Abnormal transaction behavior processing method and device, storage medium and computer device

Abstract

This application relates to the field of anomaly detection technology, and discloses a method, apparatus, storage medium, and computer device for processing abnormal trading behavior. The method includes: acquiring a multi-dimensional sequence of user trading behavior data by sliding a window along a time axis; calculating baseline deviation using the mean and standard deviation of each dimension's data sequence to capture statistical shifts in behavior relative to historical habits; simultaneously reconstructing the sequence using a pre-trained trading behavior autoencoder and calculating the reconstruction error; fusing the baseline deviation and reconstruction error of each dimension into a fusion score for that dimension; then weighting and accumulating the fusion scores of each dimension according to the multi-dimensional weights corresponding to the current trading scenario to obtain a total fusion score representing the overall degree of anomaly; finally, comparing the total fusion score with an anomaly behavior judgment threshold adapted to the scenario to determine whether the user has engaged in abnormal trading behavior. This method can be applied to fintech scenarios.

Description

Technical Field

[0001] This application relates to the field of anomaly identification technology, and in particular to a method, apparatus, storage medium, and computer equipment for processing abnormal transaction behavior. Background Technology

[0002] With the rapid development of internet payment, e-commerce, and various online service platforms, high-frequency trading has become the norm in the digital economy. In payment and financial transaction systems, high-frequency trading is often closely related to fraud attacks, credential stuffing attacks, or automated script operations. Traditional risk control methods typically rely on rule engines or threshold strategies for interception, such as setting limits on the number of transactions per unit time, amount thresholds, or device frequency limits. These methods are effective in simple scenarios, but they have significant shortcomings in complex, highly dynamic environments.

[0003] However, traditional rule-based methods rely on human experience to set rules, making it difficult to adapt to rapid changes in trading behavior. Once attack patterns change (e.g., frequency decreases but duration increases), fixed threshold strategies are prone to failure, leading to missed detections or false positives. Furthermore, high-frequency trading exhibits clear time-series characteristics; its anomalies are often reflected in "changes in behavioral patterns" rather than single indicators, which traditional methods struggle to capture. In addition, while some systems incorporate machine learning models, these are often trained offline, failing to meet real-time detection requirements and resulting in delayed risk response. In high-concurrency scenarios, systems need to make decisions quickly, thus placing extremely high demands on model efficiency and real-time performance.

[0004] Currently, the accuracy and response speed of risk control decisions need to be improved. Summary of the Invention

[0005] In view of this, embodiments of this application provide a method, apparatus, storage medium, and computer device for processing abnormal transaction behavior, thereby improving the accuracy of abnormal behavior identification and response speed.

[0006] According to one aspect of this application, a method for handling abnormal transaction behavior is provided, the method comprising: By using a sliding window mechanism, users can obtain multi-dimensional transaction behavior data sequences. Based on the mean and standard deviation of the transaction behavior data sequences for each dimension, the baseline deviation of the transaction behavior data sequences for each dimension is determined; and, the transaction behavior data sequences for each dimension are reconstructed using a pre-trained transaction behavior autoencoder, and the reconstruction error of the transaction behavior data sequences for each dimension is determined based on the reconstructed transaction behavior sequences for each dimension and the transaction behavior data sequences. Based on the baseline deviation and reconstruction error of each dimension, the fusion score of the transaction behavior data sequence of each dimension is determined; Obtain the multi-dimensional weights and abnormal behavior judgment thresholds corresponding to the current transaction scenario, and perform weighted calculation on the fusion score of each dimension according to the multi-dimensional weights to obtain the total fusion score of the transaction behavior data sequence; Based on the overall fusion score and the abnormal behavior determination threshold, it is determined whether the user has engaged in abnormal transaction behavior.

[0007] According to another aspect of this application, an apparatus for processing abnormal transaction behavior is provided, the apparatus comprising: The data acquisition module is used to acquire multi-dimensional transaction behavior data sequences of users through a sliding window mechanism; The scoring calculation module is used to determine the baseline deviation of the transaction behavior data sequence in each dimension based on the mean and standard deviation of the transaction behavior data sequence in each dimension; and to reconstruct the transaction behavior data sequence in each dimension through a pre-trained transaction behavior autoencoder, and determine the reconstruction error of the transaction behavior data sequence in each dimension based on the reconstructed transaction behavior data sequence in each dimension and the transaction behavior data sequence; to determine the fusion score of the transaction behavior data sequence in each dimension based on the baseline deviation and reconstruction error of each dimension; to obtain the multi-dimensional weights and abnormal behavior judgment thresholds corresponding to the current transaction scenario, and to perform weighted calculation on the fusion score of each dimension based on the multi-dimensional weights to obtain the total fusion score of the transaction behavior data sequence; An anomaly detection module is used to determine whether the user has engaged in abnormal transaction behavior based on the overall fusion score and the abnormal behavior judgment threshold.

[0008] According to another aspect of this application, a storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the above-mentioned method for handling abnormal transaction behavior.

[0009] According to another aspect of this application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the program to implement the above-mentioned method for handling abnormal transaction behavior.

[0010] By employing the above technical solutions, embodiments of this application provide a method, apparatus, storage medium, and computer device for processing abnormal transaction behavior. This method acquires multi-dimensional transaction behavior data sequences of users by sliding a window mechanism along a time axis. It calculates baseline deviation using the mean and standard deviation of each dimension's data sequence to capture statistical shifts in behavior relative to historical habits. Simultaneously, it reconstructs the sequences using a pre-trained transaction behavior autoencoder and calculates the reconstruction error. The baseline deviation and reconstruction error of each dimension are fused into a fusion score for that dimension. Then, the fusion scores of each dimension are weighted and accumulated according to the multi-dimensional weights corresponding to the current transaction scenario to obtain a total fusion score representing the overall degree of abnormality. Finally, this total fusion score is compared with a scenario-adapted abnormal behavior judgment threshold to determine whether the user has engaged in abnormal transaction behavior. Through the technical solutions of this application, a dual-path anomaly detection fusion of statistical baseline deviation and deep learning reconstruction perception is achieved, improving the comprehensiveness and reliability of anomaly detection. Simultaneously, the introduction of scenario-adaptive multi-dimensional weight configuration allows for flexible allocation of the contribution of each behavioral dimension under different transaction scenarios. The resulting total fusion score and dynamic threshold collaborative judgment mechanism improve the accuracy of abnormal behavior identification.

