Conditioned abnormal sample generation method and system

Abstract

The present application relates to a conditional abnormal sample generation method, system, electronic device, non-transitory computer readable storage medium and computer program product. The method comprises: obtaining a target abnormal behavior type and object behavior data associated with the target abnormal behavior type, the object behavior data indicating behavior records of one or more target objects and corresponding associated information; extracting behavior features related to sample generation from the object behavior data according to the target abnormal behavior type to obtain generation constraint data, the generation constraint data limiting the sample object range and the generation condition of the behavior records within the sample when a sample generation model generates a synthetic abnormal sample; and inputting the generation constraint data into the sample generation model to generate a synthetic abnormal sample corresponding to the target abnormal behavior type.

Description

Technical Field

[0001] This article relates to the field of computer technology, and in particular to methods, systems, electronic devices, non-transitory computer-readable storage media, and computer program products for generating conditional anomaly samples. Background Technology

[0002] During the training of anomaly behavior recognition models, the coverage and structural quality of sample data affect the model's ability to identify anomalous behavior patterns. For some anomalous behavior scenarios, there may be insufficient numbers of real anomalous samples, delayed label feedback, or rapid changes in sample distribution, making it difficult for the model training data to promptly cover newly emerging or changed anomalous behavior patterns.

[0003] The content described herein is provided only as background information relevant to this article and does not necessarily constitute prior art. Summary of the Invention

[0004] This article provides methods, systems, electronic devices, non-transitory computer-readable storage media, and computer program products for generating conditional anomaly samples.

[0005] Firstly, this paper provides a conditional anomaly sample generation method. This method includes: acquiring a target anomaly behavior type and object behavior data associated with that target anomaly behavior type; the object behavior data indicating behavior records of one or more target objects and corresponding associated information; extracting behavioral features related to sample generation from the object behavior data based on the target anomaly behavior type to obtain generation constraint data; the generation constraint data limiting the range of sample objects and the generation conditions of behavior records within the sample when the sample generation model generates synthetic anomaly samples; and inputting the generation constraint data into the sample generation model to generate synthetic anomaly samples corresponding to the target anomaly behavior type.

[0006] According to one or more embodiments of the method herein, optionally, the object behavior data includes stage behavior data corresponding to multiple behavior stages, and the behavior records of the same target object in different stage behavior data are associated through object identifiers.

[0007] According to one or more embodiments of the present invention, optionally, extracting behavioral features related to sample generation from object behavior data includes: sorting behavior records with the same object identifier in behavior data of each stage according to the chronological relationship of multiple behavior stages to obtain a cross-stage behavior sequence; and extracting behavioral temporal features from the cross-stage behavior sequence.

[0008] According to one or more embodiments of the method herein, optionally, the association information is represented by an association graph, which includes object nodes corresponding to target objects and relationship edges representing behavioral associations between target objects.

[0009] According to one or more embodiments of the present invention, optionally, extracting behavioral features related to sample generation from object behavior data includes: determining the node connectivity or node clustering degree based on the connection relationship between object nodes in the association graph to obtain object association features.

[0010] According to one or more embodiments of the present invention, the type of the target anomalous behavior is optionally determined based on the distribution change of the observed behavior data within the current time window relative to historical reference data.

[0011] According to one or more embodiments of the method herein, optionally, determining the distribution change includes: calculating corresponding observation indicators based on the observed behavior data and historical reference data respectively; and determining the distribution change based on the difference between the observation indicators corresponding to the observed behavior data and the observation indicators corresponding to the historical reference data.

[0012] According to one or more embodiments of the method herein, optionally, in response to a distribution change satisfying a triggering condition, an abnormal event is generated, and the abnormal event records the observation index that triggers the abnormal event and a set of candidate objects associated with the observation index.

[0013] According to one or more embodiments of the present invention, wherein, optionally, the abnormal event corresponds to one of single-object anomaly, object feature cluster drift, or abnormal behavior type distribution change, the method further includes: determining whether the triggering condition for generating a synthetic abnormal sample is met based on the anomaly level corresponding to the abnormal event; and determining the sample object range in response to meeting the triggering condition.

[0014] According to one or more embodiments of the present invention, optionally, obtaining the generated constraint data includes: selecting a target condition item from a set of preset condition items corresponding to the target abnormal behavior type based on the observation indicators of the abnormal event record; determining the value or value range of the target condition item based on one or more of the following to obtain the generated constraint data: the abnormal value range of the observation indicator; the abnormal level corresponding to the abnormal event; and a set of candidate objects.

[0015] According to one or more embodiments of the present invention, optionally, obtaining the generated constraint data includes: selecting a target condition item that matches the behavior feature from a preset set of condition items corresponding to the target abnormal behavior type; determining the value of the target condition item based on the behavior feature to obtain the generated constraint data.

[0016] According to one or more embodiments of the method herein, optionally, the value of the target condition term is determined based on the distribution of the corresponding behavioral features in the real abnormal sample set.

[0017] According to one or more embodiments of the method herein, optionally, generating constraint data includes object filtering conditions that limit the target objects contained in the synthetic anomalous sample and the range of associations between the target objects.

[0018] According to one or more embodiments of the method herein, optionally, the generation of constraint data includes behavioral temporal conditions that define the temporal order and time interval between multiple behavioral records in a synthetic anomaly sample.

[0019] According to one or more embodiments of the method herein, optionally, the generated constraint data includes fund flow conditions, which limit the flow path of funds among multiple target objects in the synthetic anomaly sample and the relationship between fund inflows and fund outflows.

[0020] According to one or more embodiments of the present invention, the method may optionally include, before inputting the generation constraint data into the sample generation model, selecting a sample generation model from a plurality of candidate sample generation models based on the data structure represented by the generation constraint data.

[0021] According to one or more embodiments of the method herein, optionally, in response to generating constraint data characterizing the association graph structure, a graph structure generation model is selected, and synthetic anomaly samples including object nodes and relation edges are generated through the graph structure generation model.

[0022] According to one or more embodiments of the method herein, optionally, in response to generating constraint data characterizing the synthetic anomaly sample to be generated having a behavioral temporal structure, a temporal sample generation model is selected, and the generating constraint data is input into the temporal sample generation model to generate a synthetic anomaly sample including multiple behavioral records sorted by time.

[0023] According to one or more embodiments of the method herein, optionally, the method further includes: recording generation metadata corresponding to the synthesized anomalous sample, wherein the generation metadata includes one or more of the following: generation constraint data identifier, sample generation model type, sample generation model version, generation time, and sample batch information.

[0024] According to one or more embodiments of the method herein, optionally, the method further includes: obtaining generation feedback data corresponding to the synthesized anomalous sample; and adjusting at least one of the model parameters, conditional injection parameters, and sampling parameters of the sample generation model based on the generation feedback data.

[0025] According to one or more embodiments of the present invention, the method may optionally generate feedback data including the sample statistical distribution of synthetic anomalous samples and the sample statistical distribution of the real anomalous sample set; and adjust at least one of the model parameters, conditional injection parameters, and sampling parameters of the sample generation model based on the generated feedback data, including: adjusting the conditional injection parameters of the sample generation model based on the distribution difference between the sample statistical distribution of synthetic anomalous samples and the sample statistical distribution of the real anomalous sample set.

[0026] According to one or more embodiments of the method herein, optionally, generating feedback data includes online confirmation labels indicating abnormal object behavior data; adjusting at least one of the model parameters, conditional injection parameters, and sampling parameters of the sample generation model based on the generated feedback data includes: calibrating the sample generation model based on the online confirmation labels indicating abnormal object behavior data.

[0027] According to one or more embodiments of the present invention, the method may optionally further include: recording the model version of the adjusted sample generation model and the generation parameters corresponding to the model version; and generating the next batch of synthetic anomalous samples based on the adjusted sample generation model.

[0028] According to one or more embodiments of the present invention, the method may optionally further include: performing constraint verification on the synthetic anomalous sample to obtain a verification result and a target synthetic anomalous sample that satisfies the verification conditions.

[0029] According to one or more embodiments of the present invention, optionally, performing constraint verification on the synthetic anomalous sample includes: performing hard constraint verification on the synthetic anomalous sample based on the generation constraint data to determine whether the synthetic anomalous sample meets the generation conditions defined by the generation constraint data.

[0030] According to one or more embodiments of the method herein, optionally, the hard constraint verification includes: verifying whether multiple behavior records in the synthesized abnormal sample are arranged in ascending order of timestamps, and whether the occurrence time of each behavior record is not earlier than the state effective time of the corresponding target object.

[0031] According to one or more embodiments of the method herein, optionally, the hard constraint verification further includes: determining whether the synthetic abnormal sample satisfies the capital flow conservation condition based on the capital inflow and capital outflow corresponding to the multiple target objects in the synthetic abnormal sample.

[0032] According to one or more embodiments of the present invention, optionally, constraint verification is performed on synthetic anomalous samples, including: determining the distributional similarity between the synthetic anomalous samples and a subset of real anomalous samples; and determining a soft constraint score for the synthetic anomalous samples based on the distributional similarity.

[0033] According to one or more embodiments of the present invention, wherein, optionally, determining the distribution similarity between synthetic anomalous samples and a subset of real anomalous samples includes: determining at least one of feature distribution differences, object association structure differences, and behavioral temporal distribution differences between synthetic anomalous samples and a subset of real anomalous samples.

[0034] According to one or more embodiments of the method herein, optionally, the method further includes: adjusting the generation constraint data in response to a verification result indicating that the synthesized anomalous sample does not meet the verification conditions, and regenerating the synthesized anomalous sample based on the adjusted generation constraint data.

[0035] According to one or more embodiments of the method herein, optionally, the method further includes: adjusting at least one of the model parameters, conditional injection parameters, and sampling parameters of the sample generation model based on the verification result.

[0036] According to one or more embodiments of the present invention, optionally, adjusting at least one of the model parameters, conditional injection parameters, and sampling parameters of the sample generation model based on the verification result includes: adjusting the sampling parameters or conditional injection parameters of the sample generation model based on the proportion of samples that failed the hard constraint verification in the verification result.

[0037] According to one or more embodiments of the present invention, the method may optionally include adjusting at least one of the model parameters, condition injection parameters, and sampling parameters of the sample generation model based on the verification results, and may further include adjusting the model parameters of the sample generation model based on the changing trend of the soft constraint scores in the verification results.

[0038] According to one or more embodiments of the method herein, optionally, the method further includes: recording the model version of the adjusted sample generation model, the generation parameters before and after adjustment, and the verification results that trigger the model adjustment.

[0039] According to one or more embodiments of the present invention, the method may optionally further include: training or updating an abnormal behavior recognition model based on a set of target synthetic abnormal samples and a set of real abnormal samples.

[0040] According to one or more embodiments of the method herein, the method may optionally further include: adjusting the sample weights of the target synthetic abnormal sample in the training sample set based on the verification results of the trained or updated abnormal behavior recognition model.

[0041] According to one or more embodiments of the present invention, the method may optionally further include: writing object behavior data indicating abnormality by online confirmation tags into a set of real abnormal samples; and calibrating and generating constraint data based on the updated set of real abnormal samples.

[0042] Secondly, this paper provides a conditional anomaly sample generation system. This system includes a data acquisition module, a feature extraction module, and a sample generation module. The data acquisition module is configured to acquire the target anomaly behavior type and the object behavior data associated with it. The object behavior data indicates the behavior records of one or more target objects and the corresponding associated information. The feature extraction module is configured to extract behavioral features related to sample generation from the object behavior data based on the target anomaly behavior type, obtaining generation constraint data. The generation constraint data limits the range of sample objects and the generation conditions of behavior records within the sample when the sample generation model generates synthetic anomaly samples. The sample generation module is configured to input the generation constraint data into the sample generation model to generate synthetic anomaly samples corresponding to the target anomaly behavior type.

[0043] Thirdly, this document provides an electronic device. The electronic device includes a processor and a memory, the memory storing program instructions that, when executed by the processor, cause the processor to perform any of the methods described in the first aspect.

[0044] Fourthly, this document provides a non-transitory computer-readable storage medium. This non-transitory computer-readable storage medium stores program instructions that, when executed by a processor, cause the processor to perform any of the methods described in the first aspect.

[0045] Fifthly, this document provides a computer program product. The computer program product includes program instructions that, when executed by a processor, cause the processor to perform the method described in any of the first aspects. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this article, the accompanying drawings used in the description of the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this article and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 A flowchart of a conditional anomaly sample generation method 100 according to some embodiments is shown.

