CN-121981832-A - Multi-node abnormal transaction data collaborative analysis method combining federal learning

CN121981832ACN 121981832 ACN121981832 ACN 121981832ACN-121981832-A

Abstract

The invention provides a multi-node abnormal transaction data collaborative analysis method combining federal learning, which belongs to the technical field of federal learning and comprises the steps of deploying a federation chain of an improved PBFT consensus algorithm, deploying a federal learning platform, preprocessing transaction data by each node, extracting basic, behavior and risk characteristics, collaborative training an abnormal transaction recognition model, adopting dynamic threshold adjustment and multi-node cross-validation optimization judgment effects, and embedding an intelligent contract into a tracing module to track the flow direction of funds. According to the scheme, the situation that data cannot be locally output, the island of the data is broken, privacy protection and supervision compliance are considered, the abnormal transaction identification efficiency and accuracy are remarkably improved, and the scheme is suitable for scenes such as financial anti-fraud, fund safety prevention and control and the like.

Inventors

ZHAO XUEJUN
CHEN WEI
LU KEMING
Zhuang Pengjie
FU JINXING
WANG FANGYUAN
ZHANG YIWEN
LUO TONG
LIU WENBIN

Assignees

上海市刑事科学技术研究院
恒安嘉新（北京）科技股份公司

Dates

Publication Date: 20260505
Application Date: 20260407

Claims (8)

