Bank financial transaction real-time risk assessment method based on machine learning

Abstract

The invention provides a bank financial transaction real-time risk assessment method based on machine learning, and relates to the technical field of risk control, which can effectively identify fast-in and fast-out fund abnormal flow by analyzing a time interval coefficient and fund retention duration between payment path nodes, and can effectively identify the fund abnormal flow by calculating a fund circulation path and account activation degree. The method can accurately identify the fund exchange relation among multiple accounts, and discovers the sleeve behavior of fund dispersed transfer. Therefore, in a bank cross-border transaction scene, the transaction fraud that the transaction time-space characteristics and the transaction opponent behavior characteristics cannot be associated and analyzed in real time, so that fund fast-in and fast-out by using multiple cross-border accounts is difficult to identify in time can be reduced.

Description

Technical Field

[0001] The present invention relates to the field of risk control technology, and more specifically, to a real-time risk assessment method for banking financial transactions based on machine learning. Background Art

[0002] With the acceleration of global economic integration and the booming cross-border payment business, the scale and frequency of cross-border financial transactions have shown a significant growth trend. Traditional cross-border transaction risk assessment methods rely primarily on rule engines and expert experience, screening transactions by setting static risk rules and thresholds. With the development of computer technology and artificial intelligence, risk assessment methods based on machine learning have gradually become a research hotspot. These methods can adaptively learn transaction patterns and risk characteristics by analyzing massive amounts of historical transaction data, and quickly make risk assessments when new transactions occur. In particular, algorithmic innovations in areas such as complex network analysis and anomaly detection have provided new technical means and solutions for cross-border transaction risk assessment.

[0003] However, existing machine learning-based risk assessment methods still face several technical difficulties and limitations. First, most methods focus solely on the characteristics of individual transactions, ignoring the underlying capital flow paths and account relationships, making it difficult to detect abnormal behavior hidden through multi-layered nested transfers. Second, existing methods often employ fixed feature engineering strategies, which are unable to effectively capture dynamically changing fraudulent methods and transaction patterns. Third, traditional risk assessment models have high computational complexity, making it difficult to meet the real-time response requirements of large-scale cross-border transaction scenarios. Furthermore, when processing the characteristics of account behavior sequences, existing methods fail to adequately characterize temporal dependencies and long-term evolution patterns, affecting the accuracy and interpretability of risk assessments. Summary of the Invention

[0004] To address the aforementioned technical issues, the present invention provides a real-time risk assessment method for bank financial transactions based on machine learning. This method can, to a certain extent, address the difficulty in identifying fraudulent transactions involving the rapid inflow and outflow of funds using multiple cross-border accounts, often due to the inability to correlate and analyze transaction temporal and spatial characteristics with counterparty behavioral characteristics in cross-border banking transactions.

[0005] According to one aspect of the present invention, a real-time risk assessment method for banking financial transactions based on machine learning is provided, which includes:

[0006] Obtaining transaction information of the cross-border transaction to be evaluated, and extracting transaction characteristic parameters based on the transaction information;

[0007] Inputting the transaction feature parameters into a pre-trained cross-border path link analysis model to obtain a path anomaly score;

[0008] Building a collection and payment account association network based on the transaction characteristic parameters, analyzing the capital inflow and outflow ratio, the number of capital circulation paths, and the account activation degree in the collection and payment account association network to generate an account behavior feature vector;

[0009] The path anomaly score and the account behavior feature vector are input into a pre-trained fraud identification model to output a fraud risk level for the cross-border transaction.

[0010] Furthermore, the transaction characteristic parameters include dollar amount, transaction processing time, geographic coordinate sequence, payer account characteristic vector, and payee account characteristic vector.

[0011] Furthermore, the cross-border path link analysis model performs path link analysis using the transaction feature parameters, including:

[0012] Calculate the time interval coefficient between any two adjacent nodes;

[0013] Based on the time interval coefficient, it is determined whether the retention time of funds in each intermediate clearing bank is abnormal. If abnormal, the node is marked as an abnormal retention node;

[0014] Calculating a path link integrity score based on the number of the stranded abnormal nodes and the distribution positions of the stranded abnormal nodes in the path;

[0015] The transaction processing time and the path link integrity score are weighted and summed to generate a path anomaly score.