[0011] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0012] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart illustrating a method for handling abnormal transaction behavior provided in an embodiment of this application is shown. Figure 2 A flowchart illustrating another method for handling abnormal transaction behavior provided in an embodiment of this application is shown; Figure 3 A schematic diagram of the structure of a device for processing abnormal transaction behavior provided in an embodiment of this application is shown; Figure 4 A schematic diagram of the device structure of a computer device provided in an embodiment of this application is shown. Detailed Implementation

[0013] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0014] This embodiment provides a method for handling abnormal transaction behavior, such as... Figure 1 As shown, the method includes: Step 101: Use a sliding window mechanism to obtain multi-dimensional transaction behavior data sequences of users.

[0015] In this step, the sliding window mechanism refers to a data sampling strategy that extracts data segments from a continuous data stream over a fixed time span (such as the past 30 minutes, 1 hour, or 24 hours). The window size can be preset or adaptively adjusted according to the dynamic characteristics of the transaction scenario. For example, the multi-dimensional aspects specifically include: transaction frequency dimension, representing the number of transactions by the user per unit time; transaction amount dimension, representing the total transaction amount or average amount per transaction by the user per unit time; device fingerprint dimension, representing the hardware and software feature vectors of the terminal device used by the user when conducting transactions; geographic location dimension, representing the distance deviation between the user's transaction initiation location and frequently used locations; operational behavior dimension, representing the user's click flow, dwell time, or input rhythm characteristics on the transaction page; and order feature dimension, representing the degree of matching between the user's current transaction's product category, payment method, or delivery address and historical habits.

[0016] In an optional embodiment, the sliding window mechanism includes a first sliding window and a second sliding window running in parallel; the first sliding window has a first time length and a first sliding step size, used to capture instantaneous pulse-like anomalies in the transaction behavior data sequence; the second sliding window has a second time length and a second sliding step size, the second time length being greater than the first time length and the second sliding step size being greater than the first sliding step size, used to capture gradual trend anomalies in the transaction behavior data sequence; the step of obtaining multi-dimensional user transaction behavior data sequences through the sliding window mechanism includes: obtaining a first transaction behavior data sequence and a second transaction behavior data sequence through the first sliding window and the second sliding window respectively; wherein, the transaction behavior data sequence includes the first transaction behavior data sequence and the second transaction behavior data sequence; the total fusion score corresponding to the transaction behavior data sequence is the maximum value of the total fusion score corresponding to the first transaction behavior data sequence and the total fusion score corresponding to the second transaction behavior data sequence.

[0017] In this embodiment, the first sliding window refers to a data extraction tool with a short time span and a small sliding step. For example, the time length is set to seconds to minutes (e.g., 1 minute, 5 minutes, or 15 minutes), and the step size is set to one-third to one-half of that time length. It is specifically used to capture sudden, instantaneous pulse-like anomalies in transaction behavior data sequences (e.g., a sudden surge in a single transaction amount or a sudden change in device fingerprint). The second sliding window refers to a data extraction tool with a longer time span and a larger sliding step. For example, the time length is set to hours to days (e.g., 2 hours, 24 hours, or 7 days). The second time length is greater than the first time length, and the second sliding step size is greater than the first sliding step size. It is specifically used to capture slowly evolving, gradual trend anomalies in behavior data sequences (e.g., a step-like increase in transaction frequency over several consecutive days or a gradual shift in transaction location). The two windows run in parallel using independent processing threads or lightweight coroutines. After the two windows complete data extraction, subsequent fusion scoring calculations are performed on the transaction behavior data sequences under each window. The final total fusion score used to determine abnormal transaction behavior is the maximum of the two scores.

[0018] Step 102: Determine the baseline deviation of the trading behavior data sequence for each dimension based on the mean and standard deviation of the trading behavior data sequence for each dimension; and reconstruct the trading behavior data sequence for each dimension using a pre-trained trading behavior autoencoder, and determine the reconstruction error of the trading behavior data sequence for each dimension based on the reconstructed trading behavior data sequence for each dimension and the trading behavior data sequence.

[0019] Among them, baseline deviation refers to the degree of deviation of the transaction behavior data sequence in each dimension relative to the historical average level of that dimension. It is quantified by calculating the ratio of the difference between each data point in the sequence and the sequence mean to the standard deviation, reflecting the extent to which the current behavior deviates from daily habits; reconstruction error refers to the difference between the original input sequence and the autoencoder reconstructed output sequence. The larger the difference, the more unconventional behavior patterns that the current input sequence contains that the model cannot reconstruct normally.

[0020] In this step, the baseline deviation is calculated by first traversing the acquired data sequence for each dimension, calling the historical mean and standard deviation parameters stored for that dimension, and then subtracting the mean of that dimension from each data point in the sequence and dividing by the standard deviation to obtain a standardized residual sequence. The arithmetic mean of the absolute values ​​of this residual sequence is then calculated to obtain the single-value measure of the baseline deviation for that dimension. Simultaneously, the reconstruction error is calculated by inputting the same multi-dimensional data sequence as a whole into a pre-trained autoencoder. The encoder compresses the input into a latent vector through a multi-layer fully connected network, and the decoder restores this latent vector into a reconstructed sequence through a symmetric network structure. The difference between the input sequence and the reconstructed sequence is measured using pointwise Euclidean distance or cosine distance. The sum of the distance values ​​of all data points is divided by the sequence length to obtain the reconstruction error for that dimension. This dual measure of baseline deviation and reconstruction error ensures that behavioral anomaly assessment considers both statistically significant relative deviations and globally perceptible pattern anomalies from deep models, with the two complementing each other.

[0021] In an optional embodiment, the pre-trained trading behavior autoencoder is a sequence autoencoder based on a long short-term memory network, the sequence autoencoder including an encoder and a decoder; the encoder is used to compress the trading behavior data sequence of each dimension into a fixed-length behavior latent vector; the decoder is used to restore the behavior latent vector to the trading behavior reconstruction sequence; the reconstruction error is the mean square error or mean absolute error between the trading behavior reconstruction sequence and the trading behavior data sequence. The training steps of the sequence autoencoder include: acquiring a historical normal transaction behavior dataset; performing time-series alignment processing on the historical transaction data of each dimension in the historical normal transaction behavior dataset; and dividing the continuous historical normal transaction behavior into fixed-length training sequence samples according to a preset time window length, with each training sequence sample having the same number of time steps on the time axis; inputting each training sequence sample into the LSTM unit of the encoder sequentially according to the time steps; the LSTM unit of the encoder iteratively updates the hidden state with each time step, and outputs the hidden state at the final time step as a fixed-length behavioral semantic vector, which represents the temporal behavior pattern of the training sequence sample; using the behavioral semantic vector as the initial hidden state of the LSTM unit of the decoder, and recursively restoring the input of each time step from the initial time step. Output values ​​are generated to create predicted transaction behavior sequences with the same time step length as the input sequence. The mean squared error (MSE) between each training sequence sample and its corresponding predicted transaction behavior sequence is calculated step-by-step, and this MSE is used as the main reconstruction loss. Based on this main reconstruction loss, the L2 norm regularization term of each network parameter in the encoder and decoder is added as a regularization loss. The main reconstruction loss and the regularization loss are weighted and summed to form the total training loss. With minimizing the total training loss as the optimization objective, a time-dimensional backpropagation algorithm is used to calculate the gradients of each network parameter in the encoder and decoder along the time axis. An adaptive moment estimation optimizer is used to adaptively adjust the learning rate of each network parameter based on the calculated gradients, and iteratively updates the values ​​of each network parameter until a preset number of training sequence samples have been iterated.

