CN115660688B - Financial transaction anomaly detection method and cross-regional sustainable training method thereof - Google Patents

Financial transaction anomaly detection method and cross-regional sustainable training method thereof Download PDF

Info

Publication number
CN115660688B
CN115660688B CN202211301695.8A CN202211301695A CN115660688B CN 115660688 B CN115660688 B CN 115660688B CN 202211301695 A CN202211301695 A CN 202211301695A CN 115660688 B CN115660688 B CN 115660688B
Authority
CN
China
Prior art keywords
transaction
node
financial
nodes
anomaly detection
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202211301695.8A
Other languages
Chinese (zh)
Other versions
CN115660688A (en
Inventor
杨新
李昱洁
杨宇轩
刘贵松
程秀传
黄鹂
殷光强
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Kashgar Electronic Information Industry Technology Research Institute
Southwestern University Of Finance And Economics
Original Assignee
Kashgar Electronic Information Industry Technology Research Institute
Southwestern University Of Finance And Economics
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Kashgar Electronic Information Industry Technology Research Institute, Southwestern University Of Finance And Economics filed Critical Kashgar Electronic Information Industry Technology Research Institute
Priority to CN202211301695.8A priority Critical patent/CN115660688B/en
Publication of CN115660688A publication Critical patent/CN115660688A/en
Application granted granted Critical
Publication of CN115660688B publication Critical patent/CN115660688B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Landscapes

  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

The invention relates to the field of financial risk management, and discloses a financial transaction anomaly detection method and a cross-regional sustainable training method thereof, wherein the financial transaction anomaly detection method is used for solving the problems that a homograph in the prior art is difficult to retain multi-type semantic information and cannot capture dynamic space-time characteristics by constructing a heterostructure information graph formed by a plurality of nodes and multi-type paths, fully mining high-order semantics such as time information, greatly enriching the available information quantity, adopting a depth map neural network model, fusing the nodes, the paths and the network structure based on an attention mechanism to obtain graph embedding representation, detecting anomaly behaviors based on the graph embedding representation, and improving the efficiency and the accuracy of anomaly detection; meanwhile, a cross-region sustainable training method is provided, cross-region sustainable learning of the financial transaction anomaly detection model is achieved through a knowledge playback strategy and a parameter smoothing strategy, cross-region deployment is facilitated, and the method is suitable for financial risk management tasks such as financial transaction fraud detection and the like.

