A federal financial fraud detection method and system based on SPD manifold

Abstract

The application discloses a federal financial fraud detection method and system based on an SPD manifold, and belongs to the technical field of Riemann manifolds and federal learning. The application realizes the method as follows: 1, obtaining of local transaction data of a client; 2, preprocessing of the local transaction data of the client; 3, construction of an account transaction time window; 4, generation of a symmetric positive definite matrix sample; 5, federal aggregation of a global reference mean under a logarithmic Euclidean metric; 6, logarithmic domain feature mapping and vectorization; 7, training of a local Tangent-MLP model of the client; 8, weighted aggregation of a global model of a server; 9, local fraud reasoning and risk disposal of the client. Compared with the prior art, the application solves the technical problems that original transaction data is difficult to share across institutions, a single transaction Euclidean feature is difficult to express an account historical behavior structure, ordinary federal training is prone to client drift under non-independent and identically distributed financial data, and the selection of a geometric metric in a symmetric positive definite matrix manifold is not clear.

Description

Technical Field

[0001] This invention relates to a federated financial fraud detection method and system based on SPD manifold, belonging to the field of Riemannian manifold and federated learning technology, and applied in financial transaction scenarios. Background Technology

[0002] Financial transaction fraud detection is a core risk control task for banks, payment institutions, clearing institutions, consumer finance companies, and internet finance platforms. Transaction data typically includes information such as transaction time, transaction type, transaction amount, initiating account, receiving account, account balance changes, and terminal environment. Due to the covert, temporal, and rare nature of fraudulent activities, relying solely on the static characteristics of a single transaction for judgment can easily overlook the recent behavioral structure of accounts and the correlations between various transaction characteristics.

[0003] Most existing financial fraud detection methods employ centralized machine learning or deep learning models, such as logistic regression, tree models, and multilayer perceptrons. These methods typically require data from different institutions or departments to be centralized on a unified server for training. However, real financial transaction data is constrained by personal information protection, trade secrets, financial regulatory compliance, and institutional data security boundaries, making it difficult for different data holders to directly share original transaction records.

[0004] Federated learning enables cross-institutional collaborative modeling through server-distributed global models, client-side local training, and server-aggregated model parameters. However, data distributions across different financial institutions, regions, customer groups, and business types often exhibit significant differences, with client-side data frequently displaying non-independent and identically distributed (NID) patterns. In this scenario, the ordinary federated averaging (FedAvg) method is prone to issues such as client drift, unstable convergence, and insufficient ability to identify minority fraud samples. These differences in client-side data distribution are commonly referred to as non-independent and identically distributed (Non-IID).

[0005] On the other hand, financial transactions exhibit an account-level time window structure. Second-order correlations exist among features such as recent transaction amounts, balance changes, transaction types, and time intervals. Directly inputting individual transaction features as Euclidean vectors into the model fails to adequately represent this correlation structure. Furthermore, directly expanding the transaction window as a covariance matrix without utilizing the geometric properties of the non-Euclidean space containing the symmetric positive definite matrix may distort distance representations and model input representations.

[0006] In the processing of symmetric positive definite matrix manifolds, common geometric choices include affine-invariant Riemannian metrics and log-Euclidean metrics. These two metrics differ in their corresponding distances, means, and mapping forms. The mean of an affine-invariant Riemannian metric typically requires iterative calculation; the log-Euclidean metric, through the principal logarithm of the matrix, globally maps the symmetric positive definite matrix manifold to a symmetric linear space, allowing Euclidean operations to be performed in the logarithmic domain. If the choice of metric is not explicitly stated, the mathematical meanings of the mean, centralization feature, and manifold distance can easily lead to ambiguity.

[0007] Therefore, there is a need for a financial transaction fraud detection technology that can take into account local retention of original transaction data, expression of account behavior structure, geometric consistency of symmetric positive definite matrices, minority class identification ability, and stability of federated training under non-independent and identically distributed conditions. Summary of the Invention

[0008] The purpose of this invention is to solve the technical problems of difficulty in sharing raw transaction data across institutions, difficulty in expressing the historical behavior structure of an account by the Euclidean features of a single transaction, easy client drift in ordinary federated training under non-independent and identically distributed financial data, and unclear choice of geometric metric in symmetric positive definite matrix manifolds. The invention proposes a federated financial fraud detection method and system based on SPD manifold.