[0048] Figure 2 A schematic flowchart of a sample generation model adjustment method 200 according to some embodiments is shown.

[0049] Figure 3 A flowchart illustrating a method 300 for adjusting a sample generation model based on constraint verification according to some embodiments is shown.

[0050] Figure 4A flowchart illustrating an example implementation of conditional anomaly sample generation and model enhancement according to some embodiments is shown.

[0051] Figure 5 A schematic diagram of the modules of a conditional anomaly sample generation system 500 according to some embodiments is shown.

[0052] Figure 6 A schematic diagram of the structure of an electronic device 600 according to some embodiments is shown. Detailed Implementation

[0053] The technical solutions in the embodiments described herein will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments described herein, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments described herein without creative effort are within the scope of protection of this document.

[0054] In this article, the term "target anomalous behavior type" can refer to the category, pattern, or scenario of anomalous behavior corresponding to the synthetic anomalous sample to be generated. The target anomalous behavior type can be determined based on the application scenario, historical anomalous samples, manual annotation results, anomalous events, model recognition results, or business rules. For example, the target anomalous behavior type can include object collaboration anomalies, behavioral timing anomalies, data flow anomalies, identity association anomalies, etc., or it can correspond to a more specific anomalous behavior scenario, such as a particular type of financial fraud.

[0055] In this article, the term "target object" refers to the entity or logical object that is recorded or associated in object behavior data. Target objects can be one or more of the following: accounts, users, merchants, payment recipients, transaction objects, audit objects, etc. Target objects can correspond to entities in real-world business systems, or to object identifiers, nodes, or logical units in data processing systems.

[0056] In this article, the term "object behavior data" refers to data that is associated with a target abnormal behavior type and can characterize the behavior records of one or more target objects, as well as the corresponding related information. Object behavior data can include raw data, standardized data, feature-based data, graph-structured data, time-series data, or multi-source fused data. As an example, the record content involved in object behavior data can include one or more of the following: transaction records, application records, repayment records, transfer records, login records, device usage records, object attribute records, object relationship records, and behavior stage records.

[0057] In this article, the term "relationship information" can refer to the relationships between behavioral records, between target objects, or between behavioral records and target objects. Relationship information can include interaction relationships, data flow relationships, graph structure connection relationships, etc. Relationship information can be represented by table structures, edge tables, relationship graphs, relationship matrices, index records, log records, or other machine-processable data structures.

[0058] In this paper, the term "behavioral features" refers to feature data extracted from object behavior data and related to sample generation. Behavioral features can include statistical features, behavioral temporal features, object interaction features, data flow features, object attribute features, and relationship graph features. Behavioral features can be used to determine generation constraint data, as well as to select sample generation models, determine the scope of sample objects, determine the generation conditions of behavioral records within the sample, or perform subsequent constraint verification.

[0059] The following provides illustrative examples of the conditional anomaly sample generation method, system, electronic device, non-transitory computer-readable storage medium, and computer program product provided herein.

[0060] In some embodiments, the conditional anomaly sample generation method provided herein can be executed by a data processing device. The data processing device can be a server, a cloud computing node, an edge computing node, a model training device, a processing node in a data analysis platform, or other computing devices capable of acquiring object behavior data, running a sample generation model, and generating synthetic anomaly samples. This method can be implemented using a software system that includes processing capabilities such as data acquisition, feature extraction, sample generation, model adjustment, constraint verification, model training, or feedback optimization. Different processing capabilities can be deployed on the same device or distributed across multiple computing nodes, and interact with each other through data interfaces or network communication links.

[0061] The following is combined Figure 1 This paper explains the conditional anomaly sample generation method provided in this paper. Figure 1 A flowchart illustrating a conditional anomaly sample generation method according to some embodiments is shown. This method can be executed by a server, cloud computing node, edge computing node, model training device, or other data processing device. The method may include steps S110 to S130.

[0062] In step S110, the target abnormal behavior type and the object behavior data associated with the target abnormal behavior type are obtained. The object behavior data indicates the behavior records of one or more target objects and the associated information corresponding to the behavior records.

[0063] The target anomalous behavior type can represent the anomalous behavior category, pattern, or scenario corresponding to the synthetic anomalous samples to be generated in this sample generation task. The target anomalous behavior type can be obtained from the sample generation task, anomalous events, model output results, manually configured data, or a preset set of types. For example, the target anomalous behavior type can correspond to object collaboration anomalies (e.g., multiple accounts forming a centralized interaction relationship around the same object), behavior temporal anomalies (e.g., multiple behavior records exhibiting an abnormal sequence or time interval between preset stages), data flow anomalies (e.g., data flowing back or circulating among multiple objects according to a specific path), identity association anomalies (e.g., multiple objects sharing devices, network addresses, or identity association information), or other anomalous types that can be characterized by object behavior data.

[0064] For example, in credit or transaction risk control scenarios, abnormal object collaboration can include multiple applicant accounts engaging in transactions around the same merchant or group of merchants within a short period of time, creating transaction flows that do not correspond to actual business activities; abnormal behavior timing can include accounts applying for loans or credit lines intensively in a short period before the loan is granted, maintaining normal transactions or repayments for several periods during the loan period to create the appearance of normal behavior, and then experiencing concentrated overdue payments, refusals, or defaults after the loan is granted; abnormal data flow can include transaction funds flowing from the applicant account to the merchant account, then flowing back to the source account or its associated accounts through one or more receiving accounts, transit accounts, or related accounts; and abnormal identity association can include multiple applicant accounts sharing device identifiers, network addresses, contact information, receiving account information, login environments, or other identity association information. The above financial scenarios are just examples; the target abnormal behavior types can also correspond to other abnormal behavior patterns reflected through object behavior data.

[0065] Object behavior data can include raw behavior records corresponding to one or more target objects, standardized behavior records, object attribute records, and relationship records between objects. Target objects can be, for example, accounts, users, merchants, devices, network addresses, payment recipients, intermediary objects (e.g., objects that transfer or switch data between multiple objects), or other data processing objects that can be distinguished by object identifiers. Behavior records can be, for example, transaction records, application records, repayment records, transfer records, login records, device usage records, or object status change records (e.g., object registration, activation, online, frozen, invalid, or tag change records).

[0066] For example, in credit or transaction risk control scenarios, transaction records can include payment records, consumption records, refund records, chargeback records, or settlement records initiated by the account to the merchant; application records can include loan applications, credit limit applications, credit limit increase applications, or multi-platform application records; repayment records can include on-time repayment, early repayment, minimum repayment, overdue repayment, or non-repayment records; transfer records can include fund flow records between merchant accounts, receiving accounts, transit accounts, application accounts, and their associated accounts; login records or device usage records can include account login time, login device, network address, geographical location, or device fingerprint; and object status change records can include account registration, account activation, merchant online, credit limit changes, overdue status changes, manual review label changes, or risk label changes.

[0067] Association information can be used to indicate the relationships between different target objects, between the behavior records of different target objects, or between a target object and a behavior record. For example, association information can indicate whether multiple objects have common interaction objects (e.g., multiple accounts interacting with the same merchant or the same device), whether they share a device or network address, whether there is a data flow relationship, whether they have the same object identifier, or whether they are located in the connection path of the same association graph.

[0068] For example, in merchant loans or consumer credit scenarios, related information can indicate whether multiple application accounts have concentrated transactions with the same merchant or the same group of merchants, whether multiple accounts share device identifiers, network addresses, contacts, bank cards, receiving accounts or login environments, whether the merchant account receives transaction funds and then flows back to the application account or the application account's related account through the receiving account, transit account or related account, and whether multiple accounts, merchants, devices, receiving accounts and transit accounts are located in the same account-transaction-merchant relationship diagram or fund flow path.

[0069] In some embodiments, object behavior data includes stage behavior data corresponding to multiple behavior stages, and behavior records of the same target object in different stage behavior data are associated through object identifiers. Multiple behavior stages can be divided according to the time of behavior occurrence, object state changes, business processing flow, or data processing cycle. Object identifiers can be account identifiers, user identifiers, device identifiers, merchant identifiers, node identifiers, or other unique identifiers or combinations thereof used to identify the target object.

[0070] By associating behavioral records from different stages with object identifiers, behavioral records that were originally scattered across different data tables, time windows, or data sources can be mapped to the same target object, thus providing a data foundation for subsequent extraction of cross-stage behavioral features.

[0071] In some embodiments, the target anomalous behavior type is determined based on the distribution change of the observed behavior data within the current time window relative to historical reference data. The current time window can be a time range corresponding to the current monitoring period, and the historical reference data can be object behavior data from one or more historical time windows prior to the current time window, or reference data formed from historical normal samples, historical anomalous samples, or their statistical results.

[0072] Acquiring the target anomalous behavior type can include directly reading the already determined target anomalous behavior type, or it can include determining the target anomalous behavior type based on the observed behavior data and historical reference data. Therefore, the "acquiring" step S110 does not limit the target anomalous behavior type to be predetermined by an external device.

[0073] In some embodiments, corresponding observation indicators are calculated based on the observed behavior data and historical reference data, respectively, and the distribution changes are determined based on the differences between the observation indicators corresponding to the observed behavior data and the observation indicators corresponding to the historical reference data. Observation indicators can reflect the number of behaviors (e.g., the number of transactions or applications within a preset time window), the value of behaviors (e.g., transaction amount, transfer amount, or credit limit usage value), the frequency of behavior occurrence (e.g., the number of behavior records per unit time), the degree of object reuse (e.g., the degree to which device identifiers or network addresses are shared by multiple objects), the degree of object association (e.g., the connection density or clustering degree of object nodes in the same association graph), the data flow ratio (e.g., the ratio of inflow to outflow or return ratio), or other object behavior characteristics. In credit risk control scenarios, observation indicators may also include the number of loan applications in the past 1 day, the growth rate of merchant transaction volume, the growth rate of merchant transaction amount, refund rate, chargeback rate, device reuse rate, network address reuse rate, number of common merchants, short-term fund return rate, or clustering coefficients in the account-merchant relationship graph.

[0074] The differences between the aforementioned observation indicators can be numerical differences, rates of change, distribution distances, statistical test results, or anomaly detection results. These differences can be compared to corresponding trigger thresholds, or anomaly detection models can be used to determine whether the differences reflect changes in the distribution of the observed behavioral data relative to historical reference data.

[0075] In some embodiments, corresponding anomaly detection conditions can be pre-configured for different observation indicators. These conditions may include whether the observation indicator exceeds a preset normal range, whether it enters a preset anomaly range, whether the degree of change of the observation indicator relative to historical reference data meets preset change conditions, whether the anomaly involves a preset number of candidate objects, or a combination of the aforementioned conditions. If an observation indicator meets its corresponding anomaly detection condition, the observation indicator can be determined to be anomaly. Different observation indicators may correspond to different anomaly detection conditions.

[0076] As an example, a single-sample abnormal signal at the micro level can be identified as abnormal when the distance between a new input sample and a known abnormal pattern reaches a preset distance condition; an object feature cluster at the meso level can be identified as abnormal when the offset direction, offset distance, or offset velocity of the feature cluster centroid reaches the corresponding drift condition; and an abnormal behavior type at the macro level can be identified as abnormal when the quantity proportion, occurrence frequency, or proportion change trend of the abnormal behavior type reaches the corresponding proportional change condition.

[0077] In some embodiments, an anomalous event is generated in response to a distribution change satisfying a triggering condition. The anomalous event record includes the observed index that triggered the event and a set of candidate objects associated with that index. The anomalous event may also include an anomalous event identifier, the time of occurrence, the type of anomalous event, the intensity of the anomalous event, the range of data involved, a statistical summary, or other information that describes the outcome of the anomalous observation.

[0078] The candidate object set can include one or more target objects that cause changes in the observed metric or have a data association with that observed metric. By recording the observed metric and the candidate object set in the anomaly event, the detection results of distribution changes can be transformed into data objects that can be processed in the subsequent sample generation process.

[0079] In some embodiments, anomalies can correspond to single-object anomalies at the micro level, object feature cluster drift at the meso level, or changes in the distribution of anomalous behavior types at the macro level. Single-object anomalies can indicate that one or a few target objects deviate from their historical reference distribution; object feature cluster drift can indicate that the position, range, or distribution of a feature cluster corresponding to a class of target objects changes in the feature space; changes in the distribution of anomalous behavior types can indicate that the proportion, frequency, or trend of one or more anomalous behavior types changes.