Description

Financial transaction anomaly detection method and cross-regional sustainable training method thereof
Technical Field
The invention relates to the field of financial risk management, in particular to a financial transaction anomaly detection method and a cross-regional sustainable training method thereof.
Background
With the rapid expansion of electronic commerce and the explosive development of communication technology, economic activity has seen a demand for trans-regional, trans-time and low cost. The digital finance is a novel finance business state, has strong physical penetrability and low cost advantage, avoids the limitation of physical network points and further improves the efficiency, and brings convenience. However, with the development of digital technology, digital financial fraud is derived, which affects the progress of legal transaction processes, resulting in economic losses for users.
For digital finance, abnormal transactions such as finance fraud and the like can seriously hurt trust of users on finance technology, cause economic loss, reputation loss and the like to various financial institutions and enterprises, bring adverse effects to innovative development of digital finance and digital transformation upgrading of traditional finance industry, and cause fatal threat to development of the digital finance industry. Therefore, the financial anti-fraud has become a key ring of financial risk prevention capability, and the financial anomaly detection technology has important application value and research significance for financial industry safety and national information safety.
The main purpose of the financial anomaly detection is to detect whether the financial transaction is anomalous, including anomalous transaction detection and anomalous behavior detection. Traditional financial anti-fraud solutions rely on rule-based models that detect financial fraud by building manual features derived from historical transaction data to discover potential anomalies, and expert experience to set up important features. However, rule-based approaches rely heavily on a priori knowledge of humans, resulting in bias in detection and susceptibility to breakdown when dealing with more complex rule patterns; on the other hand, it relies on static structured data, however, existing anti-fraud models have difficulty in reacting quickly and accurately due to the open dynamic nature of the data and the heterogeneous nature of fraudulent data. In addition, most of the existing model designs also lead to lack of interpretability and high efficiency of the system, and difficulty in efficiently handling continuous learning in a real open environment.
In recent years, with the development of graph representation learning, more and more financial research uses a depth map neural network-based method, and by modeling entities such as clients and merchants as nodes and interactions between the entities as edges, high-order implicit information in data is explored, so that graph representation learning is used to reveal implicit modes behind a large-scale financial transaction.
Existing depth map neural network-based solutions present two significant challenges:
1. Transaction data in real-world business scenarios includes various types of additional entities, such as transaction time, transaction space, in addition to customer and merchant entities. However, most of the existing solutions only consider isomorphic networks and decompose heterogeneous interactions into multiple isomorphic connections, which results in high-order semantic information loss, and models cannot learn spatio-temporal dynamic characteristics.
2. The existing solutions are only suitable for a narrow range due to the limitation of data acquisition in practical applications. When financial services are extended to new areas, such as new cities and even new countries, it is common to either use a previously trained, i.e. static, model or to develop a completely new model. Because the consumption characteristics and behavior characteristics of different regional entities are more or less different, the target characteristics can not be directly used due to mismatching of the target characteristics caused by geographic differences of a financial model trained through the existing data learning; and developing a new model requires high monetary and time costs.
Disclosure of Invention
The technical problems to be solved by the invention are as follows: the financial transaction abnormality detection method and the cross-regional sustainable training method thereof can improve the efficiency and the precision of the financial transaction abnormality detection and can conveniently carry out cross-regional deployment.
The technical scheme adopted for solving the technical problems is as follows:
The financial transaction anomaly detection method comprises the following steps:
A1, constructing a financial heterogeneous information graph according to financial transaction data to be detected of a target area; the entity nodes of the financial heterogeneous information graph comprise user nodes, merchant nodes, time nodes and transaction nodes, node feature vectors are obtained through encoding according to corresponding knowledge information, and the types of the meta paths comprise user-transaction paths, merchant-transaction paths and time-transaction paths;
A2, obtaining embedded representation of each node through a coding network according to the feature vector of each node; according to the embedded representation of the transaction node and the neighbor node thereof, classifying and aggregating based on an attention mechanism according to the element path types of the transaction node and the neighbor node thereof to obtain the embedded representation of each element path type of the transaction node; then, according to the element path types, aggregating the embedded representations of the element path types corresponding to each transaction node to obtain the embedded representations of the element path types of the financial heterogeneous information graph;
A3, according to the embedded representation of each element path type of the financial heterogeneous information graph, fusing the embedded representation of each element path type based on a self-attention mechanism to obtain the graph embedded representation of the financial heterogeneous information graph;
A4, based on the graph embedded representation of the financial heterogeneous information graph, outputting a classification label of abnormality detection by adopting a full connection layer as an abnormality detection result.
Specifically, in step A1, the node feature vector is obtained by encoding according to the corresponding knowledge information, and includes:
The user node corresponding knowledge information is the unique identity ID of the transaction user;
The knowledge information corresponding to the merchant node is the unique identity ID of the transaction merchant;
The time node corresponding knowledge information is the time stamp information of the transaction;
The transaction node correspondence knowledge information includes a transaction serial number, a transaction location, a transaction amount, and a transaction type.
Further, the feature vector encoding of the time node includes: firstly, dividing 24 hours per day into time windows at time intervals, then, coding according to digital information or onehot modes of time periods according to time periods corresponding to the time windows to which transaction time stamps belong, and obtaining feature vector codes of time nodes.
Further, feature vector encoding of the transaction node includes: firstly, coding according to digital information of a transaction serial number, coding according to longitude and latitude of a transaction place, coding according to digital information of transaction amount, coding transaction type according to onehot mode, and then splicing the serial number, the transaction place, the transaction amount and the transaction type obtained by coding to form feature vector coding of a transaction node.