[0009] The objective of this invention is achieved through the following technical solution:

[0010] This invention discloses a federalized financial fraud detection method based on SPD manifold, applicable to a system consisting of a federal server and... A federated learning system consisting of client nodes, where... Total number of clients For client-side indexing, the following steps are included:

[0011] Step 1: Acquire local transaction data on the client side. Each client stores the original financial transaction dataset locally;

[0012]

[0013] in, For the first The number of original transaction records per client. For the first Transaction records For the corresponding transaction tags, This indicates a normal transaction. This indicates a fraudulent transaction. Each client corresponds to a financial institution, branch, business department, or other data-holding node; the client does not upload the original transaction records to the federated server.

[0014] Step 2: Preprocessing local transaction data on the client side. Sort local transaction records in ascending order according to transaction time, and convert each transaction record into... 3D feature vector ,in, For the characteristic dimensions of a single transaction, For the first The first client The preprocessed feature vector of each transaction record. The preprocessing includes: one-hot encoding of the transaction type field; and performing [processing] on the transaction amount. The transformation involves constructing the change in the initiating account balance, the change in the receiving account balance, the ratio of the transaction amount to the balance, and the time interval between adjacent transactions within the same account; and standardizing the continuous numerical features using training data statistics. The account identifier includes the transaction initiating account identifier, the transaction receiving account identifier, or a combination of both forming an associated account identifier.

[0015] Step 3: Constructing the account transaction time window. For the account At the target time The target transaction that occurred is selected up to and including the most recent target transaction. Each transaction feature vector, arranged in chronological order, forms a behavior matrix.

[0016]

[0017] And with the current target transaction's label This serves as the sample label for the window. For account identification, For the target trading time, The length of the trading window. For a moment The corresponding account behavior matrix, This is the label for the current target transaction. When the account's cumulative number of transactions before and at the target time is less than [a certain number]... When this happens, the target transaction sample can be discarded, or zero-filling, account mean-filling, or mask-filling can be used; it is preferable to discard samples with insufficient historical data. After filtering by window, the client was obtained 1 valid window sample, of which Compared with the number of original transaction records Distinguish between each other;

[0018] Step 4: Generate symmetric positive definite matrix samples. For the row matrix... Calculate the mean vector of window features;

[0019]

[0020] in, For a moment The window feature mean vector, for A one-dimensional vector. Center the matrix of actions:

[0021]

[0022] in, This is the centered behavior matrix. Calculate the window feature covariance matrix with the regularization term added:

[0023]

[0024] in, For a moment The corresponding window feature covariance type SPD sample, for An identity matrix of order 1. Regularization coefficients are used to ensure the matrix is ​​strictly positive definite and numerically stable. Because... and ,therefore,

[0025]

[0026] in, express A symmetric positive definite matrix manifold. The matrix... This is used to express the second-order correlation structure between transaction amounts, balance changes, transaction types, time intervals, and other features within an account window.

[0027] Step 5: Global reference mean federated aggregation under logarithmic Euclidean metric. This invention... The log-Euclidean metric (LEM) is used above. For and its tangent vector The logarithmic Euclidean metric is expressed as:

[0028]

[0029] in, The corresponding SPD reference matrix for the metric, express exist The tangent space at the point, and Let be the tangent vector in this tangent space. For matrix The logarithmic Euclidean inner product at the point; The principal logarithm of the matrix. Represents the matrix logarithmic mapping in Along the direction Fréchet's differential, The Frobenius inner product is the sum of the element-wise products of matrices. The log-Euclidean distance induced by this metric is:

[0030]

[0031] in, and For any two SPD matrices, The logarithmic Euclidean distance between the two is... It is the Frobenius norm. Each client is based locally. Calculate the local logarithmic mean statistic for each valid SPD sample;

[0032]

[0033] in, For the first The first client's One valid SPD sample, For the first The local logarithmic domain mean statistic for each client. Clients can contribute via a secure aggregation protocol. and Alternatively, upload statistics that have been encrypted, de-identified, or differentially privacy-processed. The federated server determines the aggregation weight based on the number of valid SPD samples;

[0034]

[0035] And calculate the global logarithmic field statistic and the global LEM reference mean, where, For the first The aggregate weight of each client, For global logarithmic field statistics, The global LEM reference mean:

[0036]

[0037] The global reference mean satisfies:

[0038]

[0039] It possesses the aforementioned closed-form expression, eliminating the need for multiple manifold iterations required by affine-invariant Karcher's mean (i.e., the intrinsic mean obtained by minimizing the sum of squared distances from samples on the manifold to the reference point). The initial training phase can be achieved through a single statistical aggregation. When the client set, effective training samples, or feature standardization statistics change to a predetermined degree, a new reference mean can be recalculated and published.

[0040] Furthermore, due to the matrix principal logarithm mapping Under the logarithmic Euclidean metric Isometric mapping to linear space Therefore, the distance between SPD samples, the reference mean, and the centering process can all be calculated in Euclidean form within the logarithmic domain.