[0080] The generation of synthetic anomaly samples can be determined based on the anomaly level corresponding to the anomaly event and the number of candidate objects involved. For single-object anomalies at the microscopic level, if the anomaly involves only one or a few candidate objects, the corresponding anomaly signal can be recorded and monitored during subsequent observations without immediately triggering the generation of synthetic anomaly samples. If the number of candidate objects with the same or similar anomaly characteristics reaches a preset threshold, the generation of synthetic anomaly samples can be triggered based on these candidate objects.

[0081] For meso-level object feature cluster drift, if the offset direction, offset distance, offset velocity, or feature distribution change of the feature cluster centroid meets the corresponding triggering conditions, the generation of synthetic anomalous samples for the anomalous behavior type corresponding to that feature cluster can be triggered. For macro-level anomalous behavior type distribution changes, if the quantity proportion, frequency of occurrence, or proportion change trend of one or more anomalous behavior types meets the corresponding triggering conditions, one or more sample generation tasks can be triggered, or the number of generated samples, sample object range, or task priority of the corresponding anomalous behavior type can be adjusted.

[0082] For example, if a single account experiences an unusually high number of loan applications within a short period, that account can be recorded as an object to be observed. If multiple accounts with similar application frequencies, device reuse relationships, or shared merchant relationships appear within the same time window, sample generation for that type of account can be triggered. If the characteristics of a group of accounts gradually change from small, scattered transactions to concentrated shared merchants, increased device reuse, and longer fund return paths, sample generation for that feature cluster can be triggered. If the proportion of fund return-type abnormal behavior in the current time window continues to increase relative to historical windows, the number of fund return-type abnormal samples generated can be increased, or the corresponding generation task can be reconfigured.

[0083] In step S120, based on the target abnormal behavior type, behavioral features related to sample generation are extracted from the object behavior data to obtain generation constraint data. The generation constraint data limits the scope of sample objects and the generation conditions of behavioral records within the sample when the sample generation model generates synthetic abnormal samples. Generation constraint data can be represented as one or more of the following: a set of fields, a set of conditions, a set of rules, a set of parameters, configuration data, vectors, embedded representations, graph structure conditions, time window conditions, fund flow conditions, and generation task configurations. It can also limit the sample generation process from dimensions such as the scope of sample objects, the generation conditions of behavioral records, and the relationships between objects. Behavioral features can be data obtained through statistical analysis, sorting, aggregation, matching, graph processing, time-series processing, or other feature processing based on the original fields, behavioral records, related information, or combinations thereof of the object behavior data. Behavioral features related to sample generation can be features that reflect the scope of objects, behavioral relationships, behavioral order, or data flow methods corresponding to the target abnormal behavior type.

[0084] In some embodiments, behavioral records with the same object identifier in each stage of behavioral data are sorted according to the chronological relationship of multiple behavioral stages to obtain a cross-stage behavioral sequence, and behavioral temporal features are extracted from the cross-stage behavioral sequence.

[0085] Cross-stage behavior sequences can record the order of actions of the same target object across multiple behavior stages, the time of action, the time interval between adjacent actions, the number of actions in each stage, or the object state in each stage. Behavioral temporal characteristics can be obtained from one or more behavior records in a cross-stage behavior sequence and can reflect the behavioral changes of the target object between different stages.

[0086] For example, behavioral records corresponding to the same object identifier can be sorted according to behavioral stages and timestamps, thereby forming a continuous behavioral sequence covering multiple stages. This behavioral sequence can be used to define the stage order and temporal relationship in which behavioral records in synthetic anomaly samples should be generated.

[0087] In some embodiments, the association information is represented by an association graph. The association graph includes object nodes corresponding to target objects, and relationship edges representing behavioral associations between target objects.

[0088] Object nodes can correspond to accounts, users, merchants, devices, network addresses, payment recipients, transit recipients, or other target objects. Relationship edges can represent transaction relationships, transfer relationships, shared device relationships, shared network address relationships, shared interaction object relationships, or other behavioral associations that can connect different target objects.

[0089] Relationship graphs can be generated from object identifiers and related records in object behavior data, or obtained from existing graph data, graph databases, or relationship edge tables. Relationship edges can also carry behavior time, behavior value, relationship type, behavior frequency, or other edge attributes.

[0090] In some embodiments, based on the connection relationships between object nodes in the association graph, the node connectivity degree or node clustering degree is determined to obtain object association features. Node connectivity degree can reflect the number or strength of connections between an object node and other object nodes. Node clustering degree can reflect whether multiple object nodes form a relatively concentrated association group.

[0091] Object association features can also reflect the number of objects interacting together, the number of repeated connections, the density of relationship edges, the length of association paths, or the size of object groups. These object association features can be incorporated into the generation constraint data to limit the number of objects and the ways in which objects are associated in synthetic anomalous samples.

[0092] In some embodiments, behavioral features related to sample generation are extracted from object behavior data, including one or more of statistical features, behavioral temporal features, object interaction features, and data flow features.

[0093] Statistical characteristics may include the number of actions within a preset time window, the mean or dispersion of action values, the number of changes in object state, or other statistical results. Action temporal characteristics may include the order in which actions occur, the time interval between actions, concentrated periods of action, or cross-stage action changes. Object interaction characteristics may include the number of interactions between different objects, the number of objects interacting together, the degree of object reuse, or relationship graph structure characteristics. Data flow characteristics may include the flow path, the number of flow layers, the inflow volume, the outflow volume, the flow ratio, or the flow direction.

[0094] For example, in credit or transaction risk control scenarios, statistical characteristics may include the number of transactions, average transaction amount, transaction amount variance, refund rate, chargeback rate, or number of loan applications for an account in the past 1 day, 7 days, or 30 days; behavioral temporal characteristics may include the chronological order between stages such as frequent pre-loan applications, normal repayments during the loan period, and concentrated overdue payments after the loan period, or the time interval between adjacent transactions or concentrated transaction periods; object interaction characteristics may include the number of transactions between an account and a merchant, the number of merchants with multiple accounts conducting transactions together, and the number of times multiple accounts share a device or network address; data flow characteristics may include the path, number of layers, proportion, and time interval of transaction funds flowing from the application account to the merchant account, and then flowing back to the application account or associated account through the receiving account or transit account.

[0095] In some embodiments, obtaining the generated constraint data includes selecting a target condition item that matches the behavior characteristics from a set of preset condition items corresponding to the target abnormal behavior type, and determining the value of the target condition item based on the behavior characteristics to obtain the generated constraint data.

[0096] As an example, in the abnormal scenario of merchant loan gangs, the scope of objects can include a set of candidate merchants, a set of candidate application accounts, and a set of candidate transit accounts; object attributes can include the number of days the account has been active, the duration of the merchant's online activity, the number of times the device has been reused, or the number of times the network address has been reused; object relationships can include multiple accounts jointly trading with the same merchant, multiple accounts sharing the same device, or multiple accounts being associated with the same receiving account; the sequence of behaviors can include the order of the pre-loan application stage, the transaction flow formation stage, the repayment faking stage, and the concentrated default stage; the behavior values ​​can include the range of transaction amounts, the range of repayment amounts, or the range of overdue amounts; the data flow path can include the fund flow path between the application account, the target merchant, the transit account, and the associated account; the number of generated samples can represent the number of sample batches or sample entries that need to be generated in this generation task.

[0097] Different target abnormal behavior types can correspond to different preset condition sets. Each preset condition set can record one or more optional condition items related to the corresponding target abnormal behavior type. Condition items can correspond to object scope, object attributes, object relationships, behavior frequency, behavior sequence, behavior value, data flow path, number of generated samples, or other generation conditions.

[0098] Selecting target condition items that match behavioral characteristics can include determining the condition items to be used in this sample generation from a preset set of condition items based on the type, degree of abnormality, involved objects, or corresponding data structures of the behavioral characteristics. Therefore, the generated constraint data does not need to use the exact same fixed fields for all target abnormal behavior types, but can determine the corresponding content based on the target abnormal behavior type and the extracted behavioral characteristics.

[0099] In some embodiments, a mapping relationship between observation indicators and candidate condition items can be pre-established. In response to the generation of an anomaly event, a target condition item corresponding to the anomaly observation indicator can be selected from the candidate condition items based on one or more anomaly observation indicators recorded in the anomaly event record.

[0100] For example, anomalies in device reuse rate or network address reuse rate can correspond to target conditions such as the set of candidate accounts, the range of the number of candidate accounts, the number of times devices are reused, the number of times network addresses are reused, and the observation time window. Anomalies in short-term fund return rate can correspond to target conditions such as fund transfer path, maximum number of transfer layers, fund return ratio, transaction amount range, and range of transfer targets. Anomalies in loan application frequency can correspond to target conditions such as the range of loan application frequency, the time interval between adjacent applications, and the sample time window. Anomalies in cross-stage behavior sequence can correspond to target conditions such as the sequential relationship between the pre-loan application stage, the loan repayment stage, and the post-loan delinquency stage, as well as the duration of each stage.

[0101] When multiple abnormal observation indicators point to the same abnormal behavior pattern, the target conditions corresponding to these abnormal observation indicators can be combined into the same generated constraint data. For example, when the equipment reuse rate, the number of shared merchants, and the short-term fund return rate are all abnormal at the same time, the generated constraint data can simultaneously include conditions such as the candidate account set, shared equipment relationship, shared merchant relationship, fund flow path, and fund return ratio.

[0102] The value or range of the target condition can be determined based on one or more of the following: the type of the abnormal observation indicator, the anomaly level to which the abnormal observation indicator belongs, the abnormal numerical range of the observation indicator, the set of candidate objects involved in the abnormal event, and the distribution of corresponding behavioral characteristics in the set of real abnormal samples. Specifically, the set of candidate objects can be used as the value for the target condition of object screening, the abnormal numerical range of the observation indicator can be used to determine the value range of the target condition of numerical type, and the anomaly level can be used to determine the value range of the target condition or task priority.

[0103] For example, if the abnormal device reuse rate only involves a small number of candidate accounts, the range of account quantity and device reuse frequency in the condition vector can be limited to the observation range of the corresponding candidate accounts. If the abnormal device reuse rate involves a large group of accounts, the range of account quantity can be expanded accordingly, and target condition items such as common merchant relationships, common collection account relationships, or network address reuse relationships can be added. If the short-term fund return rate is higher than the corresponding anomaly judgment condition, the fund return ratio range in the condition vector can be determined based on the fund return rate range observed in the abnormal event, and the maximum number of transfer layers and the range of transfer objects can be determined based on the abnormal fund transfer path.

[0104] A single anomalous event can correspond to one or multiple generation constraint data sets. When multiple anomaly observation indicators point to the same anomalous behavior type and the same candidate object group, the corresponding target condition terms can be combined into a single generation constraint data set. When an anomalous event involves multiple separate candidate object groups, multiple object feature clusters, or multiple anomalous behavior types, multiple generation constraint data sets can be generated separately for different candidate object groups, object feature clusters, or anomalous behavior types.

[0105] For example, if the first merchant group exhibits small-amount, high-frequency transactions within a short time window, while the second merchant group exhibits multi-layered fund inflows within a longer time window, then first and second generation constraint data can be generated respectively. The first generation constraint data may include a shorter time window, a smaller range of transaction amounts, and a higher transaction frequency; the second generation constraint data may include a longer time window, a greater number of circulation layers, and a corresponding range of fund inflow ratios.

[0106] In some embodiments, the value of the target condition term is determined based on the distribution of the corresponding behavioral features in the set of real anomaly samples. The set of real anomaly samples may include anomaly samples confirmed through manual verification, online feedback verification, historical tag verification, or other methods.

[0107] For example, the value range, representative value, or probability distribution of the target condition item can be determined based on the distribution of the number of objects, the frequency of actions, the time interval, the value of actions, or the turnover ratio in a real abnormal sample set. In this way, the value of the target condition item in the generated constraint data can be based on the behavioral characteristics of real abnormal samples, rather than relying entirely on fixed manual values.

[0108] In some embodiments, the generated constraint data includes object filtering conditions. These object filtering conditions define the target objects included in the synthesized anomalous samples and the range of associations between these target objects.

[0109] Object selection criteria can limit the set of candidate objects, object types, range of object quantity, range of object attributes, range of connections between objects, or association relationships between objects and specific interactive objects. The sample generation model can determine, based on these object selection criteria, which objects need to be generated in the synthetic anomalous samples and what associations these objects can form.