1. A multi-node abnormal transaction data collaborative analysis method combined with federal learning is characterized by comprising the following steps: Step 1, determining participating nodes by an initiator and completing identity authentication and authorization, constructing a alliance chain bottom architecture based on an improved PBFT consensus algorithm, configuring encryption certificates of trusted communication among nodes and defining intelligent contracts defining clear node entitlement obligations, data access rights and flow rules; Step 2, deploying a federation learning platform comprising a local training module, a parameter uploading module, a parameter aggregation module, a model issuing module and a model evaluating module on the basis of the federation chain, configuring an initial model and training super parameters by each node, designating an aggregation node and configuring a parameter transmission encryption mode; Step 3, each participating node performs cleaning, standardization and formatting pretreatment on the local transaction data, extracts basic characteristics, behavior characteristics and risk characteristics, and generates a local characteristic vector with unified dimension through a characteristic fusion algorithm; Step 4, each participating node trains a local model based on the local feature vector, and uploads the encrypted model parameters to the aggregation node, at the moment, the aggregation node analyzes the received model parameters to generate global model parameters and transmits the global model parameters to each participating node, each participating node updates the local model and then trains again, and the process is iterated until the model evaluation index reaches the standard; Step 5, each participating node utilizes the trained local model to carry out abnormality detection on real-time transaction data and output abnormality probability, adopts a dynamic threshold adjustment mechanism to determine an abnormality judgment threshold, uploads suspected abnormal transaction data to a coalition chain to trigger multi-node cross verification, and confirms abnormality or starts manual review according to a verification result; And 6, each participating node processes the confirmed abnormal transaction according to the rule of the intelligent contract, uploads related transaction data, an identification process and a processing result to a alliance chain for certification, collects information by a designated anti-fraud center node, generates an analysis report, reports to a supervision department, and updates blacklist data stored in the alliance chain, wherein an abnormal transaction tracing module is embedded in the intelligent contract and is used for automatically associating upstream and downstream nodes and fund flows of the abnormal transaction to generate a complete transaction tracing link.
2. The multi-node abnormal transaction data collaborative analysis method combining federal learning according to claim 1, wherein constructing a federation chain infrastructure based on an improved PBFT consensus algorithm comprises: Acquiring identity authentication information and authorization information of each participating node, and inputting the identity authentication information and the authorization information into an information analysis model to obtain a participating vector of the corresponding participating node; Acquiring a transmission network architecture of each participating node, analyzing a transmission attribute set of each transmission link in the transmission network architecture and a dynamic precaution feature spectrum based on each transaction data, and deeply mining each participating element in a participating vector of the participating node to construct a topology path of the corresponding participating element; Extracting a known mapping relation from any two topological paths under the participation vector, and constructing a multidimensional mapping type-confidence vector of the participation vector according to the known mapping relation; According to the multi-dimensional mapping type-confidence vector of the participation vector, and in combination with a consensus triggering threshold dynamically adjusted based on the improved PBFT consensus algorithm, determining the construction level of the corresponding participation node and a recommended radiation node set in the construction process, so as to obtain a local construction framework; Building a alliance chain infrastructure according to the local building architecture of each participating node and combining the direct interaction relation between the initiator and each participating node.
3. The multi-node abnormal transaction data collaborative analysis method according to claim 2, wherein constructing a topology path of a corresponding participating element comprises: Capturing data fluctuation information corresponding to each transaction type carried by each transmission link in the transmission network architecture, inputting single data fluctuation information on a single transmission link into an information fluctuation analysis model, outputting Gao Weishan fluctuation expression vectors, and obtaining single prevention feature vectors corresponding to the single data fluctuation information according to an implicit relation network of all transaction types involved in the same transmission, wherein the data fluctuation information at least comprises an instantaneous throughput time sequence change rate corresponding to the single transaction data, an entropy sequence of a message interval and a dynamic offset of a protocol load feature; Placing all single precaution feature vectors under the same transaction category according to a time sequence to obtain a time sequence feature matrix; Decomposing the time sequence feature matrix into a trend component, a period component and a residual component; Identifying a first time point set with abrupt change of the statistical characteristics of the residual components, calculating a first significant coefficient of each first time point, and simultaneously, identifying a second time point set with abrupt change in the periodic components, and calculating a second significant coefficient of each second time point; The extracted trend component, the first significant coefficient of each first moment point and the second significant coefficient of each second moment point are coded together into dynamic precaution feature spectrums of corresponding transaction types; And determining the association degree of dynamic precaution feature spectrums of any two transaction types under the same participation node according to the risk comparison relation between each participation element and each transaction type, and constructing a topology path corresponding to the participation element.
4. The multi-node abnormal transaction data collaborative analysis method combining federal learning according to claim 2, wherein obtaining a local building architecture comprises: Dynamically computing each participating node Is a consensus trigger threshold of (2) Construction level : , wherein, A basic threshold value preset based on a modified PBFT consensus algorithm; For participating nodes Is a multi-dimensional mapping type-confidence vector Is an information entropy of (a); the number of the effective nodes which are newly added or withdrawn in the corresponding transmission network architecture in the past preset time window is calculated; the number of total valid nodes in the corresponding transport network architecture; 、 Is a preset adjustment coefficient; , For participating nodes Mapping confidence in the kth preset service dimension, wherein m is the total number of dimensions; ; , wherein, The weight of the kth preset service dimension; is a downward rounding function; construction of participating nodes Candidate neighbor node set of (a) Involving and participating nodes Confidence levels are higher than a preset lower threshold on at least one mapping type Is a node of (a); From a set of candidate neighbor nodes The selected nodes form a radiation node set Maximizing the objective function: ; The constraint conditions are as follows: ; For radiating node sets The number of nodes in (a); Wherein: Representing inter-node Cosine similarity of confidence vector; Representing candidate nodes With the current radiation set The intermediate node has an overlap of the connections already present, Is a candidate node Is a current neighbor set of (a); 、 Presetting punishment and adjustment coefficients for presetting; connectable cardinality for each level preset; The method comprises the steps of (1) setting a preset maximum recommended connection number; Is that The number of intersection nodes in (a); according to the construction level of all nodes and recommended radiation node set Generating an initial building framework, and calculating the structural entropy of the initial building framework : ; Wherein, the Is a connected sub-graph set formed by directly connecting nodes; The number of nodes in the connected subgraph c 0; the maximum value of the shortest path between all node pairs in the initial building framework is obtained; is a preset normalization coefficient; To minimize the structural entropy of the initially built architecture For the purpose of iterative adjustment 、、 Up to Converging to a preset stable interval, and outputting a local building framework.
5. The multi-node abnormal transaction data collaborative analysis method combining federal learning according to claim 1, wherein the initial model is an improved XGBoost classification model incorporating attention mechanisms for enhanced risk feature weight distribution; The feature fusion algorithm combines the attention mechanism and the feature cross coding to eliminate feature dimension differences among different nodes and reserve the feature risk features of each node.
6. The multi-node abnormal transaction data collaborative analysis method according to claim 1, wherein the dynamic threshold adjustment mechanism calibrates the abnormal decision threshold in real time based on historical detection accuracy of participating nodes and current transaction scenario complexity.
7. The multi-node abnormal transaction data collaborative analysis method according to claim 1, wherein the aggregate node analyzes the received model parameters to generate global model parameters and issues the global model parameters to each participating node, comprising: after receiving the local model parameter updating quantity uploaded by each participating node, the aggregation node maps all the parameter updating quantities to a unified federal parameter cooperation space; Performing dimension reduction and structured coding on each parameter updating quantity to obtain a characteristic representation vector, wherein the coding process fuses the direction characteristic, the amplitude distribution characteristic and the path curvature characteristic of the corresponding parameter updating quantity compared with the previous round; carrying out self-adaptive clustering on all the characteristic expression vectors, identifying node groups forming a cluster structure in the federal parameter cooperation space, and distributing group consensus direction vectors for each node group; Based on the relation between the characteristic expression vector and the consensus direction vector of each node group, determining the affinity of each participating node relative to each group, and constructing a cooperative relation tensor of multidimensional association between the participating nodes and the groups; Solving a multi-objective optimization problem to obtain a collaborative aggregation scheme and generating a global model parameter update quantity, wherein the collaborative aggregation scheme corresponds to a parameter weighted combination and a multi-objective performance vector; And packaging the collaboration aggregation scheme, the multi-target performance vector, the global model parameter updating quantity and the role positioning information of each participating node in the round of collaboration relation tensor together into collaboration evidence, issuing each participating node and synchronizing the collaboration evidence to a alliance chain.
8. The multi-node abnormal transaction data collaborative analysis method according to claim 7, wherein the multi-objective optimization problem is related to maximizing expected performance improvement of an aggregated global model on a common validation set, maximizing population diversity entropy of aggregated parameters, and maximizing orthogonal components of subspaces formed by aggregated update directions and historical global update directions.

