Abnormal transaction detection method and system based on multi-modal data analysis

Abstract

The invention discloses an abnormal transaction detection method and system based on multi-modal data analysis, and the method comprises the steps: carrying out the synchronous processing of a transaction amount sequence, account feature data and equipment information through a time window alignment mechanism, and obtaining a multi-modal transaction data set; respectively constructing a transaction network graph and an account relation graph according to the fund flow direction relation and the account relevance; using a weighted graph convolution network to extract transaction space features and account space features; performing time sequence modeling through a transaction time sequence sensitive gating circulation unit to obtain a transaction time sequence vector and an account time sequence vector; and performing feature enhancement based on transaction amount distribution contrast learning, and inputting into a classifier to obtain an abnormal transaction recognition result. According to the method, the technical problems of misalignment of cross-modal data time sequences, insufficient transaction amount sensitivity modeling, inaccurate time sequence dependency relationship capture and poor abnormal feature distinguishing capability in an existing multi-modal abnormal transaction detection method are solved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method and system for detecting abnormal transactions based on multimodal data analysis. Background Art

[0002] Existing methods for detecting abnormal transactions primarily rely on single-modal data analysis techniques, identifying unusual transaction patterns through statistical analysis and machine learning modeling of single-type data such as transaction amounts, transaction times, and account characteristics. Traditional methods include rule-based threshold detection, statistical outlier detection, and machine learning-based classification detection. These methods have demonstrated some effectiveness in processing structured transaction data. Furthermore, some anomaly detection methods based on graph neural networks and time series analysis have emerged in the prior art, identifying complex abnormal patterns by constructing transaction network graphs or analyzing transaction time series.

[0003] However, existing technologies have significant technical flaws and limitations. First, single-modal data analysis methods cannot effectively integrate multiple heterogeneous data sources such as transaction behavior data, user feature data, and device information data, resulting in incomplete recognition of abnormal patterns. Second, existing methods lack an effective mechanism to deal with the problem of time series misalignment between different modal data. The differences in acquisition frequency and timestamps of different data sources affect the accuracy of data fusion. In addition, traditional methods ignore the impact of transaction amount distribution characteristics on network topology and feature propagation, and fail to fully utilize the abnormality of transaction amounts to enhance feature representation capabilities. Most importantly, existing technologies lack cross-modal semantic interaction and comparative learning mechanisms, and cannot effectively model the deep correlation relationships between different modal data.

[0004] Based on a progressive analysis of the aforementioned technical deficiencies, the core technical challenges facing existing technologies include establishing an effective spatiotemporal alignment mechanism for multimodal data, designing transaction amount-sensitive graph network feature extraction methods, constructing a cross-modal temporal dependency modeling framework, and enhancing the ability to distinguish anomalous patterns through contrastive learning. Addressing these technical challenges requires systematic innovation across multiple layers, including multimodal data preprocessing, graph network structure design, temporal modeling algorithms, and feature learning optimization, to achieve more accurate and robust anomalous transaction detection. Summary of the Invention

[0005] The present application provides an abnormal transaction detection method and system based on multimodal data analysis, which is used to solve the technical problems in existing multimodal abnormal transaction detection methods, such as time series misalignment of cross-modal data, insufficient modeling of transaction amount sensitivity, inaccurate capture of time series dependencies, and weak ability to distinguish abnormal features.

[0006] In the first aspect, the present application provides an abnormal transaction detection method based on multimodal data analysis, and the abnormal transaction detection method based on multimodal data analysis includes: synchronously processing the transaction amount sequence, account feature data and device information through a time window alignment mechanism to obtain a multimodal transaction data set; performing graph construction processing on the transaction amount sequence in the multimodal transaction data set according to the capital flow relationship to obtain a transaction network graph, and performing graph construction processing on the account feature data in the multimodal transaction data set according to the account correlation to obtain an account relationship graph; inputting the transaction network graph and the account relationship graph into a weighted graph convolutional network for spatial feature extraction processing to obtain transaction space features and account space features; performing time series modeling processing on the transaction space features and the account space features through a transaction timing sensitive gated recurrent unit to obtain a transaction time series vector and an account time series vector; performing feature enhancement processing on the transaction time series vector and the account time series vector according to transaction amount distribution comparative learning to obtain an abnormality sensitive feature representation, which is input into a classifier for detection processing to obtain an abnormal transaction identification result.

[0007] Optionally, the transaction amount sequence, account feature data, and device information are synchronized using a time window alignment mechanism to obtain a multimodal transaction dataset, including:

[0008] Based on the benchmark time window, the transaction amount series is segmented into fixed time intervals to obtain standardized transaction time segments;

[0009] Snapshot the account feature data based on the transaction trigger time to obtain a time-aligned account feature snapshot.

[0010] Perform event-driven collection and processing of device information based on device status changes to obtain synchronized device status records;

[0011] Inputting the standardized transaction time segment, the time-aligned account feature snapshot, and the synchronized device status record into a timestamp unified calibration module for timing alignment processing to obtain a time-synchronized multimodal data sequence;

[0012] The time-synchronized multimodal data sequence is subjected to data format standardization processing to obtain a multimodal transaction data set.

[0013] Optionally, the graph construction processing is performed on the transaction amount sequence in the multimodal transaction dataset according to the capital flow relationship to obtain a transaction network graph, and the graph construction processing is performed on the account feature data in the multimodal transaction dataset according to the account association to obtain an account relationship graph, including:

[0014] Performing weight calculation processing on the transaction records in the multimodal transaction dataset based on the transaction amount and transaction frequency to obtain a transaction weight matrix;

[0015] Performing node relationship construction processing on the transaction weight matrix according to the fund transfer path to obtain a transaction node set and a transaction edge set;

[0016] Inputting the transaction node set and the transaction edge set into a graph structure generator for topology construction processing to obtain a transaction network graph;

[0017] performing correlation analysis on the account feature data in the multimodal transaction dataset based on the account risk level and the account behavior characteristics to obtain an account correlation matrix;

[0018] Graph nodes and graph edges are constructed based on the account association matrix to obtain an account relationship graph.

[0019] Optionally, the step of inputting the transaction network graph and the account relationship graph into a weighted graph convolutional network for spatial feature extraction to obtain transaction space features and account space features includes:

[0020] Initializing the weights of the adjacency matrix of the transaction network graph based on the transaction amount distribution to obtain an amount-sensitive weight matrix;

[0021] Inputting the node features of the transaction network graph and the amount-sensitive weight matrix into the graph convolution layer for feature propagation processing to obtain a transaction node embedding vector;

[0022] Normalizing the transaction node embedding vector according to degree matrix normalization to obtain normalized transaction features;

[0023] Input the account relationship graph into the attention-enhanced graph convolutional network for neighborhood aggregation to obtain the account node feature vector;

[0024] Multi-layer convolution aggregation processing is performed on the normalized transaction features to obtain transaction space features, and multi-layer convolution aggregation processing is performed on the account node feature vector to obtain account space features.

[0025] Optionally, performing time series modeling processing on the transaction space features and the account space features by using a transaction time series sensitive gated recurrent unit to obtain a transaction time series vector and an account time series vector includes:

[0026] Calculate the time decay factor of the transaction space feature based on the transaction time interval to obtain the transaction time sequence weight coefficient;

[0027] Performing parameter modulation processing on the reset gate and the update gate according to the transaction timing weight coefficient to obtain timing-sensitive gating parameters;

[0028] Inputting the transaction space features and the timing-sensitive gating parameters into a gated recurrent unit for hidden state update processing to obtain a transaction hidden state sequence;

[0029] Performing candidate hidden state calculation processing on the account space feature based on the transaction amount modulation factor to obtain a candidate hidden state of the account;

[0030] The transaction hidden state sequence is subjected to cross-modal attention fusion processing to obtain a transaction time series vector, and the account candidate hidden state is subjected to time series aggregation processing to obtain an account time series vector.