[0110] In some embodiments, the generated constraint data includes behavioral temporal conditions. These behavioral temporal conditions define the temporal order and time intervals between multiple behavioral records in the synthesized anomalous sample.

[0111] Behavioral timing conditions can restrict multiple behavioral records to appear in a preset stage sequence, or they can limit the time interval between adjacent behavioral records, the time window in which a behavioral record is located, or the duration of a specific behavior. By using behavioral timing conditions, the possibility of the sample generation model generating behavioral records that do not conform to the order in which the behaviors occur can be reduced.

[0112] In some embodiments, the generated constraint data includes fund flow conditions. Fund flow conditions define the flow path of data among multiple target objects in the synthetic anomaly sample, as well as the relationship between inflows and outflows.

[0113] Data flow paths can include starting objects, intermediate objects, ending objects, and the flow order between objects. The relationship between inflows and outflows can be equal, proportional, range-based, or other relationships determined by the object's status. Fund flow conditions can also limit the number of flow layers, the number of inflows and outflows for a single object, or the range of objects that can be flowed.

[0114] In step S130, the constraint data is input into the sample generation model to generate synthetic abnormal samples corresponding to the target abnormal behavior type.

[0115] A sample generation model can be a model, algorithm, rule engine, generator, or a combination thereof capable of generating synthetic anomalous samples based on generation constraint data. As an example, a sample generation model may include one or more of the following: graph structure generation model, time series sample generation model, tabular sample generation model, conditional generation model, rule template generator, etc. The sample generation model can be deployed on servers, cloud computing nodes, edge computing nodes, data processing devices, or other computing devices.

[0116] The constraint data can be directly used as input to the sample generation model, or it can be processed through encoding, embedding, format conversion, or condition injection before being input into the sample generation model. The sample generation model can generate target objects within the sample object range defined by the constraint data, and generate corresponding behavioral records and associated information according to the generation conditions defined by the constraint data.

[0117] Synthetic anomaly samples can be sample data generated by a sample generation model based on generation constraint data and corresponding to the target anomalous behavior type. Synthetic anomaly samples can include one or more of the following: one or more target objects, multiple behavior records, relationships between objects, temporal relationships between behavior records, data flow paths between multiple target objects, sample labels, and generation metadata. Synthetic anomaly samples can be used to train, update, test, evaluate, or calibrate anomaly behavior recognition models, and can also be used for anomaly behavior rule verification or sample coverage analysis.

[0118] Synthetic outliers can be single samples or batches of multiple samples. Synthetic outliers can take the form of tabular data, time-series data, graph-structured data, event sequences, sets of object records, or combinations thereof.

[0119] In some embodiments, before inputting the generation constraint data into the sample generation model, a sample generation model is selected from multiple candidate sample generation models based on the data structure represented by the generation constraint data.

[0120] Multiple candidate sample generation models can be adapted to handle different data structures. For example, some candidate sample generation models can be adapted to generate graph structure samples that include object nodes and relation edges; some candidate sample generation models can be adapted to generate behavioral sequences ordered by time; and other candidate sample generation models can be adapted to generate table samples with fixed fields.

[0121] The sample generation model can be selected based on the main condition terms included in the generated constraint data, the representation of the associated information, the output structure of the sample to be generated, or the historical generation results.

[0122] In some embodiments, in response to generating constraint data representing the association graph structure, a graph structure generation model is selected, and synthetic anomaly samples including object nodes and relation edges are generated through the graph structure generation model.

[0123] Graph structure generation models can generate corresponding object nodes and relation edges based on the number of objects, object types, object association ranges, and relation edge attributes specified by generation constraint data. The generated synthetic anomaly samples can include graph edge tables, node attribute tables, graph structure identifiers, or other data that can represent the graph structure.

[0124] In some embodiments, in response to generating constraint data characterizing the synthetic anomaly sample to be generated as having a behavioral temporal structure, a temporal sample generation model is selected, and the generating constraint data is input into the temporal sample generation model to generate a synthetic anomaly sample including multiple behavioral records sorted by time.

[0125] The time-series sample generation model can generate behavior records one by one based on the temporal conditions of the behavior, or it can generate a group of behavior records with timestamps or stage identifiers at once. The generated multiple behavior records can be arranged according to the time of occurrence of the behavior, the stage of the behavior, or other temporal identifiers.

[0126] In some embodiments, generation metadata corresponding to the synthesized anomalous samples is recorded. Generation metadata includes one or more of the following: generation constraint data identifier, sample generation model type, sample generation model version, generation time, and sample batch information.

[0127] The generation constraint data identifier can associate the synthesized anomalous sample with the generation constraint data used when generating the sample. The sample generation model version can indicate the model parameter version or model configuration version corresponding to this sample generation. The sample batch information can indicate the generation task, generation batch, or generation time range to which the synthesized anomalous sample belongs.

[0128] By recording the generated metadata, the source, generation conditions, and model version of the synthesized anomalous samples can be traced, providing data basis for subsequent model adjustments, constraint verification, or sample selection.

[0129] Through steps S110 to S130, generation constraint data can be determined based on the target abnormal behavior type and object behavior data. This generation constraint data simultaneously limits the object scope and behavior record generation conditions of the samples to be generated. Therefore, the synthetic abnormal samples generated by the sample generation model can reflect the relationships between target objects, the temporal relationships between behavior records, or the data flow relationships, reducing the possibility of generating unreasonable samples based solely on category labels or a few attributes.

[0130] The following is combined with Figure 2This section explains the adjustment process for sample generation models that do not require constraint verification results as a prerequisite for adjustment. Figure 2 A schematic flowchart of a sample generation model adjustment method according to some embodiments is shown. Figure 2 The method shown may include steps S210 to S270.

[0131] In step S210, the target abnormal behavior type and the object behavior data associated with the target abnormal behavior type are obtained.

[0132] In step S220, behavioral features related to sample generation are extracted from the object behavior data according to the target abnormal behavior type to obtain generation constraint data.

[0133] In step S230, the constraint data is input into the sample generation model to generate synthetic abnormal samples corresponding to the target abnormal behavior type.

[0134] Steps S210 to S230 can adopt the same or similar processing methods as steps S110 to S130. The descriptions above regarding object behavior data, behavior features, generation constraint data, sample generation model, and synthetic abnormal samples can all be applied to steps S210 to S230, provided there is no conflict.

[0135] In step S240, the generation feedback data corresponding to the synthesized abnormal sample is obtained.

[0136] The generated feedback data can be derived from the statistical results of the synthetic anomalous samples themselves, real anomalous samples, online confirmation labels, historical generation task results, or model training results after sample generation. The generated feedback data can be generated directly for the current batch of synthetic anomalous samples, or it can be data accumulated from multiple historical sample batches.

[0137] In step S250, at least one of the model parameters, conditional injection parameters, and sampling parameters of the sample generation model is adjusted based on the generated feedback data.

[0138] Model parameters can be the parameters used by the sample generation model during training or generation. Conditional injection parameters can be parameters that control the influence of generation constraint data on the sample generation process. Sampling parameters can be parameters that control the number of samples generated, the range of sample selection, or the randomness of the generation results.

[0139] In some embodiments, the type and direction of the parameter to be adjusted can be determined based on the generated feedback data. If the statistical distribution of the synthetic anomaly sample on a certain behavioral feature dimension is higher or lower than that of the real anomaly sample set, the conditional injection weight corresponding to that behavioral feature dimension can be decreased or increased, or the sampling probability or sampling range of the corresponding target object, behavioral record, or behavioral value can be adjusted. For example, when the overall number of device reuses in the synthetic anomaly sample is lower than that in the real anomaly sample, the conditional injection weight of the device reuse condition can be increased, or the probability of candidate accounts with device reuse relationships being sampled can be increased; when the overall transaction time interval in the synthetic anomaly sample is shorter than that in the real anomaly sample, the sampling range of adjacent transaction time intervals can be expanded.

[0140] When the sample generation model is a trainable generation model, the real abnormal samples corresponding to the generated feedback data or the object behavior data of objects indicating abnormality by online confirmation labels can be used as calibration samples. The sample generation model can then be trained based on the calibration samples to update the model parameters of the sample generation model.

[0141] Step S250 does not require that the synthesized anomalous samples have passed the constraint verification. That is, in some embodiments, the sample generation model can be adjusted directly based on the statistical distribution of the synthesized anomalous samples, the statistical distribution of the real anomalous samples, or the online confirmation labels.

[0142] In some embodiments, the generated feedback data includes the statistical distribution of the synthetic anomalous samples and the statistical distribution of the real anomalous sample set. Based on the distribution difference between the statistical distribution of the synthetic anomalous samples and the statistical distribution of the real anomalous sample set, the conditional injection parameters of the sample generation model are adjusted.

[0143] The statistical distribution of a sample can correspond to the distribution of the number of objects, the frequency of actions, the value of actions, the time interval, the connectivity of objects, the degree of object clustering, or other behavioral characteristics. Distribution differences can represent the deviation of synthetic anomalous samples from real anomalous samples in one or more behavioral characteristic dimensions.

[0144] The influence of different generation conditions on the sample generation process can be adjusted according to the distribution differences, so that the subsequently generated synthetic abnormal samples are close to the real abnormal sample set in the corresponding behavioral feature dimensions.

[0145] In some embodiments, the generated feedback data includes object behavior data indicating abnormalities as confirmed by online verification tags. The sample generation model is then calibrated based on this object behavior data.

[0146] Online confirmation labels can be generated through manual review, subsequent status feedback, online test result confirmation, or other label confirmation processes. Abnormal object behavior data indicated by online confirmation labels can be added to a calibration sample set, and behavioral features corresponding to the target abnormal behavior type can be extracted from the calibration sample set.

[0147] Calibrating the sample generation model can include updating one or more of the following based on a calibration sample set: the training data of the sample generation model, the reference distribution of real abnormal samples, the mapping relationship between the target abnormal behavior type and the preset condition set, and the conditional injection parameters and sampling parameters. If the sample generation model is a trainable model, it can also be trained further based on the calibration sample set to update the model parameters.

[0148] In step S260, the model version of the adjusted sample generation model and the generation parameters corresponding to the model version are recorded.

[0149] The model version can correspond one-to-one with the sample generation model after this adjustment. The generation parameters can include the model parameters, conditional injection parameters, sampling parameters, or other model configurations used after this model adjustment. It can also record the model adjustment time, adjustment basis, generated feedback data identifier, or the model version before adjustment.

[0150] In step S270, the next batch of synthetic anomalous samples is generated based on the adjusted sample generation model.

[0151] The next batch of synthesized anomalous samples can continue to use the generation constraint data obtained in step S220, or it can use the generation constraint data updated based on the latest object behavior data or the latest generation feedback data. The next batch of synthesized anomalous samples can be associated with the adjusted model version and generation parameters to support subsequent comparisons of generation results from different model versions.

[0152] The following is combined Figure 3 The process of adjusting the sample generation model based on the constraint verification results is explained. Figure 3 A schematic diagram of a method for adjusting a sample generation model based on constraint verification according to some embodiments is shown. Figure 3 The method shown may include steps S310 to S390.

[0153] In step S310, the target abnormal behavior type and the object behavior data associated with the target abnormal behavior type are obtained.

[0154] In step S320, behavioral features related to sample generation are extracted from the object behavior data according to the target abnormal behavior type to obtain generation constraint data.

[0155] In step S330, the constraint data is input into the sample generation model to generate synthetic abnormal samples corresponding to the target abnormal behavior type.

[0156] Steps S310 to S330 can be performed in the same or similar manner as steps S110 to S130, and will not be repeated here.

[0157] In step S340, constraint verification is performed on the synthesized abnormal samples.

[0158] Constraint verification can be a process of verifying whether synthetic anomalous samples meet preset verification conditions or the generation conditions limited by the constraint data. Constraint verification can include hard constraint verification and soft constraint scoring. Hard constraint verification can be used to determine whether synthetic anomalous samples meet necessary conditions such as time sequence, object state, data flow, and numerical range. Soft constraint scoring can be used to determine the degree of similarity between synthetic anomalous samples and real anomalous samples in terms of feature distribution, object association structure, and behavioral temporal distribution.

[0159] In some embodiments, constraint verification can be used to determine whether the synthesized anomalous sample meets the generation conditions defined by the generation constraint data, or whether the synthesized anomalous sample is close to the real anomalous sample within a preset similarity range. Constraint verification may include only hard constraint verification, only soft constraint scoring, or a combination of hard constraint verification and soft constraint scoring.

