CN113723950B - Fraudulent transaction identification method, system and device based on dynamic weighted information entropy - Google Patents

Abstract

The invention provides a method, system and device for identifying fraudulent transactions based on dynamic weighted information entropy, which includes the following steps: using dynamic weighted information entropy to screen one-class-SVM models, and selecting the one with the largest dynamic weighted information entropy of overlapping data subsets ‑class‑SVM model M _ocsvm ; use one‑class‑SVM model M _ocsvm to divide the original data into overlapping data subsets and non-overlapping data subsets; use the one‑class‑SVM model M _ocsvm to divide the overlapping data subsets for training Nonlinear classifier model M _clf , uses the nonlinear classifier model M _clf to distinguish fraudulent transactions and normal transactions in overlapping data subsets; generates fraudulent transactions composed of one‑class‑SVM model M _ocsvm and nonlinear classifier model M _clf Identify the model. The present invention adopts a divide-and-conquer strategy to discharge a large amount of easily identifiable normal transaction data for the nonlinear machine learning model, so that the model can only focus on the learning of data that is difficult to divide, giving full play to the ability of the nonlinear model and improving the performance of the fraudulent transaction identification model. performance.

Description

Fraudulent transaction identification method, system and device based on dynamic weighted information entropy

Technical Field

The present invention relates to the technical field of electronic fraud transaction identification, and in particular to a fraud transaction identification method, system and device based on dynamic weighted information entropy.

Background Art

In recent years, FinTech, which integrates finance and technology, has become one of the hot research areas. Artificial intelligence has driven FinTech to provide higher quality services. At the same time, FinTech has provided a wide range of platforms and application scenarios for artificial intelligence research and innovation. Electronic transaction fraud detection is one of the most important research areas in FinTech and has attracted widespread attention. Identifying fraudulent transactions is very challenging, and one of the most important reasons is the data imbalance problem, especially the data imbalance problem with data overlap. Class imbalance occurs when the sample size difference between different categories of data is large, which is obvious in electronic transaction records because the number of fraudulent transactions is much less than the number of normal transactions. Overlapping refers to the inclusion of samples of different categories in the same data space area, which increases the learning difficulty of the classifier to distinguish samples of different categories in the overlapping area. Since fraudsters will spare no effort to imitate the transaction behavior of real cardholders to make the fraud detection system ineffective, fraudulent transactions and legitimate transactions will be intertwined in certain data space areas and cause overlapping problems. If it is just a data imbalance (non-overlapping) problem, even if the data imbalance ratio is very high, it may not have a big impact on the performance of the classifier, because the performance of some classification models is independent of the number of samples of different categories, such as the classification model based on the maximum margin. However, if data imbalance and overlapping problems occur at the same time, even a classifier based on the maximum margin cannot achieve good performance in correctly distinguishing samples of different categories.

In electronic fraud transaction identification, data imbalance is one of the key factors affecting the performance of fraud transaction identification models. Since fraudsters try their best to imitate the real transaction behavior of cardholders to avoid being identified, the real transaction data and fraud transaction data overlap, resulting in overlapping problems. The data imbalance problem with overlapping makes fraud transaction identification more difficult.

Existing research mainly uses the nearest neighbor method k-NN model to divide the original data set into overlapping data subsets and non-overlapping data subsets. For the overlapping data subset, sampling methods are usually used to remove the majority class samples, so that the boundaries between samples of different categories are clearer, which is more conducive to accurately identifying minority class samples. Finally, the processed overlapping data subset and non-overlapping data subset are merged into a new data set, and then the machine learning model is trained with this new data set to distinguish samples of different categories. This type of method has some obvious defects. First, some samples in the overlapping data subset are deleted. Although a clearer decision boundary is obtained, it may cause important sample information to be lost, resulting in errors in the decision boundary. In addition, the overlapping data subset is obtained by dividing the original data by the k-NN model, but the selection of k-NN model parameters lacks guidance and is usually determined after multiple experiments, which requires a lot of time and computing resources. Especially in the fraud transaction identification scenario with massive transaction data, the k-NN model is difficult to apply.

Therefore, we hope to solve the problems of how to effectively and quickly identify overlapping and non-overlapping data subsets, how to accelerate the training process of subsequent nonlinear machine learning models, reduce the resource consumption of model training, and how to better identify electronic fraud transactions.

Summary of the invention

In view of the shortcomings of the prior art mentioned above, the purpose of the present invention is to provide a fraudulent transaction identification method, system and device based on dynamic weighted information entropy, which is used to solve the problems in the prior art of how to effectively and quickly identify overlapping and non-overlapping data subsets, how to accelerate the training process of subsequent nonlinear machine learning models, reduce resource consumption of model training, and how to better identify electronic fraud transactions.

To achieve the above-mentioned and other related purposes, the present invention provides a fraudulent transaction identification method based on dynamic weighted information entropy, comprising the following steps: using fraudulent transaction samples to train a hyperparameter One-class-SVM (single classification model) model; belong Use the trained one-class-SVM model to divide the original data into overlapping data subsets and non-overlapping data subsets; calculate different hyperparameters The dynamic weighted information entropy of the overlapping data subsets obtained by the corresponding one-class-SVM model division, and the corresponding hyperparameter of the overlapping data subset with the largest dynamic weighted information entropy is selected The corresponding one-class-SVM model is the one-class-SVM model _Mocsvm with the largest dynamic weighted information entropy of the overlapping data subset; the original data is divided into overlapping data subsets and non-overlapping data subsets using the one-class-SVM model _Mocsvm ; the nonlinear classifier model _Mclf is trained on the overlapping data subsets obtained by the one-class-SVM model _Mocsvm , and the nonlinear classifier model _Mclf is used to distinguish fraudulent transactions from normal transactions in the overlapping data subsets; a fraudulent transaction recognition model composed of the one-class-SVM model _Mocsvm and the nonlinear classifier model _Mclf is generated.