[0022] Step 103: Determine the fusion score of the transaction behavior data sequence for each dimension based on the baseline deviation and reconstruction error of each dimension.

[0023] In this step, the baseline deviation value and reconstruction error value for each dimension are first normalized and aligned, mapping them to a unified numerical range of [0,1]. Then, the normalized deviation and reconstruction error are fused and scored. For example, a weighted summation method can be used to calculate the weighted sum as the fusion score.

[0024] In an optional embodiment, determining the fusion score of the transaction behavior data sequence for each dimension based on the baseline deviation and reconstruction error of each dimension specifically includes: determining a first weighting factor corresponding to the baseline deviation and a second weighting factor corresponding to the reconstruction error based on the user's profile maturity; weighting and summing the baseline deviation and the reconstruction error according to the first weighting factor and the second weighting factor to obtain the fusion score for that dimension; wherein, when the sample size of the user's transaction behavior data sequence is less than a preset sample size threshold, the first weighting factor is greater than the second weighting factor; when the sample size is greater than or equal to the preset sample size threshold, the second weighting factor increases with the increase of the sample size, and the sum of the first weighting factor and the second weighting factor is a fixed value.

[0025] The maturity of a user profile refers to the sufficiency of the historical transaction behavior data records accumulated by the user within the system, which is directly quantified by the total number of valid samples in the corresponding transaction behavior data sequence. The preset sample size threshold refers to the critical sample size boundary value that distinguishes between low-maturity user groups and high-maturity user groups. This value can be pre-calibrated based on the minimum training sample size required for the autoencoder model to achieve stable reconstruction performance, or it can be set according to manual experience or business needs.

[0026] In this embodiment, after obtaining the baseline deviation and reconstruction error of the current user across various dimensions, the system first queries the user profile database to retrieve the total number of the user's historical transaction records. This total number is used as the sample size of the user's transaction behavior data sequence, and a numerical comparison is performed with a preset sample size threshold. When the sample size is less than the preset sample size threshold, the user profile is deemed insufficiently mature, and the autoencoder cannot learn sufficiently generalized normal behavior patterns at this sample size, resulting in low reliability of its output reconstruction error. In this case, the first weight factor is configured to a larger value (e.g., set to a value between 0.7 and 0.9), while the second weight factor is configured to a smaller value (correspondingly set to a value between 0.1 and 0.3), ensuring that the sum of the two equals the fixed normalized value of 1. The configuration of the first weight factor being greater than the second weight factor ensures that the fusion score is primarily dominated by the baseline deviation, with statistical measurement as the core basis. When the sample size is greater than or equal to the preset sample size threshold, the user profile is deemed sufficiently mature, and the autoencoder, supported by sufficient training data, can output a highly reliable reconstruction error. At this point, the dynamic incremental configuration logic is executed: the second weight factor is configured as a monotonically increasing function of the sample size, meaning that as the user sample size continues to accumulate, the second weight factor gradually increases between a preset minimum value and a fixed normalized value of 1; simultaneously, the first weight factor is configured as 1 minus the second weight factor, causing it to decrease synchronously with the increase in sample size. For example, this dynamic configuration logic can be a linear incremental approach, setting the second weight factor as a linear function of the portion of the sample size exceeding a threshold (e.g., the second weight factor increases proportionally with the excess). For every fixed number of additional sample records, the second weight factor is increased by a fixed step size (e.g., increased by 0.01 for every 100 additional records), until a preset value is reached and then remains constant, for example, 0.8. After the above weight factors are configured, the first weight factor is multiplied by the baseline deviation to obtain the first weighted component; the second weight factor is multiplied by the reconstruction error to obtain the second weighted component; the first weighted component and the second weighted component are added together, and the sum is the fusion score for that dimension. This allows the contribution ratio of baseline deviation and reconstruction error in the fusion score to be dynamically adjusted according to the user's data accumulation level: In the low maturity stage, relying on the statistical baseline can effectively avoid false reconstruction signals caused by insufficient training of the autoencoder, ensuring the reliability and interpretability of anomaly detection for cold-start users; In the high maturity stage, the dynamically increasing second weight factor allows the deep model to fully release its ability to characterize multi-dimensional complex behavioral patterns, thus achieving an adaptive dynamic balance between the unreliability of the model caused by data sparsity and the full utilization of deep features when data is abundant.

[0027] Step 104: Obtain the multi-dimensional weights and abnormal behavior judgment thresholds corresponding to the current transaction scenario, and perform weighted calculation on the fusion score of each dimension according to the multi-dimensional weights to obtain the total fusion score of the transaction behavior data sequence.

[0028] In this step, the system first retrieves a matching multi-dimensional weight vector from the weight configuration library based on the specific scenario of the current exchange (including contextual information such as transaction type, transaction time, user location, and transaction channel). Each element in this vector corresponds to the weight coefficient of each data dimension in step 1, and all coefficients are positive and their sum is normalized to 1. For example, the multi-dimensional weights can be preset using expert experience. Risk control experts pre-set weight values ​​based on the prior importance of each dimension under different transaction scenarios and store them in a scenario-weight mapping table. After the system goes live, the table can be directly accessed by scenario. Alternatively, historical data statistics can be used. The system calculates the discrimination index (such as information gain or Gini coefficient) of each dimension in historical abnormal transactions offline every day. The discrimination index is then normalized and used as the dynamic weight of each dimension for the next day, achieving adaptive adjustment of weights as data distribution shifts. After the weight vector is determined, a weighted summation calculation is performed on the feature vector formed by the fusion score of each dimension and the weight vector. The fusion score of each dimension is multiplied by its corresponding weight coefficient, and then the multiplications of all dimensions are summed to obtain the total fusion score.