[0031] Optionally, performing candidate hidden state calculation processing on the account space feature based on the transaction amount modulation factor to obtain the candidate account hidden state includes:

[0032] Perform sigmoid transformation on the transaction amount ratio based on the current transaction amount and the historical average transaction amount to obtain the transaction amount modulation factor;

[0033] Input the account space features and the previous hidden state into the tanh activation function for linear transformation to obtain the basic candidate hidden state;

[0034] Performing weighted modulation processing on the bias parameter based on the transaction amount modulation factor to obtain a modulation bias vector;

[0035] performing a vector addition operation on the base candidate hidden state and the modulation bias vector to obtain an enhanced candidate hidden state;

[0036] Nonlinear activation processing is performed on the enhanced candidate hidden state to obtain the account candidate hidden state.

[0037] Optionally, the feature enhancement processing is performed on the transaction time series vector and the account time series vector according to the transaction amount distribution comparative learning to obtain abnormal sensitive feature representation, which is input into the classifier for detection processing to obtain abnormal transaction identification results, including:

[0038] Based on the difference in transaction amount distribution, positive and negative sample pairs are constructed for the transaction time series vector and the account time series vector to obtain comparative learning sample pairs;

[0039] Performing similarity quantization processing on the comparative learning sample pairs according to cosine similarity calculation to obtain a sample similarity matrix;

[0040] Inputting the sample similarity matrix into the comparative loss function to calculate the loss value and obtain the transaction amount distribution comparative loss;

[0041] Performing gradient updating processing on the transaction time series vector and the account time series vector based on the transaction amount distribution comparison loss to obtain abnormal sensitive feature representation;

[0042] The abnormal sensitive feature representation is input into a dual-branch neural network classifier for abnormal probability calculation processing to obtain an abnormal transaction identification result.

[0043] In a second aspect, the present application provides an abnormal transaction detection system based on multimodal data analysis, the abnormal transaction detection system based on multimodal data analysis comprising:

[0044] The synchronization module is used to synchronize transaction amount sequences, account feature data, and device information through a time window alignment mechanism to obtain a multimodal transaction dataset;

[0045] a construction module configured to perform graph construction processing on the transaction amount sequence in the multimodal transaction dataset according to the capital flow relationship to obtain a transaction network graph, and to perform graph construction processing on the account feature data in the multimodal transaction dataset according to the account association to obtain an account relationship graph;

[0046] An extraction module, configured to input the transaction network graph and the account relationship graph into a weighted graph convolutional network for spatial feature extraction processing to obtain transaction space features and account space features;

[0047] a modeling module, configured to perform time series modeling processing on the transaction space features and the account space features through a transaction time series sensitive gated recurrent unit to obtain a transaction time series vector and an account time series vector;

[0048] The identification module is used to perform feature enhancement processing on the transaction time series vector and the account time series vector based on transaction amount distribution comparative learning, obtain abnormal sensitive feature representation, input it into the classifier for detection processing, and obtain abnormal transaction identification results.

[0049] In a third aspect, an abnormal transaction detection device based on multimodal data analysis is provided, comprising: a memory and at least one processor, wherein instructions are stored in the memory; the at least one processor calls the instructions in the memory so that the abnormal transaction detection device based on multimodal data analysis executes the above-mentioned abnormal transaction detection method based on multimodal data analysis.

[0050] In a fourth aspect, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium, which, when executed on a computer, enables the computer to execute the above-mentioned abnormal transaction detection method based on multimodal data analysis.

[0051] In the technical solution provided by this application, the time window alignment mechanism solves the problem of asynchronous time series of multimodal data in the prior art. By processing the transaction amount sequence, account feature data and device information with a unified time benchmark, it ensures the accurate correspondence of different data sources in the time dimension, avoids feature association errors caused by time deviation, and significantly improves the accuracy of multimodal data fusion. The graph construction process based on the relationship between capital flow and account correlation effectively captures the complex relationship patterns in the transaction network. The transaction network graph reflects the topological structure of capital flow, and the account relationship graph reveals the intrinsic correlation between account features. This dual-graph structure can more comprehensively characterize the multi-dimensional characteristics of abnormal transactions than the single network modeling method of the prior art. The spatial feature extraction processing performed by the weighted graph convolutional network uses the neighborhood information aggregation and weight propagation mechanism to enable the feature representation of each node to integrate its structural information and neighborhood features in the network. Compared with traditional feature extraction methods, it has stronger expression ability and better abnormal pattern recognition accuracy. The transaction timing-sensitive gated recurrent unit's temporal modeling process innovatively incorporates a time decay mechanism and cross-modal attention fusion, accurately modeling the temporal dependencies of transaction behaviors and the semantic interactions between different modalities. This addresses the existing issues of inaccurate temporal modeling and insufficient cross-modal information fusion. The feature enhancement process for comparative learning of transaction amount distributions creates a clear demarcation between normal and abnormal transactions in the feature space by constructing positive and negative sample pairs and optimizing the similarity distribution. This significantly enhances the ability to distinguish abnormal patterns, resulting in stronger discrimination and better generalization performance than existing single-feature learning approaches.

[0052] In the specific application area of ​​financial anomaly transaction detection, the algorithms and model designs of this application fully consider the particularities of financial transaction data and business needs. The transaction amount-sensitive weight initialization and amount modulation factor design specifically address the significant amount differences in financial transactions, allowing large-value anomaly transactions to receive higher model attention while small-value normal transactions do not interfere with anomaly detection. This domain-specific algorithm design is more suitable for the actual needs of financial scenarios than general anomaly detection methods. The time decay factor and transaction behavior time constant design in the timing-sensitive gated recurrent unit take into account the temporal irregularities of financial transactions, enabling the model to accurately handle the pattern differences between concentrated transactions on weekdays and sparse transactions on holidays, improving its adaptability to transaction timing patterns in real financial environments. The contrastive learning mechanism based on transaction amount distribution is specifically designed to address the extremely imbalanced number of normal and abnormal transactions in financial data. Through intelligent sample matching and loss weight adjustment, the model maintains good detection performance even in the presence of sample imbalance. This algorithm optimization for financial anomaly detection scenarios significantly improves detection accuracy and false positive control in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0054] Figure 1 Schematic diagram of an embodiment of a method for detecting abnormal transactions based on multimodal data analysis in an embodiment of the present application;

[0055] Figure 2 Schematic diagram of an embodiment of an abnormal transaction detection system based on multimodal data analysis in an embodiment of the present application;

[0056] Figure 3 It is a schematic block diagram of the structure of an abnormal transaction detection device based on multimodal data analysis in an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The embodiments of the present application provide a method and system for detecting abnormal transactions based on multimodal data analysis. The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or that are inherent to these processes, methods, products or devices.

[0058] For ease of understanding, the specific process of the embodiment of the present application is described below. Figure 1 In one embodiment of the present application, an abnormal transaction detection method based on multimodal data analysis includes:

[0059] Step S101: Synchronize the transaction amount sequence, account feature data, and device information through a time window alignment mechanism to obtain a multimodal transaction dataset;

[0060] Step S102: Graph-building processing is performed on the transaction amount sequence in the multimodal transaction dataset based on the capital flow relationship to obtain a transaction network graph, and graph-building processing is performed on the account feature data in the multimodal transaction dataset based on the account association to obtain an account relationship graph;

[0061] Step S103: Input the transaction network graph and the account relationship graph into a weighted graph convolutional network to perform spatial feature extraction processing to obtain transaction space features and account space features;

[0062] Step S104: Perform time series modeling on the transaction space features and the account space features through a transaction time series sensitive gated recurrent unit to obtain a transaction time series vector and an account time series vector;

[0063] Step S105: Perform feature enhancement processing on the transaction time series vector and the account time series vector based on transaction amount distribution comparative learning to obtain abnormal sensitive feature representation, input the feature representation into the classifier for detection processing, and obtain abnormal transaction identification results.