[0016] Furthermore, calculating the path link integrity score includes:

[0017] Obtaining the location index value of the abnormal node;

[0018] Calculating the node position weight based on the position index value, and summing up the position weights of the retention abnormal nodes to obtain a retention abnormality weighted score;

[0019] Calculate the ratio of the number of the abnormal nodes to the total number of nodes to obtain the abnormal retention ratio;

[0020] The path link integrity score is obtained by multiplying the retention anomaly weighted score by the square of the retention anomaly ratio.

[0021] Furthermore, the number of capital circulation paths includes:

[0022] Exploring circular paths in the association network based on depth-first search;

[0023] The geometric mean of the path edge weights is calculated as the strength score;

[0024] The intensity scores are fitted by Gaussian kernel density and the paths are divided into high and low intensity paths. Finally, the high-intensity circular path is selected as the valid path, and the number of valid paths is recorded as the number of capital circulation paths.

[0025] Furthermore, dividing the high-intensity and low-intensity paths includes:

[0026] The grid points whose absolute values of the first-order derivatives are less than the set accuracy are selected as candidate stationary points, and their types are determined by the second-order derivatives. The local extreme points are confirmed according to the change in the sign of the first-order derivatives. Finally, the local minimum points between the two local maximum points with the largest density are selected as inflection points to divide the high-intensity and low-intensity categories.

[0027] Furthermore, the account activation degree is obtained by calculating the deviation between the current account activity benchmark value and the historical mean and fluctuation degree, and compressing it through an activation function to obtain an activation indicator of the degree of account behavior mutation.

[0028] Furthermore, the fraud identification model uses a multi-layer decision tree structure to extract the complex correlation between features layer by layer;

[0029] Each layer of the decision tree in the model divides the samples based on different feature combinations. When the feature value meets the splitting condition of a decision tree node, the sample is classified into the corresponding child node; the prediction results of all decision trees are weighted averaged to obtain the final fraud risk probability score.

[0030] Furthermore, the multi-layer decision tree structure captures the feature combination relationship through residual optimization, generates the final fraud risk probability score, and tracks the key feature combination for high-risk prediction through splitting paths.

[0031] Furthermore, the multi-layer decision tree structure also includes a fast channel mechanism;

[0032] When the fast-track mechanism detects that the value of a single feature or a combination of features at each level of the decision tree has clearly exceeded the preset risk threshold, there is no need to continue traversing subsequent decision branches. The sample is directly determined to the corresponding risk level through the fast track and a warning result is output.

[0033] Compared to existing technologies, the machine learning-based real-time risk assessment method for bank financial transactions provided by this invention effectively identifies abnormal, rapid inflow and outflow flows of funds by analyzing the time interval coefficient between payment path nodes and the duration of fund retention. By calculating fund circulation paths and account activation levels, it accurately identifies fund flows between multiple accounts and identifies cash-out behaviors involving dispersed fund transfers. This reduces the difficulty in identifying fraudulent transactions involving rapid inflows and outflows of funds using multiple cross-border accounts, often due to the inability to correlate and analyze transaction temporal and spatial characteristics with counterparty behavior in real time in cross-border bank transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0035] Figure 1 Flowchart of a real-time risk assessment method for banking financial transactions based on machine learning according to an embodiment of the present invention.

[0036] Figure 2 The present invention provides a flowchart for obtaining a fraud risk probability score in a real-time risk assessment method for banking financial transactions based on machine learning according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] Below, the exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments of the present invention, and it should be understood that the present invention is not limited to the exemplary embodiments described herein.

[0038] Figure 1 FIG1 is a flow chart of a real-time risk assessment method for banking financial transactions based on machine learning according to an embodiment of the present invention. Figure 1 As shown, the real-time risk assessment method for banking financial transactions based on machine learning includes:

[0039] S1: Obtain transaction information of the cross-border transaction to be evaluated, including transaction amount, transaction time, cross-border payment path nodes, and payee and payee account information, and extract transaction feature parameters based on the transaction information;