[0041] Step 6: Logarithmic domain feature mapping and vectorization. The client receives the global reference mean from the federated server. For local SPD samples Perform a log-Euclidean centralization mapping:

[0042]

[0043] in, For the first The centered log-domain matrix of each SPD sample relative to the global reference mean express A symmetric matrix in a linear space. Under log-Euclidean metric... With reference point The tangent space coordinates at each point correspond equally. Perform symmetric matrix vectorization:

[0044]

[0045] in, This represents the symmetric vectorization operator. For the first Vectorized features of each sample The feature dimension is the vectorized dimension. The operation extracts the upper triangular elements of the symmetric matrix and multiplies the off-diagonal elements by . , making

[0046]

[0047] Step 7: Train the Tangent-MLP model locally on the client side. Build a model based on... This is a multilayer perceptron fraud classification model with input. The model consists of a first fully connected layer, a first rectified linear unit (ReLU) activation layer, a dropout layer, a second fully connected layer, a second ReLU activation layer, a third fully connected layer, and a sigmoid output layer, which outputs the fraud probability.

[0048]

[0049] in, These are the model parameters for Tangent-MLP. For parameters A defined classification function For the first The predicted probability that a sample belongs to a fraudulent transaction. When hour, The model can be adopted The network structure;

[0050] To mitigate the imbalance between legitimate and fraudulent transactions, a weighted binary cross-entropy (WBCE) loss is employed.

[0051]

[0052] in, and These are the weights for fraudulent samples and the weights for normal samples, respectively. For the first The true class label of each sample. The weight can be set according to the reciprocal of the class frequency, and is set when both classes of samples exist.

[0053]

[0054] in, and The first The number of fraudulent samples and the number of normal samples for each client, and When a client lacks a sample of one class, the global class weight published by the server or the weight determined based on the validation set and business cost can be used.

[0055] No. Local experience risks for individual clients for:

[0056]

[0057] In the In each round of federated training, the server distributes global model parameters. , where here This indicates the Federated Communications Round Index, which is related to the target transaction time in step S3. They are distinct from each other. The client uses... Minimize the FedProx local objective function using the initial values;

[0058]

[0059] in, These are the FedProx proximal term coefficients, used to control the penalty strength for the local model deviating from the current global model; scalars here. Compared with the window mean vector in step S4 Mutual differentiation. Weighted binary cross-entropy is used to increase the contribution of minority class fraud samples to the training objective; federated proximal constraints are used to limit the excessive offset of the local model relative to the current global model, mitigating client drift caused by non-independent and identically distributed data. At that time, the local target degenerates into a federated average training form that does not include proximal terms;

[0060] Step 8: Server-side global model weighted aggregation. The client obtains the model after completing local training. And uploaded to the federal server, among which, For the first The client in the first The server performs a weighted aggregation of the model parameters trained locally. The aggregation is based on the number of valid SPD samples from the currently participating clients.

[0061]

[0062] in, For the first The set of clients participating in the training round. The next round of global model parameters will be aggregated by the server. The data is sent to the client, and steps S7 and S8 are repeated until the preset number of communication rounds is reached or the verification metric converges, resulting in the final global model. ,in, This represents the final model parameters when the federated training converges or reaches the preset number of rounds.

[0063] Step 9: Client-side Local Fraud Reasoning and Risk Handling. For newly occurring target transactions, the client constructs the most recent [database name] containing the current target transaction, following steps 2 to 6. The risk score is obtained by taking a transaction window, SPD samples, and a logarithmic domain feature vector, and then inputting this feature vector into the final global model. ,in, Assign a fraud risk score to the current target transaction. Set a first risk threshold. Second risk threshold ,in, and These represent the boundaries for determining low risk and medium risk, and medium risk and high risk, respectively. :when When it is determined to be low risk, it is automatically released; when At that time, it was determined to be of medium risk and entered the manual review stage; when If the risk is deemed high, secondary verification, transaction blocking, or account freezing will be triggered. Subsequent review labels can be used to generate new training samples locally for periodic federated updates.

[0064] A federal financial fraud detection system based on SPD manifold for implementing the above method includes a client-side module and a federal server-side module;

[0065] The client-side modules include a transaction data preprocessing module, an account transaction window construction module, an SPD sample construction module, a logarithmic domain feature mapping module, a FedProx local training module, and a risk inference module.

[0066] The transaction data preprocessing module is used to complete transaction time sorting, transaction type encoding, logarithmic transformation of transaction amount, construction of balance change features, construction of transaction amount relative to balance ratio features, construction of adjacent transaction time interval features, and standardization of continuous numerical features.