[0064] It is understandable that the execution subject of this application can be an abnormal transaction detection system based on multimodal data analysis, or a terminal or a server, which is not limited here. The embodiment of this application is described by taking the server as the execution subject as an example.

[0065] Specifically, the time window alignment mechanism addresses the timing discrepancies between data modalities by establishing a unified time base. First, the transaction amount sequence is segmented into fixed-time intervals based on a base time window, set here to 300 seconds. The continuous transaction stream is then divided into standardized transaction time segments at fixed intervals, each containing all transaction records within that time window. Next, a snapshot of account feature data is collected based on the transaction trigger time. When a transaction event is detected, account status information at that moment is immediately captured, including static features such as account balance, historical transaction frequency, and risk level, to form a time-aligned account feature snapshot. Simultaneously, event-driven device information is collected based on device status changes, monitoring dynamic changes such as device login status, IP address changes, and operating system type, generating synchronized device status records. These three types of data are then fed into the unified timestamp calibration module for timing alignment. A timestamp standardization algorithm maps data with different collection frequencies onto a unified timeline. Finally, data format standardization is performed to produce a multimodal transaction dataset.

[0066] A graph structure is constructed to represent complex transaction relationships and account associations. Transaction records in a multimodal transaction dataset are weighted based on transaction amount and frequency. The weight calculation formula is the logarithmic ratio of the transaction amount to the user's average transaction amount multiplied by the transaction frequency. This takes into account both the relative importance of the amounts and the level of transaction activity. A transaction weight matrix is ​​then constructed based on the fund transfer path. Accounts are set as graph nodes, and fund flows are defined as directed edges. Edge weights reflect the intensity and frequency of fund flows, forming a set of transaction nodes and edges. These node and edge sets are then input into a graph structure generator for topology construction, generating a transaction network graph. Correlation analysis is also performed on account feature data based on account risk level and account behavior characteristics. The Pearson correlation coefficient between different account feature dimensions is calculated to construct an account correlation matrix, which then generates an account relationship graph.

[0067] Spatial correlation features are extracted using a weighted graph convolutional network. The adjacency matrix of the transaction network graph is weighted initialized based on the transaction amount distribution. This weight initialization strategy uses the logarithmic transformation of the transaction amount distribution variance as a modulation factor, giving larger transactions higher weight in network propagation. The node features and amount-sensitive weight matrix of the transaction network graph are fed into a graph convolutional layer for feature propagation. This graph convolution operation updates the feature representation of the central node by aggregating information from neighboring nodes. The new feature of each node is equal to the weighted average of the features of its neighboring nodes. The transaction node embedding vectors are then normalized using degree matrix normalization, which prevents nodes with larger degrees from dominating feature propagation. The account relationship graph is then fed into an attention-enhanced graph convolutional network for neighborhood aggregation. Attention weights are derived by calculating the similarity between node features. Finally, through multiple layers of convolutional aggregation, transaction space features and account space features are obtained, respectively.

[0068] A transaction-timing-sensitive gated recurrent unit (GRU) is used to model temporal dependencies. A time decay factor is calculated for transaction-space features based on transaction time intervals. The time decay factor adopts a negative exponential function, with a time constant determined statistically based on the temporal distribution characteristics of historical transaction data. The transaction-timing weight coefficient is used to modulate the parameters of the reset and update gates, enabling the gating mechanism to detect the non-uniformity of transaction time intervals. The transaction-space features and timing-sensitive gating parameters are fed into the GRU for hidden state update. The GRU controls the degree of forgetting of historical information through the reset gate and the proportion of incorporation of new information through the update gate. Simultaneously, candidate hidden states are calculated for account-space features based on a transaction amount modulation factor. The transaction amount modulation factor is derived by applying a sigmoid transform to the ratio of the current transaction amount to the historical average transaction amount. This factor is used to modulate the bias parameters in the candidate hidden state calculation. Finally, through cross-modal attention fusion and temporal aggregation, the transaction and account time series vectors are obtained, respectively.

[0069] This method achieves feature enhancement and anomaly detection. Based on differences in transaction amount distribution, positive and negative sample pairs are constructed for transaction time series vectors and account time series vectors. Positive samples represent transactions from users with the same risk level, while negative samples represent transactions from users with different risk levels. Similarity is quantified for the comparative learning sample pairs using cosine similarity. Cosine similarity is calculated by dividing the vector inner product by the vector modulus product and reflects the directional similarity of the feature vectors. The sample similarity matrix is ​​input into the contrastive loss function for loss calculation. The contrastive loss function uses a cross-entropy formula, increasing the similarity of positive sample pairs while decreasing the similarity of negative sample pairs. Gradient updates are performed on the feature vectors based on the contrastive loss of the transaction amount distribution. The network parameters are optimized using a backpropagation algorithm to obtain anomaly-sensitive feature representations with enhanced discriminative capabilities. The anomaly-sensitive feature representations are input into a two-branch neural network classifier for anomaly probability calculation. The two branches are responsible for binary classification and multi-classification recognition, respectively, ultimately outputting the abnormal transaction identification results.

[0070] In a specific embodiment, the process of executing step S101 may specifically include the following steps:

[0071] Based on the benchmark time window, the transaction amount series is segmented into fixed time intervals to obtain standardized transaction time segments;

[0072] Snapshot the account feature data based on the transaction trigger time to obtain a time-aligned account feature snapshot.

[0073] Perform event-driven collection and processing of device information based on device status changes to obtain synchronized device status records;

[0074] Inputting the standardized transaction time segment, the time-aligned account feature snapshot, and the synchronized device status record into a timestamp unified calibration module for timing alignment processing to obtain a time-synchronized multimodal data sequence;

[0075] The time-synchronized multimodal data sequence is subjected to data format standardization processing to obtain a multimodal transaction data set.

[0076] Specifically, the core of the fixed time interval segmentation processing of the transaction amount sequence based on the reference time window is to establish a unified time base to deal with the discretization problem of the continuous transaction flow. The reference time window refers to a preset fixed time length, which is used as the standard unit for data segmentation. It is usually set to 300 seconds or other time intervals determined according to business needs. Fixed time interval segmentation processing is to divide the continuous transaction amount sequence into equal lengths according to the length of the reference time window. Each time segment contains all transaction records that occurred within the time window, including transaction amount, transaction timestamp, transaction type and other information. Standardized transaction time segments refer to data blocks with the same time length formed after time segmentation processing. Each segment corresponds to a fixed time interval, and the transactions within the segment are arranged in chronological order of occurrence. This segmentation method solves the problem of uneven distribution of transaction data in the time dimension, and at the same time enables subsequent time series analysis and feature extraction to have a unified time base.

[0077] Snapshotting account feature data based on transaction trigger moments involves an event-driven data collection mechanism. The transaction trigger moment refers to the specific point in time when a transaction event actually occurs, identified by monitoring the event stream of the trading system. Snapshot collection and processing involves immediately capturing all relevant account feature information at the moment a transaction event is detected. This includes static and dynamic features such as account balance, historical transaction frequency, account opening date, risk level, and geographic location. A time-aligned account feature snapshot is account status data precisely corresponding to the moment a transaction occurred. Each snapshot contains a complete account feature vector and a precise timestamp. This snapshot mechanism ensures precise temporal correspondence between account feature data and transaction data, avoiding feature deviations caused by inconsistent data collection times.