Specifically, in step A2, according to the feature vector of each node, obtaining an embedded representation of each node through a coding network; according to the embedded representation of the transaction node and the neighbor node thereof, classifying and aggregating based on an attention mechanism according to the element path types of the transaction node and the neighbor node thereof to obtain the embedded representation of each element path type of the transaction node; then, according to the element path type, aggregating the embedded representation of the element path type corresponding to each transaction node to obtain the embedded representation of the element path type of the financial heterogeneous information graph, comprising:
A21, mapping the feature vectors of all nodes in the financial heterogeneous information graph to a feature space through a coding network to obtain embedded representation of each node in the feature space
Wherein,For the embedded representation of the ith node in feature space, W x is the learnable parameter matrix of the coding network,/>Is the feature vector of the i-th node;
a22, adopting an attention mechanism to obtain attention scores between the transaction node and the neighbor nodes thereof
Wherein att η represents the mechanism of attention,For the attention score between transaction node i and neighbor node j,/>The type of the meta-path between the transaction node i and the neighbor node j;
A23, using SoftMax function to score the attention points of each element path type according to the element path type Normalized to get attention weight/>
Wherein,The meta-path type in the neighbor node of the transaction node i is the mth meta-path/>Is a set of neighbor nodes;
A24, according to the element path types of the transaction node and the neighbor nodes, attention weight is based on Performing classification aggregation to obtain embedded representation/>, of each element path type of transaction node i
Wherein σ is a sigmoid function;
a25, embedding representation of each transaction node Aggregation is carried out according to the meta-path types to obtain the embedded representation/>, of each meta-path type
Further, in step A22, the attention score is calculated using a sigmoid function
Wherein,For a learnable parameter matrix, the superscript T represents matrix transposition, and II is a matrix connection symbol; sigmoid is the activation function.
Specifically, in step A3, according to the embedded representation of each element path type of the financial heterogeneous information graph, based on a self-attention mechanism, the embedded representation of each element path type is fused to obtain the graph embedded representation of the financial heterogeneous information graph, which includes:
A31, obtaining the attention score among the path types of each element by adopting a self-attention mechanism
Wherein,Represents the m-th meta-path/>Is a concentration score of (2); /(I)Representing meta-paths/>Is embedded in the representation; m represents the number of meta-path types; att ψ represents the mechanism of attention;
A32, using SoftMax function to score attention Normalized to get attention weight/>
A33 based on attention weightFusing embedded representations of each element path type;
wherein Z represents a graph embedded representation of the financial heterogeneous information graph.
Further, in step A31, the attention score is calculated as follows
Wherein,For the embedded representation of the m-th element path of the transaction node i, tanh represents the hyperbolic tangent activation function, q, W' and b are all learnable parameters, the superscript T represents matrix transposition, and N is the number of transaction nodes.
In order to facilitate implementation of the above-mentioned abnormal financial transaction detection method in a cross-region manner, the invention also provides a cross-region sustainable training method for the abnormal financial transaction detection method, which comprises the following steps:
B1, constructing initial parameters and a playback sample set of a target area financial transaction anomaly detection model according to a continuous learning strategy;
The continuous learning strategy includes: knowledge playback policies and parameter smoothing policies;
The knowledge playback strategy is: sampling a preset number of samples from the samples of the reference area, and constructing a playback sample set; the parameter smoothing strategy is: extracting a parameter matrix of a financial transaction anomaly detection model of a reference area, taking the parameter matrix as an initial parameter matrix of a target area, and evaluating the parameter matrix to obtain a parameter importance degree score; the reference area is an area which is trained by the abnormal detection model of the financial transaction, the initial area is a random area, and a parameter matrix of the random area is obtained in a random mode;
B2, constructing a financial heterogeneous information graph according to the playback sample set and the sample set of the target area, and obtaining an abnormality detection result of the target area according to the financial transaction abnormality detection method;
And B3, calculating training loss by adopting a cross entropy loss function according to the anomaly detection result and the real label, performing iterative training on the financial transaction anomaly detection model of the target area until a preset iteration round or model convergence is achieved, obtaining the financial transaction anomaly detection model of the target area, and restraining the training process according to the parameter importance degree score obtained in the step B1 based on a parameter smoothing strategy.
Further, in step B1, a preset number of samples are sampled from the samples in the reference area, and a playback sample set is constructed, including:
firstly, randomly sampling transaction nodes from a financial heterogeneous information graph of a reference area, and calculating the average value of feature vectors of the sampling transaction nodes as a playback prototype c l-1:
Wherein, Transaction node set obtained for random sampling,/>For/>Characteristic vector of transaction node i in (I)/>The number of transaction nodes obtained by random sampling;
the playback sample set is then constructed as follows:
The method comprises the steps of obtaining the proximity degree of each transaction node feature vector and a playback prototype according to sampling, and determining the proximity degree from near to far according to the preset quantity Selecting transaction nodes, forming a playback sample set by the selected transaction nodes and neighbor nodes thereof, wherein the number of the transaction nodes obtained by random sampling is larger than the preset number;
Secondly, gaussian noise is generated, feature vectors of transaction nodes obtained through random sampling are corrected based on the generated Gaussian noise, playback sample sets are formed based on the transaction nodes obtained through correction and neighbor nodes of the transaction nodes obtained through random sampling, and the number of the transaction nodes obtained through random sampling is a preset number;
And thirdly, firstly processing according to the first mode, and then processing according to the second mode, so as to complete the construction of the playback sample set.
Further, in step B1, a parameter matrix of the reference area financial transaction anomaly detection model is evaluated to obtain a parameter importance degree score according to a gradient change of a reference area transaction node feature vector under the condition of the parameter matrix.
Specifically, the method adopts the snow charging information matrix to evaluate the parameter matrix, and comprises the following steps:
