AI-driven intelligent identification and early warning method and system for improper behaviors of market subjects

Abstract

The invention relates to an AI-driven market subject improper behavior intelligent identification and early warning method and system, and the method comprises the following steps: carrying out the multi-dimensional semantic vectorization coding processing of the transaction record data of a market subject, and obtaining a structured transaction behavior feature matrix; based on the structured transaction behavior feature matrix topology, analyzing a fund flow direction track of the market subject to obtain a fund flow direction topological relation graph; performing risk assessment on the market subject based on the fund flow topological relation graph to obtain a comprehensive risk assessment vector; based on the comprehensive risk assessment vector, classifying and identifying an improper behavior type of the market subject to obtain an improper behavior type identification result; and performing real-time early warning trigger condition judgment on the improper behavior type recognition result to obtain an intelligent early warning response scheme, thereby solving the technical problem that most risk monitoring systems still depend on manual rule setting and static threshold judgment and are difficult to adapt to high-frequency and variable market behavior characteristics.

Description

Technical Field

[0001] This invention relates to the field of market entity data processing technology, and in particular to an AI-driven intelligent identification and early warning method and system for improper behavior of market entities. Background Technology

[0002] With the rapid development of the digital economy, the trading activities of various market entities are becoming increasingly frequent and the trading models are becoming more complex. Traditional regulatory methods are no longer sufficient to effectively address the challenges posed by new forms of misconduct. Against this backdrop, automated risk identification and early warning methods based on artificial intelligence technology have become a research hotspot. However, the existing regulatory system still has significant shortcomings in processing multi-source heterogeneous transaction data, accurately capturing the trajectory of capital flows, and dynamically assessing market risks, necessitating the construction of a more intelligent and efficient risk identification framework.

[0003] Currently, most risk monitoring systems still rely on manual rule setting and static threshold judgments, making it difficult to adapt to the high-frequency and ever-changing characteristics of market behavior. Furthermore, traditional risk assessment methods are often limited to single-dimensional data analysis, lacking in-depth mining and correlation analysis of market participants' behavioral patterns, easily leading to misjudgments or omissions. At the same time, faced with complex financial operations and concealed illegal methods, existing models also show limitations in classifying and identifying inappropriate behavior types and in the real-time nature of early warning responses, resulting in significant regulatory lag.

[0004] Therefore, leveraging artificial intelligence technologies, particularly emerging methods such as semantic vectorization and graph topology analysis, to build a system capable of dynamically sensing, intelligently identifying, and promptly issuing warnings of improper behavior by market participants has become an urgent need in current financial regulation and compliance management. This requires not only models with strong data representation capabilities but also the integration of dynamic adjustment mechanisms to enhance the flexibility and adaptability of the warning system, thereby effectively addressing increasingly complex market environments and regulatory challenges. Summary of the Invention

[0005] The main objective of this invention is to provide an AI-driven intelligent identification and early warning method for improper behavior of market entities, which solves the technical problem that most risk monitoring systems still rely on manual rule setting and static threshold judgment, making it difficult to adapt to the high-frequency and ever-changing characteristics of market behavior.

[0006] To achieve the above objectives, this invention provides an AI-driven intelligent identification and early warning method for improper behavior of market entities, comprising the following steps: The transaction record data of market participants are processed by multi-dimensional semantic vectorization encoding to obtain a structured transaction behavior feature matrix; Based on the structured transaction behavior feature matrix, the fund flow trajectory of the market participants is analyzed to obtain a fund flow topology map; Based on the aforementioned capital flow topology map, a risk assessment is conducted on the market entities to obtain a comprehensive risk assessment vector; When the comprehensive risk assessment vector exceeds the preset risk threshold, the inappropriate behavior type of the market entity is classified and identified based on the comprehensive risk assessment vector to obtain the inappropriate behavior type identification result; By using a dynamic threshold adjustment mechanism to determine the real-time early warning trigger conditions based on the identification results of the inappropriate behavior types, an intelligent early warning response scheme is obtained.