[0029] Step 105: Determine whether the user has any abnormal transaction behavior based on the total fusion score and the abnormal behavior judgment threshold.

[0030] In this step, after calculating the overall integration score, an abnormal behavior judgment threshold is obtained. For example, this threshold is stored in the configuration center at the scenario level. The corresponding threshold is retrieved based on the current scenario identifier. If no explicitly configured threshold is available for the scenario, the global default threshold (set to 0.75) is used instead. If the overall integration score is greater than or equal to the threshold, the current transaction is determined to have abnormal behavior, and the abnormal response process can continue. If the overall integration score is less than the threshold, the current transaction is determined to be normal, allowing the transaction to continue and enter the subsequent routine risk control process. For example, a three-level tiered judgment method can be adopted, setting two thresholds: a low threshold and a high threshold. An overall integration score below the low threshold is considered normal; a score between the low and high thresholds is considered "suspected abnormal" and transferred to the manual review queue; and a score above the high threshold is considered "confirmed abnormal" and automatically blocked. This method provides differentiated operational space for risk control. This is to identify risk states where the user's behavior pattern in this transaction is significantly inconsistent with their historical habits, the behavior patterns of the same scenario group, or compliant transaction rules. This state indicates that the transaction may involve fraud, theft, money laundering, or other unauthorized operations.

[0031] For example, the abnormal behavior determination threshold includes a high-risk determination threshold and a medium-risk determination threshold; determining whether the user has abnormal transaction behavior based on the total fusion score and the abnormal behavior determination threshold specifically includes: when the total fusion score is greater than the high-risk determination threshold, determining that the user has high-risk abnormal transaction behavior and generating a transaction interception instruction; when the total fusion score is greater than the medium-risk determination threshold and less than or equal to the high-risk determination threshold, determining that the user has medium-risk abnormal transaction behavior and generating a secondary authentication instruction; when the total fusion score is less than or equal to the medium-risk determination threshold, determining that the user does not have abnormal transaction behavior and generating a transaction release instruction.

[0032] By applying the technical solution of this embodiment, a sliding window mechanism is used to acquire multi-dimensional transaction behavior data sequences of users along the time axis. The mean and standard deviation of each dimension's data sequence are used to calculate the baseline deviation to capture the statistical shift of behavior relative to historical habits. Simultaneously, a pre-trained transaction behavior autoencoder is used to reconstruct the sequence and calculate the reconstruction error. The baseline deviation and reconstruction error of each dimension are fused into a fusion score for that dimension. Then, the fusion scores of each dimension are weighted and accumulated according to the multi-dimensional weights corresponding to the current transaction scenario to obtain a total fusion score representing the overall degree of anomaly. Finally, this total fusion score is compared with an abnormal behavior judgment threshold adapted to the scenario to determine whether the user has engaged in abnormal transaction behavior. Through the technical solution of this application embodiment, a dual-path anomaly detection fusion of statistical baseline deviation and deep learning reconstruction perception is achieved, improving the comprehensiveness and reliability of anomaly detection. At the same time, the introduction of scenario-adaptive multi-dimensional weight configuration allows for flexible allocation of the contribution of each behavioral dimension under different transaction scenarios. The resulting total fusion score and dynamic threshold collaborative judgment mechanism improve the accuracy of abnormal behavior identification.

[0033] In an optional embodiment, the method further includes: obtaining a real label of the judgment result of the abnormal transaction behavior, wherein the real label is derived from the results of manual review, user appeal, or post-confirmation; calculating the false positive rate or false negative rate of the user in the current time period based on the comparison between the real label and the judgment result; when the false positive rate or false negative rate exceeds a preset tolerance threshold in multiple consecutive time windows, determining that the user's transaction behavior pattern has undergone conceptual drift, and dynamically adjusting the abnormal behavior judgment threshold until the false positive rate and the false negative rate fall back to within the preset tolerance threshold.

[0034] The "true label" refers to a definitive conclusion obtained through offline or online manual intervention regarding whether a current transaction is truly abnormal. Its sources include, but are not limited to, the results of manual review of the transaction's risk level by a human auditor, the user's appeal resolution after the transaction was incorrectly blocked, or the final confirmed risk status after the transaction is completed and funds are cleared and reconciled. The false positive rate refers to the proportion of samples that were actually normal transactions but were incorrectly classified as abnormal among all of a user's abnormal judgments; this ratio reflects the system's oversensitivity. The false negative rate refers to the proportion of samples that were incorrectly allowed to proceed without being correctly detected by the system among all of a user's genuinely abnormal transactions; this ratio reflects the system's lack of sensitivity. Multiple consecutive time windows refer to multiple adjacent statistical intervals divided by the number of transactions or natural time, with each interval being contiguous and of fixed length, used to accumulate a sufficient sample size to ensure statistical significance. The preset tolerance threshold refers to the maximum acceptable boundary value set by the business party for the proportion of such risk judgment errors; this value is pre-calibrated based on business risk preferences, compliance requirements, and historical operational experience. Concept drift refers to the phenomenon that a user's transaction behavior pattern undergoes irreversible or significant changes over time at the statistical distribution level. This phenomenon causes the static abnormal behavior judgment threshold, which is optimized based on old behavior data, to no longer maintain its optimal distinguishing ability in the current period.

[0035] In this embodiment, after the anomaly judgment is completed, an asynchronous tag collection thread can be started. This thread sends tag query requests in parallel to the manual review subsystem, the user appeal processing subsystem, and the post-event settlement and reconciliation module. For example, the earliest valid tag returned from the three sources is adopted as the true tag for this judgment result. If there is a conflict in the values ​​of the tags returned by the three parties (e.g., the manual review labels it as abnormal while the user appeal labels it as normal), the final true tag is determined according to a preset decision rule: the manual review tag has the highest priority, followed by the user appeal tag, and the post-event confirmation tag has the lowest priority. After the true tag is determined, the tag value is compared with the abnormal behavior judgment result (abnormal or normal). If the true tag is normal but the judgment result is abnormal, the false alarm counter for the user is incremented. If the true tag is abnormal but the judgment result is normal, the false negative counter for the user is incremented. If the two are the same, both counters remain unchanged.