wherein Θ l-1 represents a parameter matrix of a financial transaction anomaly detection model of the reference area, and X l-1 represents a set of feature vectors of each transaction node in a financial heterogeneous information graph of the reference area; g (x; Θ l-1) represents the gradient change of the eigenvector of the transaction node x under Θ l-1 calculated by the loss function, and T represents the matrix transpose.
Specifically, the loss function in step B3The method comprises the following steps:
Wherein, For cross entropy loss,/>Regularization constraint items for constraining the updating process according to the parameter importance degree scores respectively;
The cross entropy loss is calculated as follows:
Wherein, True tag representing the ith transaction node,/>A forecast tag representing an ith transaction node, wherein N is the number of the transaction nodes;
The regularization constraint term is calculated as:
Wherein Θ l represents a parameter matrix of the target area financial transaction anomaly detection model, S represents an area set in which training of the financial transaction anomaly detection model has been completed before the target area, Θ s represents a parameter matrix of the financial transaction anomaly detection model of the S-th area in the area set, and Θ l-1 represents a parameter matrix of the reference area financial transaction anomaly detection model of the target area; a matrix representing the importance of the financial transaction anomaly detection model parameters of the target area; gamma, lambda are smoothing factors.
The beneficial effects of the invention are as follows:
The invention overcomes the defects that the prior homogeneous map is difficult to retain multi-type semantic information and cannot capture dynamic space-time characteristics by constructing the heterogeneous structure information map, fully excavates high-order semantics such as time information and the like, greatly enriches the degree of the available information quantity, fuses nodes, node connection and network structure by using a depth map neural network model, learns low-dimensional embedded representation, detects abnormal results, and not only improves the abnormal detection efficiency, but also improves the financial abnormal detection precision.
Meanwhile, the invention fully considers the actual requirement of cross-regional business expansion in the real financial scene, and based on the continuous learning of the depth map neural network model, the defect that the current financial anomaly detection system is limited to a single region is overcome, and the cross-regional deployment can be conveniently carried out.
The invention is suitable for various financial risk management tasks such as financial transaction fraud detection and the like, and helps financial enterprises to conduct risk management and control in cross-regional financial business, and guarantee financial security.
Drawings
FIG. 1 is a training flow chart of a financial transaction anomaly detection model in an embodiment of the present invention;
FIG. 2 is a diagram of a process for constructing a financial heterogeneous information map according to an embodiment of the present invention;
FIG. 3 is a flow chart of the financial transaction anomaly detection using a model in an embodiment of the present invention.
Detailed Description
The invention aims to provide a financial transaction abnormality detection method and a cross-regional sustainable training method thereof, which can improve the efficiency and the precision of detecting financial transaction abnormality and can conveniently carry out cross-regional deployment.
The training may be continued, i.e., learning (Continual Learning, CL) continuously, i.e., the ability to use knowledge of one task on another task, and the ability to learn a later task without forgetting how to do the previous task. This learning paradigm needs to address: 1. how the experience of the previous task can be used, so that the current task can be learned faster and better; 2. when learning the current task, the task which is learned before can not be forgotten. Currently, the main challenge of continuous learning is that a disaster forgets, i.e. knowledge obtained in the past is forgotten when a new task is learned, which then results in the previous task not performing as much as before. In order to realize cross-region sustainable training, the invention adopts a knowledge playback strategy and a parameter smoothing strategy, and solves the problems of disastrous forgetting and knowledge migration in cross-region continuous learning.
Meanwhile, the invention overcomes the defects that the prior homographs are difficult to retain multi-type semantic information and cannot capture dynamic space-time characteristics by constructing the heterostructure information graph, fully excavates high-order semantics of time information and the like, greatly enriches the degree of the available information quantity, fuses nodes, node connection and network structure by using a depth map neural network model, learns low-dimensional embedded representation, detects abnormal results, and not only improves the trans-regional abnormal detection efficiency, but also improves the financial abnormal detection accuracy.
Examples:
the embodiment comprises two parts of training a financial transaction abnormality detection model and utilizing the model to carry out financial transaction abnormality detection.
The process of training the abnormal financial transaction detection model, as shown in fig. 1, includes the following implementation steps:
S1, constructing initial parameters and playback sample sets of a target area financial transaction anomaly detection model:
In this step, for cross-regional financial transaction data sample data, different transaction regions are firstly divided according to geographic longitude and latitude and the sequence of the regions is randomly set so as to simulate the situation that the transaction regions continuously increase in the real transaction scene. In addition, the embodiment also performs a series of preprocessing operations on the data samples, including deleting repeated information and correcting errors, so as to ensure the data consistency and the data quality of the transaction.
The method is a sustainable learning cross-regional financial transaction anomaly detection method, so that a region-by-region training mode is adopted during training, each divided region is respectively trained, and a financial transaction anomaly detection model corresponding to the region is obtained; and the initial parameters and the playback sample set of the financial transaction abnormality detection model are constructed by adopting a sustainable learning strategy aiming at the construction mode of the initial parameters and the playback sample set of each area, so that the financial transaction abnormality detection model corresponding to the area is applicable to the area and is also applicable to the area which is trained and covered by the model before the training of the area is completed.
Specifically, the continuous learning strategy includes: knowledge playback policies and parameter smoothing policies.
The knowledge playback strategy is: sampling a preset number of samples from the samples of the reference area, and constructing a playback sample set; the parameter smoothing strategy is: and extracting a parameter matrix of the financial transaction abnormality detection model of the reference area as an initial parameter matrix of the target area, and evaluating the parameter matrix to obtain a parameter importance degree score.
The reference area is an area which is trained by the abnormal detection model of the financial transaction, the initial area is a random area, and a parameter matrix of the random area is obtained in a random mode.