[0160] In some embodiments, hard constraint verification is performed on the synthesized anomalous samples based on the generation constraint data to determine whether the synthesized anomalous samples meet the generation conditions defined by the generation constraint data.

[0161] Hard constraint validation can be performed on object selection conditions, behavioral timing conditions, fund flow conditions, or other mandatory generation conditions in the generated constraint data. If a synthetic anomalous sample does not meet any of the mandatory generation conditions, it can be determined that the synthetic anomalous sample has failed the hard constraint validation.

[0162] In some embodiments, hard constraint verification includes verifying whether multiple behavior records in the synthesized abnormal sample are arranged in ascending order of timestamps, and whether the occurrence time of each behavior record is not earlier than the state effective time of the corresponding target object.

[0163] The effective time of a target object's status can be the time when the target object completes registration, creation, activation, going online, or other status changes. By comparing the occurrence time of a behavior record with the effective time of its status, time-related logical conflicts can be identified where the behavior record occurred before the corresponding target object possessed the corresponding status.

[0164] In some embodiments, hard constraint verification further includes determining whether the synthetic anomaly sample satisfies the capital flow conservation condition based on the inflow and outflow amounts corresponding to the multiple target objects in the synthetic anomaly sample.

[0165] The principle of capital flow conservation can limit the inflow and outflow of intermediate target objects to satisfy an equal relationship, a proportional relationship, or an allowable deviation range. It can also determine whether the flow records in the synthesized abnormal samples result in an unacceptable data volume state based on the target object's state data before and after the flow.

[0166] In some embodiments, constraint verification is performed on the synthetic anomalous samples, including determining the distributional similarity between the synthetic anomalous samples and a subset of real anomalous samples, and determining a soft constraint score for the synthetic anomalous samples based on the distributional similarity.

[0167] Distributional similarity can be obtained by comparing the statistical distributions of synthetic anomalous samples and subsets of real anomalous samples across one or more behavioral feature dimensions. Soft constraint scores can be continuous numerical values, rank values, or other data that can represent the degree of similarity between synthetic and real anomalous samples.

[0168] In some embodiments, determining the distributional similarity between synthetic anomalous samples and subsets of real anomalous samples includes determining at least one of feature distribution differences, object association structure differences, and behavioral temporal distribution differences between synthetic anomalous samples and subsets of real anomalous samples.

[0169] Differences in feature distribution can reflect deviations in the distribution of features such as the frequency of actions, the numerical value of actions, or object attributes. Differences in object association structure can reflect differences in graph structure features such as the number of object nodes, the number of relation edges, node connectivity, or the degree of node clustering. Differences in the temporal distribution of actions can reflect differences in features such as the order in which actions occur, the time intervals between actions, or the duration of stages.

[0170] In step S350, the verification result and the target synthetic abnormal sample that meets the verification conditions are obtained.

[0171] The verification results may include whether the hard constraint verification passed, the types of constraints that failed, the soft constraint scores, distribution similarity, sample credibility, or other verification data. The target synthetic anomalous sample can be a synthetic anomalous sample that passes the hard constraint verification and whose soft constraint score reaches the threshold, or it can be a synthetic anomalous sample selected according to different verification rules.

[0172] In some embodiments, in response to a verification result indicating that the synthesized anomalous sample does not meet the verification conditions, the generation constraint data is adjusted, and the synthesized anomalous sample is regenerated based on the adjusted generation constraint data.

[0173] Adjusting the generated constraint data may include modifying the values ​​of target condition items, adding or deleting target condition items, narrowing the sample object range, adjusting the time series range of behavior, or adjusting the fund flow conditions. The regenerated synthetic abnormal samples can re-enter step S340 for constraint verification, thus forming a feedback process of adjusting the generated constraint data and regenerating samples.

[0174] In step S360, based on the verification results, at least one of the model parameters, conditional injection parameters, and sampling parameters of the sample generation model is adjusted.

[0175] The validation results can be used as a basis for adjusting the sample generation model. The parameters to be adjusted can be determined based on the types of failed constraints recorded in the validation results.

[0176] For example, when the failed constraint type is a behavioral timing constraint, the condition injection weight of the behavioral timing condition can be increased, the sampling range of the behavioral record time interval can be adjusted, or the random disturbance amplitude when generating timestamps can be reduced; when the failed constraint type is an object screening constraint, the sampling range of candidate objects can be narrowed or the sampling probability of different candidate objects can be adjusted; when the failed constraint type is a capital flow conservation constraint, the condition injection weight of the capital flow condition can be increased, or the sampling range of inflow, outflow, number of flow layers and return ratio can be adjusted.

[0177] In step S370, the sampling parameters or conditional injection parameters of the sample generation model are adjusted according to the proportion of samples that failed the hard constraint verification in the verification results.

[0178] The proportion of samples failing hard constraint validation can be determined for all hard constraints, or separately for time sequence constraints, object state constraints, or capital flow conservation constraints. The failure proportions corresponding to different hard constraints can trigger adjustments to the corresponding condition injection parameters or sampling parameters. This proportion can be compared to a preset proportion threshold, and when the proportion reaches the preset threshold, the sampling parameters or condition injection parameters corresponding to the hard constraint are adjusted. The parameter adjustment range can be determined based on the degree to which the proportion exceeds the preset proportion threshold, or based on the mapping relationship between a pre-configured proportion range and the parameter adjustment amount.

[0179] For example, when multiple synthetic anomalous samples do not meet the behavioral timing conditions, the degree of constraint of the behavioral timing conditions on the sample generation process can be increased; when multiple synthetic anomalous samples do not meet the object screening conditions, the sampling range of the sample objects can be adjusted.

[0180] In step S380, the model parameters of the sample generation model are adjusted according to the changing trend of the soft constraint score in the verification results.

[0181] The trend of soft constraint scores can be determined based on the soft constraint scores of multiple consecutive batches of samples generated by the same sample generation model, or based on the soft constraint scores of batches of samples generated by different model versions. For example, the trend of soft constraint scores can be determined based on the score difference between adjacent batches, the average score of multiple batches, or the rate of change of scores.

[0182] When the soft constraint score continuously decreases, the average score falls below a preset score threshold, or the score decrease reaches a preset update condition, it can be determined that the model parameters of the sample generation model need to be updated. If the sample generation model is a trainable model, it can be trained again based on the corresponding real abnormal sample set and synthetic abnormal sample set to update the model parameters; after updating, synthetic abnormal samples can be generated again and the soft constraint score can be determined.

[0183] In step S390, the model version of the adjusted sample generation model, the generation parameters before and after the adjustment, and the verification results that triggered the model adjustment are recorded.

[0184] The validation results that trigger model adjustments can include the percentage of hard constraint validation failures, the types of constraints that failed, and soft constraint scores or score trends. By associating and recording the model version, generation parameters, and validation results, the triggering reasons and results of different model adjustment operations can be traced.

[0185] In some embodiments, the abnormal behavior recognition model can also be trained or updated based on the target synthetic abnormal sample and the set of real abnormal samples. This process can be a downstream processing branch after the target synthetic abnormal sample is generated, and is not required to be executed simultaneously with the sample generation model adjustment in steps S360 to S390.

[0186] An abnormal behavior recognition model can be a machine learning model, statistical model, rule model, or a combination thereof used to identify abnormal behavior, abnormal objects, abnormal samples, or abnormal events. The abnormal behavior recognition model can be trained or updated based on real abnormal samples, synthetic abnormal samples, normal samples, object behavior data, or their feature data. The output of the abnormal behavior recognition model may include one or more of the following: abnormal identification result, abnormal probability, abnormal score, abnormal type, review result, model validation result, etc.

[0187] Anomaly recognition models differ from sample generation models. Sample generation models generate synthetic anomaly samples based on generation constraint data, while anomaly recognition models output anomaly recognition results based on input object behavior data or sample features. Target synthetic anomaly samples can be combined with real anomaly samples to form a training sample set, supplementing the limited number or insufficient coverage of anomaly behavior patterns in the real anomaly samples.

[0188] In some embodiments, the sample weights of the target synthetic anomalous sample in the training sample set are adjusted based on the verification results of the trained or updated anomalous behavior recognition model.

[0189] Validation results can include the anomaly recognition model's accuracy, recall, false positives, false negatives, ranking, or other model performance metrics on the validation sample set. Adjusting sample weights based on the validation results can include increasing the weight of synthetic anomaly samples that positively contribute to model recognition, or decreasing the weight of synthetic anomaly samples that negatively impact model performance.

[0190] In some embodiments, the abnormal object behavior data indicated by the online confirmation label is written into the real abnormal sample set, and the constraint data is calibrated and generated based on the updated real abnormal sample set.

[0191] The online confirmation tags can supplement the latest abnormal behavior patterns in the real abnormal sample set. Based on the updated real abnormal sample set, the values ​​of target condition items can be redefined, the value ranges of different condition items can be adjusted, or the correspondence between target abnormal behavior types and the preset condition item set can be updated.

[0192] In this way, real online label data can be used to calibrate the generated constraint data, reducing the possibility that the synthetic anomalous samples will shift relative to the distribution of real anomalous samples after long-term cyclic use.

[0193] To further illustrate the implementation process of the conditional anomaly sample generation method presented in this paper in a specific application scenario, the following section combines... Figure 4 Please provide an explanation. Figure 4 A schematic diagram of the overall implementation architecture for conditional anomaly sample generation and model enhancement according to some embodiments is shown. This overall implementation architecture 400 may include a data access and preprocessing module S410, an environment observation module S420, a conditional vector construction agent S430, a conditional sample generation module S440, a constraint verification module S450, an enhancement training and model deployment module S460, and an online monitoring and adaptive tuning module S470.

[0194] Figure 4 The "condition vector" in this context can be a specific data format for generating constraint data as described above; the "fraud sample" can be a specific example of synthesized abnormal samples in a credit anomaly behavior identification scenario; and the "risk control model" can be a specific implementation of an anomaly behavior identification model. Therefore, Figure 4 The specific embodiments shown do not constitute a limitation on the overarching technical concepts described above.

[0195] Figure 4The modules shown can transmit data sequentially in the directions S410 to S470. Specifically, after detecting a data change that meets the trigger conditions, the environmental observation module S420 can send trigger information to the condition vector construction agent S430. The trigger information sent by the environmental observation module S420 to the condition vector construction agent S430 may include the identifier of the abnormal observation indicator, the abnormal level to which the abnormal observation indicator belongs, the abnormal value range of the observation indicator, the set of candidate objects involved in the abnormality, the number of candidate objects, the object feature cluster identifier, or the abnormal behavior type identifier, etc. The condition vector construction agent S430 can determine whether to generate a condition vector based on the trigger information, and determine one or more of the following in the condition vector: condition items, number of condition items, value range of condition items, number of condition vectors, number of generated samples, and task priority.

[0196] When the constraint verification module S450 determines that a generated sample has failed verification, it can feed back the verification result to the condition vector construction agent S430 to adjust the condition vector and regenerate the sample. The online monitoring and adaptive tuning module S470 can feed back the online feedback data to the environmental observation module S420, so that subsequent environmental observation and sample generation processes can continue to be executed based on the updated data.

[0197] In one specific embodiment, Figure 4 The overall implementation architecture 400 shown can be applied to generate samples of abnormal group behavior in merchant loan scenarios. One type of abnormal behavior in this scenario can manifest as follows: a group of accounts repeatedly initiates transactions at one or more merchants to create transaction flows that do not correspond to actual business activities; subsequently, the transaction funds flow back to the source account or its associated account through a specific path via a related receiving account or transit account, thus forming an abnormal behavior chain that includes multiple accounts, multiple merchants, multiple fund flow nodes, and multiple behavioral stages.

[0198] In this embodiment, the target abnormal behavior type can be abnormal group transactions, abnormal fraudulent transaction flow, abnormal fund return, or a combination of the aforementioned abnormal types. Target objects can include application accounts, transaction accounts, merchants, receiving accounts, transit accounts, devices, and network addresses, etc. Object behavior data can include transaction records, application records, repayment records, transfer records, device usage records, and object association records for different target objects.

[0199] The data access and preprocessing module S410 can access multi-source data from the pre-loan, loan application, and post-loan stages. Pre-loan stage data may include account registration data, loan application data, multi-platform application records, device identifiers, network addresses, and account attribute data. Loan application stage data may include transaction records, merchant behavior data, repayment records, credit limit usage records, and account status change records. Post-loan stage data may include overdue records, chargeback records, refund records, fund return records, manual review tags, and subsequent confirmation tags.