[0067] The account transaction window construction module is used to extract the most recent transactions up to the current transaction and including the current transaction, based on the account identifier and transaction time sequence. Each transaction forms a behavior matrix and outputs the corresponding target transaction label.

[0068] The SPD sample construction module is used to calculate the centered window feature covariance matrix based on the behavior matrix and add a regularization term to generate samples belonging to the SPD model. A symmetric positive definite matrix sample.

[0069] The logarithmic domain feature mapping module is used to receive SPD samples and LEM reference mean sent by the server, and perform matrix principal logarithm, centering, and... Vectorize to output the logarithmic domain eigenvectors.

[0070] The FedProx local training module is used to receive logarithmic domain feature vectors, transaction labels, and global model parameters issued by the server, to train the local model under the combined effect of weighted binary cross-entropy loss and federated proximal constraints, and to upload the local model parameters.

[0071] The risk inference module is used to output a fraud risk score during the deployment phase and generate handling results such as automatic release, manual review, secondary verification, transaction interception or account freezing based on the first risk threshold and the second risk threshold.

[0072] The federal server-side modules include a reference mean security aggregation module, a global model initialization module, a global model weighted aggregation module, a model publishing module, and an audit log module.

[0073] The reference mean secure aggregation module is used to receive or securely aggregate contributions from each client. and Calculate the global logarithmic field statistics and the LEM reference mean, and send the LEM reference mean to the model publishing module.

[0074] The global model initialization module is used to establish the Tangent-MLP initial network based on the logarithmic domain feature dimension, hidden layer size and output dimension, and to initialize the global model parameters, number of communication rounds, number of local training rounds, learning rate, class weights, proximal term coefficients and risk threshold.

[0075] The global model weighted aggregation module is used to receive local model parameters uploaded by each client, perform weighted aggregation based on the number of valid SPD samples, and obtain the next round of global model parameters.

[0076] The model publishing module is used to publish the LEM reference mean, the global model parameters for the current round, and the unified training configuration to the client, so that each client adopts consistent logarithmic domain coordinates and model parameters.

[0077] The audit record module is used to record the participating clients, number of valid samples, aggregate weights, model version, risk score, threshold judgment results and handling results for each round, forming traceable training audit records and risk decision audit records.

[0078] Compared with existing technologies, it has the following beneficial effects:

[0079] 1. This invention completes cross-institutional financial transaction fraud detection under the federated learning framework, without requiring the uploading of original transaction records, account transaction windows or individual SPD samples, thus reducing the leakage and compliance risks caused by centralized sharing of original data.

[0080] 2. The present invention constructs an SPD covariance matrix based on an account transaction time window that includes the current target transaction. This matrix can express the second-order correlation between features such as transaction amount, balance change, transaction type and time interval, thereby improving the expressive ability of the account's recent behavior structure.

[0081] 3. This invention explicitly adopts the logarithmic Euclidean metric and its induced logarithmic Euclidean distance to calculate the closed reference mean and centralized features in the unified logarithmic domain, avoiding confusion with the affine invariant Riemannian metric.

[0082] 4. This invention obtains the LEM reference mean through a single secure aggregation of local logarithmic domain statistics, reducing the communication overhead of affine invariant Karcher mean iteration in cross-institutional environments.

[0083] 5. This invention employs Vectorization maintains consistency between the Frobenius norm and the vector 2-norm, ensuring that the model input distance corresponds to the log-Euclidean distance.

[0084] 6. This invention uses weighted binary cross-entropy to improve the training contribution of minority class fraud samples, and uses FedProx proximal terms to alleviate client drift caused by non-independent and identically distributed data, thereby improving the stability of federated training.

[0085] 7. This invention is applicable to multi-entity collaborative risk control scenarios involving banks, payment institutions, clearing institutions, consumer finance companies, and internet finance platforms, and can be extended to anti-money laundering, abnormal transaction monitoring, and credit risk early warning. Attached Figure Description

[0086] Figure 1 This is a schematic diagram of the overall process of the method of the present invention;

[0087] Figure 2 This is a schematic diagram of the structure of the federated learning system of this invention;

[0088] Figure 3 This is a schematic diagram of the account transaction window and SPD sample construction of the present invention;

[0089] Figure 4 This is a schematic diagram of the LEM reference mean, centered logarithmic mapping, and logarithmic domain features of the present invention;

[0090] Figure 5 This is a schematic diagram of the Tangent-MLP model structure of the present invention;

[0091] Figure 6 This is a time-series diagram illustrating the FedProx local training and global model aggregation of the present invention;

[0092] Figure 7 This is a schematic diagram of the fraud detection and risk handling process during the deployment phase of this invention. Detailed Implementation

[0093] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are used to explain the present invention, but are not intended to limit the scope of protection of the present invention. Without departing from the concept of the present invention, those skilled in the art can make equivalent substitutions or adjustments to the feature dimensions, window length, number of network layers, number of clients, aggregation weight, risk threshold, and security aggregation method.