Further, if the target area is the first area, that is, the first area for training the model, since there is no learning basis before, that is, there is no model that has already been trained in other areas, one other area may be randomly selected as the reference area, and a random initial parameter of the model may be used as the initial parameter. If the target region is not the first region, that is, there is a model that has been trained for other regions, then the "existing region" for which model training has been completed, that is, the region covered by the existing model, may be used as the reference region for target region learning.
Of course, to ensure that the coverage area of the model is maximized after training of the target area, it is preferable to select the area of the target area that has been previously trained from the existing areas as the reference area.
Further, the knowledge playback strategy can employ a small-sized empirical knowledge register to randomly play back samples from the selected reference region, thereby helping training the anomaly detection model of the current target region.
Specifically, the present embodiment adopts a prototype method (Prototypes), namely a feature averaging method (Meanof Feature, MF), to construct a playback sample set for alleviating the training instability problem caused by random sampling, including:
Firstly, randomly sampling transaction nodes from a financial heterogeneous information graph of a reference area, and calculating the average value of feature vectors of the sampling transaction nodes as a playback prototype c l-l:
Wherein, Transaction node set obtained for random sampling,/>For/>Characteristic vector of transaction node i in (I)/>The number of transaction nodes obtained by random sampling;
And then, generating Gaussian noise, correcting the feature vector of the transaction node obtained by random sampling based on the generated Gaussian noise, forming a playback sample set based on the transaction node obtained by correction and neighbor nodes of the transaction node obtained by random sampling, wherein the number of the transaction nodes obtained by random sampling is a preset number. Through the robustness experiment, the model performs optimally when the playback ratio is 0.1, so the preset number of the embodiment is the number of samples when the playback ratio is 0.1.
Of course, other than the above, it is also possible to employ: judging the proximity degree of each transaction node feature vector and a playback prototype by Euclidean distance, and according to the preset quantity from near to far, determining the proximity degree of each transaction node feature vector and the playback prototype from near to farSelecting transaction nodes, forming a playback sample set by the selected transaction nodes and neighbor nodes thereof, wherein the number of the transaction nodes obtained by random sampling is larger than the preset number; or screening according to the Euclidean distance mode, and correcting according to the Gaussian noise mode to complete the construction of the playback sample set.
Parameter smoothing strategies, i.e., constraining the updating of important parameters by smoothing parameter methods, can alleviate the catastrophic forgetting problem between cross-regional fraud detection tasks. Further, for the parameter matrix of the reference area financial transaction anomaly detection model, the parameter importance degree score can be estimated and obtained according to the gradient change of the reference area transaction node feature vector under the condition of the parameter matrix.
Specifically, in this embodiment, a snow information matrix is used to evaluate a parameter matrix, which includes:
wherein Θ l-1 represents a parameter matrix of a financial transaction anomaly detection model of the reference area, and X l-1 represents a set of feature vectors of each transaction node in a financial heterogeneous information graph of the reference area; g (x; Θ l-1) represents the gradient change of the eigenvector of the transaction node x under Θ l-1 calculated by the loss function, and T represents the matrix transpose.
S2, constructing a financial heterogeneous information graph according to the playback sample set and the sample set of the target area:
the financial heterogeneous information graph is constructed and mainly comprises three parts, namely entity node construction, meta-path construction and node characteristic construction.
Specifically, as shown in fig. 2, the method includes:
s21, building entity nodes and building node characteristics:
The invention extracts four types of entities from a financial transaction data sample as entity nodes, namely a user node, a merchant node, a time node and a transaction node, wherein the node feature vectors are obtained by encoding corresponding knowledge information.
Specifically, in an embodiment, the node feature vector is obtained by encoding corresponding knowledge information, and includes:
The user node corresponding knowledge information is the unique identity ID of the transaction user;
The knowledge information corresponding to the merchant node is the unique identity ID of the transaction merchant;
The time node corresponding knowledge information is the time stamp information of the transaction;
The transaction node correspondence knowledge information includes a transaction serial number, a transaction location, a transaction amount, and a transaction type.
The user ID, merchant ID, transaction code and time stamp are structured, and thus can be directly used as feature vector codes for the corresponding nodes.
In order to capture the sensitivity of the financial anomaly detection task to the transaction time, the invention adds a time node with timestamp information as an identification, but in order to facilitate classification processing, further, the feature vector coding of the time node comprises the following steps: firstly, dividing 24 hours per day into time windows at time intervals, then, coding according to digital information of time periods according to time periods corresponding to the time windows to which transaction time stamps belong, and obtaining feature vector codes of time nodes. Of course, onehot modes of coding can also be adopted.
In order to further describe the inherent semantics of each transaction node and improve the efficiency of the anomaly detection task, when constructing the financial heterogeneous information graph, the characteristics related to the transaction are all used as the attribute characteristics of the transaction node, and specifically, the characteristic vector of the transaction node is encoded, including: firstly, coding according to digital information of a transaction serial number, coding according to longitude and latitude of a transaction place, coding according to digital information of transaction amount, coding transaction type according to onehot mode, and then splicing the serial number, the transaction place, the transaction amount and the transaction type obtained by coding to form feature vector coding of a transaction node.
S22, constructing a meta path:
The meta-path is widely applied to heterogeneous network semantic exploration, and aims to define types of corresponding relations among the connecting edges of the nodes. Three types of meta paths, namely a user-transaction type path, a merchant-transaction type path and a time-transaction type path, are constructed to describe heterogeneous associated information derived from given semantics.
Wherein "transaction-user-transaction" describes different transactions conducted by the same user; "transaction-timestamp-transaction" describes different transactions occurring in the same period of time; "transaction-merchant-transaction" describes different transactions that occur at the same merchant.
Therefore, the financial heterogeneous information graph constructed by the invention is a heterogeneous network structure with various nodes and relationship types, can fully utilize different types of information related to transactions, constructs a heterogeneous transaction information network through various types of meta-paths, and fuses rich semantic information.