[0007] Furthermore, the multi-dimensional semantic vectorization encoding processing of the market participants' transaction record data yields a structured transaction behavior feature matrix, including: The transaction record data of the market participants are decomposed into time series to obtain transaction trend components, seasonal components and random fluctuation components, and a multi-level time feature vector is constructed based on the transaction trend components, seasonal components and random fluctuation components; The text information in the transaction record data is semantically encoded using adaptive word embedding technology to obtain a transaction semantic feature vector. Context relevance analysis is then performed based on the transaction semantic feature vector to obtain a transaction semantic association network. A structured transaction behavior feature matrix is ​​constructed based on the multi-level time feature vector and the transaction semantic association network.

[0008] Furthermore, the topological analysis of the market participants' capital flow trajectories based on the structured transaction behavior feature matrix to obtain a capital flow topological relationship map includes: Multi-dimensional clustering analysis is performed on the structured transaction behavior feature matrix to obtain transaction entity groups, and the capital flow trajectory of the market entities is analyzed based on the topology of the transaction entity groups to generate an initial capital flow network; The importance of nodes in the initial fund flow network is evaluated by using a complex network centrality measurement method to obtain a set of key fund hub nodes. Based on the set of key fund hub nodes, community detection is performed to obtain the fund flow community structure. Dynamic graph embedding technology is applied to the aforementioned fund flow community structure to obtain a time-varying fund flow graph representation. Based on the time-varying fund flow graph representation, a time-series consistency analysis is performed to obtain fund flow pattern characteristics. Based on the characteristics of the fund flow pattern and the set of key fund hub nodes, a graph neural network is used to perform dynamic evolution analysis on the fund flow topology to obtain a fund flow topology graph.

[0009] Furthermore, the initial fund flow network is evaluated for node importance using a complex network centrality measurement method to obtain a set of key fund hub nodes, including: Degree centrality is calculated on the initial fund flow network to obtain a node connectivity degree distribution sequence, and feature entropy is calculated on the node connectivity degree distribution sequence to obtain a node connectivity entropy matrix, wherein the node connectivity entropy matrix includes in-degree entropy, out-degree entropy, and connectivity strength entropy. Based on the node connection entropy matrix, the betweenness centrality of the initial capital flow network is analyzed to obtain a path control index set, and the path control index set is decomposed hierarchically to obtain a multi-level node influence spectrum. The proximity centrality measure of the influence spectrum of the multi-level nodes is performed to obtain the node proximity metric, and the feature subspace is mapped based on the node proximity metric to obtain the node importance feature vector group. Based on the node importance feature vector group, the node proximity metric is threshold-filtered to obtain a set of key funding hub nodes.

[0010] Furthermore, the risk assessment of the market entities based on the aforementioned capital flow topology map, yielding a comprehensive risk assessment vector, includes: Entropy values ​​are calculated for the node degree centrality and edge weight distribution in the fund flow topology graph to obtain an anomaly measurement index for fund flow, and quantile statistics are performed on the anomaly measurement index to obtain an abnormal fund flow feature set. Based on the abnormal fund flow feature set, subgraph extraction is performed on the fund flow topology graph to obtain a high-risk fund flow subnetwork, and time-series evolution analysis is performed on the high-risk fund flow subnetwork to obtain risk propagation path characteristics. The risk propagation path characteristics are decomposed into multiple layers using spectral clustering to obtain hierarchical risk assessment indicators. Based on these hierarchical risk assessment indicators, a hierarchical risk measurement system is constructed to obtain multidimensional risk quantification parameters. Based on the multidimensional risk quantification parameters, a multidimensional correlation analysis is performed on the market participants to obtain a risk correlation strength matrix. Then, feature vectors are extracted from the risk correlation strength matrix to obtain a comprehensive risk assessment vector, which includes risk level, risk volatility, and risk transmission coefficient.