[0094] Example

[0095] Example 1: Federal Financial Transaction Fraud Detection Based on SPD Manifold

[0096] like Figure 1 As shown, this embodiment sequentially performs local transaction preprocessing, account transaction window construction, SPD sample construction, LEM reference mean estimation, log domain feature generation, Tangent-MLP local training, FedProx constraints, and global model weighted aggregation, and outputs a fraud risk score.

[0097] The information transmitted or securely aggregated between the client and server includes local logarithmic domain statistical contributions, local model parameters, global reference mean, and global model parameters, but does not include original transaction logs, complete account history sequences, or individual SPD samples. Model parameters and statistics may still carry data-related information; therefore, in practical deployments, secure aggregation, homomorphic encryption, trusted execution environments, or differential privacy mechanisms can be further integrated.

[0098] The client first sorts the transaction records in ascending order by time. Transaction types can include PAYMENT, TRANSFER, CASH_OUT, DEBIT, and CASH_IN, and one-hot encoding is used. The transaction amount is then processed. Transform and construct

[0099]

[0100]

[0101]

[0102] Features such as the time interval between adjacent transactions within the same account, among which, and These represent the account balances before and after the transaction was initiated. and These represent the account balances before and after the transaction. and These represent the changes in the balances of the initiating account and the receiving account, respectively. The ratio of the transaction amount to the balance of the initiating account before the transaction. To prevent small positive numbers with a denominator of zero, continuous numerical features are standardized using the mean and standard deviation of the training set.

[0103] like Figure 3 As shown, for time Target transactions, selection The nearest within the interval This includes the current target transaction. (In the main implementation example...) It can also be set to 5, 20, or 30. After centering the window features, calculate the covariance matrix and add... . Can be set to , Or adjust according to numerical stability. If Then each SPD sample is Matrix, logarithmic field vector dimension is .

[0104] like Figure 4 As shown, each client calculates The server obtains security through aggregation. and and calculate The client is based on a fixed... calculate and When the distribution of the training samples changes significantly, it can be re-estimated. The reference mean version and the model version are recorded together.

[0105] Furthermore, to illustrate the equivalence between SPD manifold computation under logarithmic Euclidean metric and logarithmic Euclidean computation, let...

[0106]

[0107] Let the objective function be defined on a symmetric positive definite matrix manifold, and its corresponding logarithmic field function be defined.

[0108]

[0109] in, Describe the objective function The corresponding function in the logarithmic field, express Real symmetric matrix express A linear space formed by real symmetric matrices. Represents the matrix index.

[0110] Under the log-Euclidean metric, the principal logarithmic mapping of a matrix

[0111]

[0112] Transform geometric operations on the SPD manifold into Euclidean operations in the logarithmic field. If... Indicates the first The SPD variable in the next iteration, with Indicates the first The step size of the next iteration, and let

[0113]

[0114] Then the Euclidean gradient update in the logarithmic field can be expressed as:

[0115]

[0116] in, Representation function exist The Euclidean gradient with respect to the Frobenius inner product. After mapping the matrix exponent back to the SPD manifold, we obtain...

[0117]

[0118] The above relationship shows that, under logarithmic Euclidean metric, The calculations of distance, mean, and centering can be transformed into Euclidean calculations in the logarithmic field, thus providing a mathematical basis for LEM reference mean estimation, centered logarithmic mapping, and logarithmic field feature construction in this embodiment.

[0119] It should be noted that this embodiment does not directly use SPD samples as model parameters to be optimized. The client first converts the SPD samples into centered logarithmic features based on the LEM reference mean, and then... The operation yields Euclidean vectors, which are then input into the Tangent-MLP model; model parameters. Still within the Euclidean parameter space, optimization is performed using weighted binary cross-entropy loss and FedProx near-end terms.

[0120] like Figure 5 As shown, Tangent-MLP adopts The structure uses ReLU activation in the hidden layer, Dropout is applied after the first hidden layer, and Sigmoid is used in the output layer. Class weights can be determined by local class frequencies, class counts obtained from global safety aggregation, or the cost of misjudgment in the business context.