S3, obtaining embedded representation of each node through a coding network according to the feature vector of each node; according to the embedded representation of the transaction node and the neighbor node thereof, classifying and aggregating based on an attention mechanism according to the element path types of the transaction node and the neighbor node thereof to obtain the embedded representation of each element path type of the transaction node; then, according to the element path type, aggregating the embedded representation of the element path type corresponding to each transaction node to obtain the embedded representation of the element path type of the financial heterogeneous information graph, comprising:
S31, mapping the feature vectors of all the nodes in the financial heterogeneous information graph to a feature space through a coding network to obtain embedded representation of each node in the feature space
Wherein,For the embedded representation of the ith node in feature space, W x is the learnable parameter matrix of the coding network,/>Is the feature vector of the i-th node;
s32, adopting an attention mechanism to obtain attention scores between the transaction nodes and the neighbor nodes thereof
Wherein att η represents the mechanism of attention,For the attention score between transaction node i and neighbor node j,The type of the meta-path between the transaction node i and the neighbor node j;
specifically, in this embodiment, the attention score is calculated using a sigmoid function
Wherein,For a learnable parameter matrix, the superscript T represents matrix transposition, and II is a matrix connection symbol; sigmoid is the activation function.
S33, using a SoftMax function to score the attention points of each element path type according to the element path typeNormalized to get attention weight/>
Wherein,The meta-path type in the neighbor node of the transaction node i is the mth meta-path/>Is a set of neighbor nodes;
S34, according to the element path types of the transaction node and the neighbor nodes, attention weight is based on Performing classification aggregation to obtain embedded representation/>, of each element path type of transaction node i
Wherein σ is a sigmoid function;
s35, embedding representation of each transaction node Aggregation is carried out according to the meta-path types to obtain the embedded representation/>, of each meta-path type
S4, according to the embedded representation of each element path type of the financial heterogeneous information graph, fusing the embedded representation of each element path type based on a self-attention mechanism to obtain the graph embedded representation of the financial heterogeneous information graph, wherein the method comprises the following steps:
S41, obtaining attention scores among path types of each element by adopting a self-attention mechanism
Wherein,Represents the m-th meta-path/>Is a concentration score of (2); /(I)Representing meta-paths/>Is embedded in the representation; m represents the number of meta-path types, m=3 in this embodiment; att ψ represents the mechanism of attention;
Specifically, the attention score is calculated according to the following formula
Wherein,For the embedded representation of the m-th element path of the transaction node i, tanh represents the hyperbolic tangent activation function, q, W' and b are all learnable parameters, the superscript T represents matrix transposition, and N is the number of transaction nodes.
S42, scoring the attention by using a SoftMax functionNormalized to get attention weight/>
S43, based on attention weightFusing embedded representations of each element path type;
wherein Z represents a graph embedded representation of the financial heterogeneous information graph.
S5, based on graph embedding representation, obtaining an abnormality detection result:
In the step, based on the obtained graph embedded representation, a full-connection layer is adopted to output a classification label for fraud detection as an anomaly detection result; if the output result is "1" indicates "abnormal transaction", the output result is "0" indicates "abnormal transaction".
S6, updating model parameters:
In the step, training loss is calculated by adopting a cross entropy loss function according to an anomaly detection result and a real label, iterative training is carried out on a financial transaction anomaly detection model of a target area until a preset iteration round or model convergence is achieved, the financial transaction anomaly detection model of the target area is obtained, and the training process is constrained according to the parameter importance degree score obtained in the step B1 based on a parameter smoothing strategy
Specifically, the loss functionThe method comprises the following steps:
/>
Wherein, For cross entropy loss,/>Regularization constraint items for constraining the updating process according to the parameter importance degree scores respectively;
The cross entropy loss is calculated as follows:
Wherein, True tag representing the ith transaction node,/>A forecast tag representing an ith transaction node, wherein N is the number of the transaction nodes;
The regularization constraint term is calculated as:
Wherein Θ l represents a parameter matrix of the target area financial transaction anomaly detection model, S represents an area set in which training of the financial transaction anomaly detection model has been completed before the target area, Θ s represents a parameter matrix of the financial transaction anomaly detection model of the S-th area in the area set, and Θ l-1 represents a parameter matrix of the reference area financial transaction anomaly detection model of the target area; a matrix representing the importance of the financial transaction anomaly detection model parameters of the target area; gamma, lambda are smoothing factors.
After training to obtain an anomaly detection model of the target area, the model can be used to detect financial transaction data of the corresponding area, so as to determine whether the transaction is an anomaly transaction such as fraud, and the flow is shown in fig. 3, and specifically includes:
A1, constructing a financial heterogeneous information graph according to financial transaction data to be detected of a target area;
A2, obtaining embedded representation of each node through a coding network according to the feature vector of each node; according to the embedded representation of the transaction node and the neighbor node thereof, classifying and aggregating based on an attention mechanism according to the element path types of the transaction node and the neighbor node thereof to obtain the embedded representation of each element path type of the transaction node; then, according to the element path types, aggregating the embedded representations of the element path types corresponding to each transaction node to obtain the embedded representations of the element path types of the financial heterogeneous information graph;
A3, according to the embedded representation of each element path type of the financial heterogeneous information graph, fusing the embedded representation of each element path type based on a self-attention mechanism to obtain the graph embedded representation of the financial heterogeneous information graph;
A4, based on the graph embedded representation of the financial heterogeneous information graph, outputting a classification label of abnormality detection by adopting a full connection layer as an abnormality detection result.
Although the application has been described herein with reference to the above examples, which are only preferred embodiments of the present application, the embodiments of the present application are not limited by the above examples, and it should be understood that numerous other modifications and embodiments can be devised by those skilled in the art that will fall within the scope and spirit of the principles of this disclosure.