[0078] Event-driven collection and processing of device information based on device status changes uses status monitoring and change detection to acquire device-related data. A device status change refers to any change in a device's login status, network connection, operating system version, browser type, IP address, and other information. Event-driven collection and processing monitors device status change events in real time and immediately records relevant device information when a status change is detected, including a comparison of the status before and after the change, the time the change occurred, and the type of change. Synchronized device status records are device information records synchronized with transaction and account data. Each record contains a device identifier, status information, and a timestamp. This collection method can capture dynamically changing patterns in device behavior and is crucial for identifying abnormal login and device switching behaviors.

[0079] The unified timestamp calibration module handles time synchronization issues across disparate data sources. While standardized transaction time segments, time-aligned account feature snapshots, and synchronized device status records all contain time information, the timestamp format and precision vary due to the different source systems. Time series alignment uses a timestamp standardization algorithm to convert the timestamps of all data into a unified time format and time zone, establishing a global timeline. A time-synchronized multimodal data sequence is a multimodal data stream with a consistent time base that has been time-calibrated. Each time point corresponds to complete transaction, account, and device information. The calibration process includes steps such as time format conversion, time zone adjustment, precision alignment, and time offset correction.

[0080] Data format standardization involves converting time-synchronized multimodal data sequences into a unified data format and structure. Data from different modalities have different data types and formats. Transaction data is primarily numeric, account feature data includes both numeric and categorical data, and device information data primarily includes both text and categorical data. Format standardization includes steps such as data type unification, missing value handling, outlier filtering, and encoding conversion. A multimodal transaction dataset is a standardized data set formed after comprehensive preprocessing, with aligned time dimensions, a unified data format, and complete feature information.

[0081] In a specific embodiment, the process of executing step S102 may specifically include the following steps:

[0082] Performing weight calculation processing on the transaction records in the multimodal transaction dataset based on the transaction amount and transaction frequency to obtain a transaction weight matrix;

[0083] Performing node relationship construction processing on the transaction weight matrix according to the fund transfer path to obtain a transaction node set and a transaction edge set;

[0084] Inputting the transaction node set and the transaction edge set into a graph structure generator for topology construction processing to obtain a transaction network graph;

[0085] performing correlation analysis on the account feature data in the multimodal transaction dataset based on the account risk level and the account behavior characteristics to obtain an account correlation matrix;

[0086] Graph nodes and graph edges are constructed based on the account association matrix to obtain an account relationship graph.

[0087] Specifically, weighting transaction records in a multimodal transaction dataset based on transaction amount and frequency involves a comprehensive consideration of both the absolute importance and relative activity of transactions. Transaction amount refers to the specific monetary value of a single transaction, while transaction frequency refers to the number of transactions occurring within a specific time window. Weight calculation is performed by applying a logarithmic transformation to the ratio of the transaction amount to the user's historical average transaction amount and multiplying it by the transaction frequency to obtain a composite weight. The logarithmic transformation accounts for the power-law distribution of transaction amounts and prevents excessive influence of extremely large transactions on the weight calculation. The transaction weight matrix is ​​a two-dimensional matrix structure, with rows and columns representing the sender and receiver accounts of a transaction, respectively. The matrix elements represent the transaction weights between corresponding account pairs. During matrix construction, the weights of multiple transactions between the same pair of accounts are accumulated to form a comprehensive indicator of transaction intensity between the account pairs.

[0088] Based on the funds transfer path, the transaction weight matrix is ​​constructed using node relationships, transforming abstract transaction relationships into concrete graph elements. A funds transfer path refers to the specific path and direction of funds flowing from a source account to a target account, including all possible direct and indirect transfer paths. This node relationship construction process sets each account involved in a transaction as a graph node and the fund flow relationships between accounts as directed edges. The transaction node set contains the identifiers of all independent accounts involved in the transaction, with each node corresponding to a unique account entity. The transaction edge set contains the fund flow relationships between all account pairs. Each edge includes a source node, a target node, an edge weight, and a direction. The edge weight is directly derived from the weight value of the corresponding position in the transaction weight matrix, and the direction of the edge is determined by the direction of the fund flow.

[0089] The graph generator is a processing module specifically responsible for organizing node and edge sets into a complete graph structure. After the transaction node and edge sets are input into the graph generator, node indexing is first performed, assigning each account node a unique numerical index. Next, an adjacency list is constructed, maintaining a list of all neighboring nodes and corresponding edge weights for each node. Topology construction involves calculating node degrees, analyzing connectivity, and partitioning into subgraphs. The resulting transaction network graph is a directed, weighted graph structure, with nodes representing accounts, edges representing fund flows, and edge weights reflecting transaction intensity. This graph structure intuitively displays fund flow patterns and network topology relationships between accounts.

[0090] Correlation analysis of account feature data based on account risk level and account behavior characteristics aims to uncover inherent correlation patterns between account characteristics. Account risk level is a risk classification based on a comprehensive assessment of factors such as account history, credit history, and transaction patterns, and is typically categorized as low, medium, or high risk. Account behavior characteristics include multi-dimensional features such as account opening time, historical transaction frequency, average transaction amount, geographic location, and device usage habits. Correlation analysis utilizes the Pearson correlation coefficient to measure the degree of linear correlation between different feature variables. The account correlation matrix is ​​a matrix structure that records the strength of correlation between any two account feature dimensions. Matrix element values ​​range from -1 to +1, with larger absolute values ​​indicating stronger correlation.

[0091] Based on the account association matrix, graph nodes and edges are constructed to convert the correlation relationships between account features into a graph structure. Graph node construction sets each account feature dimension as an independent node, with node attributes containing information such as the feature name, data type, and value range. Graph edge construction is based on the correlation coefficient in the account association matrix. When the absolute value of the correlation between two feature dimensions exceeds a preset threshold, an edge is established between the corresponding nodes. Edge weights are set to the absolute value of the correlation coefficient, and the edge type is determined as positive or negative based on the sign of the correlation coefficient. The account relationship graph is an undirected, weighted graph that describes the relationships between account features. The graph structure enables the identification of feature clustering patterns and key feature nodes.

[0092] In a specific embodiment, the process of executing step S103 may specifically include the following steps:

[0093] Initializing the weights of the adjacency matrix of the transaction network graph based on the transaction amount distribution to obtain an amount-sensitive weight matrix;

[0094] Inputting the node features of the transaction network graph and the amount-sensitive weight matrix into the graph convolution layer for feature propagation processing to obtain a transaction node embedding vector;

[0095] Normalizing the transaction node embedding vector according to degree matrix normalization to obtain normalized transaction features;

[0096] Input the account relationship graph into the attention-enhanced graph convolutional network for neighborhood aggregation to obtain the account node feature vector;

[0097] Multi-layer convolution aggregation processing is performed on the normalized transaction features to obtain transaction space features, and multi-layer convolution aggregation processing is performed on the account node feature vector to obtain account space features.

[0098] Specifically, weight initialization of the adjacency matrix of the transaction network graph based on transaction amount distribution addresses the existing problem of ignoring the impact of transaction amounts on network topology. The adjacency matrix of a transaction network graph is a two-dimensional matrix that records the connectivity between nodes, where non-zero elements indicate the existence of a transaction relationship between corresponding accounts. Transaction amount distribution refers to the statistical distribution characteristics of all transaction amounts in numerical space, typically exhibiting a power-law or log-normal distribution. Weight initialization converts the binary connectivity relationships in the original adjacency matrix into continuous weight values ​​by calculating the statistical relationship between the transaction amount corresponding to each edge and the global transaction amount distribution. The specific calculation process involves locating the distribution position of the transaction amount of each edge, calculating its quantile in the global distribution, and then obtaining the weight modulation factor through logarithmic transformation and normalization. The amount-sensitive weight matrix is ​​a weight matrix modulated by the transaction amount distribution. The matrix element values ​​reflect the combined characteristics of the relative importance of the transaction amount and the strength of network connectivity.