[0036] The calculation of false positive and false negative rates is performed with the user as an independent statistical granularity. The system maintains a sliding statistical window for each user containing a fixed number of recent judgment events (e.g., the most recent 50, 100, or 200 events). Within this window, the false positive count is divided by the total number of events judged as abnormal within the window to obtain the user's false positive rate for the current time period; the false negative count is divided by the total number of truly abnormal events within the window to obtain the user's false negative rate for the current time period. Specifically, a fixed number sliding method can be used, where each newly added judgment event with a true label is added to the window, while the oldest event in the window is removed, ensuring that the window always contains the most recent N samples. This is suitable for user scenarios with stable transaction frequency. Alternatively, a fixed natural time method can be used, with the most recent 24 hours, 7 days, or 30 days as statistical boundaries. The window data is recalculated daily, and outdated samples exceeding the time range are automatically discarded when crossing days. This is suitable for scenarios where behavior patterns follow a date rhythm.

[0037] After calculating the false positive rate and false negative rate, they are compared with the preset tolerance thresholds corresponding to the user. These preset tolerance thresholds are stored based on user profile level and transaction scenario type (e.g., a higher tolerance threshold is set for newly registered users to accommodate the uncertainty of the cold start phase, while a lower tolerance threshold is set for low-risk, stable users to pursue higher accuracy). Before comparison, the corresponding false positive and false negative tolerance thresholds are queried based on the user's profile level and current scenario identifier. When the false positive rate is detected to be greater than the false positive tolerance threshold for multiple consecutive time windows (e.g., 3, 5, or 7 consecutive windows), or the false negative rate is detected to be greater than the false negative tolerance threshold for multiple consecutive time windows (also 3, 5, or 7 consecutive windows), the concept drift judgment logic is triggered. This indicates that the user's transaction behavior pattern has changed significantly at the statistical distribution level, and there is a mismatch between the currently applicable abnormal behavior judgment threshold and the user's new behavior pattern. Furthermore, after triggering the concept drift judgment, the thresholds can be dynamically adjusted; specifically, adjustments are performed in the opposite direction based on the type of exceedance. For example, if the false positive rate exceeds the limit (indicating that the threshold is too wide, over-classifying normal behavior as abnormal), the abnormal behavior judgment threshold is adjusted to increase in order to narrow the scope of abnormal judgment and reduce false positives; if the false negative rate exceeds the limit (indicating that the threshold is too strict, allowing genuine abnormalities to pass), the abnormal behavior judgment threshold is adjusted to decrease in order to expand the scope of abnormal judgment and reduce false negatives. When both the false positive rate and the false negative rate fall back to within their respective preset tolerance thresholds after adjustment, the current abnormal behavior judgment threshold is locked, and the threshold is written to the user profile's dedicated configuration table to replace the old value for subsequent transaction judgments.

[0038] In an optional embodiment, the method further includes: when the sample size of the user's transaction behavior data sequence is lower than a preset cold start sample size, determining the user group category to which the user belongs; obtaining the group mean statistic and group standard deviation statistic corresponding to the user group category, using the group mean statistic to replace the user's own mean, and using the group standard deviation statistic to replace the user's own standard deviation, to calculate the baseline deviation; when the sample size of the user's transaction behavior data sequence reaches the preset cold start sample size, switching to using the user's own mean and standard deviation to calculate the baseline deviation.

[0039] The preset cold start sample size refers to a very small threshold of transaction counts (e.g., 3, 5, or 10 transactions) that is far smaller than the sample size required for training a conventional model. This threshold is specifically used to determine whether the statistical parameters of an individual user possess basic credibility. This threshold is independent of the preset sample size threshold used to determine the credibility of the autoencoder, and its value is usually smaller. User group category refers to the group identifier obtained by clustering or rule mapping based on the attribute information filled in by the user during registration (including region, registration channel, industry category, and bound account type), static characteristics in the initial transaction behavior (first transaction amount range, first transaction time distribution), or device fingerprint attributes (operating system version, commonly used network IP segment). Users within the same group are expected to have similar basic transaction behavior statistical distributions. The group mean statistic and group standard deviation statistic are statistical parameters calculated dimension-by-dimensionally on the historical transaction behavior data sequence of all active users covered by the user group category. These parameters replace individual specificity with group universality, providing a statistically reasonable baseline reference for users with sparse data.

[0040] In this embodiment, before calculating the baseline deviation, the user's cumulative effective transaction sample size is read and compared with a preset cold start sample size. When the sample size is less than the preset cold start sample size, the user is determined to be in a pure cold start phase, and their own mean and standard deviation lack statistical representativeness and stability due to insufficient sample size. At this time, the static attribute label set stored in the user profile is extracted to form a query vector, the user group category to which the user belongs is determined, and the group mean and group standard deviation statistics corresponding to this category are obtained. After obtaining the group statistics, the position where the user's own mean should be filled in the baseline deviation calculation is replaced by the group mean statistics, and the position where the user's own standard deviation should be filled in is replaced by the group standard deviation statistics. The standardized residual sequence is calculated based on this group parameter as a benchmark, and the baseline deviation of this dimension is finally obtained. Once the accumulated sample size reaches or exceeds the preset cold start sample size, it is determined that the user has accumulated a sufficient number of their own transaction behavior samples, and their individual mean and standard deviation have basic statistical credibility. Then, the source of the baseline deviation calculation parameters is switched from the statistics of this group to the rolling mean and rolling standard deviation maintained by the user in real time.

[0041] In one alternative embodiment, such as Figure 2 As shown, the method further includes: Step 201: Aggregate the total fusion score corresponding to multiple transaction behavior sequences that are determined to be abnormal transactions within a preset geographical area or preset business unit, and generate a regional aggregated abnormal score.

[0042] Step 202: When the sliding average of the regional aggregation anomaly score within a preset statistical period exceeds the resource scheduling trigger threshold, obtain the entry request volume time series of the preset geographical region or preset business unit within the historical lookback window as the first input feature, and obtain the regional aggregation anomaly score of the preset geographical region or preset business unit within the historical lookback window as the second input feature; after concatenating the first input feature and the second input feature, input them into the pre-trained time series prediction model to obtain the entry request volume prediction sequence for each time step within the future preset time window.

[0043] Step 203: Extract the peak prediction value from the ingress request volume prediction sequence. If the peak prediction value exceeds the current computing resource carrying capacity threshold, determine the traffic peak prediction time based on the time corresponding to the peak prediction value, and generate a capacity expansion warning signal based on the traffic peak prediction time.

[0044] Step 204: Based on the expansion warning signal, issue a resource preheating instruction to the container orchestration platform of the preset geographical area or preset business unit, wherein the resource preheating instruction is used to instruct the container orchestration platform to complete the elastic expansion of computing resources before the predicted traffic peak time arrives.