[0200] The data access and preprocessing module S410 does not require the use of all available data in each generation task. In some embodiments, the data sources and fields to be accessed can be determined based on the target abnormal behavior type, sample generation task configuration, or preset field configuration. For example, for abnormal group transactions, the focus can be on accessing account association relationships, common merchant relationships, device or network address reuse relationships, and fund transfer records; for abnormal cross-stage defaults, the focus can be on accessing behavioral records from multiple stages such as application, normal repayment, credit limit usage, and concentrated overdue payments.

[0201] The data access and preprocessing module S410 can perform preprocessing on data from different data sources, such as field mapping, object identifier alignment, time format unification, numerical normalization, outlier handling, missing value handling, and duplicate record removal, to obtain standardized transaction tables or other standardized behavior record tables.

[0202] As an example, a record in a standardized transaction table can include fields such as transaction identifier, account identifier, merchant identifier, transaction amount, transaction currency, transaction time, device identifier, network address, refund status, and transaction status. Object identifier alignment can link records corresponding to the same account, merchant, or device in different data sources to form object behavior records across data sources.

[0203] The data access and preprocessing module S410 can also extract structured features from standardized behavior records. Statistical features may include transaction frequency, average transaction amount, transaction amount variance, refund rate, or chargeback rate over the past 1 day, 7 days, or 30 days. Temporal features may include the time interval between the most recent N transactions, the day-night distribution of transactions, transaction concentration within a specific time period, and the time span across behavioral phases. Interaction features may include merchant-user side weights, the number of shared merchants among users, device reuse, and network address reuse.

[0204] The data access and preprocessing module S410 can also generate a ternary relationship graph of account-transaction-merchant or a corresponding edge table, and calculate graph structure indicators such as node degree, node clustering coefficient, number of relation edges, and length of associated paths based on the ternary relationship graph. The output of the data access and preprocessing module S410 may include a standardized transaction table, a graph edge table, an object attribute table, and a structured abnormal behavior feature set.

[0205] The environmental observation module S420 can receive the standardized transaction table and structured abnormal behavior feature set output by the data access and preprocessing module S410, and calculate one or more observation indicators. Observation indicators may include chargeback rate, refund rate, growth rate of merchant transaction amount, growth rate of merchant transaction number, device reuse rate, network address reuse rate, short-term fund return rate, and graph clustering coefficient, etc.

[0206] The environmental observation module S420 can compare the observed indicators within the current time window with the observed indicators within the historical reference window to determine whether the data distribution has changed. The historical reference window can be a continuous time window preceding the current time window, or it can be a reference data set formed based on historical normal samples or historical abnormal samples.

[0207] In one implementation, anomaly detection conditions corresponding to different observation indicators can be stored through a configuration table or rule base. These conditions may include normal value range, abnormal value range, rate of change condition, number of candidate objects condition, and task priority corresponding to the anomaly level. The environmental observation module S420 can read the anomaly detection conditions corresponding to the observation indicator to be judged and determine whether the observation indicator is abnormal based on whether it meets these conditions. The statistical tests, distribution distances, and anomaly detectors described later can serve as specific methods for determining whether an observation indicator meets the anomaly detection conditions. In some embodiments, the environmental observation module S420 can use the Kolmogorov-Smirnov Test (KS test), Jensen-Shannon Divergence (JS divergence), or MeanShift method to detect distribution changes. The environmental observation module S420 can also use anomaly detectors such as an autoencoder or isolation forest to determine the degree of anomaly of new input data relative to historical data.

[0208] As an example of a threshold, when the probability value corresponding to the KS test is less than 0.01, or the JS divergence is greater than 0.1, it can be determined that the corresponding observation indicator meets the triggering condition. This value is only an example and does not constitute a limitation on the triggering threshold. Different observation indicators can use different thresholds, and the threshold can also be adjusted according to the amount of data, time window, or target abnormal behavior type.

[0209] When the environmental observation module S420 determines that the triggering conditions are met, it can generate an abnormal event and send it to the condition vector construction agent S430. The abnormal event may include an abnormal event identifier, an abnormality type, a triggering indicator, a list of candidate merchants involved, a list of candidate accounts involved, the time of the abnormality, and a statistical summary.

[0210] In some embodiments, the environmental observation module S420 may use a three-layer state space to represent the environmental state.

[0211] The first layer can be the macro-state layer. The macro-state layer can include distribution vectors for multiple abnormal behavior types, such as the proportion and trend of the proportions of gang-related anomalies, single-object anomalies, and fraudulent transaction flow anomalies within a preset time window.

[0212] The second layer can be the meso-state layer. The meso-state layer can include the feature subspace and core feature clusters corresponding to each anomalous behavior type, and can monitor the drift direction and velocity of the feature cluster centroids. If a feature cluster corresponding to a known anomalous type experiences continuous drift, it indicates that a new behavioral variant of that anomalous type has emerged.

[0213] The third layer can be a microstate layer. The microstate layer can include anomalous signals of a single new input sample, such as the nearest neighbor distance between the new input sample and a known anomalous pattern.

[0214] The environmental observation module S420 can employ different processing methods based on the level of anomaly occurrence and the number of candidate objects involved. Single or a small number of anomalous signals in the micro-state layer can be written into the observation record; when the number of candidate objects with the same or similar anomalous characteristics meets a preset quantity condition, a micro-level anomalous event can be generated and a corresponding sample generation task can be triggered. When the centroid drift of an object feature cluster in the meso-state layer meets a corresponding drift condition, an anomalous event targeting that object feature cluster can be generated, and a relatively high task priority can be assigned to that anomalous event. When the proportion or trend of anomalous behavior types in the macro-state layer meets a corresponding proportion change condition, annomalous events involving one or more anomalous behavior types can be generated, and the number of generated samples, the range of sample objects, or the generation strategy for the corresponding anomalous behavior type can be adjusted.

[0215] In the S430 conditional vector-based intelligent agent, it can receive structured abnormal behavior feature sets, online monitoring indicators, historical sample generation results, abnormal behavior recognition model training results, rule base, and business parameters. Online monitoring indicators may include short-term capital return rate, merchant transaction surge index, device reuse rate, and network address reuse rate. Historical model performance may include the area under the receiver operating characteristic curve (AUC), KS statistic, recall rate, false positive rate, or other validation metrics.

[0216] The S430 conditional vector construction agent can represent generated constraint data as JavaScript Object Notation (JSON) data, field sets, vectors, embedded representations, or other structured configurations. The S430 conditional vector construction agent can be implemented through a rule engine, a policy selection program, a reinforcement learning policy module, or a combination thereof.

[0217] In some embodiments, the condition vector construction agent S430 can read the abnormal observation indicators, abnormal level, abnormal value range and candidate object set in the abnormal event, and query the mapping relationship between the observation indicators and the candidate condition items in order to select the target condition item included in the condition vector.

[0218] When an anomalous event corresponds to a micro-level anomaly, if the sample generation triggering conditions are met, the condition vector can primarily limit the candidate objects involved in the anomaly, the attribute range of the candidate objects, and the behavioral conditions directly related to the anomaly observation indicators. The condition vector corresponding to a micro-level anomalous event can have a relatively narrow range of objects and condition values.

[0219] When an abnormal event corresponds to a shift in the object feature cluster at the meso-level, the condition vector can include condition terms corresponding to one or more feature dimensions that caused the shift. The value range of the condition terms can be determined based on the shifted object feature cluster. For example, if the shift in the object feature cluster is mainly manifested as an increase in equipment reuse rate, an increase in the number of common merchants, and an extension of the fund return path, then the condition vector can include condition terms such as the number of equipment reuses, the number of common merchants, the maximum number of circulation layers, and the fund return ratio.

[0220] When the distribution of abnormal behavior types at the macro level changes corresponding to abnormal events, the condition vector construction agent S430 can generate condition vectors for one or more abnormal behavior types whose proportions change, and determine the number of samples to be generated according to the degree of change in the proportion of different abnormal behavior types, the scarcity of samples, or the priority of tasks.

[0221] In one implementation, the conditional vector construction agent S430 can set merchant filtering conditions to limit the range of merchants involved in the synthesized anomalous samples. This range can include a list of candidate merchants in the anomalous event, or merchants with the same attributes or similar behavioral characteristics as the candidate merchants.

[0222] The S430 intelligent agent, which constructs conditional vectors, can also set account attribute conditions. For example, account attribute conditions may include account duration, device reuse count, network address reuse count, average transaction interval, and account status.

[0223] For abnormal group behavior, the conditional vector construction agent S430 can set group size conditions based on the group size distribution in real group samples. For example, the group size can be set to a target range of 3 to 15 people. This value is one example, and the actual range can be adjusted according to the type of abnormal behavior and the distribution of real samples.

[0224] The S430 agent, which constructs conditional vectors, can also set time window conditions. For example, 30 days or 180 days can be set as the time span for generating samples to simulate anomalous behavior with different durations. Shorter time windows are suitable for representing concentrated bursts of anomalous behavior, while longer time windows are suitable for representing anomalous behavior that gradually develops across multiple behavioral stages.

[0225] The S430 intelligent agent, which constructs conditional vectors, can also set a range of numerical values ​​for behaviors. For example, the range for small abnormal transactions at a Point of Sale (POS) terminal can be set to 50 to 1000, and the range for fraudulent transaction records related to merchant loans can be set to 2000 to 20000. This range can be interpreted according to the corresponding currency and can be adjusted based on the application region, merchant type, or distribution of real samples.

[0226] The S430 intelligent agent, which constructs conditional vectors, can also set conditions for fund flow. For example, the fund return ratio can be set to 0.8 to 1.0, the maximum number of flow layers (max_hop) can be set to 3, and the maximum number of inflows per account (max_inflow) can be set to 5. Fund flow conditions can ensure that the generated fund flow network satisfies preset flow paths, return ratios, and conservation relationships.

[0227] In a complete generation task, the generation constraints can be defined as follows: the group size is between 3 and 15 people; the sample time window is 30 days; the single transaction amount is between 2,000 and 20,000; the return flow ratio is between 0.8 and 1.0; the maximum number of circulation layers is 3; and the maximum number of payments received by a single account is 5. These items can be used individually or in combination. The aforementioned group size, time window, transaction amount, return flow ratio, maximum number of circulation layers, and maximum number of payments received can be used as preset initial values ​​or example values. During the execution of the generation task, the range of values ​​for the aforementioned conditions can be narrowed, expanded, or redefined based on the abnormal value range of the abnormal observation indicators, the set of candidate objects involved in the abnormal events, and the behavioral characteristic distribution of the corresponding real abnormal samples.

[0228] The S430 agent, which constructs conditional vectors, can also select generator types and generation parameters from a policy library. Policy selection can be based on the data structure represented by the generation constraint data, or on the impact of historical generation tasks on the performance of the abnormal behavior recognition model.

[0229] The output of the S430 condition vector-based agent can be a generated task. The generated task may include a task identifier, condition vectors, policy number, number of generated samples, and task priority. The S430 can also generate an agent log, which records decision rationale, triggering evidence, selected policy, input anomalies, and condition field values ​​to support subsequent auditing and traceability.

[0230] In one alternative implementation, instead of using reinforcement learning, a rule-based trigger consisting of a fixed threshold and expert rules can be used to generate the condition vector. In another alternative implementation, an agent S430 can be constructed from the condition vector to generate candidate generation conditions, which are then manually confirmed and the generation task is issued.

[0231] To illustrate the granularity of the conditions used to generate constraint data, in a set of comparative configurations, the first conditional configuration might only include category labels such as "anomaly category = 1". In this case, the sample generation model might generate samples belonging to different anomaly subtypes, and specific anomaly behavior patterns might be diluted in the generated results.

[0232] The second condition configuration can add attribute conditions such as "overdue = yes" and "amount = high" in addition to category labels. However, if the behavior sequence condition is missing, the generated samples may still show situations where the application behavior and the overdue behavior occur on the same day, which does not conform to a complete behavior chain.

[0233] One possible configuration of the conditions presented in this paper can further include a multi-borrowing graph structure, a sequence of frequent pre-loan applications, a normal repayment phase during the loan period, and a concentrated default pattern after the loan. Thus, the generated constraint data not only indicates which type of anomalous sample to generate, but also limits the specific scenario and behavioral stage of that anomalous sample, enabling the generated sample to express the complete behavioral chain from multiple applications and phased normal repayments to concentrated default.