[0099] The feature propagation process in the graph convolutional layer is the core computational process of graph neural networks, aiming to update node feature representations by aggregating neighborhood information. The node features of the transaction network graph include each account's initial feature vector, such as account type, registration time, and historical transaction statistics. The amount-sensitive weight matrix, serving as the weight parameter in the graph convolutional layer, controls the intensity of information propagation between neighborhood nodes. The computational steps of feature propagation include neighborhood feature aggregation, weighted averaging, and nonlinear transformation. Neighborhood feature aggregation is the weighted sum of all neighboring node features for each node, calculated by edge weights. Weighted averaging is the normalization of the aggregated features by dividing them by the total weight of the neighborhood nodes. Nonlinear transformation introduces nonlinear representation capabilities through activation functions. The transaction node embedding vector is the node feature representation obtained after processing the graph convolutional layer. It combines neighborhood structure information with the node's own features.

[0100] Degree matrix normalization is a key technique in graph neural networks to prevent feature propagation from being dominated by nodes with larger degrees. The degree matrix is ​​a diagonal matrix whose diagonal elements represent the degree of the corresponding node, that is, the number of edges connected to that node or the sum of the edge weights. During degree matrix normalization of transaction node embedding vectors, each node's feature vector element is divided by the square root of the node's degree. This normalization ensures that the features of nodes with different degrees have the same numerical scale. Normalization also includes L2 norm normalization of the feature vectors, adjusting the modulus of each vector to unit length. Normalized transaction features are node feature representations that have undergone both degree matrix normalization and L2 normalization, resulting in numerical stability and comparability.

[0101] The attention-enhanced graph convolutional network (ACN) is an improved algorithm that introduces an attention mechanism based on the standard graph convolution. The account relationship graph contains correlation connections between account feature dimensions, with nodes representing feature dimensions and edges representing correlation strength. Neighborhood aggregation processing in the ACN includes two sub-steps: attention weight calculation and weighted aggregation. Attention weight calculation calculates the attention coefficient by calculating the similarity between the features of the central node and neighboring nodes. The similarity is calculated using the dot product or cosine similarity method and then normalized using the softmax function. Weighted aggregation is to perform a weighted summation of neighboring node features according to the attention weights to obtain a node representation that incorporates neighborhood information. The account node feature vector is the feature representation of each feature dimension node in the account relationship graph after the attention-enhanced graph convolution processing.

[0102] Multi-layer convolutional aggregation processing enhances feature representation by stacking multiple graph convolutional layers. Normalized transaction features are fed into a multi-layer graph convolutional network. Each layer aggregates neighborhood information and transforms features, while residual or dense connections between layers maintain information flow. This multi-layered structure enables nodes to perceive information from multi-hop neighborhoods, capturing network structural patterns over a wider range. Account node feature vectors are also aggregated through multi-layer convolution, achieving a more abstract feature representation through hierarchical feature learning. Transaction space features are high-dimensional feature vectors derived from normalized transaction features after multi-layer convolution. They contain information about the topological structure and node characteristics of the transaction network. Account space features are the result of multi-layer convolutional aggregation of account node feature vectors, reflecting the deep correlation patterns between account feature dimensions.

[0103] In a specific embodiment, the process of executing step S104 may specifically include the following steps:

[0104] Calculate the time decay factor of the transaction space feature based on the transaction time interval to obtain the transaction time sequence weight coefficient;

[0105] Performing parameter modulation processing on the reset gate and the update gate according to the transaction timing weight coefficient to obtain timing-sensitive gating parameters;

[0106] Inputting the transaction space features and the timing-sensitive gating parameters into a gated recurrent unit for hidden state update processing to obtain a transaction hidden state sequence;

[0107] Performing candidate hidden state calculation processing on the account space feature based on the transaction amount modulation factor to obtain a candidate hidden state of the account;

[0108] The transaction hidden state sequence is subjected to cross-modal attention fusion processing to obtain a transaction time series vector, and the account candidate hidden state is subjected to time series aggregation processing to obtain an account time series vector.

[0109] Specifically, the calculation and processing of the time decay factor for transaction space features based on the transaction time interval is intended to address the problem of the failure of existing technologies to effectively model the non-uniformity of transaction timing. The transaction time interval refers to the time difference between the current transaction and the previous transaction, usually measured in seconds, minutes or hours. The time decay factor is calculated using a negative exponential decay function. The calculation formula is the negative exponential form of a natural constant, and the exponential term is the transaction time interval divided by the transaction behavior time constant. The transaction behavior time constant is a characteristic parameter obtained from historical transaction data statistics, reflecting the temporal regularity of user transaction behavior. It is determined by analyzing the mean and variance of the user's historical transaction time intervals. The transaction timing weight coefficient is the weight value of the normalized time decay factor, which is used to modulate the parameters in the gated recurrent unit so that transactions with shorter time intervals receive higher weights and transactions with longer time intervals gradually decay in weight.

[0110] Modulating the parameters of the reset and update gates based on the transaction timing weight coefficient involves dynamic adjustment of the internal parameters of the gated recurrent unit. The reset and update gates are core components of the gated recurrent unit. The reset gate controls the degree of forgetting of the previous hidden state information, while the update gate controls the ratio of the fusion of new input information with historical information. Parameter modulation uses the transaction timing weight coefficient as a modulation factor, performing element-wise multiplication with the weight matrix and bias vector of the reset and update gates. Timing-sensitive gating parameters include the reset and update gate parameters modulated by the timing weight. These parameters enable the gating mechanism to adaptively adjust the intensity of information flow based on the length of the transaction interval. The modulated gating parameters maintain high information transmission capacity when processing continuous transactions with short intervals, while appropriately reducing the influence of historical information when processing sparse transactions with longer intervals.

[0111] The gated recurrent unit (GRU) is a specialized recurrent neural network architecture specifically designed to handle long-term dependencies in sequential data. After the transaction spatial features and time-sensitive gating parameters are input into the GRU, the reset gate is first calculated. This concatenates the current input features with the previous hidden state, then linearly transforms them using the modulated reset gate weight matrix. The reset gate output is then activated using a sigmoid function. Next, the candidate hidden state is calculated. The current input features are concatenated with the previous hidden state modulated by the reset gate. A weight matrix transformation and a tanh activation function are then used to obtain the candidate hidden state. The update gate is then calculated, using a similar process as the reset gate to obtain the update gate output. The hidden state update process weightedly fuses the previous hidden state with the candidate hidden state according to the ratio of the update gate outputs to obtain the current hidden state. The transaction hidden state sequence is a sequence of hidden state vectors corresponding to each time step, integrating the temporal dependency information and spatial feature information of the transaction sequence.

[0112] The calculation of candidate hidden states for account-space features based on a transaction amount modulation factor is specifically tailored to the needs of time-series modeling of account features. The transaction amount modulation factor is calculated by dividing the current transaction amount by the user's historical average transaction amount, then transforming it through a sigmoid function to obtain a modulation coefficient between zero and one. The candidate hidden state calculation process linearly combines the account-space features with the previous hidden state, with the weight of this linear combination adjusted by the transaction amount modulation factor. The specific calculation process involves applying a nonlinear transformation from the account-space features and the previous hidden state to a tanh activation function to obtain a base candidate hidden state. The transaction amount modulation factor is then multiplied by a bias parameter to obtain a modulation bias vector. Finally, the base candidate hidden state and the modulation bias vector are added together and the final candidate hidden state is obtained through an activation function. The candidate hidden state represents the time-series representation of the account features under the influence of the current transaction amount.