In one embodiment of the present invention, the dynamic weighted information entropy of the overlapping data subset is defined as:

G _DWE (θ)＝W _snr *H

Among them, θ represents a set of hyperparameters of the one-class-SVM model; H represents the information entropy of the overlapping data subsets; W _snr represents the dynamic weight of H, which is determined by the signal-to-noise ratio of the minority class samples. H and W _snr are defined as:

Where i∈{0, 1, ..., k}, k represents the category in the overlapping data subset (k=1 for fraudulent transaction identification), _pi represents the probability that a sample in the overlapping data subset belongs to category i, n _all represents the number of minority class samples in the original data set, and n _outliers represents the number of minority class samples in the original data set that are judged to be noise data.

In one embodiment of the present invention, the nonlinear classifier model is a deep learning model.

In one embodiment of the present invention, the overlapping data subsets obtained by dividing the one-class-SVM model M _ocsvm are used to train the nonlinear classifier model _Mclf , including: using a first part of samples of the overlapping data subsets to train the nonlinear classifier model _Mclf ; using a second part of samples of the overlapping data subsets to verify the nonlinear classifier model _Mclf ; repeating the training and verification steps until the accuracy of the nonlinear classifier model _Mclf meets the preset requirements.

To achieve the above-mentioned purpose, the present invention also provides a fraudulent transaction identification system based on dynamic weighted information entropy, including: a training module, a division module, a distinction module and a model generation module; the training module is used to train a fraudulent transaction sample containing hyperparameters One-class-SVM model; belong Use the trained one-class-SVM model to divide the original data into overlapping data subsets and non-overlapping data subsets; calculate different hyperparameters The dynamic weighted information entropy of the overlapping data subsets obtained by the corresponding one-class-SVM model division, and the corresponding hyperparameter of the overlapping data subset with the largest dynamic weighted information entropy is selected The corresponding one-class-SVM model is the one-class-SVM model _Mocsvm with the largest dynamic weighted information entropy of the overlapping data subset; the partitioning module is used to use the one-class-SVM model _Mocsvm to divide the original data into overlapping data subsets and non-overlapping data subsets; the distinguishing module is used to train the nonlinear classifier model _Mclf using the overlapping data subsets obtained by the division of the one-class-SVM model _Mocsvm , and use the nonlinear classifier model _Mclf to distinguish fraudulent transactions and normal transactions in the overlapping data subsets; the model generation module is used to generate a fraudulent transaction recognition model composed of the one-class-SVM model _Mocsvm and the nonlinear classifier model _Mclf .

In one embodiment of the present invention, the dynamic weighted information entropy of the overlapping data subset is defined as:

G _DWE (θ)＝W _snr *H

Among them, θ represents a set of hyperparameters of the one-class-SVM model; H represents the information entropy of the overlapping data subsets; W _snr represents the dynamic weight of H, which is determined by the signal-to-noise ratio of the minority class samples. H and W _snr are defined as:

Where i∈{0, 1, ..., k}, k represents the category in the overlapping data subset (k=1 for fraudulent transaction identification), _pi represents the probability that a sample in the overlapping data subset belongs to category i, n _all represents the number of minority class samples in the original data set, and n _outliers represents the number of minority class samples in the original data set that are judged to be noise data.

In one embodiment of the present invention, the nonlinear classifier model is a deep learning model.

In one embodiment of the present invention, the overlapping data subsets obtained by dividing the one-class-SVM model M _ocsvm are used to train the nonlinear classifier model _Mclf , including: using a first part of samples of the overlapping data subsets to train the nonlinear classifier model _Mclf ; using a second part of samples of the overlapping data subsets to verify the nonlinear classifier model _Mclf ; and repeating the training and verification steps until the accuracy of the nonlinear classifier model _Mclf meets preset requirements.

To achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, it implements any of the above-mentioned fraudulent transaction identification methods based on dynamic weighted information entropy.

To achieve the above-mentioned purpose, the present invention also provides a fraud transaction identification device based on dynamic weighted information entropy, comprising: a processor and a memory; the memory is used to store a computer program; the processor is connected to the memory, and is used to execute the computer program stored in the memory, so that the fraud transaction identification device based on dynamic weighted information entropy can execute any of the above-mentioned fraud transaction identification methods based on dynamic weighted information entropy.