[0234] The conditional sample generation module S440 can receive a conditional vector, a small number of real outlier samples, and a generation configuration. The real outlier samples can be used to train or calibrate the sample generation model. The generation configuration can include model checkpoints, model parameters, sampling parameters, and the number of generated samples.

[0235] The conditional sample generation module S440 can select different types of sample generation models based on the data structure of the conditional vector.

[0236] When the conditional vectors primarily represent the graph structure, a graph variational autoencoder (GraphVAE) or a graph generative adversarial network (GraphGAN) can be used to generate an account-merchant-payment object subgraph. The generated subgraph can include node attributes, relation edge attributes, and fund flow attributes.

[0237] When the conditional vectors primarily represent the temporal structure of behavior, a conditional Transformer model or a Long Short-Term Memory (LSTM) network can be used to generate transaction sequences or behavior sequences ordered by time.

[0238] When the samples to be generated are mainly tabular fields, a Conditional Tabular Generative Adversarial Network (CTGAN), a Conditional Variational Autoencoder (cVAE), or a Conditional Generative Adversarial Network (cGAN) can be used to generate tabular samples.

[0239] The model types described above are merely examples. The conditional sample generation module S440 can also employ other models or algorithms capable of receiving constraint data and outputting synthetic anomalous samples.

[0240] The conditional sample generation module S440 can take the transaction amount range, the proportion of funds returning to the bank, the size of the group, the conditions for fund transfer and the number of samples generated as additional inputs to the sample generation model, or encode these conditions and inject them into the intermediate representation or sampling process of the model.

[0241] The conditional sample generation module S440 can generate samples in batches according to the number of samples to be generated, and record metadata for each batch. The generated metadata may include the condition vector identifier, generator type, generator version, generation time, number of samples in this batch, and verification status. The output of the conditional sample generation module S440 may include transaction records, a graph edge list, generated metadata, and a generation log.

[0242] In an alternative implementation, the conditional sample generation module S440 can employ a rule template generator pre-configured by the abnormal behavior analyst. For example, several gang object structure templates, transaction time series templates, and fund return templates can be pre-configured, and then the object, time, and numerical fields can be filled in based on the generated constraint data.

[0243] The constraint verification module S450 can receive a synthetic abnormal sample dataset, a subset of real abnormal samples, verification rules and threshold configurations, and perform hard constraint verification and soft constraint scoring on the generated samples.

[0244] Regarding amount and currency rules, the constraint verification module S450 can check whether the transaction amount is greater than zero, whether the transaction amount is within the range defined by the condition vector, and whether the currency field in the transaction record is consistent with the currency type in the condition vector. For example, when the sample covers multiple market data such as RMB, USD, or JPY, the amount field and currency field can be verified separately.

[0245] Regarding time sequence rules, the constraint verification module S450 can check whether the transaction timestamps in the sample are strictly increasing, and whether the occurrence time of each transaction is later than the registration time of the corresponding account and the online time of the merchant. For time-series abnormal behavior chains such as circular transfers or group streaming, it can also check whether the time difference between adjacent transactions conforms to the preset delay distribution.

[0246] Regarding the rules for maintaining the balance of funds, the constraint verification module S450 can perform a fund balance check on the generated return chain. For example, it can check whether the sum of inflows and the sum of outflows meet the preset equality relationship or allowable deviation range, check whether the balance of intermediate accounts is negative, and check whether the proportion of funds finally flowing back to the source account or related account meets the setting of the condition vector.

[0247] The constraint verification module S450 can also calculate statistical distribution similarity, graph structure consistency score and feature space alignment to obtain soft constraint score.

[0248] In some embodiments, the quality score (Quality) of the synthesized anomalous samples can be represented as: Quality=HardPass×(α×DistSim+β×GraphSim+γ×FeatureSim).

[0249] Here, HardPass represents the hard constraint verification result, which can be 0 or 1; DistSim represents the statistical distribution similarity between the synthetic anomalous sample and the real anomalous sample; GraphSim represents the graph structure similarity between the two; FeatureSim represents the alignment between the two in the feature space; α, β, and γ represent the weighting coefficients of the corresponding similarity terms. The weighting coefficients can be learned by the model or configured manually.

[0250] When a synthesized anomalous sample fails the hard constraint validation, HardPass can be set to 0, resulting in a quality score of 0. If the quality score is lower than a preset quality threshold, the synthesized anomalous sample can be removed, or the validation result can be fed back to the condition vector construction agent S430 for adjustment and regeneration.

[0251] The constraint verification module S450 can generate confidence labels for synthetic anomaly samples that pass the verification. Confidence labels can be pass / fail indicators, or continuous scores or discrete levels.

[0252] In one alternative implementation, a discriminator based on contrastive learning can be used to replace or supplement statistical tests to identify distributional differences in the high-dimensional feature space. In another alternative implementation, some synthetic outlier samples can be sent to a manual review queue, and the results of the manual review can be used as the verification results or the true label data.

[0253] The enhanced training and model deployment module S460 can receive a real training set, a validated synthetic anomaly sample set, and a training configuration. The real training set may include historical confirmation labels, and the training configuration may include model type, sample weights, loss function, and training parameters.

[0254] The S460 enhancement training and model deployment module can mix real anomaly samples and highly reliable synthetic anomaly samples to form a training sample set. As an example, in the initial training phase, the proportion of synthetic anomaly samples in the anomaly training samples can not exceed 30%, and then be gradually adjusted based on the validation results.

[0255] The S460 enhanced training and model deployment module can output new versions of the anomalous behavior recognition model and validation reports. Validation reports may include AUC, KS statistic, recall, false positive rate, false negative rate, or other model performance metrics.

[0256] In an alternative implementation, a semi-supervised training approach can be adopted, which first performs comparative pre-training based on synthetic anomalous samples, and then fine-tunes the model using a small number of samples with real labels.

[0257] The online monitoring and adaptive tuning module S470 can receive online performance and actual feedback from the abnormal behavior recognition model. Actual feedback may include the rejection rate, manual review results, false positive samples, missed positive samples, and subsequent confirmation tags.

[0258] The S470 online monitoring and adaptive tuning module can divide online traffic into different experimental groups. For example, experimental traffic and control traffic can be divided in a 10:90 ratio, while monitoring the corresponding indicators and performing significance tests using t-tests or bootstrap methods to determine whether the new model version meets the deployment requirements.

[0259] The online monitoring and adaptive tuning module S470 can automatically collect online samples that have been manually labeled as abnormal, normal, or false alarms, and write the samples with confirmed labels into the training database as real label data.

[0260] Based on online performance, the online monitoring and adaptive tuning module S470 can adjust the weight, confidence threshold, and manual review ratio of synthetic anomalous samples in the training sample set, and can also generate new generation parameters and model tuning instructions.

[0261] When a new abnormal behavior identification model causes the preset business indicators or model performance indicators to deteriorate, the online monitoring and adaptive tuning module S470 can trigger model version rollback and manual review, and record the rollback time, model versions before and after the rollback, trigger indicators and related samples to support subsequent analysis.

[0262] The generation parameters and model tuning instructions output by the online monitoring and adaptive tuning module S470 can be fed back to the environment observation module S420 or the condition vector construction agent S430 to update the subsequent trigger thresholds, condition vectors, generation sample ratios, or sample generation strategies.

[0263] In some embodiments, to reduce the cumulative shift of synthesized outliers after multiple rounds of feedback, a real sample anchoring mechanism can be employed. The real sample anchoring mechanism allows the generation strategy to continuously use the statistical distribution, graphical structure distribution, or temporal distribution of real outliers as a reference benchmark.

[0264] In addition, hard and soft constraint thresholds can be set to prevent synthetic anomalous samples that do not meet the generation conditions or differ too much from real anomalous samples from entering the training sample set. Furthermore, the generation strategy can be periodically calibrated based on real online labeled data to update the condition vector fields, field value ranges, generation model parameters, and sample proportions.

[0265] Figure 4 S410 to S470 shown can be executed according to the above data transfer relationship, so that the synthetic anomalous samples are subject to generation condition constraints in terms of object relationship, behavior sequence and data flow, and can be calibrated according to real samples and online labels.

[0266] The following is combined Figure 5 This paper describes the conditional anomaly sample generation system provided in this paper. Figure 5 A schematic diagram of a conditional anomaly sample generation system according to some embodiments is shown.

[0267] like Figure 5 As shown, the conditional anomaly sample generation system 500 may include a data acquisition module 510, a feature extraction module 520, and a sample generation module 530.

[0268] The data acquisition module 510 is configured to acquire the target abnormal behavior type and the object behavior data associated with the target abnormal behavior type. The object behavior data indicates the behavior records of one or more target objects and the associated information corresponding to the behavior records.

[0269] The data acquisition module 510 can acquire object behavior data from databases, data warehouses, message queues, data interfaces, log storage systems, or other data sources. The data acquisition module 510 can also match object identifiers from different data sources to associate the behavior records of the same target object in different data sources or at different stages.

[0270] The feature extraction module 520 is configured to extract behavioral features related to sample generation from object behavior data based on the target abnormal behavior type, thereby obtaining generation constraint data. The generation constraint data limits the range of sample objects and the generation conditions of behavior records within the sample when the sample generation model generates synthetic abnormal samples.

[0271] The feature extraction module 520 can perform statistical feature extraction, behavioral time-series feature extraction, object interaction feature extraction, data flow feature extraction, or association graph feature extraction. The feature extraction module 520 can also select target condition items from a preset set of condition items based on the target abnormal behavior type, and determine the values ​​of the target condition items based on the behavioral characteristics.

[0272] The sample generation module 530 is configured to input the generation constraint data into the sample generation model to generate synthetic abnormal samples corresponding to the target abnormal behavior type.

[0273] The sample generation module 530 can select the appropriate sample generation model based on the data structure represented by the generation constraint data. The sample generation module 530 can also encode the generation constraint data into model inputs that the sample generation model can process, and record the generation metadata corresponding to the generated synthetic anomalous samples.

[0274] Figure 5 The module division in the text is mainly used to illustrate the functions of the conditional anomaly sample generation system 500, and does not constitute a limitation on the number of modules, module boundaries, or implementation location. Any two or more modules among the data acquisition module 510, feature extraction module 520, and sample generation module 530 can be integrated into a software module or hardware module, and the processing function of a module can also be implemented by multiple software units, processing processes, or computing nodes.

[0275] For details regarding the specific processing, optional data types, feature extraction methods, constraint data determination methods, sample generation model selection methods, model adjustment methods, constraint verification methods, and model training methods performed by each module in the conditional anomaly sample generation system 500, please refer to the previous embodiments of the conditional anomaly sample generation method. Where there is no conflict, the processing described in the previous method embodiments can be applied equally, similarly, or adaptively to the conditional anomaly sample generation system 500, and will not be repeated here.

[0276] refer to Figure 6 , Figure 6 A schematic diagram of an electronic device 600 is shown. The electronic device 600 may include a processor 602, a memory 604, a communication device 606, and a bus 608. The processor 602, memory 604, and communication device 606 can communicate with each other via the bus 608.

[0277] The processor 602 can be used to execute program instructions to implement the conditional anomaly sample generation method described above. The processor 602 may include a general-purpose processor, a special-purpose processor, a microprocessor, a digital signal processor, a programmable logic device, a graphics processor, a neural network processor, or other processing devices capable of executing program instructions. In some embodiments, the processor 602 can perform processes such as acquiring object behavior data, extracting behavior features, determining generation constraint data, calling the sample generation model, generating synthetic anomaly samples, adjusting the sample generation model, verifying constraints, and training or updating the anomaly behavior recognition model.

[0278] The memory 604 can be used to store program instructions, target abnormal behavior types, object behavior data, behavior records, association information, behavior features, generation constraint data, sample generation models, synthetic abnormal samples, generation metadata, generation feedback data, a set of real abnormal samples, online confirmation labels, verification results, target synthetic abnormal samples, abnormal behavior recognition models, model verification results, model versions, model parameters, conditional injection parameters, sampling parameters, generation parameters, or sample weights. Furthermore, the memory 604 can also be used to store standardized behavior record tables, object attribute tables, object association edge tables, association graphs, cross-stage behavior sequences, preset condition item sets, generation tasks, agent logs, hard constraint verification rules, soft constraint scoring configurations, training sample sets, model tuning instructions, or other data structures related to conditional abnormal sample generation. The memory 604 can include volatile or non-volatile memory.