[0011] Furthermore, based on the comprehensive risk assessment vector, the classification and identification of the types of inappropriate behavior of the market entities to obtain the inappropriate behavior type identification results include: The comprehensive risk assessment vector is transformed in the feature space to obtain a risk feature subspace mapping matrix, and the risk feature subspace mapping matrix is ​​decoupled in terms of behavior patterns to obtain a set of behavior feature components. Density clustering analysis is performed on the risk feature subspace mapping matrix based on the behavioral feature component set to obtain behavioral type clusters. Then, it is identified whether there are inappropriate clusters in the behavioral type clusters. If there are, the boundary features in the behavioral type clusters are extracted by a preset boundary-sensitive heuristic algorithm to obtain an inappropriate behavior boundary feature map. The boundary feature map of the inappropriate behavior is subjected to map matching analysis to obtain the mapping relationship of inappropriate behavior types. Based on the mapping relationship of inappropriate behavior types, the clusters of behavior types are semantically labeled to obtain the semantic description sequence of inappropriate behavior. Based on the semantic description sequence of the inappropriate behavior, the mapping relationship of the inappropriate behavior type is classified in a multi-level manner to obtain the inappropriate behavior type identification result.

[0012] Furthermore, the intelligent early warning response scheme is obtained by using a dynamic threshold adjustment mechanism to determine the real-time early warning trigger conditions based on the identification results of the inappropriate behavior type, including: The results of the identification of the inappropriate behavior type are processed by a dynamic threshold adjustment mechanism to obtain a warning threshold hierarchy matrix. The warning threshold hierarchy matrix is ​​then dynamically updated in time to obtain an adaptive warning threshold sequence. The adaptive warning threshold sequence includes a behavior type risk threshold, a trigger time window threshold, and a warning level determination threshold. Based on the adaptive warning threshold sequence, the results of the identification of the inappropriate behavior type are classified and warning is determined to obtain a warning trigger instruction set. Then, the warning trigger instruction set is matched with a response strategy to obtain an intelligent warning response scheme. The intelligent warning response scheme includes a warning level identifier, a list of handling measures, and response time limit requirements.

[0013] This invention also provides an AI-driven intelligent identification and early warning system for improper behavior of market entities, comprising: The encoding module is used to perform multi-dimensional semantic vectorization encoding on the transaction record data of market participants to obtain a structured transaction behavior feature matrix; The analysis module is used to perform topological analysis of the capital flow trajectory of the market participants based on the structured transaction behavior feature matrix, and obtain a capital flow topological relationship map; The assessment module is used to conduct risk assessment on the market entities based on the fund flow topology map to obtain a comprehensive risk assessment vector; The identification module is used to classify and identify the types of improper behavior of the market entity based on the comprehensive risk assessment vector when the comprehensive risk assessment vector exceeds a preset risk threshold, and obtain the identification result of the improper behavior type. The judgment module is used to judge the real-time early warning trigger conditions of the inappropriate behavior type identification results through a dynamic threshold adjustment mechanism, so as to obtain an intelligent early warning response scheme.

[0014] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of any of the methods described above.

[0015] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any of the methods described above.

[0016] This invention provides an AI-driven intelligent identification and early warning method for improper behavior of market entities, comprising the following steps: performing multi-dimensional semantic vectorization encoding on the transaction record data of market entities to obtain a structured transaction behavior feature matrix; performing topological analysis on the fund flow trajectory of the market entities based on the structured transaction behavior feature matrix to obtain a fund flow topological relationship map; performing risk assessment on the market entities based on the fund flow topological relationship map to obtain a comprehensive risk assessment vector; classifying and identifying the types of improper behavior of the market entities based on the comprehensive risk assessment vector to obtain improper behavior type identification results; and performing real-time early warning trigger condition judgment on the improper behavior type identification results to obtain an intelligent early warning response scheme. This method solves the technical problem that most risk monitoring systems still rely on manual rule setting and static threshold judgment, making it difficult to adapt to high-frequency and ever-changing market behavior characteristics. It realizes the technical effect of using fund flow topological maps for risk assessment and generating comprehensive risk assessment vectors, which can simultaneously capture systemic risks and individual abnormal behaviors at both macro and micro levels, enhancing the scientificity and accuracy of risk identification. Attached Figure Description