[0040] Obtain transaction information of the cross-border transaction to be evaluated, the transaction information including the transaction amount, the payment currency type of the transaction amount, the transaction initiation time, the transaction completion time, the geographical location of the counterparty bank initiating the transaction, the intermediate clearing bank node information of the cross-border flow of funds, the geographical location of the intermediate clearing bank, the payer's bank account number, the payer's bank account opening time, the total number of historical transactions of the payer, the payee's account reserved mobile phone number, the payee's bank account number, the payee's account opening bank name, the payee's account opening time, and the total number of historical transactions of the payee; extract transaction feature parameters from the transaction information, specifically including: based on the transaction amount and the payment currency type, converting the transaction amount into a US dollar amount; based on the transaction initiation time and the The transaction completion time is used to calculate the transaction processing time; based on the geographical location of the counterparty bank that initiated the transaction and the geographical location of the intermediate clearing bank, a geographical coordinate sequence of the cross-border payment path is determined; based on the payer's bank account number, the opening time of the payer's bank account, the total number of historical transactions of the payer, and the reserved mobile phone number of the payer's account, a payer account feature vector is generated; based on the payee's bank account number, the name of the payee's account opening bank, the opening time of the payee's account, and the total number of historical transactions of the payee, a payee account feature vector is generated; the US dollar amount, the transaction processing time, the geographical coordinate sequence, the payer's account feature vector, and the payee's account feature vector are combined into transaction feature parameters.

[0041] S2: Inputting the transaction characteristic parameters into a pre-trained cross-border path link analysis model, the cross-border path link analysis model calculates the time interval coefficient between payment path nodes and the funds retention time to obtain a path anomaly score;

[0042] The transaction characteristic parameters are input into a pre-trained cross-border path link analysis model, and the cross-border path link analysis model performs path link analysis based on the transaction characteristic parameters, specifically including:

[0043] The method comprises the following steps: obtaining the actual processing time of the intermediate clearing banks corresponding to adjacent nodes in the geographic coordinate sequence, calculating the time interval coefficient between any two adjacent nodes, wherein the time interval coefficient is the ratio of the actual processing time to the historical average processing time of the clearing path; judging whether the retention time of funds at each intermediate clearing bank is abnormal based on the time interval coefficient, specifically by comparing the time interval coefficient with a preset time anomaly threshold; marking the node as an abnormal retention node if the time interval coefficient is greater than the time anomaly threshold; counting the number of abnormal retention nodes in the geographic coordinate sequence, and calculating a path link integrity score based on the number of abnormal retention nodes and the distribution positions of the abnormal retention nodes in the path; performing a weighted summation of the transaction processing time and the path link integrity score to generate a path anomaly score, wherein the path anomaly score is used to characterize the degree of time anomaly in the process of cross-border funds flow, wherein a larger path anomaly score indicates a more abnormal time characteristic of the cross-border funds flow.

[0044] Among them, the time anomaly threshold is calculated based on historical transaction data, specifically including: obtaining the processing time records of historical transactions on the clearing path, calculating the time interval coefficient between adjacent nodes for each historical transaction; performing statistical analysis on the time interval coefficient to calculate its mean and standard deviation; when the distribution of historical transaction data approximately obeys a normal distribution, the mean plus three times the standard deviation is used as the time anomaly threshold, which can cover approximately 99.7% of normal transaction samples; when the distribution of historical transaction data shows obvious skewness, the quantile statistical method is used, and the 95th percentile is used as the time anomaly threshold; if the clearing path is a newly established path, an analogy calculation is performed based on the historical data of similar paths, where similar paths refer to payment paths with similar geographical locations and the same clearing bank level; at the same time, the time anomaly threshold should be dynamically adjusted according to factors such as different time periods (such as working days and holidays), different business types, and different currencies to improve the accuracy of anomaly judgment.

[0045] Calculating a path link integrity score based on the number of the abnormal nodes and the distribution positions of the abnormal nodes in the path, specifically including:

[0046] The geographic coordinate sequence is traversed in the order of capital flow. When an abnormal node is detected, the position index value of the node is obtained, and the position index value represents the relative position of the node in the geographic coordinate sequence. The node position weight is calculated based on the position index value, and the closer the position index value is to the starting point or the end point of the geographic coordinate sequence, the greater the node position weight is. The sum of the position weights of the abnormal nodes is counted to obtain a weighted score of abnormal retention. The total number of nodes in the geographic coordinate sequence is obtained, and the proportion of the number of abnormal nodes in the total number of nodes is calculated to obtain the abnormal retention ratio. The abnormal retention weighted score is multiplied by the square of the abnormal retention ratio to obtain a path link integrity score. When the path link integrity score is larger, it indicates that the capital retention behavior in the cross-border payment path is more abnormal, and the abnormal node distribution is more concentrated in the key payment link.