[0279] The communication device 606 can be used to receive or send data related to the generation of conditional anomaly samples. For example, the communication device 606 can receive target anomaly behavior types, object behavior data, observed behavior data within the current time window, historical reference data, a set of real anomaly samples, online confirmation labels, generation feedback data, verification rules, threshold configurations, or model validation results. It can also output synthetic anomaly samples, generation metadata, verification results, target synthetic anomaly samples, sample generation model version, anomaly behavior recognition model version, model tuning instructions, or sample generation task results. The communication device 606 can also communicate with data sources, data warehouses, object behavior data acquisition systems, sample generation services, model training platforms, online monitoring systems, manual review systems, or servers via network interfaces, inter-process communication interfaces, remote procedure call interfaces, message queue interfaces, database interfaces, model service interfaces, log interfaces, manual review interfaces, or other communication interfaces.

[0280] Bus 608 can be used to transmit data or control signals between processor 602, memory 604 and communication device 606.

[0281] In some embodiments, the electronic device 600 may further include an input device or an output device. The input device may include a keyboard, mouse, touchscreen, file reading interface, management console interface, data import interface, model configuration interface, rule configuration interface, or other input components. The output device may include a display screen, file output interface, communication output interface, log output interface, alarm output interface, model version output interface, or other output components.

[0282] This document also provides a non-transitory computer-readable storage medium. This non-transitory computer-readable storage medium may store program instructions. When the program instructions are executed by a processor, the processor performs the aforementioned conditional exception sample generation method. The non-transitory computer-readable storage medium may include read-only memory, random access memory, flash memory, hard disk, solid-state drive, optical disk, magnetic disk, or other media capable of storing program instructions.

[0283] This document also provides a computer program product. This computer program product may include program instructions. When executed by a processor, the program instructions cause the processor to perform the aforementioned conditional anomaly sample generation method. The program instructions may be written in one or more programming languages, such as C, C++, Java, Python, Go, Rust, Scala, SQL, or other programming languages ​​suitable for data processing, sample generation, model training, model service invocation, or the development of anomaly behavior recognition systems.

[0284] It should be noted that the steps described in connection with the method, the modules described in connection with the system, and the components described in connection with the electronic device described in this document can be implemented by hardware, software, firmware, or any combination thereof. The names of the modules mentioned above are only used to distinguish the processing content they perform and do not constitute a limitation on the module structure, deployment location, or implementation method. Where there is no technical conflict, the various embodiments described above regarding the conditional anomaly sample generation method, conditional anomaly sample generation system, electronic device, non-transitory computer-readable storage medium, and computer program product can be referred to, combined, or adaptively substituted for each other.

Claims

1. A method for generating conditional anomaly samples, comprising: Obtain the target abnormal behavior type and the object behavior data associated with the target abnormal behavior type, wherein the object behavior data indicates the behavior records of one or more target objects and the associated information corresponding to the behavior records; Based on the target abnormal behavior type, behavioral features related to sample generation are extracted from the object behavior data to obtain generation constraint data. The generation constraint data limits the range of sample objects and the generation conditions of behavior records within the sample when the sample generation model generates synthetic abnormal samples. as well as The generation constraint data is input into the sample generation model to generate synthetic abnormal samples corresponding to the target abnormal behavior type.

2. The method according to claim 1, wherein, The object behavior data includes stage behavior data corresponding to multiple behavior stages, and the behavior records of the same target object in different stage behavior data are associated through object identifiers.

3. The method according to claim 2, wherein, Extracting behavioral features related to sample generation from the object behavior data includes: Based on the chronological relationship of the multiple behavioral stages, the behavioral records with the same object identifier in the behavioral data of each stage are sorted to obtain a cross-stage behavioral sequence. Extract behavioral temporal features from the cross-stage behavioral sequence.

4. The method according to claim 1, wherein, The association information is represented by an association graph, which includes object nodes corresponding to the target objects and relationship edges representing the behavioral associations between the target objects.

5. The method according to claim 4, wherein, Extracting behavioral features related to sample generation from the object behavior data includes: Based on the connection relationships between object nodes in the association graph, the node connectivity or node clustering degree is determined to obtain object association features.

6. The method according to claim 1, wherein, The type of abnormal behavior of the target is determined based on the distribution change of the observed behavior data within the current time window relative to historical reference data.

7. The method according to claim 6, wherein, The determination of the distribution change includes: Calculate the corresponding observation indicators based on the observed behavior data and the historical reference data, respectively. The distribution change is determined based on the difference between the observed index corresponding to the observed behavior data and the observed index corresponding to the historical reference data.

8. The method according to claim 7, wherein, In response to the distribution change satisfying the triggering condition, an abnormal event is generated. The abnormal event records the observation index that triggers the abnormal event and a set of candidate objects associated with the observation index.

9. The method according to claim 8, wherein, The abnormal event corresponds to one of the following: single-object anomaly, object feature cluster drift, or change in the distribution of abnormal behavior types. The method further includes: Based on the anomaly level corresponding to the anomaly event, determine whether the triggering conditions for generating a synthetic anomaly sample are met; and In response to the fulfillment of the triggering condition, the range of sample objects is determined.

10. The method of claim 9, wherein, Obtaining the generated constraint data includes: Based on the observation indicators recorded in the abnormal event log, a target condition item is selected from a set of preset condition items corresponding to the target abnormal behavior type; and The value or range of the target condition item is determined based on one or more of the following to obtain the generated constraint data: the abnormal value range of the observed index; the abnormal level corresponding to the abnormal event; and the candidate object set.

11. The method according to claim 1, wherein, Obtaining the generated constraint data includes: Select the target condition item that matches the behavior feature from the set of preset condition items corresponding to the target abnormal behavior type; The value of the target condition term is determined based on the behavioral characteristics to obtain the generated constraint data.

12. The method according to claim 11, wherein, The value of the target condition term is determined based on the distribution of the corresponding behavioral features in the real abnormal sample set.

13. The method according to claim 1, wherein, The generated constraint data includes object filtering conditions, which limit the target objects contained in the synthetic anomaly sample and the range of associations between the target objects.

14. The method according to claim 1, wherein, The generated constraint data includes behavioral temporal conditions, which define the temporal order and time interval between multiple behavioral records in the synthetic anomaly sample.

15. The method according to claim 1, wherein, The generated constraint data includes fund flow conditions, which limit the flow path of data in the synthetic anomaly sample among multiple target objects and the relationship between inflow and outflow.

16. The method according to claim 1, wherein, Before inputting the generation constraint data into the sample generation model, the method further includes: Based on the data structure represented by the generation constraint data, the sample generation model is selected from multiple candidate sample generation models.

17. The method according to claim 16, wherein, In response to the generated constraint data characterizing the association graph structure, a graph structure generation model is selected, and the synthetic anomaly sample including object nodes and relation edges is generated through the graph structure generation model.

18. The method according to claim 16, wherein, In response to the generation constraint data characterizing the synthetic anomaly sample to be generated having a behavioral temporal structure, a temporal sample generation model is selected, and the generation constraint data is input into the temporal sample generation model to generate the synthetic anomaly sample including multiple behavioral records sorted by time.

19. The method according to claim 1, further comprising: Record the generation metadata corresponding to the synthesized abnormal sample. The generation metadata includes one or more of the following: generation constraint data identifier, sample generation model type, sample generation model version, generation time, and sample batch information.

20. The method according to claim 1, further comprising: Obtain the generation feedback data corresponding to the synthesized abnormal sample; Based on the generated feedback data, adjust at least one of the model parameters, conditional injection parameters, and sampling parameters of the sample generation model.

21. The method according to claim 20, wherein, The generated feedback data includes the sample statistical distribution of the synthetic abnormal samples and the sample statistical distribution of the real abnormal sample set; Based on the generated feedback data, at least one of the model parameters, conditional injection parameters, and sampling parameters of the sample generation model is adjusted, including: Based on the distribution difference between the statistical distribution of the synthesized abnormal samples and the statistical distribution of the real abnormal sample set, the conditional injection parameters of the sample generation model are adjusted.

22. The method according to claim 20, wherein, The generated feedback data includes online confirmation tags indicating abnormal object behavior data; Based on the generated feedback data, at least one of the model parameters, conditional injection parameters, and sampling parameters of the sample generation model is adjusted, including: The sample generation model is calibrated based on the abnormal object behavior data indicated by the online confirmation tags.

23. The method of claim 20, further comprising: Record the model version of the adjusted sample generation model and the generation parameters corresponding to the model version; The next batch of synthetic anomalous samples is generated based on the adjusted sample generation model.

24. The method according to claim 1, further comprising: Constraint verification is performed on the synthetic anomalous sample to obtain the verification result and the target synthetic anomalous sample that meets the verification conditions.

25. The method according to claim 24, wherein, Perform constraint verification on the synthesized anomalous samples, including: Hard constraint verification is performed on the synthetic anomalous sample based on the generated constraint data to determine whether the synthetic anomalous sample meets the generation conditions defined by the generated constraint data.

26. The method according to claim 25, wherein, The hard constraint verification includes: Verify whether the multiple behavior records in the synthesized abnormal sample are arranged in ascending order of timestamps, and whether the occurrence time of each behavior record is not earlier than the state effective time of the corresponding target object.

27. The method according to claim 25, wherein, The hard constraint verification also includes: Based on the inflow and outflow amounts corresponding to multiple target objects in the synthetic anomaly sample, determine whether the synthetic anomaly sample satisfies the capital flow conservation condition.

28. The method according to claim 24, wherein, Perform constraint verification on the synthesized anomalous samples, including: Determine the distributional similarity between the synthetic anomalous samples and the subset of real anomalous samples; The soft constraint score of the synthetic anomalous sample is determined based on the distribution similarity.

29. The method according to claim 28, wherein, Determining the distributional similarity between the synthetic anomalous samples and the subset of real anomalous samples includes: Determine at least one of the following differences between the synthetic anomalous sample and the subset of real anomalous samples: difference in feature distribution, difference in object association structure, and difference in behavioral temporal distribution.

30. The method of claim 24, further comprising: In response to the verification result indicating that the synthesized anomalous sample does not meet the verification conditions, the generation constraint data is adjusted, and the synthesized anomalous sample is regenerated based on the adjusted generation constraint data.

31. The method of claim 24, further comprising: Based on the verification results, adjust at least one of the model parameters, conditional injection parameters, and sampling parameters of the sample generation model.

32. The method according to claim 31, wherein, Based on the verification results, adjust at least one of the model parameters, conditional injection parameters, and sampling parameters of the sample generation model, including: Based on the proportion of samples that failed the hard constraint verification in the verification results, adjust the sampling parameters or conditional injection parameters of the sample generation model.

33. The method according to claim 31, wherein, Based on the verification results, adjusting at least one of the model parameters, conditional injection parameters, and sampling parameters of the sample generation model further includes: Based on the changing trend of the soft constraint scores in the verification results, the model parameters of the sample generation model are adjusted.

34. The method of claim 31, further comprising: Record the model version of the adjusted sample generation model, the generation parameters before and after the adjustment, and the verification results that triggered the model adjustment.

35. The method of claim 24, further comprising: The abnormal behavior recognition model is trained or updated based on the target set of synthesized abnormal samples and real abnormal samples.

36. The method of claim 35, further comprising: Based on the verification results of the trained or updated abnormal behavior recognition model, the sample weights of the target synthetic abnormal samples in the training sample set are adjusted.

37. The method of claim 36, further comprising: Write the abnormal object behavior data indicated by the online confirmation label into the real abnormal sample set; The generated constraint data is calibrated based on the updated set of real anomaly samples.

38. A conditional anomaly sample generation system, comprising: The data acquisition module is configured to acquire a target abnormal behavior type and object behavior data associated with the target abnormal behavior type, wherein the object behavior data indicates behavior records of one or more target objects and associated information corresponding to the behavior records. The feature extraction module is configured to extract behavioral features related to sample generation from the object behavior data according to the target abnormal behavior type, and obtain generation constraint data. The generation constraint data limits the range of sample objects and the generation conditions of behavior records within the sample when the sample generation model generates synthetic abnormal samples. The sample generation module is configured to input the generation constraint data into the sample generation model to generate synthetic abnormal samples corresponding to the target abnormal behavior type.

39. An electronic device comprising: processor; as well as A memory storing program instructions that, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 37.

40. A non-transitory computer-readable storage medium storing program instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 37.

41. A computer program product comprising program instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 37.

Images