[0045] In this embodiment, a preset geographical region or preset business unit is used as the aggregation granularity. The system continuously collects the total fusion score corresponding to all transaction behavior sequences judged as abnormal at this granularity. At the end of each statistical period (e.g., every 1 minute), all abnormal scores within that period are summarized, and aggregation calculation is performed to generate the regional aggregated abnormal score for that time point. After generating the regional aggregated abnormal score for each time point, the system maintains a circular buffer with a queue length equal to the preset statistical duration. Each new score is enqueued, and the oldest score is removed. The arithmetic mean of all scores in the buffer is calculated in real time as the current moving average for that region, and this moving average is compared with the resource scheduling trigger threshold. When the moving average first exceeds the resource scheduling trigger threshold, the resource prediction process is triggered. Specifically, the system first extracts the entry request volume time series of the preset geographical region or preset business unit within the historical review window as the first input feature. The extraction method is as follows: the historical review window is discretized and sampled at fixed time steps (e.g., 1 minute or 5 minutes), and the total request volume record value within each time step is taken and arranged in chronological order to form a vector. Simultaneously, the region aggregation anomaly score time series within the same historical lookback window (a fixed-length time interval before the current moment) is extracted as the second input feature. The sampling time steps are completely aligned with the first input feature to ensure temporal consistency. After extraction, the first and second input features are concatenated. The concatenated feature vector is input into a pre-trained temporal prediction model. The output layer of this model is set to a multi-step prediction structure, outputting the predicted entry request volume values ​​for each time step within a future preset time window, forming an entry request volume prediction sequence.

[0046] Furthermore, the sequence is traversed to find the maximum value and its corresponding index. This index maps to a specific time point, which is the predicted traffic peak time. If the predicted peak value is greater than the current computing resource capacity threshold, it is determined that the current resource reserves are insufficient to cope with the upcoming traffic peak, and resource preheating is required. At this time, a capacity expansion warning signal is generated based on the traffic peak prediction time. This signal contains the region or unit identifier, the predicted peak value, the predicted peak timestamp, and the suggested incremental resource expansion (e.g., the suggested increase in the number of Pods is equal to the predicted peak value divided by the maximum capacity of a single Pod, rounded up). After generation, a resource preheating instruction is issued to the container orchestration platform of the preset geographical region or preset business unit. The instruction can carry the predicted peak time and the suggested incremental resource expansion, so that the container orchestration platform can complete the elastic expansion of computing resources before the traffic peak prediction time arrives, avoiding response delays or service degradation caused by sudden abnormal transaction traffic surges.

[0047] Furthermore, as Figure 1 In terms of specific implementation, this application provides a device for handling abnormal transaction behavior, such as... Figure 3 As shown, the device includes: The data acquisition module is used to acquire multi-dimensional transaction behavior data sequences of users through a sliding window mechanism; The scoring calculation module is used to determine the baseline deviation of the transaction behavior data sequence in each dimension based on the mean and standard deviation of the transaction behavior data sequence in each dimension; and to reconstruct the transaction behavior data sequence in each dimension through a pre-trained transaction behavior autoencoder, and determine the reconstruction error of the transaction behavior data sequence in each dimension based on the reconstructed transaction behavior data sequence in each dimension and the transaction behavior data sequence; to determine the fusion score of the transaction behavior data sequence in each dimension based on the baseline deviation and reconstruction error of each dimension; to obtain the multi-dimensional weights and abnormal behavior judgment thresholds corresponding to the current transaction scenario, and to perform weighted calculation on the fusion score of each dimension based on the multi-dimensional weights to obtain the total fusion score of the transaction behavior data sequence; An anomaly detection module is used to determine whether the user has engaged in abnormal transaction behavior based on the overall fusion score and the abnormal behavior judgment threshold.

[0048] In an optional embodiment, the scoring calculation module is specifically used for: Based on the maturity of the user's profile, a first weighting factor corresponding to the baseline deviation and a second weighting factor corresponding to the reconstruction error are determined. The baseline deviation and the reconstruction error are weighted and summed according to the first weighting factor and the second weighting factor to obtain the fusion score for this dimension; Wherein, when the sample size of the user's transaction behavior data sequence is less than a preset sample size threshold, the first weight factor is greater than the second weight factor; when the sample size is greater than or equal to the preset sample size threshold, the second weight factor increases with the increase of the sample size, and the sum of the first weight factor and the second weight factor is a fixed value.

[0049] In an optional embodiment, the pre-trained trading behavior autoencoder is a sequence autoencoder based on a long short-term memory network, the sequence autoencoder including an encoder and a decoder; the encoder is used to compress the trading behavior data sequence of each dimension into a fixed-length behavior latent vector; the decoder is used to restore the behavior latent vector to the trading behavior reconstruction sequence; the reconstruction error is the mean square error or mean absolute error between the trading behavior reconstruction sequence and the trading behavior data sequence. The training steps of the sequence autoencoder include: Obtain a historical normal transaction behavior dataset, perform time-series alignment processing on the historical transaction data of each dimension in the historical normal transaction behavior dataset, and divide the continuous historical normal transaction behavior into training sequence samples of fixed length according to a preset time window length, with each training sequence sample having the same number of time steps on the time axis. Each training sequence sample is sequentially input into the LSTM unit of the encoder according to time steps. The LSTM unit of the encoder iteratively updates the hidden state with each time step and outputs the hidden state at the final time as a fixed-length behavioral semantic vector. The behavioral semantic vector represents the temporal behavioral pattern of the training sequence sample. The behavioral semantic vector is used as the initial hidden state of the LSTM unit of the decoder. The decoder recursively restores the output value of each time step from the initial time step to generate a transaction behavior reconstruction sequence prediction value with the same time step length as the input sequence. Calculate the mean squared error between each training sequence sample and the corresponding transaction behavior reconstruction sequence prediction value at each time step, and use the mean squared error as the main reconstruction loss; on the basis of the main reconstruction loss, add the L2 norm regularization term of each network parameter in the encoder and the decoder as the regularization loss, and sum the main reconstruction loss and the regularization loss by weight to form the total training loss. With minimizing the total training loss as the optimization objective, a backpropagation algorithm based on the time dimension is used to calculate the gradient of each network parameter in the encoder and the decoder in reverse along the time axis; an adaptive moment estimation optimizer is used to adaptively adjust the learning rate of each network parameter according to the calculated gradient, and iteratively update the value of each network parameter until the training sequence sample iteration of the preset number of rounds is completed.