[0121] like Figure 6 As shown, the server in the first... Wheel down Client execution Round-robin local training and minimizing of the objective function containing FedProx proximal terms; client upload ; server press Weighted aggregation. Number of communication rounds. It can be set to 50 or 100, the number of local training rounds. It can be set to 1, 3, or 5, where, This indicates the total number of communication rounds between the federated server and the client. This represents the number of local training rounds performed by the client within each communication round; the learning rate can be set to... The optimizer can employ either Adaptive Moment Estimation (Adam) or Stochastic Gradient Descent (SGD).

[0122] like Figure 7 As shown, during the deployment phase, the client constructs a new transaction that includes the most recent transaction from the current transaction. The transaction window is used to sequentially construct the SPD, generate logarithmic domain features, and perform model inference. Risk threshold. , The amount can be determined based on the costs of underreporting, the costs of misreporting, the capacity for manual verification, and regulatory requirements.

[0123] Example 2: Client partitioning and non-independent identical distribution settings

[0124] In real-world cross-institutional scenarios, each client corresponds to a different financial institution or business department. In simulations or system tests, account hashing can be used for partitioning.

[0125]

[0126] in, For account The corresponding client number, The hash value for the account identifier. Indicates the total number of clients Modulo. This partitioning ensures that transactions from the same account always belong to the same client. Alternatively, a Dirichlet distribution can be used to partition samples of different classes to simulate differences in label proportions between clients. Dirichlet parameters. Concentration parameters used to control the degree of heterogeneity in client category distribution; The smaller the value, the greater the difference in client-side tag distribution. The larger the value, the closer the data distribution is to an independent and identically distributed system. (Proximal term coefficient) It can be selected from 0, 0.001, 0.01, 0.1 or 1.0, and determined by the validation set.

[0127] Example 3: System Implementation

[0128] This invention can be implemented by a federated server, client devices, and a computer-readable storage medium. The client device can be a local server of a financial institution, a branch risk control server, or an edge computing node; the federated server can be an independent coordination server or a coordination node jointly managed by multiple parties. Each device includes a processor, a memory, and a network communication interface. The memory stores a computer program, and the processor executes the program to implement steps S1 to S9.

[0129] In an optional implementation, statistics and model parameters uploaded or contributed by the client can be transmitted after secure aggregation, homomorphic encryption (HE), trusted execution environment (TEE) protection, or differential privacy (DP) noise processing. These enhancement mechanisms do not change the core process of "account window construction—SPD sample generation—log-Euclidean reference mean—centralized logarithmic domain features—Tangent-MLP—FedProx local training—global model weighted aggregation".