[0047] The total number of nodes in the geographic coordinate sequence is obtained, and the position index value is divided by the total number of nodes to obtain a normalized value of the node position; a bimodal Gaussian distribution function is constructed based on the normalized value, and the two peaks of the bimodal Gaussian distribution function are located at 0.15 and 0.85 respectively, and the standard deviation of the bimodal Gaussian distribution function is set to 0.1; the normalized value is substituted into the bimodal Gaussian distribution function to obtain the position weight score of the node; the position weight score is normalized so that the sum of the position weights of all nodes is 1, and the final node position weight is obtained; the node position weight is used to perform weighted calculation on the abnormally detained nodes, and the bimodal Gaussian distribution function naturally reflects the focus on the abnormal detention behavior near the starting point and end point of the cross-border payment path, and the weight distribution is smoother and more reasonable.

[0048] More specifically, the calculation of the path link integrity score can be expressed as follows:

[0049]

[0050] Among them, the node position weight can be expressed as follows:

[0051]

[0052] Among them, S is the path link integrity score, w i is the position weight of the i-th retained abnormal node, p i is the normalized value of the position index of the i-th abnormal node (position index / total number of nodes), n is the number of abnormal nodes, N is the total number of nodes, n a is the number of retained abnormal nodes.

[0053] It's worth noting that while the above description outlines the general process for calculating node position weights based on position index values, the specific implementation details can be more clearly understood through the following example: Assume that the path of a cross-border payment transaction contains 10 nodes. The node at position 2 has a position index of 2, and a normalized value of 0.2. Substituting 0.2 into the bimodal Gaussian distribution function yields a higher position weight, such as 0.35, due to its proximity to the first peak, 0.15. On the other hand, the node at position 5 has a normalized value of 0.5, which is far from both peaks. Substituting this into the function might yield a weight of only 0.1. The node at position 8 has a normalized value of 0.8, which is close to the second peak, 0.85, and similarly results in a higher weight, such as 0.35. Finally, the weights of all nodes are normalized to ensure that their sum is 1. This weight calculation method, based on a bimodal Gaussian distribution, naturally prioritizes abnormal behavior at the beginning and end of the payment path, avoiding the potential for sudden changes caused by artificially setting fixed thresholds. For example, in practice, if a node with an abnormal retention rate is located near the starting point (such as the second node), its higher position weight will result in a larger weighted retention rate score, making it more likely to trigger a risk control alert.

[0054] S3: Constructing a payment account association network based on the transaction characteristic parameters, analyzing the capital inflow and outflow ratio, the number of capital circulation paths, and the account activation degree in the payment account association network using a dynamic weight calculation method, and generating an account behavior feature vector;

[0055] A collection and payment account association network is constructed based on the transaction characteristic parameters, and the characteristics of the network are analyzed using a dynamic weight calculation method, specifically including:

[0056] The payment and receipt accounts are used as network nodes, and the fund transactions between accounts are used as network edges, where the weight of the network edges is the corresponding transaction amount; for each account node, the ratio of the total fund inflow to the total fund outflow within a certain time window is calculated to obtain the fund flow ratio. When the fund flow ratio significantly deviates from 1, it indicates that the account may have fund aggregation or dispersion behavior; the association network is searched for existing circular paths, and the number of circular paths starting from each account is counted. The circular path indicates that the funds return to the starting account after passing through multiple intermediate accounts; the product of the transaction frequency and transaction size of each account during the observation period is calculated, and compared with the historical activity level of the account to obtain the account activation index, which reflects the degree of mutation of the account behavior pattern; the fund flow ratio, the number of circular paths, and the account activation are normalized and spliced to generate a vector describing the account behavior characteristics. The vector can be used for subsequent abnormal behavior identification and analysis.

[0057] Searching for an existing circular path in the association network specifically includes: selecting each account node in the association network as a starting node, and using a depth-first search algorithm to start exploring from the node; maintaining an access record list for storing account nodes that have been visited on the current search path; obtaining target nodes corresponding to all outgoing edges of the current access node, and when the target node is in the access record list, it indicates that a circular path has been found, and recording the node sequence and corresponding edge weight of the circular path; when the target node is not in the access record list, adding the target node to the access record list, and continuing the search with the node as the new current node; when the search depth reaches a preset maximum depth threshold, backtracking to The previous node continues to search for other unvisited outgoing edges. When all possible paths of an account node have been searched, the number of all circular paths starting from the node is counted, and the strength score of each circular path is calculated. The strength score of the circular path is the geometric mean of the weights of all edges on the path. When there is a weight on the path that is significantly lower than that of other edges, the strength score of the path will be significantly reduced. The strength scores of all circular paths of each starting node are normalized, and the Gaussian kernel density estimation method is used to fit the distribution curve of the strength score. The circular paths are divided into high-intensity and low-intensity categories based on the inflection point of the distribution curve. The circular paths in the high-intensity category are selected as the final valid circular paths.