[0050] In an optional embodiment, the sliding window mechanism includes a first sliding window and a second sliding window that operate in parallel; the first sliding window has a first time length and a first sliding step size, used to capture instantaneous impulsive anomalies in the transaction behavior data sequence; the second sliding window has a second time length and a second sliding step size, the second time length being greater than the first time length and the second sliding step size being greater than the first sliding step size, used to capture gradual trend anomalies in the transaction behavior data sequence. The data acquisition module is specifically used to: acquire a first transaction behavior data sequence and a second transaction behavior data sequence through a sliding window mechanism, respectively, through the first sliding window and the second sliding window; wherein, the transaction behavior data sequence includes the first transaction behavior data sequence and the second transaction behavior data sequence; the total fusion score corresponding to the transaction behavior data sequence is the maximum value of the total fusion score corresponding to the first transaction behavior data sequence and the total fusion score corresponding to the second transaction behavior data sequence.

[0051] In an optional embodiment, the anomaly detection module is further configured to: Obtain the true label of the judgment result of the abnormal transaction behavior, and the true label comes from the results of manual review, user appeal, or post-event confirmation. Based on the comparison between the real tag and the judgment result, the false alarm rate or false negative rate of the user in the current time period is calculated; When the false positive rate or the false negative rate exceeds a preset tolerance threshold within multiple consecutive time windows, it is determined that the user's transaction behavior pattern has undergone conceptual drift, and the abnormal behavior judgment threshold is dynamically adjusted until the false positive rate and the false negative rate fall back to within the preset tolerance threshold.

[0052] In an optional embodiment, the scoring calculation module is further configured to: When the sample size of the user's transaction behavior data sequence is lower than the preset cold start sample size, the user group category to which the user belongs is determined; Obtain the group mean statistic and group standard deviation statistic corresponding to the user group category, use the group mean statistic to replace the user's own mean, and use the group standard deviation statistic to replace the user's own standard deviation, and calculate the baseline deviation. Once the sample size of the user's transaction behavior data sequence reaches the preset cold start sample size, the system switches to using the user's own mean and standard deviation to calculate the baseline deviation.

[0053] In an optional embodiment, the device further includes: a flexible expansion module, used for: Aggregate the total fusion score corresponding to multiple transaction behavior sequences that are identified as abnormal transactions within a preset geographical area or preset business unit to generate a regional aggregated abnormal score; When the sliding average of the regional aggregation anomaly score within a preset statistical period exceeds the resource scheduling trigger threshold, the time series of the inbound request volume of the preset geographical region or preset business unit within the historical lookback window is obtained as the first input feature, and the regional aggregation anomaly score of the preset geographical region or preset business unit within the historical lookback window is obtained as the second input feature; the first input feature and the second input feature are concatenated and input into a pre-trained time series prediction model to obtain the predicted sequence of inbound request volume for each time step within the future preset time window; Extract peak prediction values ​​from the ingress request volume prediction sequence. If the peak prediction value exceeds the current computing resource carrying capacity threshold, determine the traffic peak prediction time based on the time corresponding to the peak prediction value, and generate a capacity expansion warning signal based on the traffic peak prediction time. Based on the capacity expansion warning signal, a resource preheating instruction is issued to the container orchestration platform of the preset geographical area or preset business unit, wherein the resource preheating instruction is used to instruct the container orchestration platform to complete the elastic expansion of computing resources before the predicted traffic peak time arrives.

[0054] It should be noted that other corresponding descriptions of the functional units involved in the abnormal transaction behavior processing device provided in this application embodiment can be found in the following references. Figures 1 to 2 The corresponding descriptions in the method will not be repeated here.

[0055] This application also provides a computer device, which may specifically be a personal computer, a server, a network device, etc. Figure 4 As shown, the computer device includes a bus, a processor, memory, and a communication interface, and may also include an input / output interface and a display device. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores location information. The network interface allows communication with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps in the various method embodiments.

[0056] Those skilled in the art will understand that Figure 4The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0057] In one embodiment, a computer-readable storage medium is provided, which may be non-volatile or volatile, having stored thereon a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0058] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0059] It should be noted that the user personal information involved in the embodiments of this application is all authorized (with the knowledge and consent) by the relevant parties or fully authorized by all parties, and the executing entity can obtain it through various legal and compliant means. The collection, storage, use, processing, transmission, provision, and disclosure of the information, data, and signals involved all comply with the relevant laws and regulations of the relevant countries and regions, and do not violate public order and good morals. It should be noted that if any software tools or components other than those of this company appear in the embodiments of this application, they are merely illustrative examples and do not represent actual use.

[0060] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, graphics processors, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0061] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0062] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for handling abnormal transaction behavior, characterized in that, The method includes: By using a sliding window mechanism, users can obtain multi-dimensional transaction behavior data sequences. Based on the mean and standard deviation of the transaction behavior data sequences for each dimension, the baseline deviation of the transaction behavior data sequences for each dimension is determined; and, the transaction behavior data sequences for each dimension are reconstructed using a pre-trained transaction behavior autoencoder, and the reconstruction error of the transaction behavior data sequences for each dimension is determined based on the reconstructed transaction behavior sequences for each dimension and the transaction behavior data sequences. Based on the baseline deviation and reconstruction error of each dimension, the fusion score of the transaction behavior data sequence of each dimension is determined; Obtain the multi-dimensional weights and abnormal behavior judgment thresholds corresponding to the current transaction scenario, and perform weighted calculation on the fusion score of each dimension according to the multi-dimensional weights to obtain the total fusion score of the transaction behavior data sequence; Based on the overall fusion score and the abnormal behavior determination threshold, it is determined whether the user has engaged in abnormal transaction behavior.

2. The method according to claim 1, characterized in that, The process of determining the fusion score of the transaction behavior data sequence for each dimension based on the baseline deviation and reconstruction error of each dimension specifically includes: Based on the maturity of the user's profile, a first weighting factor corresponding to the baseline deviation and a second weighting factor corresponding to the reconstruction error are determined. The baseline deviation and the reconstruction error are weighted and summed according to the first weighting factor and the second weighting factor to obtain the fusion score for this dimension; Wherein, when the sample size of the user's transaction behavior data sequence is less than a preset sample size threshold, the first weight factor is greater than the second weight factor; when the sample size is greater than or equal to the preset sample size threshold, the second weight factor increases with the increase of the sample size, and the sum of the first weight factor and the second weight factor is a fixed value.

