain the training dataset; The training dataset is divided into multiple training subsets, and multiple preset detection models are trained incrementally based on the multiple training subsets to obtain the abnormal transaction detection model.

3. The method according to claim 2, characterized in that, Obtaining the simulation sample includes: By training a generative adversarial neural network model using historical data of abnormal transactions, an adversarial example generation model is obtained. Multiple adversarial examples are obtained based on the aforementioned adversarial example generation model; The preset detection model is used to filter the multiple adversarial samples to obtain the simulated samples, wherein the simulated samples are the adversarial samples that cannot be correctly detected by the preset detection model among the multiple adversarial samples.

4. The method according to claim 1, characterized in that, Obtaining new training samples includes: Obtain unlabeled transaction samples, determine the Euclidean distance between labeled transaction samples and the unlabeled transaction samples, and determine the confidence score of the unlabeled transaction samples based on the Euclidean distance; If the confidence score is greater than the preset score, the label of the unlabeled transaction sample is determined based on the label of the labeled transaction sample, and the newly added training sample is obtained.

5. The method according to claim 4, characterized in that, After determining the confidence score of the unlabeled transaction sample based on the Euclidean distance, the method further includes: If the confidence score is less than the preset score, the unlabeled transaction sample is added to the sample pool; Multiple samples to be reviewed are selected from the sample pool using an uncertainty sampling method, and the multiple samples to be reviewed are sent to the server of the annotator to receive the annotation results of the multiple samples to be reviewed; Based on the annotation results, the multiple samples to be reviewed are identified as new training samples.

6. The method according to claim 1, characterized in that, After making a decision based on a preset threshold and the probability value of abnormal transactions, the method further includes: Obtain the detection quantity and detection result information of the abnormal transaction detection model within a preset time range; The attack intensity index is determined based on the number of detections and the detection results. The preset threshold is adjusted using the attack strength index to obtain the adjusted preset threshold.

7. A device for detecting abnormal transactions, characterized in that, include: The data receiving unit is used to acquire the transaction data stream to be detected; A probability output unit is used to input the transaction data stream into an abnormal transaction detection model and output the abnormal transaction probability value corresponding to the transaction data stream using the abnormal transaction detection model, wherein the abnormal transaction detection model is a model trained based on simulation samples. The result acquisition unit is used to make decisions based on a preset threshold and the abnormal transaction probability value to obtain abnormal transaction detection results for the transaction data stream.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the computer-readable storage medium is located to perform the abnormal transaction detection method according to any one of claims 1 to 6.

9. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, executes the abnormal transaction detection method according to any one of claims 1 to 6.

10. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the abnormal transaction detection method according to any one of claims 1 to 6.

Images