[0113] Cross-modal attention fusion is a key technology for connecting features from different modalities, addressing semantic inconsistencies between multimodal data. A transaction latent state sequence consists of multiple latent state vectors along the temporal dimension. Cross-modal attention fusion achieves information exchange by calculating attention weights between transaction latent states and candidate account latent states. The attention weights are calculated using a dot-product attention mechanism. Each vector in the transaction latent state sequence is dot-producted with the candidate account latent state to obtain a similarity score, which is then normalized using a softmax function to obtain an attention weight distribution. The fusion process weights the transaction latent state sequence according to the attention weights to produce a transaction representation that incorporates account information. The transaction time series vector is the feature representation of the transaction after cross-modal attention fusion. It contains the transaction's temporal pattern and its association with account features. Time series aggregation aggregates the candidate account latent states along the temporal dimension, using average pooling or max pooling to compress the time series information into a fixed-length vector representation. The account time series vector is the final feature representation of the candidate account latent state after time series aggregation.

[0114] In a specific embodiment, the process of executing step S105 may specifically include the following steps:

[0115] Perform sigmoid transformation on the transaction amount ratio based on the current transaction amount and the historical average transaction amount to obtain the transaction amount modulation factor;

[0116] Input the account space features and the previous hidden state into the tanh activation function for linear transformation to obtain the basic candidate hidden state;

[0117] Performing weighted modulation processing on the bias parameter based on the transaction amount modulation factor to obtain a modulation bias vector;

[0118] performing a vector addition operation on the base candidate hidden state and the modulation bias vector to obtain an enhanced candidate hidden state;

[0119] Nonlinear activation processing is performed on the enhanced candidate hidden state to obtain the account candidate hidden state.

[0120] Specifically, a sigmoid transformation is performed on the transaction amount ratio based on the current transaction amount and the historical average transaction amount to convert the relative change in transaction amount into a standardized modulation factor. The current transaction amount refers to the specific amount of the transaction being processed, while the historical average transaction amount is a benchmark value obtained by calculating the arithmetic mean of all transaction amounts of the user over a certain period of time. The transaction amount ratio is calculated by dividing the current transaction amount by the historical average transaction amount. This ratio reflects the degree to which the current transaction deviates from the user's typical transaction level. The sigmoid transformation uses the sigmoid function to perform a nonlinear mapping of the ratio. The mathematical expression of the sigmoid function is one divided by one plus a natural constant raised to the power of negative x, where x is the input transaction amount ratio. The sigmoid function has the property of mapping any real number to the range between zero and one. When the transaction amount ratio is equal to one, the output is close to 0.5; when the ratio is greater than one, the output approaches one; and when the ratio is less than one, the output approaches zero. The transaction amount modulation factor is the standardized value obtained after the sigmoid transformation and is used in the subsequent parameter modulation process.

[0121] Inputting the account-space features and the previous hidden state into the tanh activation function for linear transformation involves fundamental computational operations in neural networks. Account-space features are high-dimensional feature vectors extracted from the account relationship graph, containing information such as account risk levels, behavioral patterns, and correlations. The previous hidden state is the hidden state vector generated by the gated recurrent unit during the previous time step, containing a compressed representation of historical time series information. The linear transformation process first concatenates the account-space features and the previous hidden state to form a higher-dimensional joint feature vector. Matrix multiplication is then performed on the joint feature vector using a weight matrix to achieve linear combination and dimensionality transformation. The tanh activation function then applies nonlinear mapping to the linear transformation result. The tanh function maps the input values ​​to the range from -1 to +1, exhibiting zero-centering and saturation properties. The base candidate hidden state is the intermediate result obtained after the tanh activation function, laying the foundation for subsequent modulation.

[0122] The key innovation of the present invention is to perform weighted modulation processing on the bias parameter based on the transaction amount modulation factor, which is used to solve the problem in the prior art that the transaction amount information cannot be effectively used to adjust the model parameters. The bias parameter is a learnable parameter in the neural network, which is usually added to the linear transformation result to increase the model's expressive power and fitting flexibility. The weighted modulation processing uses the transaction amount modulation factor as the weight coefficient and performs element-level multiplication operation with the bias parameter. When the transaction amount modulation factor is close to one, it means that the current transaction amount is significantly higher than the historical average level. The bias parameter is amplified, which enhances the model's sensitivity to abnormal large transactions. When the modulation factor is close to zero, it means that the current transaction amount is far below the historical average level. The bias parameter is reduced, which reduces the response intensity to small transactions. The modulated bias vector is a new parameter vector formed after all bias parameters are modulated by the transaction amount modulation factor. Its numerical value directly reflects the degree of abnormality of the current transaction amount.

[0123] Performing vector addition on the base candidate hidden state and the modulation bias vector is a key step in feature fusion. The base candidate hidden state contains a fusion of account features and historical hidden states, while the modulation bias vector carries the abnormal signal of the current transaction amount. Vector addition performs element-wise addition at corresponding positions, linearly superimposing the information of the two vectors. This addition ensures the equal integration of the base feature information and the transaction amount modulation information, avoiding the overlap or suppression of one type of information over the other. The enhanced candidate hidden state is the vector result obtained after the addition operation, in which each dimension contains a comprehensive representation of account features, historical time series information, and the abnormality of the current transaction amount. The enhanced candidate hidden state has stronger discriminative power than the base candidate hidden state, especially when processing abnormal transactions with significant deviations in transaction amounts.

[0124] Nonlinear activation of the enhanced candidate hidden states is the final step in candidate hidden state calculation, aiming to introduce nonlinear expressiveness and control the numerical range. Nonlinear activation typically uses activation functions such as tanh or ReLU to perform element-wise nonlinear transformations on the enhanced candidate hidden states. The tanh activation function compresses input values ​​to the range of negative one to positive one, exhibiting smooth gradients and zero-centered outputs. The ReLU activation function sets negative values ​​to zero and leaves positive values ​​unchanged, offering the advantages of computational simplicity and non-saturated gradients. The choice of activation function is determined by the specific model design and performance requirements, and the optimal activation method is typically selected through experimental verification. The account candidate hidden state is the final result of nonlinear activation processing, possessing a standardized numerical range and enhanced nonlinear expressiveness, and is directly used in subsequent time series aggregation and anomaly detection processes.

[0125] In a specific embodiment, the process of executing step S106 may specifically include the following steps:

[0126] Based on the difference in transaction amount distribution, positive and negative sample pairs are constructed for the transaction time series vector and the account time series vector to obtain comparative learning sample pairs;

[0127] Performing similarity quantization processing on the comparative learning sample pairs according to cosine similarity calculation to obtain a sample similarity matrix;

[0128] Inputting the sample similarity matrix into the comparative loss function to calculate the loss value and obtain the transaction amount distribution comparative loss;

[0129] Performing gradient updating processing on the transaction time series vector and the account time series vector based on the transaction amount distribution comparison loss to obtain abnormal sensitive feature representation;

[0130] The abnormal sensitive feature representation is input into a dual-branch neural network classifier for abnormal probability calculation processing to obtain an abnormal transaction identification result.