Claims

1. A federalized financial fraud detection method based on SPD manifold, applied to a system consisting of a federal server and... A federated learning system consisting of client nodes, where... Total number of clients For client-side indexing, the method is characterized by including the following steps: Step 1: Acquire local transaction data on the client side; Each client stores the original financial transaction dataset locally; Step 2: Preprocessing local transaction data on the client side; Sort local transaction records in ascending order according to transaction time, and convert each transaction record into... 3D feature vector ,in, For the characteristic dimensions of a single transaction, For the first The first client Preprocessed feature vectors of each transaction record; Step 3: Constructing the account transaction time window; For the account At the target time The target transaction that occurred is selected up to and including the most recent target transaction. Each transaction feature vector, arranged in chronological order, forms a behavior matrix. Step 4: Generate symmetric positive definite matrix samples; For the row matrix Calculate the mean vector of window features; in, For a moment The window feature mean vector, for A one-dimensional vector; centering the behavior matrix: in, The behavior matrix after centering; calculate the window feature covariance matrix with regularization terms added: in, For a moment The corresponding window feature covariance type SPD sample, for An identity matrix of order 1. Regularization coefficients are used to ensure the strict positive definiteness and numerical stability of the matrix; due to and ,therefore, in, express Symmetric positive definite matrix manifold; the matrix Used to express the second-order correlation structure between transaction amount, balance change, transaction type, time interval and other features within the account window; Step 5: Global reference mean federated aggregation under logarithmic Euclidean metric; This invention is based on... The logarithmic Euclidean metric is used above; for and its tangent vector The logarithmic Euclidean metric is expressed as: in, The corresponding SPD reference matrix for the metric, express exist The tangent space at the point, and Let be the tangent vector in this tangent space. For matrix The logarithmic Euclidean inner product at the point; The principal logarithm of the matrix. Represents the matrix logarithmic mapping in Along the direction Fréchet's differential, The Frobenius inner product is the sum of the element-wise products of matrices; the log-Euclidean distance induced by this metric is: in, and For any two SPD matrices, The logarithmic Euclidean distance between the two is... For Frobenius norm; the first Each client is based locally. Calculate the local logarithmic mean statistic for each valid SPD sample; in, For the first The first client's One valid SPD sample, For the first The local logarithmic domain mean statistic for each client; clients can contribute via a secure aggregation protocol. and Alternatively, upload statistics that have been encrypted, de-identified, or differentially privacy-processed; the federated server determines the aggregation weight based on the number of valid SPD samples; And calculate the global logarithmic field statistic and the global LEM reference mean, where, For the first The aggregate weight of each client, For global logarithmic field statistics, The global LEM reference mean: The global reference mean satisfies: It possesses the aforementioned closed-form expression, eliminating the need for multiple manifold iterations required for affine-invariant Karcher's mean (i.e., the intrinsic mean obtained by minimizing the sum of squared distances from samples on the manifold to the reference point); the initial training phase can be achieved through a single statistical aggregation. When the client set, effective training samples, or feature standardization statistics change to a predetermined degree, a new reference mean can be recalculated and published. Furthermore, due to the matrix principal logarithm mapping Under the logarithmic Euclidean metric Isometric mapping to linear space Therefore, the distance between SPD samples, the reference mean, and the centering process can all be calculated in Euclidean form in the logarithmic domain; Step 6: Logarithmic domain feature mapping and vectorization; The client receives the global reference mean from the federated server. For local SPD samples Perform a log-Euclidean centralization mapping: in, For the first The centered log-domain matrix of each SPD sample relative to the global reference mean express A symmetric matrix in a linear space; under logarithmic Euclidean metric. With reference point The tangent space coordinates at the point are equidistant from each other; for Perform symmetric matrix vectorization: in, This represents the symmetric vectorization operator. For the first Vectorized features of each sample The feature dimension after vectorization; The operation extracts the upper triangular elements of the symmetric matrix and multiplies the off-diagonal elements by . , making Step 7: Train the Tangent-MLP model locally on the client side; Build a model based on... The input is a multilayer perceptron fraud classification model; the model consists of a first fully connected layer, a first rectified linear unit (ReLU) activation layer, a dropout layer, a second fully connected layer, a second ReLU activation layer, a third fully connected layer, and a sigmoid output layer, which outputs the fraud probability. in, These are the model parameters for Tangent-MLP. For parameters A defined classification function For the first The predicted probability that a sample belongs to a fraudulent transaction; when hour, The model can be adopted The network structure; To mitigate the imbalance between legitimate and fraudulent transactions, a weighted binary cross-entropy loss is employed. in, and These are the weights for fraudulent samples and the weights for normal samples, respectively. For the first The true class label of each sample; the weight can be set according to the reciprocal of the class frequency, and is set when both classes of samples exist. in, and The first The number of fraudulent samples and the number of normal samples for each client, and When a client lacks a sample of one class, the global class weight published by the server or the weight determined based on the validation set and business cost can be used. No. Local experience risks for individual clients for: In the In each round of federated training, the server distributes global model parameters. , where This indicates the Federated Communications Round Index, which is related to the target transaction time in step S3. Distinguish between each other; the client uses Minimize the FedProx local objective function using the initial values; in, These are the FedProx proximal term coefficients, used to control the penalty strength for the local model deviating from the current global model; scalars here. Compared with the window mean vector in step S4 Mutual differentiation; weighted binary cross-entropy is used to increase the contribution of minority class fraud samples to the training objective; federated proximal constraints are used to limit the excessive offset of the local model relative to the current global model, mitigating client drift caused by non-independent and identically distributed data; when At that time, the local target degenerates into a federated average training form that does not include proximal terms; Step 8: Server-side global model weighted aggregation; After the client completes local training, it obtains... And uploaded to the federal server, among which, For the first The client in the first The server performs a weighted aggregation of the model parameters trained locally; the parameters of the currently participating clients are calculated based on the number of valid SPD samples. in, For the first The set of clients participating in the training round. The next round of global model parameters will be aggregated by the server; the server will The data is sent to the client, and steps S7 and S8 are repeated until the preset number of communication rounds is reached or the verification metric converges, resulting in the final global model. ,in, This represents the final model parameters when the federated training converges or reaches the preset number of rounds. Step 9: Client-side local fraud reasoning and risk handling; For newly occurring target transactions, the client constructs the most recent target transaction data, following steps 2 to 6. The risk score is obtained by taking a transaction window, SPD samples, and a logarithmic domain feature vector, and then inputting this feature vector into the final global model. ,in, Assign a fraud risk score to the current target transaction; set a first risk threshold. Second risk threshold ,in, and These represent the boundaries for determining low risk and medium risk, and medium risk and high risk, respectively. :when When it is determined to be low risk, it is automatically released; when At that time, it was determined to be of medium risk and entered the manual review stage; when When a risk is identified as high, secondary verification, transaction blocking, or account freezing is triggered; subsequent review labels can be used to generate new training samples locally for periodic federal updates.