Claims (12)

1. The financial transaction anomaly detection method is characterized by comprising the following steps of:
A1, constructing a financial heterogeneous information graph according to financial transaction data to be detected of a target area; the entity nodes of the financial heterogeneous information graph comprise user nodes, merchant nodes, time nodes and transaction nodes, node feature vectors are obtained through encoding according to corresponding knowledge information, and the types of the meta paths comprise user-transaction paths, merchant-transaction paths and time-transaction paths;
A2, obtaining embedded representation of each node through a coding network according to the feature vector of each node; according to the embedded representation of the transaction node and the neighbor node thereof, classifying and aggregating based on an attention mechanism according to the element path types of the transaction node and the neighbor node thereof to obtain the embedded representation of each element path type of the transaction node; then, according to the element path types, aggregating the embedded representations of the element path types corresponding to each transaction node to obtain the embedded representations of the element path types of the financial heterogeneous information graph;
A3, according to the embedded representation of each element path type of the financial heterogeneous information graph, fusing the embedded representation of each element path type based on a self-attention mechanism to obtain the graph embedded representation of the financial heterogeneous information graph;
A4, outputting a classification label of anomaly detection by adopting a full-connection layer as an anomaly detection result based on the graph embedded representation of the financial heterogeneous information graph;
In the step A2, according to the characteristic vector of each node, obtaining embedded representation of each node through a coding network; according to the embedded representation of the transaction node and the neighbor node thereof, classifying and aggregating based on an attention mechanism according to the element path types of the transaction node and the neighbor node thereof to obtain the embedded representation of each element path type of the transaction node; then, according to the element path type, aggregating the embedded representation of the element path type corresponding to each transaction node to obtain the embedded representation of the element path type of the financial heterogeneous information graph, comprising:
A21, mapping the feature vectors of all nodes in the financial heterogeneous information graph to a feature space through a coding network to obtain embedded representation of each node in the feature space
Wherein,For the embedded representation of the ith node in feature space, W x is the learnable parameter matrix of the coding network,/>Is the feature vector of the i-th node;
a22, adopting an attention mechanism to obtain attention scores between the transaction node and the neighbor nodes thereof
Wherein att η represents the mechanism of attention,For the attention score between transaction node i and neighbor node j,/>The type of the meta-path between the transaction node i and the neighbor node j;
A23, using SoftMax function to score the attention points of each element path type according to the element path type Normalized to get attention weight/>
Wherein,The meta-path type in the neighbor node of the transaction node i is the mth meta-path/>Is a set of neighbor nodes;
A24, according to the element path types of the transaction node and the neighbor nodes, attention weight is based on Performing classification aggregation to obtain embedded representation/>, of each element path type of transaction node i
Wherein σ is a sigmoid function;
a25, embedding representation of each transaction node Aggregation is carried out according to the meta-path types to obtain the embedded representation/>, of each meta-path type
2. The method for detecting financial transaction anomalies according to claim 1, wherein,
In step A1, the node feature vector is obtained by encoding according to the corresponding knowledge information, and includes:
The user node corresponding knowledge information is the unique identity ID of the transaction user;
The knowledge information corresponding to the merchant node is the unique identity ID of the transaction merchant;
The time node corresponding knowledge information is the time stamp information of the transaction;
The transaction node correspondence knowledge information includes a transaction serial number, a transaction location, a transaction amount, and a transaction type.
3. The method for detecting financial transaction anomalies according to claim 2, wherein,
Feature vector encoding of a temporal node, comprising: firstly, dividing 24 hours per day into time windows at time intervals, then, coding according to digital information or onehot modes of time periods according to time periods corresponding to the time windows to which transaction time stamps belong, and obtaining feature vector codes of time nodes.
4. The method for detecting financial transaction anomalies according to claim 2, wherein,
Feature vector encoding of a transaction node, comprising: firstly, coding according to digital information of a transaction serial number, coding according to longitude and latitude of a transaction place, coding according to digital information of transaction amount, coding transaction type according to onehot mode, and then splicing the serial number, the transaction place, the transaction amount and the transaction type obtained by coding to form feature vector coding of a transaction node.
5. The method for detecting financial transaction anomalies according to claim 1, wherein,
In step A22, the attention score is calculated using a sigmoid function
Wherein,For a learnable parameter matrix, the superscript T represents matrix transposition, and I is a matrix connection symbol; sigmoid is the activation function.
6. The method for detecting abnormal financial transaction according to any one of claims 1 to 4, wherein in the step A3, according to the embedded representation of each element path type of the financial heterogeneous information graph, the embedded representation of each element path type is fused based on a self-attention mechanism, and the graph embedded representation of the financial heterogeneous information graph is obtained, comprising:
A31, obtaining the attention score among the path types of each element by adopting a self-attention mechanism
Wherein,Represents the m-th meta-path/>Is a concentration score of (2); /(I)Representing meta-paths/>Is embedded in the representation; m represents the number of meta-path types; att ψ represents the mechanism of attention;
A32, using SoftMax function to score attention Normalized to get attention weight/>
A33 based on attention weightFusing embedded representations of each element path type;
where z represents the graph embedded representation of the financial heterogeneous information graph.
7. The method for detecting financial transaction anomalies according to claim 6, wherein,
In step A31, the attention score is calculated as follows
Wherein,For the embedded representation of the m-th element path of the transaction node i, tanh represents the hyperbolic tangent activation function, q, W' and b are all learnable parameters, the superscript T represents matrix transposition, and N is the number of transaction nodes.
8. A transregional sustainable training method for use in a financial transaction anomaly detection method as claimed in any one of claims 1 to 7 comprising the steps of:
B1, constructing initial parameters and a playback sample set of a target area financial transaction anomaly detection model according to a continuous learning strategy;
The continuous learning strategy includes: knowledge playback policies and parameter smoothing policies;
The knowledge playback strategy is: sampling a preset number of samples from the samples of the reference area, and constructing a playback sample set; the parameter smoothing strategy is: extracting a parameter matrix of a financial transaction anomaly detection model of a reference area, taking the parameter matrix as an initial parameter matrix of a target area, and evaluating the parameter matrix to obtain a parameter importance degree score; the reference area is an area which is trained by the abnormal detection model of the financial transaction, the initial area is a random area, and a parameter matrix of the random area is obtained in a random mode;
B2, constructing a financial heterogeneous information graph according to a playback sample set and a sample set of a target area, and obtaining an abnormality detection result of the target area according to the financial transaction abnormality detection method of any one of claims 1 to 7;
And B3, calculating training loss by adopting a cross entropy loss function according to the anomaly detection result and the real label, performing iterative training on the financial transaction anomaly detection model of the target area until a preset iteration round or model convergence is achieved, obtaining the financial transaction anomaly detection model of the target area, and restraining the training process according to the parameter importance degree score obtained in the step B1 based on a parameter smoothing strategy.
9. The transregional sustainable training method of claim 8,
In step B1, a preset number of samples are sampled from the samples in the reference area, and a playback sample set is constructed, including:
firstly, randomly sampling transaction nodes from a financial heterogeneous information graph of a reference area, and calculating the average value of feature vectors of the sampling transaction nodes as a playback prototype c l-1:
Wherein, Transaction node set obtained for random sampling,/>For/>The feature vector of the transaction node i,The number of transaction nodes obtained by random sampling;
the playback sample set is then constructed as follows:
The method comprises the steps of obtaining the proximity degree of each transaction node feature vector and a playback prototype according to sampling, and determining the proximity degree from near to far according to the preset quantity Selecting transaction nodes, forming a playback sample set by the selected transaction nodes and neighbor nodes thereof, wherein the number of the transaction nodes obtained by random sampling is larger than the preset number;
Secondly, gaussian noise is generated, feature vectors of transaction nodes obtained through random sampling are corrected based on the generated Gaussian noise, playback sample sets are formed based on the transaction nodes obtained through correction and neighbor nodes of the transaction nodes obtained through random sampling, and the number of the transaction nodes obtained through random sampling is a preset number;
And thirdly, firstly processing according to the first mode, and then processing according to the second mode, so as to complete the construction of the playback sample set.
10. The method for cross-regional sustainable training of claim 8, wherein in step B1, a parameter matrix of the reference regional financial transaction anomaly detection model is evaluated to obtain a parameter importance score according to a gradient change of a reference regional transaction node feature vector under the condition of the parameter matrix.
11. The transregional sustainable training method of claim 10,
The method adopts the snow charging information matrix to evaluate the parameter matrix, and comprises the following steps:
wherein Θ l-1 represents a parameter matrix of a financial transaction anomaly detection model of the reference area, and X l-1 represents a set of feature vectors of each transaction node in a financial heterogeneous information graph of the reference area; g (x; Θ l-1) represents the gradient change of the eigenvector of the transaction node x under Θ l-1 calculated by the loss function, and T represents the matrix transpose.
12. The transregional sustainable training method of any one of claims 8-11, wherein the loss function in step B3The method comprises the following steps:
Wherein, For cross entropy loss,/>Regularization constraint items for constraining the updating process according to the parameter importance degree scores respectively;
The cross entropy loss is calculated as follows:
Wherein, True tag representing the ith transaction node,/>A forecast tag representing an ith transaction node, wherein N is the number of the transaction nodes;
The regularization constraint term is calculated as:
Wherein Θ l represents a parameter matrix of the target area financial transaction anomaly detection model, S represents an area set in which training of the financial transaction anomaly detection model has been completed before the target area, Θ s represents a parameter matrix of the financial transaction anomaly detection model of the S-th area in the area set, and Θ l-1 represents a parameter matrix of the reference area financial transaction anomaly detection model of the target area; a matrix representing the importance of the financial transaction anomaly detection model parameters of the target area; gamma, lambda are smoothing factors.
CN202211301695.8A 2022-10-24 2022-10-24 Financial transaction anomaly detection method and cross-regional sustainable training method thereof Active CN115660688B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202211301695.8A CN115660688B (en) 2022-10-24 2022-10-24 Financial transaction anomaly detection method and cross-regional sustainable training method thereof