As described above, a fraudulent transaction identification method, system and device based on dynamic weighted information entropy of the present invention has the following beneficial effects: a fraudulent transaction identification model based on divide and conquer is proposed, firstly, the one-class-SVM model is trained with fraudulent transaction data, and the part of normal transactions that are easy to identify are identified and classified into non-overlapping data subsets, and the part of normal transactions that are difficult to distinguish from fraudulent transactions are classified into overlapping data subsets; then a nonlinear machine learning model is used to distinguish fraudulent and normal transaction data in the overlapping data subsets. A large amount of normal transaction data that is easy to identify is excluded for the nonlinear machine learning model, so that the model can only focus on the learning of data that is difficult to divide, give full play to the ability of the nonlinear model, and improve the performance of the fraudulent transaction identification model. In order to ensure that the amount of normal transaction data is reduced as much as possible in the overlapping data subsets divided by the one-class-SVM model, and at the same time, the fraudulent transaction data is not lost as much as possible, the present invention proposes dynamic weighted information entropy to guide the hyperparameter selection of the one-class-SVM model, and the dynamic weighted information entropy is a trade-off between the information entropy in the overlapping data subset and the information loss of the fraudulent transaction data. In the original data division stage, dynamic weighted information entropy is used to guide the parameter selection of the one-class-SVM model. There is no need for feedback on the subsequent nonlinear machine learning model test results, which can greatly reduce the computational complexity of parameter selection and improve the efficiency of the model.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1a is a flow chart showing a fraudulent transaction identification method based on dynamic weighted information entropy in one embodiment of the present invention;

FIG1b is a schematic diagram showing the division of the original data set by the One-class-SVM model in an embodiment of the fraudulent transaction identification method based on dynamic weighted information entropy of the present invention;

FIG. 1c is a flow chart showing a fraudulent transaction identification method based on dynamic weighted information entropy in another embodiment of the present invention;

FIG. 1d is a schematic diagram showing the variation of the _F1 value with DWE in a fraudulent transaction identification method based on dynamic weighted information entropy in one embodiment of the present invention;

FIG. 1e is a schematic diagram showing the time consumption of a one-class-SVM model and a nonlinear machine learning model in an embodiment of a fraudulent transaction identification method based on dynamic weighted information entropy according to the present invention;

FIG. 1f is a flow chart showing a fraudulent transaction identification method based on dynamic weighted information entropy in yet another embodiment of the present invention;

FIG2 is a schematic diagram showing the structure of a fraudulent transaction identification system based on dynamic weighted information entropy in one embodiment of the present invention;

FIG. 3 is a schematic diagram showing the structure of a fraudulent transaction identification device based on dynamic weighted information entropy in one embodiment of the present invention.

Component number description

21 Training Modules

22 Divide Modules

23 Differentiate modules

24 Model Generation Module

31 Processor

32 Memory

DETAILED DESCRIPTION

The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

It should be noted that the illustrations provided in the following embodiments are only used to illustrate the basic concept of the present invention in a schematic manner. Therefore, the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

The fraudulent transaction identification method, system and device based on dynamic weighted information entropy of the present invention can effectively and quickly identify overlapping and non-overlapping data subsets, accelerate the training process of subsequent models, reduce resource consumption of model training, and better identify electronic fraud transactions.

As shown in FIG. 1a , in one embodiment, the fraudulent transaction identification method based on dynamic weighted information entropy of the present invention comprises the following steps:

Step S11: Use fraudulent transaction samples to train the hyperparameters One-class-SVM model; belong The trained one-class-SVM model is used to divide the original data into overlapping data subsets and non-overlapping data subsets; the division module is used to calculate different hyperparameters The dynamic weighted information entropy of the overlapping data subsets obtained by the corresponding one-class-SVM model division, and the corresponding hyperparameter of the overlapping data subset with the largest dynamic weighted information entropy is selected The corresponding one-class-SVM model is the one-class-SVM model _Mocsvm with the largest dynamic weighted information entropy of the overlapping data subset.

The original data set contains a large amount of normal transaction data and a small amount of fraudulent transaction data, of which the fraudulent transaction data is used to train the one-class-SVM model. Ideally, the trained one-class-SVM model can divide the original data set into a non-overlapping data subset containing only normal transaction data and an overlapping data subset containing both normal and fraudulent transaction data, as shown in the overlapping data subset-1 in Figure 1b. However, there are inevitably some noise data in the fraudulent transaction data due to incorrect labeling, etc. Dividing these minority class noise data into the overlapping data subset will cause the decision boundary of the one-class-SVM model to shift toward the majority class samples, causing a large number of majority class samples to be divided into the overlapping data subset, increasing the data imbalance ratio of the overlapping data subset, and bringing difficulties to subsequent model learning. Therefore, treating some minority class samples as noise data and determining them as majority class samples can improve the quality of the overlapping data subset, thereby improving the overall performance of the fraud recognition model. As shown in Figure 1b, judging a minority class noise data as majority class data can shrink the decision boundary of the one-class-SVM model, forming an overlapping data subset-2 with less majority class data, reducing the impact of easily distinguishable data on subsequent classification models. In order to quantify the loss caused by judging some minority class samples as majority class samples and the impact on the overlapping data subset, the present invention proposes dynamic weighted information entropy.

Specifically, the one-class-SVM model is a single-class model. Different hyperparameters θ _ocsvm can be used for the same one-class-SVM model. For example, the hyperparameter Each hyperparameter will cause the trained one-class-SVM model to divide the original data into overlapping data subsets with different dynamic weighted information entropy.

Specifically, the fraudulent transaction samples are used to train the hyperparameters One-class-SVM model; including: using the first part of the fraudulent transaction sample to train the hyperparameters One-class-SVM model of the fraudulent transaction sample; hyperparameters are verified using the second part of the fraudulent transaction sample One-class-SVM model; repeat the training and validation steps until the hyperparameters The accuracy of the one-class-SVM model meets the first preset requirement. For example, the fraudulent transaction sample refers to a sample containing fraudulent transaction data. The fraudulent transaction sample is used to train the hyperparameters The one-class-SVM model can make the hyperparameters The one-class-SVM model identifies fraudulent transaction data and normal transaction data. The hyperparameters are trained using samples of fraudulent transaction samples from the first twenty days of a certain month. One-class-SVM model; hyperparameters are verified using a sample of fraudulent transactions from the last ten days of a certain month One-class-SVM model; repeat the training and validation steps until the hyperparameters The accuracy of the one-class-SVM model meets the first preset requirement. The first preset requirement refers to the hyperparameter The accuracy of the one-class-SVM model in identifying overlapping data subsets and non-overlapping data subsets. The non-overlapping data subset contains only normal transaction data, while the overlapping data subset contains both normal and fraudulent transaction data. The hyperparameters are trained using fraudulent transaction samples. The one-class-SVM model can make the hyperparameters The one-class-SVM model identifies overlapping data subsets and non-overlapping data subsets.

Specifically, the trained one-class-SVM model is used to divide the original data into overlapping data subsets and non-overlapping data subsets. The overlapping data subsets and non-overlapping data subsets include a non-overlapping data subset containing only normal transaction data and an overlapping data subset containing both normal and fraudulent transaction data. Therefore, since the non-overlapping data subset only contains normal transaction data, the non-overlapping data subset does not need to be distinguished, while since the overlapping data subset contains both normal and fraudulent transaction data, the overlapping data subset needs to be distinguished. It is inevitable that there are some noise data generated by incorrect labels in the fraudulent transaction data. Dividing these minority class noise data into the overlapping data subset will cause the decision boundary of the one-class-SVM model to shift toward the majority class samples, so that a large number of majority class samples are divided into the overlapping data subset, which increases the data imbalance ratio of the overlapping data subset, bringing difficulties to subsequent model learning. Therefore, treating some minority class samples as noise data and judging them as majority class samples can improve the quality of the overlapping data subset, thereby improving the overall performance of the fraud identification model.

Specifically, the one-class-SVM model can be used to divide the data of all original data sets. All transaction data within the decision boundary of the one-class-SVM model are divided into overlapping data subsets, which contain most of the fraudulent transaction data and some normal transaction data with high similarity to fraudulent transactions. Nonlinear machine learning models with strong learning ability are needed to distinguish them. All transaction data outside the decision boundary of the one-class-SVM model are divided into non-overlapping data subsets, which only contain a small amount of noise data of fraudulent transactions, and the rest are all normal transaction data. Therefore, all non-overlapping data subsets can be judged as normal transactions, and a small number of fraudulent transactions judged as normal transactions will not have a significant impact on the overall performance of the fraud identification model. The large amount of transaction data that is easy to distinguish in the original data set is divided into non-overlapping data subsets, which reduces the imbalance ratio of overlapping data subsets and eliminates the interference of easy-to-classify data on the training of machine learning models.

Specifically, different hyperparameters correspond to corresponding one-class-SVM models, and each hyperparameter has a corresponding one-class-SVM model, and also has a corresponding one-class-SVM model to divide the original data into overlapping data subsets and non-overlapping data subsets, and each overlapping data subset obtained after division has a dynamic weighted information entropy. Using fraudulent transaction samples to train a model containing hyperparameters One-class-SVM model, calculate different hyperparameters The corresponding one-class-SVM model divides the original data into overlapping data subsets, and selects the hyperparameter with the largest dynamic weighted information entropy of the overlapping data subsets. The corresponding one-class-SVM model is the one-class-SVM model _Mocsvm with the largest dynamic weighted information entropy of the overlapping data subset.

Therefore, calculating different hyperparameters The dynamic weighted information entropy of the overlapping data subset of the corresponding one-class-SVM model, select the hyperparameter with the largest dynamic weighted information entropy of the overlapping data subset The corresponding one-class-SVM model is the one-class-SVM model _Mocsvm with the largest dynamic weighted information entropy.

Specifically, the dynamic weighted information entropy of the overlapping data subset is defined as:

G _DWE (θ)＝W _snr *H

Among them, θ represents a set of hyperparameters of the one-class-SVM model; H represents the information entropy of the overlapping data subset; W _snr represents the dynamic weight of H, which is determined by the signal-to-noise ratio of the minority class samples. H and W _snr are defined as:

Where i∈{0, 1, ..., k}, k represents the category in the overlapping data subset (k=1 for fraudulent transaction identification), _pi represents the probability that a sample in the overlapping data subset belongs to category i, n _all represents the number of minority class samples in the original data set, and n _outliers represents the number of minority class samples in the original data set that are judged to be noise data. The dynamic weighted information entropy proposed in the present invention is a trade-off between the information loss of minority class samples and the quality of overlapping data. A larger dynamic weighted information entropy can only be obtained when both H and W _snr reach relatively large values. Using the dynamic weighted information entropy proposed in the present invention as an evaluation indicator for the selection of hyperparameters of the one-class-SVM model can ensure the overall performance of the fraudulent transaction identification model. Adjust the different hyperparameters of the one-class-SVM model and select the one that maximizes the dynamic weighted information entropy. For example, the hyperparameter with the largest dynamic weighted information entropy The corresponding one-class-SVM model is then called the one-class-SVM model _Mocsvm with the largest dynamic weighted information entropy. Compared with the existing method for processing the problem of data imbalance with overlap (using the KNN model to divide overlapping and non-overlapping data subsets), the present invention uses the one-class-SVM model to divide overlapping and non-overlapping data subsets, and the calculation speed is faster. The dynamic weighted information entropy is proposed as a reference indicator for selecting hyperparameters of the one-class-SVM model. When the one-class-SVM with specific hyperparameters completes the training, the dynamic weighted information entropy can be calculated. The performance of this one-class-SVM model can be evaluated without completing the training of the entire fraud transaction recognition model. Compared with the existing method for processing data imbalance with overlap (without dynamic weighted information entropy, the entire model needs to be trained to know the quality of the overlapping and non-overlapping data subset division), the model training process after data division can be omitted, the model training process can be accelerated, and the resource consumption of model training can be reduced.