[0058] The Gaussian kernel density estimation method is used to fit the distribution curve of the intensity score, specifically including: obtaining all intensity score sample points of the circular path, sorting the sample points and removing duplicate values; calculating the bandwidth parameter of the kernel density estimation based on the Silverman criterion, wherein the bandwidth parameter is equal to the sample standard deviation multiplied by a coefficient related to the sample size, which is the negative quarter power of the sample size; uniformly selecting a series of grid points within the value range of the intensity score, and for each grid point, calculating its distance from all sample points; substituting the distance into the Gaussian kernel function to obtain the contribution value of each sample point to the grid point, wherein the Gaussian kernel function is the probability density function of the standard normal distribution divided by the bandwidth parameter ; Sum the contribution values of all sample points to the grid point and divide it by the product of the total number of samples and the bandwidth parameter to obtain the kernel density estimate at the grid point; repeat the above calculation process for all grid points to obtain a complete kernel density estimation curve; calculate the first-order derivative of the kernel density estimation curve, when the first-order derivative changes from positive to negative, the corresponding grid point is the local maximum point of the density curve, and when the first-order derivative changes from negative to positive, the corresponding grid point is the local minimum point of the density curve; select the local minimum point between the two local maximum points with the largest density as the inflection point, and classify the circular path with an intensity score greater than the inflection point into a high-intensity category, and classify the circular path with an intensity score less than the inflection point into a low-intensity category.

[0059] Calculating the first-order derivative of the kernel density estimation curve specifically includes: calculating the kernel density estimation value of the adjacent grid points on the left and right sides of each grid point, and the spacing between the adjacent grid points and the current grid point is equal; using the central difference method to calculate the approximate first-order derivative at the current grid point, and the first-order derivative is equal to the kernel density estimation value of the right grid point minus the kernel density estimation value of the left grid point, and then divided by twice the grid spacing; when the absolute value of the first-order derivative is less than the preset numerical accuracy, the grid point is recorded as a stationary point candidate point; calculating the second-order derivative of the stationary point candidate point, and the second-order derivative is equal to the first-order derivative of the right grid point The derivative is subtracted from the first-order derivative of the left grid point, and then divided by twice the grid spacing; when the second-order derivative is negative, it indicates that the stationary point candidate point is a local maximum point, and when the second-order derivative is positive, it indicates that the stationary point candidate point is a local minimum point; the local extreme point is confirmed according to the sign change of the first-order derivative, when the first-order derivative changes from positive to negative, it corresponds to the local maximum point, and when the first-order derivative changes from negative to positive, it corresponds to the local minimum point; all confirmed local extreme points are sorted according to the size of the corresponding kernel density estimate, and the local minimum point between the two local maximum points with the largest kernel density estimate is selected as the inflection point of the density curve.

[0060] It should be noted that the computational complexity of the loop path detection method based on depth-first search is relatively high in the worst case. The specific analysis is as follows: for an associated network containing N nodes and E edges, it is necessary to search from each node, and the time complexity is O(N); in the search process of each node, when the network is highly connected, when the search depth is upper bounded to d, each node has at most N-1 possible neighbor nodes in each layer, so the search complexity of a single starting node is O((N-1)^d); for all the loop paths found, it is also necessary to calculate the strength score and perform normalization. When the loop path When the number of paths is P, the computational complexity of this part is O(P); the computational complexity of path classification using Gaussian kernel density estimation is O(P^2); taking all factors into consideration, the overall time complexity of this method is O(N*(N-1)^d+P^2). When the network scale is large and the connectivity is high, the computational overhead will increase significantly; in order to improve computational efficiency in practical applications, a parallel computing strategy can be adopted to distribute the search tasks of different starting nodes to multiple computing units for simultaneous processing; or, based on the characteristics of the business scenario, the search space can be reduced by pre-filtering low-weight edges or limiting the maximum search depth.