3. The method according to claim 1, characterized in that, The pre-trained trading behavior autoencoder is a sequence autoencoder based on a long short-term memory network. The sequence autoencoder includes an encoder and a decoder. The encoder is used to compress the trading behavior data sequence of each dimension into a fixed-length behavior latent vector. The decoder is used to restore the behavior latent vector to the trading behavior reconstruction sequence. The reconstruction error is the mean square error or mean absolute error between the trading behavior reconstruction sequence and the trading behavior data sequence. The training steps of the sequence autoencoder include: Obtain a historical normal transaction behavior dataset, perform time-series alignment processing on the historical transaction data of each dimension in the historical normal transaction behavior dataset, and divide the continuous historical normal transaction behavior into training sequence samples of fixed length according to a preset time window length, with each training sequence sample having the same number of time steps on the time axis. Each training sequence sample is sequentially input into the LSTM unit of the encoder according to time steps. The LSTM unit of the encoder iteratively updates the hidden state with each time step and outputs the hidden state at the final time as a fixed-length behavioral semantic vector. The behavioral semantic vector represents the temporal behavioral pattern of the training sequence sample. The behavioral semantic vector is used as the initial hidden state of the LSTM unit of the decoder. The decoder recursively restores the output value of each time step from the initial time step to generate a transaction behavior reconstruction sequence prediction value with the same time step length as the input sequence. Calculate the mean squared error between each training sequence sample and the corresponding transaction behavior reconstruction sequence prediction value at each time step, and use the mean squared error as the main reconstruction loss; on the basis of the main reconstruction loss, add the L2 norm regularization term of each network parameter in the encoder and the decoder as the regularization loss, and sum the main reconstruction loss and the regularization loss by weight to form the total training loss. With minimizing the total training loss as the optimization objective, a backpropagation algorithm based on the time dimension is used to calculate the gradient of each network parameter in the encoder and the decoder in reverse along the time axis; an adaptive moment estimation optimizer is used to adaptively adjust the learning rate of each network parameter according to the calculated gradient, and iteratively update the value of each network parameter until the training sequence sample iteration of the preset number of rounds is completed.

4. The method according to claim 1, characterized in that, The sliding window mechanism includes a first sliding window and a second sliding window that run in parallel; the first sliding window has a first time length and a first sliding step size, and is used to capture instantaneous pulse-like anomalies in the transaction behavior data sequence. The second sliding window has a second time length and a second sliding step, the second time length being greater than the first time length and the second sliding step being greater than the first sliding step, and is used to capture gradual trend anomalies in the transaction behavior data sequence; The method of acquiring multi-dimensional transaction behavior data sequences of users through a sliding window mechanism includes: Using a sliding window mechanism, a first transaction behavior data sequence and a second transaction behavior data sequence are obtained through the first sliding window and the second sliding window, respectively; wherein, the transaction behavior data sequence includes the first transaction behavior data sequence and the second transaction behavior data sequence; the total fusion score corresponding to the transaction behavior data sequence is the maximum value between the total fusion score corresponding to the first transaction behavior data sequence and the total fusion score corresponding to the second transaction behavior data sequence.

5. The method according to claim 1, characterized in that, The method further includes: Obtain the true label of the judgment result of the abnormal transaction behavior, and the true label comes from the results of manual review, user appeal, or post-event confirmation. Based on the comparison between the real tag and the judgment result, the false alarm rate or false negative rate of the user in the current time period is calculated; When the false positive rate or the false negative rate exceeds a preset tolerance threshold within multiple consecutive time windows, it is determined that the user's transaction behavior pattern has undergone conceptual drift, and the abnormal behavior judgment threshold is dynamically adjusted until the false positive rate and the false negative rate fall back to within the preset tolerance threshold.

6. The method according to claim 1, characterized in that, The method further includes: When the sample size of the user's transaction behavior data sequence is lower than the preset cold start sample size, the user group category to which the user belongs is determined; Obtain the group mean statistic and group standard deviation statistic corresponding to the user group category, use the group mean statistic to replace the user's own mean, and use the group standard deviation statistic to replace the user's own standard deviation, and calculate the baseline deviation. Once the sample size of the user's transaction behavior data sequence reaches the preset cold start sample size, the system switches to using the user's own mean and standard deviation to calculate the baseline deviation.

7. The method according to claim 1, characterized in that, The method further includes: Aggregate the total fusion score corresponding to multiple transaction behavior sequences that are identified as abnormal transactions within a preset geographical area or preset business unit to generate a regional aggregated abnormal score; When the sliding average of the regional aggregation anomaly score within a preset statistical period exceeds the resource scheduling trigger threshold, the time series of the inbound request volume of the preset geographical region or preset business unit within the historical lookback window is obtained as the first input feature, and the regional aggregation anomaly score of the preset geographical region or preset business unit within the historical lookback window is obtained as the second input feature; the first input feature and the second input feature are concatenated and input into a pre-trained time series prediction model to obtain the predicted sequence of inbound request volume for each time step within the future preset time window; Extract peak prediction values ​​from the ingress request volume prediction sequence. If the peak prediction value exceeds the current computing resource carrying capacity threshold, determine the traffic peak prediction time based on the time corresponding to the peak prediction value, and generate a capacity expansion warning signal based on the traffic peak prediction time. Based on the capacity expansion warning signal, a resource preheating instruction is issued to the container orchestration platform of the preset geographical area or preset business unit, wherein the resource preheating instruction is used to instruct the container orchestration platform to complete the elastic expansion of computing resources before the predicted traffic peak time arrives.

8. A device for processing abnormal transaction behavior, characterized in that, The device includes: The data acquisition module is used to acquire multi-dimensional transaction behavior data sequences of users through a sliding window mechanism; The scoring calculation module is used to determine the baseline deviation of the transaction behavior data sequence in each dimension based on the mean and standard deviation of the transaction behavior data sequence in each dimension; and to reconstruct the transaction behavior data sequence in each dimension through a pre-trained transaction behavior autoencoder, and determine the reconstruction error of the transaction behavior data sequence in each dimension based on the reconstructed transaction behavior data sequence in each dimension and the transaction behavior data sequence; to determine the fusion score of the transaction behavior data sequence in each dimension based on the baseline deviation and reconstruction error of each dimension; to obtain the multi-dimensional weights and abnormal behavior judgment thresholds corresponding to the current transaction scenario, and to perform weighted calculation on the fusion score of each dimension based on the multi-dimensional weights to obtain the total fusion score of the transaction behavior data sequence; An anomaly detection module is used to determine whether the user has engaged in abnormal transaction behavior based on the overall fusion score and the abnormal behavior judgment threshold.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

10. A computer device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

Images