[0131] Specifically, transaction amount distribution differences refer to the differences in the statistical distribution characteristics of samples within different transaction amount ranges. By analyzing the amount distribution of all transaction data, the boundaries between normal and abnormal amount ranges are identified. The positive and negative sample pair construction process determines sample labels based on the distribution of transaction amounts. Transaction time series vectors and account time series vectors within the normal amount distribution range are labeled as positive samples, while vectors within the abnormal amount distribution range are labeled as negative samples. Sample pair construction strategies include similar sample pairing and heterogeneous sample pairing. Similar sample pairing combines two positive or two negative samples into a sample pair, while heterogeneous sample pairing combines one positive sample and one negative sample into a sample pair. Contrastive learning sample pairs are data structures containing sample feature vectors and their corresponding labels. Each sample pair clearly identifies the similarity relationship between the two vectors, providing training data for subsequent similarity calculation and loss function optimization. Cosine similarity is used to quantify the similarity of contrastive learning sample pairs, employing the angular similarity metric in vector space. Cosine similarity measures the similarity of the cosine of the angle between two vectors. Its calculation process includes two steps: vector inner product calculation and vector modulus normalization. The vector inner product calculation multiplies the elements of the corresponding positions of the two eigenvectors one by one and sums them to obtain the inner product value between the vectors. The vector modulus normalization calculates the Euclidean norm of each vector, that is, the square root of the sum of the squares of all elements, and then divides the inner product value by the product of the two vector moduli. The value range of cosine similarity is between negative one and positive one. The closer the value is to positive one, the more similar the two vectors are. The closer the value is to negative one, the less similar the two vectors are. The value close to zero indicates that the two vectors are orthogonal and independent. Similarity quantization processing calculates cosine similarity for all sample pairs to form a numerical matrix that describes the strength of the relationship between samples. The sample similarity matrix is ​​a two-dimensional matrix structure that records the similarity values ​​of all sample pairs. The matrix element values ​​directly reflect the degree of feature similarity of the corresponding sample pairs.

[0132] The contrastive loss function is a loss calculation method specifically designed for contrastive learning, aiming to maximize the similarity of positive pairs while minimizing the similarity of negative pairs. After the sample similarity matrix is ​​input into the contrastive loss function, the sample pairs are first identified by label recognition to distinguish the similarity values ​​between positive and negative pairs. The loss calculation uses a modified form of cross-entropy loss. For positive pairs, the loss function calculates the negative log-likelihood, encouraging the model to output high similarity; for negative pairs, the loss function calculates the positive log-likelihood, encouraging the model to output low similarity. The specific calculation process includes three sub-steps: similarity normalization, probability conversion, and logarithmic loss calculation. Similarity normalization scales the raw similarity values ​​by a temperature parameter, which controls the steepness of the similarity distribution. Probability conversion uses the softmax function to convert the scaled similarity values ​​into a probability distribution. The logarithmic loss calculation takes the negative logarithm of the probability values ​​and weights them by the sample pair labels. The contrastive loss for the transaction amount distribution is the weighted average of the loss values ​​for all sample pairs. The weights are determined by the degree of abnormality of the transaction amount, with more abnormal sample pairs receiving greater weight in the loss calculation.

[0133] Based on the contrastive loss of transaction amount distribution, a gradient update process is performed on the transaction time series vector and the account time series vector, using the backpropagation algorithm to optimize the feature representation. The gradient update process first calculates the partial derivative of the contrastive loss function with respect to the feature vector, obtaining the direction and magnitude of the loss function's gradient along each feature dimension. The gradient calculation process involves the chain rule, starting from the loss function and moving forward, calculating the gradient contribution of each network parameter layer by layer. Parameter updates utilize a gradient descent variant, such as the Adam optimizer or the SGD optimizer, to adjust the feature vector values ​​based on gradient information. The learning rate parameter controls the step size of each update, and the momentum parameter controls the influence of historical gradient information. The anomaly-sensitive feature representation, derived from multiple rounds of gradient updates, is optimized, demonstrating enhanced ability to distinguish abnormal transactions and better feature clustering properties. This feature representation creates a clear demarcation between normal and abnormal transactions, enhancing the accuracy of subsequent classifiers.

[0134] The dual-branch neural network classifier is a classification model specifically designed for abnormal transaction detection. It consists of two parallel networks: a binary classification branch and a multi-classification branch. After the abnormality-sensitive features are input into the dual-branch neural network, they first undergo further feature transformation and abstraction through a shared feature extraction layer. The binary classification branch determines whether a transaction is abnormal. It uses a single-output neuron and a sigmoid activation function to output an abnormality probability value between zero and one. The multi-classification branch identifies the specific anomaly type and uses multiple-output neurons and a softmax activation function to output the probability distribution of each anomaly type. The anomaly probability calculation process combines the outputs of the two branches and calculates the final anomaly determination result through a weighted average or product operation. The weight coefficient is adjusted based on business needs and model performance to balance the accuracy of the binary classification with the precision of the multi-classification. The abnormal transaction identification result includes three components: anomaly probability, anomaly type, and confidence level. The anomaly probability reflects the likelihood of an abnormal transaction, the anomaly type indicates the specific abnormal pattern classification, and the confidence level indicates the reliability of the model's prediction.

[0135] The above describes the abnormal transaction detection method based on multimodal data analysis in the embodiment of the present application. The following describes the abnormal transaction detection system based on multimodal data analysis in the embodiment of the present application. Figure 2 In one embodiment of the present application, an abnormal transaction detection system based on multimodal data analysis includes:

[0136] The synchronization module is used to synchronize transaction amount sequences, account feature data, and device information through a time window alignment mechanism to obtain a multimodal transaction dataset;

[0137] a construction module configured to perform graph construction processing on the transaction amount sequence in the multimodal transaction dataset according to the capital flow relationship to obtain a transaction network graph, and to perform graph construction processing on the account feature data in the multimodal transaction dataset according to the account association to obtain an account relationship graph;

[0138] An extraction module, configured to input the transaction network graph and the account relationship graph into a weighted graph convolutional network for spatial feature extraction processing to obtain transaction space features and account space features;

[0139] a modeling module, configured to perform time series modeling processing on the transaction space features and the account space features through a transaction time series sensitive gated recurrent unit to obtain a transaction time series vector and an account time series vector;

[0140] The identification module is used to perform feature enhancement processing on the transaction time series vector and the account time series vector based on transaction amount distribution comparative learning, obtain abnormal sensitive feature representation, input it into the classifier for detection processing, and obtain abnormal transaction identification results.

[0141] above Figure 2 The abnormal transaction detection system based on multimodal data analysis in the embodiment of the present invention is described in detail from the perspective of modular functional entities. The abnormal transaction detection device based on multimodal data analysis in the embodiment of the present invention is described in detail from the perspective of hardware processing.

[0142] Reference Figure 3 In an embodiment of the present invention, there is also provided an abnormal transaction detection device based on multimodal data analysis. The abnormal transaction detection device based on multimodal data analysis may be a server, and its internal structure may be as follows: Figure 3 As shown. The abnormal transaction detection device based on multimodal data analysis includes a processor, a memory, a display screen, an input device, a network interface and a database connected via a system bus. The computer-designed processor is used to provide computing and control capabilities. The memory of the abnormal transaction detection device based on multimodal data analysis includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the abnormal transaction detection device based on multimodal data analysis is used to store the corresponding data in this embodiment. The network interface of the abnormal transaction detection device based on multimodal data analysis is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the above method is implemented.

[0143] Those skilled in the art will understand that Figure 3 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present invention, and does not constitute a limitation on the abnormal transaction detection device based on multimodal data analysis to which the solution of the present invention is applied.

[0144] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. The computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the steps of the abnormal transaction detection method based on multimodal data analysis.

[0145] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, systems and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0146] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling an abnormal transaction detection device based on multimodal data analysis (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other media that can store program code.