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202211301695.8A CN115660688B (en) 2022-10-24 2022-10-24 Financial transaction anomaly detection method and cross-regional sustainable training method thereof

Publications (2)

Publication Number Publication Date
CN115660688A CN115660688A (en) 2023-01-31
CN115660688B true CN115660688B (en) 2024-04-30

Family

ID=84991891

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202211301695.8A Active CN115660688B (en) 2022-10-24 2022-10-24 Financial transaction anomaly detection method and cross-regional sustainable training method thereof

Country Status (1)

Country Link
CN (1) CN115660688B (en)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117408697A (en) * 2023-10-19 2024-01-16 重庆邮电大学 Consumer finance field fraud detection method based on big data
CN117455497B (en) * 2023-11-12 2024-06-14 广东冠汇网络科技有限公司 Transaction risk detection method and device
CN117708821B (en) * 2024-02-06 2024-04-30 山东省计算中心(国家超级计算济南中心) Method, system, equipment and medium for detecting Lesu software based on heterogeneous graph embedding

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109003089A (en) * 2018-06-28 2018-12-14 中国工商银行股份有限公司 risk identification method and device
CN111090780A (en) * 2019-12-09 2020-05-01 中国建设银行股份有限公司 Method and device for determining suspicious transaction information, storage medium and electronic equipment
WO2021179838A1 (en) * 2020-03-10 2021-09-16 支付宝(杭州)信息技术有限公司 Prediction method and system based on heterogeneous graph neural network model
CN113506179A (en) * 2021-09-13 2021-10-15 北京大学深圳研究生院 Method for detecting abnormal entity in digital currency transaction and storage medium
CN113706279A (en) * 2021-06-02 2021-11-26 同盾科技有限公司 Fraud analysis method and device, electronic equipment and storage medium
CN114187112A (en) * 2021-12-15 2022-03-15 深圳前海微众银行股份有限公司 Training method of account risk model and determination method of risk user group
CN114386727A (en) * 2020-10-19 2022-04-22 腾讯科技(深圳)有限公司 Risk identification method, device, equipment and storage medium
CN114565053A (en) * 2022-03-10 2022-05-31 天津大学 Deep heterogeneous map embedding model based on feature fusion

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109003089A (en) * 2018-06-28 2018-12-14 中国工商银行股份有限公司 risk identification method and device
CN111090780A (en) * 2019-12-09 2020-05-01 中国建设银行股份有限公司 Method and device for determining suspicious transaction information, storage medium and electronic equipment
WO2021179838A1 (en) * 2020-03-10 2021-09-16 支付宝(杭州)信息技术有限公司 Prediction method and system based on heterogeneous graph neural network model
CN114386727A (en) * 2020-10-19 2022-04-22 腾讯科技(深圳)有限公司 Risk identification method, device, equipment and storage medium
CN113706279A (en) * 2021-06-02 2021-11-26 同盾科技有限公司 Fraud analysis method and device, electronic equipment and storage medium
CN113506179A (en) * 2021-09-13 2021-10-15 北京大学深圳研究生院 Method for detecting abnormal entity in digital currency transaction and storage medium
CN114187112A (en) * 2021-12-15 2022-03-15 深圳前海微众银行股份有限公司 Training method of account risk model and determination method of risk user group
CN114565053A (en) * 2022-03-10 2022-05-31 天津大学 Deep heterogeneous map embedding model based on feature fusion

Also Published As

Publication number Publication date
CN115660688A (en) 2023-01-31

Similar Documents

Publication Publication Date Title
CN115660688B (en) Financial transaction anomaly detection method and cross-regional sustainable training method thereof
Guikema Artificial intelligence for natural hazards risk analysis: Potential, challenges, and research needs
Peel Graph-based semi-supervised learning for relational networks
CN110213244A (en) A kind of network inbreak detection method based on space-time characteristic fusion
Wang et al. Blind drift calibration of sensor networks using sparse Bayesian learning
Du et al. GAN-based anomaly detection for multivariate time series using polluted training set
Nie et al. Network traffic prediction in industrial Internet of Things backbone networks: A multitask learning mechanism
Aalibagi et al. A matrix factorization model for hellinger-based trust management in social internet of things
CN113283902B (en) Multichannel blockchain phishing node detection method based on graphic neural network
CN111859454B (en) Privacy protection method for defending link prediction based on graph neural network
El-Toukhy et al. Electricity theft detection using deep reinforcement learning in smart power grids
Zhang et al. An open set domain adaptation algorithm via exploring transferability and discriminability for remote sensing image scene classification
CN113111930A (en) End-to-end Ethernet phishing account detection method and system
Zhu et al. Anomaly detection with deep graph autoencoders on attributed networks
Godoy et al. Ensemble random forest filter: An alternative to the ensemble Kalman filter for inverse modeling
CN110889493A (en) Method and device for adding disturbance aiming at relational network
CN111402028A (en) Information processing method, device and equipment
Wu et al. Robust low-rank latent feature analysis for spatiotemporal signal recovery
CN116090504A (en) Training method and device for graphic neural network model, classifying method and computing equipment
Feng et al. A novel approach for trajectory feature representation and anomalous trajectory detection
CN117134978A (en) Vehicle identity verification method and system based on local and global behavior pattern analysis
Das et al. A Bayesian sparse generalized linear model with an application to multiscale covariate discovery for observed rainfall extremes over the United States
CN116150429A (en) Abnormal object identification method, device, computing equipment and storage medium
Chen et al. FedLGAN: a method for anomaly detection and repair of hydrological telemetry data based on federated learning
Su et al. Anomalous social network event detection based on Higher-order networks

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant