Fraudulent transaction identification method and apparatus, server, and storage medium

Patent metadata

Field	Value
Publication number	US-10970719-B2
Application number	US-201916355439-A
Country	US
Kind code	B2
Filing date	Mar 15, 2019
Priority date	Mar 15, 2018
Publication date	Apr 6, 2021
Grant date	Apr 6, 2021

Abstract

Techniques for identifying fraudulent transactions are described. In one example method, an operation sequence and time difference information associated with a transaction are identified by a server. A probability that the transaction is a fraudulent transaction is predicted based on a result provided by a deep learning network, where the deep learning network is trained to predict fraudulent transactions based on operation sequences and time differences associated with a plurality of transaction samples, and where the deep learning network provides the result in response to input including the operation sequence and the time difference information associated with the transaction.

First claim

What is claimed is:

1. A computer-implemented method for identifying fraudulent transactions, comprising:
identifying, by a server, an operation sequence and time difference information associated with a transaction, wherein the operation sequence comprises a plurality of operations at a plurality of time points, and wherein the time difference information comprises a time difference between the time points of each two adjacent operations included in the transaction; and
predicting, by the server, a probability that the transaction is a fraudulent transaction based on a result provided by a deep learning network, wherein the deep learning network comprises a feature embedding subnetwork and a classifier subnetwork, comprising:
obtaining an operation embedding representation of each time point of the operation sequence, wherein the operation embedding representation of each time point of the operation sequence is an output at each corresponding time point of the feature embedding subnetwork, wherein an input to the feature embedding subnetwork is the operation sequence associated with the transaction;
obtaining a time difference embedding representation of each corresponding time point of the operation sequence, wherein the time difference embedding representation of each corresponding time point of the operation sequence is an output at each corresponding time point of the same feature embedding subnetwork, wherein an input to the feature embedding subnetwork is the time difference information associated with the transaction;
obtaining a combined embedding representation of the transaction by combining the operation embedding representation of each time point of the operation sequence and the time difference embedding representation of each corresponding time point of the operation sequence, comprising:
calculating a similarity between each pair of the operation embedding representation and the time difference embedding representation that corresponds to a specific time point; and
combining more than one operation features based on the calculated similarity to obtain the combined embedding representation of the transaction; and

predicting, by the classifier subnetwork, the probability that the transaction is a fraudulent transaction based on the combined embedding representation of the transaction.

2. The computer-implemented method of claim 1 , wherein training the deep learning network comprises:
obtaining a black sample associated with a fraudulent transaction and a white sample associated with a non-fraudulent transaction;
separately extracting, from the black sample and from the white sample, an operation sequence and time difference information;
obtaining an operation embedding representation and a time difference embedding representation of the black sample and the white sample, comprising performing a feature conversion and a selection on each of the operation sequences and on each of the time difference information that are extracted from the black sample and the white sample to obtain a plurality of operation features and a plurality of time difference features;
obtaining a combined embedding representation of the transaction, comprising:
calculating a similarity between each pair of the operation feature and the time difference feature that corresponds to a specific time point;
combining more than one operation features based on the calculated similarity to obtain a combined operation feature; and

training the deep learning network through classification based on the combined operation feature.

3. The computer-implemented method of claim 2 , wherein performing the feature conversion and the selection on each of the operation sequences and each of the time difference information comprises:
performing the feature conversion on each of the operation sequences and each of the time difference information to obtain an initial operation feature and an initial time feature; and
separately performing a dimension reduction and an irrelevant feature removal on the initial operation feature and the initial time feature to select the plurality of operation features and the plurality of time difference features.

4. The computer-implemented method of claim 2 , wherein calculating a similarity between each pair of the operation feature and the time difference feature that corresponds to a specific time point comprises calculating an inner product of an operation feature matrix that includes the plurality of operation features and a time difference feature matrix that includes the plurality of time difference features to obtain a similarity between each of the operation features and the time difference features.

5. The computer-implemented method of claim 2 , wherein the plurality of operation features are combined by calculating a sum of corresponding similarities.

6. The computer-implemented method of claim 2 , wherein the deep learning network is trained based on at least one of a recurrent neural network (RNN) algorithm, a long short-term memory (LSTM) algorithm, a gated recurrent unit (GRU) algorithm, and a simple recurrent unit (SRU) algorithm.

7. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations to identify fraudulent transactions, the operations comprising:
identifying, by a server, an operation sequence and time difference information associated with a transaction, wherein the operation sequence comprises a plurality of operations at a plurality of time points, and wherein the time difference information comprises a time difference between the time points of each two adjacent operations included in the transaction; and
predicting, by the server, a probability that the transaction is a fraudulent transaction based on a result provided by a deep learning network, wherein the deep learning network comprises a feature embedding subnetwork and a classifier subnetwork, comprising:
obtaining an operation embedding representation of each time point of the operation sequence, wherein the operation embedding representation of each time point of the operation sequence is an output at each corresponding time point of the feature embedding subnetwork, wherein an input to the feature embedding subnetwork is the operation sequence associated with the transaction;
obtaining a time difference embedding representation of each corresponding time point of the operation sequence, wherein the time difference embedding representation of each corresponding time point of the operation sequence is an output at each corresponding time point of the same feature embedding subnetwork, wherein an input to the feature embedding subnetwork is the time difference information associated with the transaction;
obtaining a combined embedding representation of the transaction by combining the operation embedding representation of each time point of the operation sequence and the time difference embedding representation of each corresponding time point of the operation sequence, comprising:
calculating a similarity between each pair of the operation embedding representation and the time difference embedding representation that corresponds to a specific time point; and
combining more than one operation features based on the calculated similarity to obtain the combined embedding representation of the transaction; and

predicting, by the classifier subnetwork, the probability that the transaction is a fraudulent transaction based on the combined embedding representation of the transaction.

8. The non-transitory, computer-readable medium of claim 7 , wherein training the deep learning network comprises:
obtaining a black sample associated with a fraudulent transaction and a white sample associat

Assignees

• Advanced New Technologies Co Ltd

Inventors

• Li Longfei

Classifications

• G06Q20/02 Primary

  involving a neutral party, e.g. certification authority, notary or trusted third party [TTP] · CPC title

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06F18/214

  Generating training patterns; Bootstrap methods, e.g. bagging or boosting · CPC title

• G06N3/0442

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title