Fraudulent transaction identification method and apparatus, server, and storage medium

Patent metadata

Field	Value
Publication number	US-11276068-B2
Application number	US-202117221482-A
Country	US
Kind code	B2
Filing date	Apr 2, 2021
Priority date	Mar 15, 2018
Publication date	Mar 15, 2022
Grant date	Mar 15, 2022

Abstract

Techniques for identifying fraudulent transactions are described. In one example method, an operation sequence and time difference information associated with a transaction are identified by a server. A probability that the transaction is a fraudulent transaction is predicted based on a result provided by a deep learning network, where the deep learning network is trained to predict fraudulent transactions based on operation sequences and time differences associated with a plurality of transaction samples, and where the deep learning network provides the result in response to input including the operation sequence and the time difference information associated with the transaction.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
obtaining a plurality of black samples and a plurality of white samples of transactions for training a deep learning network, wherein the deep learning network comprises a feature embedding subnetwork and a classifier subnetwork;
generating a combined operation feature value corresponding to each sample in the plurality of the black samples and the plurality of the white samples, comprising:
extracting an operation sequence of the sample and time difference information of adjacent operations in the sample, wherein the operation sequence comprises a plurality of operations at a plurality of time points, and wherein the time difference information comprises a time difference between the time points of each two adjacent operations included in a transaction;
obtaining an operation feature value of the sample at each time point of the operation sequence, wherein the operation feature value at each time point of the operation sequence is an output at each corresponding time point of the feature embedding subnetwork, wherein an input to the feature embedding subnetwork is the operation sequence of the sample;
obtaining a time difference feature value of the sample at each time point of the operation sequence, wherein the time difference feature value at each time point of the operation sequence is an output at each corresponding time point of the same feature embedding subnetwork, wherein an input to the feature embedding subnetwork is the time difference information of adjacent operations in the sample;
calculating a similarity between each pair of the operation feature value and the time difference feature value that corresponds to a specific time point;
calculating the combined operation feature value corresponding to the sample by combining more than one operation feature values based on the similarity;

predicting, by the classifier subnetwork and for each sample in the plurality of the black samples and the plurality of the white samples, a probability that the transaction associated with the sample is a fraudulent transaction based on the combined operation feature value of the sample; and
training the deep learning network based on the probabilities corresponding to the respective samples in the plurality of the black samples and the plurality of the white samples.

2. The computer-implemented method of claim 1 , wherein each black sample is associated with a fraudulent transaction and each white sample is associated with a non-fraudulent transaction.

3. The computer-implemented method of claim 1 , wherein obtaining the operation feature value and the time difference feature value comprises:
performing a feature conversion on the operation sequence and on the time difference information to obtain an initial operation feature value and an initial time feature value; and
separately performing a dimension reduction and an irrelevant feature removal on the initial operation feature value and the initial time feature value to select the operation feature value of the sample at each time point of the operation sequence and the time difference feature value of the sample at each time point of the operation sequence.

4. The computer-implemented method of claim 1 , wherein calculating the similarity between each pair of the operation feature value and the time difference feature value that corresponds to the specific time point comprises calculating an inner product of an operation feature matrix that includes a plurality of operation feature values and a time difference feature matrix that includes a plurality of the time difference feature values to obtain the similarity between each of the operation feature values and the time difference feature values.

5. The computer-implemented method of claim 1 , wherein the more than one operation feature values are combined by calculating a sum of corresponding similarities.

6. The computer-implemented method of claim 1 , wherein the deep learning network is trained based on at least one of a recurrent neural network (RNN) algorithm, a long short-term memory (LSTM) algorithm, a gated recurrent unit (GRU) algorithm, and a simple recurrent unit (SRU) algorithm.

7. The computer-implemented method of claim 1 , wherein the plurality of operations in the operation sequence are sorted chronologically.

8. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:
obtaining a plurality of black samples and a plurality of white samples of transactions for training a deep learning network, wherein the deep learning network comprises a feature embedding subnetwork and a classifier subnetwork;
generating a combined operation feature value corresponding to each sample in the plurality of the black samples and the plurality of the white samples, comprising:
extracting an operation sequence of the sample and time difference information of adjacent operations in the sample, wherein the operation sequence comprises a plurality of operations at a plurality of time points, and wherein the time difference information comprises a time difference between the time points of each two adjacent operations included in a transaction;
obtaining an operation feature value of the sample at each time point of the operation sequence, wherein the operation feature value at each time point of the operation sequence is an output at each corresponding time point of the feature embedding subnetwork, wherein an input to the feature embedding subnetwork is the operation sequence of the sample;
obtaining a time difference feature value of the sample at each time point of the operation sequence, wherein the time difference feature value at each time point of the operation sequence is an output at each corresponding time point of the same feature embedding subnetwork, wherein an input to the feature embedding subnetwork is the time difference information of adjacent operations in the sample;
calculating a similarity between each pair of the operation feature value and the time difference feature value that corresponds to a specific time point;
calculating the combined operation feature value corresponding to the sample by combining more than one operation feature values based on the similarity;

predicting, by the classifier subnetwork and for each sample in the plurality of the black samples and the plurality of the white samples, a probability that the transaction associated with the sample is a fraudulent transaction based on the combined operation feature value of the sample; and
training the deep learning network based on the probabilities corresponding to the respective samples in the plurality of the black samples and the plurality of the white samples.

9. The non-transitory, computer-readable medium of claim 8 , wherein each black sample is associated with a fraudulent transaction and each white sample is associated with a non-fraudulent transaction.

10. The non-transitory, computer-readable medium of claim 8 , wherein obtaining the operation feature value and the time difference feature value comprises:
performing a feature conversion on the operation sequence and on the time difference information to obtain an initial operation feature value and an initial time feature value; and
separately performing a dimension reduction and an irrelevant feature removal on the initial operation feature value and the initial time feature value to select the operation feature value of the sample at each time point of the operation sequence and the time difference feature value of the sample at each time point of the operation sequence.

11. The non-trans

Assignees

• Advanced New Technologies Co Ltd

Inventors

• Li Longfei

Classifications

• G06Q20/02 Primary

  involving a neutral party, e.g. certification authority, notary or trusted third party [TTP] · CPC title

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06F18/214

  Generating training patterns; Bootstrap methods, e.g. bagging or boosting · CPC title

• G06N3/0442

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title