[0061] Calculate the product of each account's transaction frequency and transaction size during the observation period and compare it with the account's historical activity level to obtain the account activation index, which includes:

[0062] The total number of transactions of the account during the observation window period is obtained and divided by the number of days in the observation window period to obtain the average daily transaction frequency; the total transaction amount of the account during the observation window period is calculated and divided by the total number of transactions to obtain the average transaction size; the average daily transaction frequency is multiplied by the average transaction size to obtain the activity benchmark value for the current observation window; the activity benchmark values of the account for each of the past 12 consecutive months are obtained, the average thereof is calculated as the historical activity mean, and the standard deviation thereof is calculated as the historical volatility; the activity benchmark value of the current observation window is subtracted from the historical activity mean and the result is divided by the historical volatility to obtain the initial value of the account activation index; when the initial value is a positive number, it indicates that the current activity is higher than the historical level; when the initial value is a negative number, it indicates that the current activity is lower than the historical level; a sigmoid function is performed on the initial value to compress the value range to between 0 and 1, thereby obtaining the final account activation index. The closer the index is to 1, the more significant the sudden change in account behavior compared to the historical pattern.

[0063] S4: Input the path anomaly score and the account behavior feature vector into a pre-trained fraud identification model to output a fraud risk level for the cross-border transaction.

[0064] The path anomaly score and the account behavior feature vector are input into a pre-trained fraud identification model, specifically including: using the path anomaly score as the first dimension feature, the capital flow ratio as the second dimension feature, the number of circular paths as the third dimension feature, and the account activation degree as the fourth dimension feature to construct a complete feature vector; performing standardization on each dimension feature in the feature vector to eliminate the dimensional differences between different features; and inputting the standardized feature vector into a fraud identification model trained based on a gradient boosting decision tree algorithm. The model uses a multi-layer decision tree structure to extract the complex correlation relationship between features layer by layer, such as Figure 2 As shown; each layer of the decision tree of the model divides the samples based on different feature combinations. When the feature value meets the splitting condition of a decision tree node, the sample is classified into the corresponding child node; the prediction results of all decision trees are weighted averaged to obtain the final fraud risk probability score; the fraud risk probability score is mapped to a predefined risk level range. When the score is in a higher range, it is determined to be a high-risk transaction; when the score is in a medium range, it is determined to be a medium-risk transaction; when the score is in a lower range, it is determined to be a low-risk transaction; for transactions determined to be high-risk, the corresponding risk feature combination is further output to explain the specific reasons leading to the high-risk determination.

[0065] A multi-layer decision tree structure is used to extract the complex correlation between features layer by layer, specifically including: firstly, constructing the first-layer decision tree, splitting the sample based on the value of a single feature, and dividing the sample into a high-risk sub-node when the path anomaly score exceeds a certain threshold, and dividing the sample into a suspicious sub-node when the capital flow ratio significantly deviates from 1; calculating the residual between the classification result of the first-layer decision tree and the true label, and using the residual as the optimization target of the second-layer decision tree; in the second-layer decision tree, considering the combination relationship of multiple features at the same time to split the sample, when the account activation degree is high and the number of circular paths is large, the sample is classified as a high-risk combination, and when When the path anomaly score is moderate but the capital flow ratio is extremely unbalanced, the sample is classified as a suspicious combination; the above process is repeated to construct decision trees at subsequent levels, and each level of decision trees is optimized based on the residuals of the previous tree, continuously capturing finer-grained feature combination patterns; when the residual decreases by less than the preset threshold or reaches the maximum number of tree layers, the construction of new decision tree levels is stopped; for the sample to be predicted, the corresponding prediction value is obtained through each level of decision tree in turn, and all prediction values are weighted and summed with the corresponding learning rate to obtain the final fraud risk probability score; based on the splitting path of each level of decision tree, the key feature combination that leads to high-risk prediction results can be tracked.

[0066] More specifically, the best splitting features for each layer of the decision tree are selected, specifically including: for the sample set of the current node, traversing each candidate feature and its possible splitting points, and calculating the change in the loss function before and after the split; when the Gini index is used as the splitting criterion, calculating the category distribution impurity of the parent node before the split and the weighted average impurity of the left and right child nodes after the split, and selecting the features and splitting points that can minimize the impurity; when information gain is used as the splitting criterion, calculating the information entropy of the parent node before the split and the conditional entropy of the left and right child nodes after the split, and selecting the features and splitting points that can bring the maximum information gain; when the mean square error is used as the splitting criterion, calculating the overall variance of the parent node samples before the split and the weighted average variance of the left and right child nodes after the split, and selecting the features and splitting points that can minimize the variance; introducing a regularization term at each split to penalize the number of newly added leaf nodes after the split to avoid overgrowth of the decision tree; when the number of node samples is less than the minimum sample number threshold, or the node depth reaches the maximum depth limit, or the best split gain of all features is less than the minimum gain threshold, stop splitting the current node.