On the one hand, information entropy H can represent the average amount of information in the overlapping data subsets. If there are too many majority class samples in the overlapping data subsets, that is, _p0 is close to 1 and _p1 is close to 0 (0 represents the majority class and 1 represents the minority class), the information entropy H will be close to 0. Only when the majority class and minority class samples in the overlapping data subsets are relatively balanced, that is, _p0 and _p1 are both close to 0, can the information entropy be close to the maximum value of 1.

On the other hand, the dynamic weight W _snr based on the signal-to-noise ratio of the minority class samples in the original data set can reflect the loss caused by the minority class samples being judged as noise data. The signal-to-noise ratio of the minority class samples in the original data set changes with the changes in the hyperparameters of the one-class-SVM model. In the original data set, the more minority class samples are judged as noise data by the one-class-SVM model, the smaller their signal-to-noise ratio W _snr is, that is, the more information the minority class samples lose.

Step S12: Use the one-class-SVM model _Mocsvm to divide the original data into overlapping data subsets and non-overlapping data subsets.

Therefore, the dynamic weighted information entropy proposed in the present invention is a trade-off between the information loss of minority class samples and the quality of overlapping data. A larger dynamic weighted information entropy can be obtained only when both H and W _snr reach relatively large values. Using the dynamic weighted information entropy proposed in the present invention as an evaluation indicator for selecting hyperparameters of the one-class-SVM model can ensure the overall performance of the fraudulent transaction identification model. Adjust the hyperparameters of different one-class-SVM models and select the one that maximizes the dynamic weighted information entropy. Then use the one-class-SVM model _Mocsvm with the maximum dynamic weighted information entropy to divide the original data into overlapping data subsets and non-overlapping data subsets.

As shown in Figure 1c, after determining the parameters of the one-class-SVM model, the one-class-SVM model can be used to divide the data of the entire original data set. All transaction data within the decision boundary of the one-class-SVM model are divided into overlapping data subsets, which contain most of the fraudulent transaction data and some normal transaction data with a high similarity to fraudulent transactions. All transaction data outside the decision boundary of the one-class-SVM model are divided into non-overlapping data subsets, which only contain a small amount of noise data of fraudulent transactions, and the rest are all normal transaction data. Therefore, all non-overlapping data subsets can be judged as normal transactions, and a small number of fraudulent transactions judged as normal transactions will not have a significant impact on the overall performance of the fraud identification model. The large amount of transaction data that is easy to distinguish in the original data set is divided into the non-overlapping data subset, which reduces the imbalance ratio of the overlapping data subset and eliminates the interference of easy-to-classify data on the training of the machine learning model.

Step S13: Use the one-class-SVM model _Mocsvm to divide the overlapping data subsets to train a nonlinear classifier model _Mclf , and use the nonlinear classifier model _Mclf to distinguish fraudulent transactions from normal transactions in the overlapping data subsets.

Specifically, the overlapping data subset obtained by dividing using the one-class-SVM model _Mocsvm is trained with a nonlinear classifier model _Mclf , including: using the first part of the samples of the overlapping data subset to train the nonlinear classifier model _Mclf ; using the second part of the samples of the overlapping data subset to verify the nonlinear classifier model _Mclf ; repeating the training and verification steps until the accuracy of the nonlinear classifier model _Mclf meets the preset requirements. For example, the nonlinear classifier model _Mclf is trained with the data samples of the first 20 days of a certain month of the overlapping data subset, and the nonlinear classifier model _Mclf is verified with the samples of the last 10 days of a certain month of the overlapping data subset; repeating the training and verification steps until the accuracy of the nonlinear classifier model _Mclf meets the preset requirements. The preset requirements refer to the accuracy of the nonlinear classifier model _Mclf in distinguishing fraudulent transaction data and normal transaction data in the overlapping data subset. It is difficult to distinguish normal transaction data and fraudulent transaction data in the overlapping data subset in the original feature space. It is necessary to use nonlinear machine learning models such as deep learning models to learn more complex feature combinations to map the original data to a new feature space, so that normal transactions and fraudulent transactions can be more easily distinguished in the new feature space, thereby ensuring the performance of fraudulent transaction identification.

Step S14: Generate a fraudulent transaction identification model consisting of a one-class-SVM model _Mocsvm and a nonlinear classifier model _Mclf .