[0147] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for detecting abnormal transactions based on multimodal data analysis, characterized in that: The method comprises: Through the time window alignment mechanism, the transaction amount sequence, account feature data and device information are synchronized to obtain a multimodal transaction dataset; Performing graph construction processing on the transaction amount sequence in the multimodal transaction dataset according to the capital flow relationship to obtain a transaction network graph, and performing graph construction processing on the account feature data in the multimodal transaction dataset according to the account association to obtain an account relationship graph; Inputting the transaction network graph and the account relationship graph into a weighted graph convolutional network for spatial feature extraction to obtain transaction space features and account space features; Performing time series modeling on the transaction space features and the account space features through a transaction time series sensitive gated recurrent unit to obtain a transaction time series vector and an account time series vector; The transaction time series vector and the account time series vector are subjected to feature enhancement processing based on transaction amount distribution comparative learning to obtain abnormal sensitive feature representation, which is input into a classifier for detection processing to obtain abnormal transaction identification results.

2. The abnormal transaction detection method based on multimodal data analysis according to claim 1 is characterized in that: The transaction amount sequence, account feature data, and device information are synchronized through the time window alignment mechanism to obtain a multimodal transaction dataset, including: Based on the benchmark time window, the transaction amount series is segmented into fixed time intervals to obtain standardized transaction time segments; Snapshot the account feature data based on the transaction trigger time to obtain a time-aligned account feature snapshot. Perform event-driven collection and processing of device information based on device status changes to obtain synchronized device status records; Inputting the standardized transaction time segment, the time-aligned account feature snapshot, and the synchronized device status record into a timestamp unified calibration module for timing alignment processing to obtain a time-synchronized multimodal data sequence; The time-synchronized multimodal data sequence is subjected to data format standardization processing to obtain a multimodal transaction data set.

3. The abnormal transaction detection method based on multimodal data analysis according to claim 1 is characterized in that: The graph construction process is performed on the transaction amount sequence in the multimodal transaction dataset according to the capital flow relationship to obtain a transaction network graph, and the graph construction process is performed on the account feature data in the multimodal transaction dataset according to the account association to obtain an account relationship graph, including: Performing weight calculation processing on the transaction records in the multimodal transaction dataset based on the transaction amount and transaction frequency to obtain a transaction weight matrix; Performing node relationship construction processing on the transaction weight matrix according to the fund transfer path to obtain a transaction node set and a transaction edge set; Inputting the transaction node set and the transaction edge set into a graph structure generator for topology construction processing to obtain a transaction network graph; performing correlation analysis on the account feature data in the multimodal transaction dataset based on the account risk level and the account behavior characteristics to obtain an account correlation matrix; Graph nodes and graph edges are constructed based on the account association matrix to obtain an account relationship graph.

4. The abnormal transaction detection method based on multimodal data analysis according to claim 1 is characterized in that: The step of inputting the transaction network graph and the account relationship graph into a weighted graph convolutional network for spatial feature extraction to obtain transaction space features and account space features includes: Initializing the weights of the adjacency matrix of the transaction network graph based on the transaction amount distribution to obtain an amount-sensitive weight matrix; Inputting the node features of the transaction network graph and the amount-sensitive weight matrix into the graph convolution layer for feature propagation processing to obtain a transaction node embedding vector; Normalizing the transaction node embedding vector according to degree matrix normalization to obtain normalized transaction features; Input the account relationship graph into the attention-enhanced graph convolutional network for neighborhood aggregation to obtain the account node feature vector; Multi-layer convolution aggregation processing is performed on the normalized transaction features to obtain transaction space features, and multi-layer convolution aggregation processing is performed on the account node feature vector to obtain account space features.

5. The abnormal transaction detection method based on multimodal data analysis according to claim 1 is characterized in that: The step of performing time series modeling processing on the transaction space features and the account space features through the transaction time series sensitive gated recurrent unit to obtain a transaction time series vector and an account time series vector includes: Calculate the time decay factor of the transaction space feature based on the transaction time interval to obtain the transaction time sequence weight coefficient; Performing parameter modulation processing on the reset gate and the update gate according to the transaction timing weight coefficient to obtain timing-sensitive gating parameters; Inputting the transaction space features and the timing-sensitive gating parameters into a gated recurrent unit for hidden state update processing to obtain a transaction hidden state sequence; Performing candidate hidden state calculation processing on the account space feature based on the transaction amount modulation factor to obtain a candidate hidden state of the account; The transaction hidden state sequence is subjected to cross-modal attention fusion processing to obtain a transaction time series vector, and the account candidate hidden state is subjected to time series aggregation processing to obtain an account time series vector.

6. The abnormal transaction detection method based on multimodal data analysis according to claim 5 is characterized in that: The processing of calculating candidate hidden states on the account space features based on the transaction amount modulation factor to obtain candidate account hidden states includes: Perform sigmoid transformation on the transaction amount ratio based on the current transaction amount and the historical average transaction amount to obtain the transaction amount modulation factor; Input the account space features and the previous hidden state into the tanh activation function for linear transformation to obtain the basic candidate hidden state; Performing weighted modulation processing on the bias parameter based on the transaction amount modulation factor to obtain a modulation bias vector; performing a vector addition operation on the base candidate hidden state and the modulation bias vector to obtain an enhanced candidate hidden state; Nonlinear activation processing is performed on the enhanced candidate hidden state to obtain the account candidate hidden state.

7. The abnormal transaction detection method based on multimodal data analysis according to claim 1 is characterized in that: The feature enhancement processing of the transaction time series vector and the account time series vector based on the transaction amount distribution comparative learning is performed to obtain abnormal sensitive feature representation, which is input into the classifier for detection processing to obtain abnormal transaction identification results, including: Based on the difference in transaction amount distribution, positive and negative sample pairs are constructed for the transaction time series vector and the account time series vector to obtain comparative learning sample pairs; Performing similarity quantization processing on the comparative learning sample pairs according to cosine similarity calculation to obtain a sample similarity matrix; Inputting the sample similarity matrix into the comparative loss function to calculate the loss value and obtain the transaction amount distribution comparative loss; Performing gradient updating processing on the transaction time series vector and the account time series vector based on the transaction amount distribution comparison loss to obtain abnormal sensitive feature representation; The abnormal sensitive feature representation is input into a dual-branch neural network classifier for abnormal probability calculation processing to obtain an abnormal transaction identification result.

8. An abnormal transaction detection system based on multimodal data analysis, characterized in that: For implementing the abnormal transaction detection method based on multimodal data analysis according to any one of claims 1 to 7, the abnormal transaction detection system based on multimodal data analysis comprises: The synchronization module is used to synchronize transaction amount sequences, account feature data, and device information through a time window alignment mechanism to obtain a multimodal transaction dataset; a construction module configured to perform graph construction processing on the transaction amount sequence in the multimodal transaction dataset according to the capital flow relationship to obtain a transaction network graph, and to perform graph construction processing on the account feature data in the multimodal transaction dataset according to the account association to obtain an account relationship graph; An extraction module, configured to input the transaction network graph and the account relationship graph into a weighted graph convolutional network for spatial feature extraction processing to obtain transaction space features and account space features; a modeling module, configured to perform time series modeling processing on the transaction space features and the account space features through a transaction time series sensitive gated recurrent unit to obtain a transaction time series vector and an account time series vector; The identification module is used to perform feature enhancement processing on the transaction time series vector and the account time series vector based on transaction amount distribution comparative learning, obtain abnormal sensitive feature representation, input it into the classifier for detection processing, and obtain abnormal transaction identification results.

9. An abnormal transaction detection device based on multimodal data analysis, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the computer program, the abnormal transaction detection method based on multimodal data analysis according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the processor is enabled to perform the abnormal transaction detection method based on multimodal data analysis according to any one of claims 1 to 7.

Images