[0067] It is worth noting that although the above description outlines the general process of extracting feature associations using a multi-layer decision tree structure, the specific implementation details need to be adjusted according to the actual application scenario. For example, in the feature splitting of the first-level decision tree, if the path anomaly score of an account is found to be greater than 0.8 and the capital flow ratio is less than 0.3 (indicating a serious capital outflow), the sample will be directly classified as a high-risk node; in the second-level decision tree, it may be found that when the account activation degree is greater than 0.7 and the number of circular paths exceeds 5, even if the path anomaly score and capital flow ratio are within the normal range, this combination of features often indicates potential fraud risk. Therefore, the sample with this feature combination is classified as a suspicious node. In subsequent decision tree levels, more complex feature interaction patterns may be captured. For example, when the account activation degree is between 0.5 and 0.7, there are 2-3 circular paths, and the path anomaly score is between 0.6 and 0.8, this feature combination may also indicate a moderate fraud risk. Regardless of the specific feature splitting criteria used, the ultimate goal is to identify various possible fraud feature combination patterns as accurately as possible and provide corresponding risk warnings.

[0068] Furthermore, in order to improve the real-time performance of model prediction, the multi-layer decision tree structure is further optimized, including:

[0069] The decision tree is pruned in advance in terms of depth and split features, retaining the key split nodes that contribute most to fraud identification; the combined judgment conditions of multiple features are merged into a shallower tree layer, and when both the path anomaly score is high and the capital flow ratio is abnormal, the sample is directly classified as a high-risk node; a fast-track mechanism is set up at each layer of the tree, and when the value of a certain feature is far beyond the normal range, the subsequent judgment is skipped and the warning result is directly output; for recurring feature combination patterns, their judgment conditions are integrated into the same decision branch to avoid repeated calculations; during the model training stage, the weights of each layer of the decision tree are optimized to highlight the tree layers that significantly improve the fraud identification effect, and weaken or eliminate the tree layers with less contribution; the preprocessed decision tree structure is converted into an efficient rule engine form, and when new transaction data is input, the risk prediction results are quickly obtained according to the predefined rule path.

[0070] For example, when the path anomaly score exceeds the historical extreme percentile, it indicates that the path is extremely abnormal. There is no need to further judge other features, and the transaction is directly marked as high-risk through the fast channel; when the capital flow ratio of an account deviates seriously from the equilibrium point, it indicates that the funds are seriously flowing in one direction, which directly triggers the fast channel warning; when the number of circular paths appearing in an account in a short period of time suddenly increases to several times the historical maximum, the relevant transactions are marked as suspicious through the fast channel; when the account activation index approaches the theoretical upper limit, it indicates that the account behavior has changed drastically compared with the history, triggering the fast channel to issue a warning; when multiple fast channel trigger conditions are found at the same time, such as when the path anomaly score and the capital flow ratio reach the warning threshold at the same time, the risk level will be raised to the highest level.

[0071] Optimally, when clearly abnormal transaction behavior is detected, early warning results can be quickly output without fully traversing all levels of the decision tree, significantly reducing model response latency. When processing large-scale transaction data, the fast-track mechanism can effectively reduce computing resource consumption, quickly completing risk assessments for clearly normal or clearly abnormal transactions, and allocating more computing resources to suspicious transactions requiring in-depth analysis. When new fraud patterns are discovered, corresponding feature judgment conditions can be added to the fast-track mechanism to achieve rapid response and interception of fraud risks. By combining the fast-track mechanism with the complete decision tree path, it ensures both the rapid detection of abnormal transactions and the accurate identification of complex fraud patterns, improving the practicality and reliability of the overall solution.

[0072] In summary, the machine learning-based real-time risk assessment method for bank financial transactions based on the embodiment of the present invention has been elucidated. By analyzing the time interval coefficient and fund retention duration between payment path nodes, abnormal quick-in, quick-out fund flows can be effectively identified. By calculating fund circulation paths and account activation levels, the fund flow relationships between multiple accounts can be accurately identified, and cash-out behaviors involving dispersed fund transfers can be discovered. This can reduce the difficulty in timely identifying transaction fraud involving quick inflows and outflows of funds using multiple cross-border accounts in cross-border bank transactions, due to the inability to correlate and analyze transaction spatiotemporal characteristics with counterparty behavior characteristics in real time.

[0073] Here, those skilled in the art will appreciate that the specific operations of each step in the above-mentioned real-time risk assessment method for banking financial transactions based on machine learning have been described in detail above. Figure 1 and Figure 2 The description of the real-time risk assessment method for bank financial transactions based on machine learning has been introduced in detail, and therefore, its repeated description will be omitted.