2. The federal financial fraud detection method based on SPD manifold as described in claim 1, characterized in that: In step 1, the original financial transaction dataset is: in, For the first The number of original transaction records per client. For the first Transaction records For the corresponding transaction tags, This indicates a normal transaction. This indicates a fraudulent transaction; each client corresponds to a financial institution, branch, business department, or other data-holding node, and the client does not upload the original transaction records to the federated server.

3. The federal financial fraud detection method based on SPD manifold as described in claim 1, characterized in that: In step 2, the preprocessing includes performing one-hot encoding on the transaction type field; Execute on transaction amount Transformation; construct the change in the balance of the initiating account, the change in the balance of the receiving account, the ratio of the transaction amount to the balance, and the time interval between adjacent transactions of the same account; standardize the continuous numerical features using training data statistics; the account identifier includes the transaction initiating account identifier, the transaction receiving account identifier, or an associated account identifier formed by a combination of the two.

4. The federal financial fraud detection method based on SPD manifold as described in claim 1, characterized in that: In step 3, the behavior matrix is: And with the current target transaction's label This serves as the sample label for the window; where... For account identification, For the target trading time, The length of the trading window. For a moment The corresponding account behavior matrix, The current target transaction label; When the account's cumulative number of transactions before and at the target time is less than [a certain number], [the following is true]. When this happens, the target transaction sample can be discarded, or zero-filling, account mean-filling, or mask-filling can be used; preferably, samples with insufficient historical data should be discarded; the third After filtering by window, the client was obtained 100 valid window samples, of which Compared with the number of original transaction records Distinguish between them.

5. A federal financial fraud detection system based on SPD manifold, implementing the method as described in claim 1, characterized in that: Includes client-side modules and federated server-side modules; The client-side module includes a transaction data preprocessing module, an account transaction window construction module, an SPD sample construction module, a logarithmic domain feature mapping module, a FedProx local training module, and a risk inference module; The federal server-side modules include a reference mean security aggregation module, a global model initialization module, a global model weighted aggregation module, a model publishing module, and an audit log module.

6. A federal financial fraud detection system based on SPD manifold as described in claim 5, characterized in that: The transaction data preprocessing module is used to complete transaction time sorting, transaction type encoding, logarithmic transformation of transaction amount, construction of balance change features, construction of transaction amount relative to balance ratio features, construction of adjacent transaction time interval features, and standardization of continuous numerical features. The account transaction window construction module is used to extract the most recent transactions up to the current transaction and including the current transaction, based on the account identifier and transaction time sequence. Each transaction forms a behavior matrix and outputs the corresponding target transaction label; The SPD sample construction module is used to calculate the centered window feature covariance matrix based on the behavior matrix and add a regularization term to generate samples belonging to the SPD model. symmetric positive definite matrix samples; The logarithmic domain feature mapping module is used to receive SPD samples and LEM reference mean sent by the server, and perform matrix principal logarithm, centering, and... Vectorize the vectors and output the logarithmic domain eigenvectors. The FedProx local training module is used to receive logarithmic domain feature vectors, transaction labels, and global model parameters issued by the server, to train the local model under the combined effect of weighted binary cross-entropy loss and federated proximal constraints, and to upload the local model parameters. The risk inference module is used to output a fraud risk score during the deployment phase and generate handling results such as automatic release, manual review, secondary verification, transaction interception or account freezing based on the first risk threshold and the second risk threshold.

7. A federal financial fraud detection system based on SPD manifold as described in claim 5, characterized in that: The reference mean secure aggregation module is used to receive or securely aggregate contributions from each client. and Calculate the global logarithmic field statistics and the LEM reference mean, and send the LEM reference mean to the model publishing module; The global model initialization module is used to establish the Tangent-MLP initial network based on the logarithmic domain feature dimension, hidden layer size and output dimension, and initialize the global model parameters, number of communication rounds, number of local training rounds, learning rate, class weights, proximal term coefficients and risk threshold; The global model weighted aggregation module is used to receive local model parameters uploaded by each client, perform weighted aggregation based on the number of valid SPD samples, and obtain the next round of global model parameters. The model publishing module is used to publish the LEM reference mean, the global model parameters for the current round, and the unified training configuration to the client, so that each client uses consistent logarithmic domain coordinates and model parameters. The audit record module is used to record the participating clients, number of valid samples, aggregate weights, model version, risk score, threshold judgment results and handling results for each round, forming traceable training audit records and risk decision audit records.

Images