Specifically, the algorithm of the fraudulent transaction identification method based on dynamic weighted information entropy is as follows:

Specifically, fraudulent transaction samples are used to train the hyperparameter One-class-SVM model; belong Use the trained one-class-SVM model to divide the original data into overlapping data subsets and non-overlapping data subsets. Corresponding steps:

Specifically, calculate different hyperparameters The dynamic weighted information entropy of the overlapping data subsets obtained by the corresponding one-class-SVM model division, and the corresponding hyperparameter of the overlapping data subset with the largest dynamic weighted information entropy is selected The corresponding one-class-SVM model is the one-class-SVM model _Mocsvm with the largest dynamic weighted information entropy of the overlapping data subset. The corresponding steps are:

Specifically, the one-class-SVM model _Mocsvm is used to divide the original data into overlapping data subsets and non-overlapping data subsets. The corresponding steps are:

14. Use _Mocsvm to divide the original data into overlapping and non-overlapping data subsets

Specifically, the overlapping data subset obtained by dividing the one-class-SVM model _Mocsvm is used to train the nonlinear classifier model _Mclf , and the nonlinear classifier model _Mclf is used to distinguish fraudulent transactions and normal transactions in the overlapping data subset. The corresponding steps are:

15. Use overlapping data subsets to train the nonlinear classifier model _Mclf

Specifically, a fraudulent transaction identification model consisting of a one-class-SVM model _Mocsvm and a nonlinear classifier model _Mclf is generated, corresponding to the following steps:

16.Return Fraudulent transaction identification model composed of _Mocsvm and _Mclf

The above steps are tested using the transaction data of a Chinese bank as an example. The data set contains transaction data from April to June 2017, with a data volume of about 3.5 million records, all of which are annotated by bank professionals. Table 1 shows the basic information of this data set.

Table 1 Electronic transaction data information

month Data volume Number of features Unbalance ratio 2017-04 1,243,035 43 1.07% 2017-05 1,216,299 43 2.22% 2017-06 1,042,714 43 2.39%

In order to demonstrate the good performance and high efficiency of the method of the present invention in identifying fraudulent transactions. We divide all the data in this data set into 1 group according to the transaction data of every 10 days, forming a total of 9 groups of data. Then use the 9 groups of data to form 6 experimental groups. Each experimental group consists of 4 consecutive groups of data, of which the first 3 groups of data are used for model training and the remaining 1 group of data is used for model testing. The detailed information of the 6 experimental groups is shown in Table 1. The data imbalance ratio is between 48 and 69, and the data overlap rate is between 0.26 and 0.29.

Table 2 Experimental group data information

Among them, datasets (data set), no.ofsamples (number of samples), no.ofmaj/min (number of majority class samples/number of minority class samples), Imbalance Ratio (data imbalance ratio), degree of overlap (overlap rate)

In each experimental group, we compared the method based on dynamic weighted information entropy described in the present invention with four common methods for dealing with data imbalance problems and two latest methods:

1)EditedNearest Neighbor(ENN);

2) Tomek links;

3)Synthetic Minority Oversampling Technique(SMOTE);

4)One Class Support Vector Machine(OC-SVM);

5)Overlap Sensitive Margin(OSM)Classifier;

6)Modified Tomek Link Search(NB-Tomek);

For each experimental group, the method used in this invention uses a grid search method to evaluate and screen the hyperparameters of the one-class-SVM model, and the hyperparameters of other comparison methods are set according to their recommended values. We use _F1 value (comprehensive performance) and G_mean (GM) (square root of the product of fraudulent transaction and normal transaction identification accuracy) as evaluation indicators for each model.

First, the experimental result Figure 1d shows the change of the overall _F1 value of the fraud identification model proposed in this paper with the dynamic weighted information entropy DWE. It can be seen that the fraud identification model proposed in this paper can achieve better performance when DWE reaches the maximum value, proving that the dynamic weighted information entropy can guide the parameter selection of the fraud transaction identification model proposed in this paper. Then, Table 3 shows the comparison results of the _F1 value and GM of different methods. Obviously, the method proposed in this paper is more effective for the problem of overlapping data imbalance. The _F1 value and GM of ours (the method adopted in this application) are higher than those of other methods. Finally, the experimental result Figure 1e shows the average time consumption of the one-class-SVM model used for data partitioning in the method proposed in this paper and the nonlinear machine learning model for identifying fraudulent transactions in the overlapping data subset. It can be seen that the use of the dynamic weighted information entropy proposed in this paper to directly guide the hyperparameter selection of the one-class-SVM model without the result feedback of the nonlinear machine learning model can greatly reduce the computational complexity of the overall parameter selection and improve the efficiency of model learning.

Table 3 Experimental test results

As shown in FIG. 1f , in one embodiment, the fraudulent transaction identification method based on dynamic weighted information entropy of the present invention includes: step S11, using fraudulent transaction samples to train a one-class-SVM model, and using dynamic weighted information entropy to select hyperparameters of the model: using fraudulent transaction samples to train a one-class-SVM model containing hyperparameters One-class-SVM model; belong Use the trained one-class-SVM model to divide the original data into overlapping data subsets and non-overlapping data subsets; calculate different hyperparameters The dynamic weighted information entropy of the overlapping data subsets obtained by the corresponding one-class-SVM model division, and the corresponding hyperparameter of the overlapping data subset with the largest dynamic weighted information entropy is selected The corresponding one-class-SVM model is used as the one-class-SVM model _Mocsvm with the largest dynamic weighted information entropy of the overlapping data subset. Step S12: Use the one-class-SVM model with the determined hyperparameters to divide the original data into overlapping and non-overlapping data subsets: Use the one-class-SVM model _Mocsvm to divide the original data into overlapping data subsets and non-overlapping data subsets. Step S13: Use the overlapping data subset to train a nonlinear classifier to distinguish fraudulent and normal transactions: Use the overlapping data subset obtained by the one-class-SVM model _Mocsvm to train a nonlinear classifier model _Mclf , and use the nonlinear classifier model _Mclf to distinguish fraudulent transactions from normal transactions in the overlapping data subset. Generate a fraudulent transaction recognition model composed of the one-class-SVM model _Mocsvm and the nonlinear classifier model _Mclf .