Description

Multi-node abnormal transaction data collaborative analysis method combining federal learning Technical Field The invention relates to the technical field of federal learning, in particular to a multi-node abnormal transaction data collaborative analysis method combining federal learning. Background Currently, telephone fraud and associated abnormal transaction cases are frequent, and have become a prominent problem in jeopardizing social security and public property security. According to the statistics of related data, the annual average case quantity of national telecommunication phishing cases exceeds millions, and the property loss caused by the annual average case quantity exceeds trillion yuan, wherein abnormal transactions are core links of funds transfer and hidden tracks of fraud molecules, so that the accurate identification and interception of abnormal transaction data become key grippers for telephone fraud management. In the existing telephone fraud treatment, the analysis of abnormal transaction data mainly depends on the traditional manual processing mode and the independent data analysis mode of a single mechanism. The method comprises the steps of arranging professional personnel to manually screen transaction data in a financial institution, a payment platform and other transaction data holding parties respectively, screening according to a risk transaction characteristic list (such as a single transaction amount exceeding 5 ten thousand yuan, a single day accumulated transaction exceeding 20 ten thousand yuan, a transaction counter party being a blacklist account and the like) issued by a supervision department, judging whether the transaction is abnormal or not by combining with manual experience, further checking transaction background, user identity information and the like by manual work for the transaction which is initially judged to be abnormal, taking measures such as freezing account, intercepting the transaction and the like after fraud risk is confirmed, and reporting relevant information to the supervision department such as an anti-fraud center and the like. In addition, a part of institutions introduce a simple machine learning model to carry out auxiliary analysis, but the method is still limited to the data in the institutions, the model training data volume is limited, and the sharing and intercommunication of transaction data can not be realized due to the data privacy protection requirements among the institutions, so that the analysis dimension is single. In order to solve the problems of low manual processing efficiency, insufficient analysis accuracy caused by data island and the like in the prior art, the invention provides a multi-node abnormal transaction data collaborative analysis method combining federal learning. Disclosure of Invention The invention provides a multi-node abnormal transaction data collaborative analysis method combining federation learning, which is used for constructing a federation chain architecture, integrating multiple subjects such as financial institutions, payment platforms, anti-fraud centers and the like into federation chain nodes to realize trusted communication and data authority management and control among the nodes, introducing the federation learning framework, enabling the nodes to cooperatively train an abnormal transaction identification model on the premise of not revealing original transaction data based on the trusted environment of the federation chain, improving the accuracy and efficiency of abnormal transaction identification through collaborative mining of multi-node data characteristics, and ensuring traceability and supervision of transaction analysis processes and results by means of the non-tamperable characteristic of the federation chain to finally form a set of efficient, accurate and safe multi-node abnormal transaction data collaborative analysis system. The invention provides a multi-node abnormal transaction data collaborative analysis method combining federal learning, which comprises the following steps: Step 1, determining participating nodes by an initiator and completing identity authentication and authorization, constructing a alliance chain bottom architecture based on an improved PBFT consensus algorithm, configuring encryption certificates of trusted communication among nodes and defining intelligent contracts defining clear node entitlement obligations, data access rights and flow rules; Step 2, deploying a federation learning platform comprising a local training module, a parameter uploading module, a parameter aggregation module, a model issuing module and a model evaluating module on the basis of the federation chain, configuring an initial model and training super parameters by each node, designating an aggregation node and configuring a parameter transmission encryption mode; Step 3, each participating node performs cleaning, standardization and formatting pretreatment on the local transac