Claims

1. A real-time risk assessment method for banking financial transactions based on machine learning, characterized in that: include: Obtaining transaction information of the cross-border transaction to be evaluated, and extracting transaction characteristic parameters based on the transaction information; Inputting the transaction feature parameters into a pre-trained cross-border path link analysis model to obtain a path anomaly score; Building a collection and payment account association network based on the transaction characteristic parameters, analyzing the capital inflow and outflow ratio, the number of capital circulation paths, and the account activation degree in the collection and payment account association network to generate an account behavior feature vector; The path anomaly score and the account behavior feature vector are input into a pre-trained fraud identification model to output a fraud risk level for the cross-border transaction.

2. The real-time risk assessment method for banking financial transactions based on machine learning according to claim 1 is characterized in that: The transaction characteristic parameters include dollar amount, transaction processing time, geographic coordinate sequence, payer account characteristic vector, and payee account characteristic vector.

3. The real-time risk assessment method for banking financial transactions based on machine learning according to claim 1 is characterized in that: The cross-border path link analysis model performs path link analysis using the transaction feature parameters, including: Calculate the time interval coefficient between any two adjacent nodes; Based on the time interval coefficient, it is determined whether the retention time of funds in each intermediate clearing bank is abnormal. If abnormal, the node is marked as an abnormal retention node; Calculating a path link integrity score based on the number of the stranded abnormal nodes and the distribution positions of the stranded abnormal nodes in the path; The transaction processing time and the path link integrity score are weighted and summed to generate a path anomaly score.

4. The real-time risk assessment method for banking financial transactions based on machine learning according to claim 3 is characterized in that: Calculating the path link integrity score includes: Obtaining the location index value of the abnormal node; Calculating the node position weight based on the position index value, and summing up the position weights of the retention abnormal nodes to obtain a retention abnormality weighted score; Calculate the ratio of the number of the abnormal nodes to the total number of nodes to obtain the abnormal retention ratio; The path link integrity score is obtained by multiplying the retention anomaly weighted score by the square of the retention anomaly ratio.

5. The real-time risk assessment method for banking financial transactions based on machine learning according to claim 1 is characterized in that: The number of capital circulation paths includes: Exploring circular paths in the association network based on depth-first search; The geometric mean of the path edge weights is calculated as the strength score; The intensity scores are fitted by Gaussian kernel density and the paths are divided into high and low intensity paths. Finally, the high-intensity circular path is selected as the valid path, and the number of valid paths is recorded as the number of capital circulation paths.

6. The real-time risk assessment method for banking and financial transactions based on machine learning according to claim 5 is characterized in that: The division of high and low intensity paths includes: The grid points whose absolute values of the first-order derivatives are less than the set accuracy are selected as candidate stationary points, and their types are determined by the second-order derivatives. The local extreme points are confirmed according to the change in the sign of the first-order derivatives. Finally, the local minimum points between the two local maximum points with the largest density are selected as inflection points to divide the high-intensity and low-intensity categories.

7. The real-time risk assessment method for banking financial transactions based on machine learning according to claim 1 is characterized in that: The account activation degree is obtained by calculating the deviation between the current account activity benchmark value and the historical mean and fluctuation degree, and compressing it through the activation function to obtain the activation degree indicator of the degree of account behavior mutation.

8. The real-time risk assessment method for banking and financial transactions based on machine learning according to claim 1 is characterized in that: The fraud identification model uses a multi-layer decision tree structure to extract the complex correlation between features layer by layer; Each layer of the decision tree in the model divides the samples based on different feature combinations. When the feature value meets the splitting condition of a decision tree node, the sample is classified into the corresponding child node; the prediction results of all decision trees are weighted averaged to obtain the final fraud risk probability score.

9. The real-time risk assessment method for banking and financial transactions based on machine learning according to claim 8 is characterized in that: The multi-layer decision tree structure captures feature combination relationships through residual optimization, generates a final fraud risk probability score, and tracks key feature combinations for high-risk predictions through splitting paths.

10. The real-time risk assessment method for banking financial transactions based on machine learning according to claim 9 is characterized in that: The multi-layer decision tree structure also includes a fast channel mechanism; When the fast-track mechanism detects that the value of a single feature or a combination of features at each level of the decision tree has clearly exceeded the preset risk threshold, there is no need to continue traversing subsequent decision branches. The sample is directly determined to the corresponding risk level through the fast track and a warning result is output.

Images