As shown in FIG2 , in one embodiment, the fraudulent transaction identification system based on dynamic weighted information entropy of the present invention includes: a training module 21 , a division module 22 , a distinction module 23 and a model generation module 24 ;

The training module 21 is used to train the fraudulent transaction samples with hyper parameters One-class-SVM model; belong Use the trained one-class-SVM model to divide the original data into overlapping data subsets and non-overlapping data subsets; calculate different hyperparameters The dynamic weighted information entropy of the overlapping data subsets obtained by the corresponding one-class-SVM model division, and the corresponding hyperparameter of the overlapping data subset with the largest dynamic weighted information entropy is selected The corresponding one-class-SVM model is the one-class-SVM model _Mocsvm with the largest dynamic weighted information entropy of the overlapping data subset.

The partitioning module 22 is used to partition the original data into overlapping data subsets and non-overlapping data subsets using the one-class-SVM model _Mocsvm .

The distinguishing module 23 is used to train a nonlinear classifier model _Mclf using the overlapping data subset obtained by dividing the one-class-SVM model _Mocsvm , and use the nonlinear classifier model _Mclf to distinguish fraudulent transactions and normal transactions in the overlapping data subset.

The model generation module 24 is used to generate a fraudulent transaction identification model consisting of a one-class-SVM model M _ocsvm and a nonlinear classifier model M _clf .

Specifically, the dynamic weighted information entropy of the overlapping data subset is defined as:

G _DWE (θ)＝W _snr *H

Among them, θ represents a set of hyperparameters of the one-class-SVM model; H represents the information entropy of the overlapping data subset; W _snr represents the dynamic weight of H, which is determined by the signal-to-noise ratio of the minority class samples. H and W _snr are defined as:

Where i∈{0, 1, ..., k}, k represents the category in the overlapping data subset (k=1 for fraudulent transaction identification), _pi represents the probability that a sample in the overlapping data subset belongs to category i, n _all represents the number of minority class samples in the original data set, and n _outliers represents the number of minority class samples in the original data set that are judged to be noise data.

Specifically, the nonlinear classifier model is a deep learning model.

Specifically, the overlapping data subset obtained by dividing the one-class-SVM model _Mocsvm is used to train the nonlinear classifier model _Mclf , including: using a first part of samples of the overlapping data subset to train the nonlinear classifier model _Mclf ; using a second part of samples of the overlapping data subset to verify the nonlinear classifier model _Mclf ; repeating the training and verification steps until the accuracy of the nonlinear classifier model _Mclf meets the preset requirements.

It should be noted that the structures and principles of the training module 21, the division module 22, the differentiation module 23 and the model generation module 24 correspond one to one with the steps in the above-mentioned fraudulent transaction identification method based on dynamic weighted information entropy, so they will not be repeated here.

It should be noted that it should be understood that the division of the various modules of the above system is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software called by processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. For example, the x module can be a separately established processing element, or it can be integrated in a chip of the above device. In addition, it can also be stored in the memory of the above device in the form of program code, and called and executed by a processing element of the above device. The implementation of other modules is similar. In addition, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

For example, the above modules may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASIC), or one or more microprocessors (DSP), or one or more field programmable gate arrays (FPGA). For another example, when a module is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).

In one embodiment of the present invention, the present invention also includes a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, any of the above-mentioned fraudulent transaction identification methods based on dynamic weighted information entropy is implemented.

Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to the computer program. The aforementioned computer program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

As shown in Figure 3, in one embodiment, the fraud transaction identification device based on dynamic weighted information entropy of the present invention includes: a processor 31 and a memory 32; the memory 32 is used to store computer programs; the processor 31 is connected to the memory 32, and is used to execute the computer program stored in the memory 32, so that the fraud transaction identification device based on dynamic weighted information entropy executes any of the fraud transaction identification methods based on dynamic weighted information entropy.

Specifically, the memory 32 includes: ROM, RAM, disk, USB flash drive, memory card or optical disk, etc., which can store program codes.

Preferably, the processor 31 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

In summary, the fraudulent transaction identification method, system and device based on dynamic weighted information entropy of the present invention adopts a divide-and-conquer strategy to exclude a large amount of easily identifiable normal transaction data for the nonlinear machine learning model, so that the model can only focus on the learning of data that is difficult to divide, giving full play to the ability of the nonlinear model and improving the performance of the fraudulent transaction identification model. Therefore, the present invention effectively overcomes various shortcomings in the prior art and has a high industrial utilization value.

The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims (8)

1. A fraudulent transaction identification method based on dynamic weighted information entropy, characterized in that it comprises the following steps: Using fraudulent transaction samples to train hyperparameters One-class-SVM model; belong Use the trained one-class-SVM model to divide the original data into overlapping data subsets and non-overlapping data subsets; calculate different hyperparameters The dynamic weighted information entropy of the overlapping data subsets obtained by the corresponding one-class-SVM model division, and the corresponding hyperparameter of the overlapping data subset with the largest dynamic weighted information entropy is selected The corresponding one-class-SVM model is the one-class-SVM model _Mocsvm with the largest dynamic weighted information entropy of the overlapping data subset; The dynamic weighted information entropy of the overlapping data subset is defined as: G _DWE (θ)＝W _snr *H Among them, θ represents a set of hyperparameters of the one-class-SVM model; H represents the information entropy of the overlapping data subsets; W _snr represents the dynamic weight of H, which is determined by the signal-to-noise ratio of the minority class samples. H and W _snr are defined as: Where i∈{0,1,…,k}, k represents the category in the overlapping data subset (k=1 for fraudulent transaction identification), _pi represents the probability that a sample in the overlapping data subset belongs to category i, n _all represents the number of minority class samples in the original data set, and n _outliers represents the number of minority class samples in the original data set that are judged to be noise data; Use the one-class-SVM model _Mocsvm to divide the original data into overlapping data subsets and non-overlapping data subsets; The overlapping data subsets obtained by using the one-class-SVM model _Mocsvm are used to train the nonlinear classifier model _Mclf , and the nonlinear classifier model _Mclf is used to distinguish fraudulent transactions from normal transactions in the overlapping data subsets; Generate a fraud transaction identification model consisting of a one-class-SVM model _Mocsvm and a nonlinear classifier model _Mclf . 2. The fraudulent transaction identification method based on dynamic weighted information entropy according to claim 1 is characterized in that the nonlinear classifier model is a deep learning model. 3. The fraudulent transaction identification method based on dynamic weighted information entropy according to claim 1, characterized in that the overlapping data subsets obtained by dividing using the one-class-SVM model _Mocsvm are used to train the nonlinear classifier model _Mclf , comprising: Use the first part of the overlapping data subsets to train the nonlinear classifier model _Mclf ; Use the second part of the overlapping data subset to verify the nonlinear classifier model _Mclf ; The training and validation steps are repeated until the accuracy of the nonlinear classifier model _Mclf meets the preset requirements. 4. A fraudulent transaction identification system based on dynamic weighted information entropy, characterized by comprising: a training module, a partitioning module, a distinguishing module and a model generation module; The training module is used to train the fraudulent transaction samples containing hyperparameters One-class-SVM model; belong Use the trained one-class-SVM model to divide the original data into overlapping data subsets and non-overlapping data subsets; calculate different hyperparameters The dynamic weighted information entropy of the overlapping data subsets obtained by the corresponding one-class-SVM model division, and the corresponding hyperparameter of the overlapping data subset with the largest dynamic weighted information entropy is selected The corresponding one-class-SVM model is the one-class-SVM model _Mocsvm with the largest dynamic weighted information entropy of the overlapping data subset; The dynamic weighted information entropy of the overlapping data subset is defined as: G _DWE (θ)＝W _snr *H Among them, θ represents a set of hyperparameters of the one-class-SVM model; H represents the information entropy of the overlapping data subsets; W _snr represents the dynamic weight of H, which is determined by the signal-to-noise ratio of the minority class samples. H and W _snr are defined as: Where i∈{0,1,…,k}, k represents the category in the overlapping data subset (k=1 for fraudulent transaction identification), _pi represents the probability that a sample in the overlapping data subset belongs to category i, n _all represents the number of minority class samples in the original data set, and n _outliers represents the number of minority class samples in the original data set that are judged to be noise data; The partitioning module is used to partition the original data into overlapping data subsets and non-overlapping data subsets using a one-class-SVM model _Mocsvm ; The distinguishing module is used to train a nonlinear classifier model _Mclf using the overlapping data subsets obtained by dividing the one-class-SVM model _Mocsvm , and use the nonlinear classifier model _Mclf to distinguish fraudulent transactions and normal transactions in the overlapping data subsets; The model generation module is used to generate a fraudulent transaction identification model composed of a one-class-SVM model M _ocsvm and a nonlinear classifier model M _clf . 5. The fraudulent transaction identification system based on dynamic weighted information entropy according to claim 4 is characterized in that the nonlinear classifier model is a deep learning model. 6. The fraudulent transaction identification system based on dynamic weighted information entropy according to claim 4, characterized in that the overlapping data subsets obtained by dividing using the one-class-SVM model _Mocsvm are used to train the nonlinear classifier model _Mclf , comprising: Use the first part of the overlapping data subsets to train the nonlinear classifier model _Mclf ; Use the second part of the overlapping data subset to verify the nonlinear classifier model _Mclf ; The training and validation steps are repeated until the accuracy of the nonlinear classifier model _Mclf meets the preset requirements. 7. A computer-readable storage medium having a computer program stored thereon, characterized in that the computer program is executed by a processor to implement the fraudulent transaction identification method based on dynamic weighted information entropy as described in any one of claims 1 to 3. 8. A fraudulent transaction identification device based on dynamic weighted information entropy, characterized by comprising: a processor and a memory; The memory is used to store computer programs; The processor is connected to the memory and is used to execute the computer program stored in the memory so that the fraudulent transaction identification device based on dynamic weighted information entropy executes the fraudulent transaction identification method based on dynamic weighted information entropy described in any one of claims 1 to 3.