[0017] Figure 1 This is a schematic diagram illustrating the steps of an AI-driven intelligent identification and early warning method for improper behavior of market entities in one embodiment of the present invention; Figure 2 This is a structural block diagram of an AI-driven intelligent identification and early warning system for improper behavior of market entities, according to one embodiment of the present invention. Figure 3 This is a schematic block diagram of the structure of a computer device according to an embodiment of the present invention.

[0018] The objectives, features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0020] like Figure 1 As shown, Figure 1 This invention provides an AI-driven method for intelligent identification and early warning of improper behavior by market entities, comprising the following steps: Step S1 involves performing multi-dimensional semantic vectorization encoding on the transaction record data of market participants to obtain a structured transaction behavior feature matrix.

[0021] Specifically, in this method, the step of "performing multi-dimensional semantic vectorization encoding of market entity transaction record data to obtain a structured transaction behavior feature matrix" aims to achieve a high-dimensional representation of market entity behavior through deep semantic analysis and numerical modeling of the original transaction records. Specifically, the system first collects historical transaction data of market entities, including but not limited to transaction time, amount, transaction object, transaction frequency, and account changes. Then, using natural language processing and graph neural network technologies, it transforms these unstructured or semi-structured transaction behavior descriptions into semantically consistent multi-dimensional vector representations. For example, in a financial regulatory scenario, if a company frequently engages in large-scale financial transactions with multiple related parties, the system will extract semantic features based on its transaction patterns, time distribution, and amount levels, mapping them to a unified vector space. This forms a structured transaction behavior feature matrix that reflects the entity's behavioral characteristics, providing a precise data foundation for subsequent fund flow analysis and risk assessment.

[0022] Step S2: Based on the structured transaction behavior feature matrix, perform topological analysis on the capital flow trajectory of the market participants to obtain a capital flow topological relationship map.

[0023] Specifically, based on the structured transaction behavior feature matrix, the system analyzes the capital flow trajectory of market participants to obtain a capital flow topology graph. The core of this step lies in using mathematical modeling and graph computing techniques to transform structured transaction behavior data into a visualized capital flow network structure. In the implementation process, the system extracts the capital flow relationships between market participants based on the structured transaction behavior feature matrix and constructs a graph model in the form of nodes and edges. Nodes represent the participants in the transaction, and edges represent the direction and intensity of capital flow between them. By performing topology analysis on this graph, abnormal capital circulation patterns such as critical paths, central nodes, and closed-loop backflows can be identified, thereby revealing potential risk chains. For example, in a financial regulatory scenario, when a company frequently conducts interbank transfers through multiple related accounts, the system constructs the topology of its capital flow based on its behavior vectors in the structured feature matrix and discovers complex behaviors such as multi-layered nesting, concealed transfers, or money laundering through shell companies in the graph, providing intuitive and interpretable graph evidence for subsequent risk assessment.

[0024] Step S3: Based on the capital flow topology map, conduct a risk assessment on the market entities to obtain a comprehensive risk assessment vector.

[0025] Specifically, risk assessment of market entities is conducted based on the aforementioned fund flow topology graph to obtain a comprehensive risk assessment vector. This process involves in-depth mining of structural features and behavioral patterns within the fund flow network, combined with graph neural networks, complex network analysis, and machine learning techniques to achieve a multi-dimensional quantitative assessment of the potential risks of market entities. Specifically, after obtaining the fund flow topology graph, the system further extracts topological indicators such as node centrality, path length, connectivity, and clustering coefficient. These are then combined with the historical behavioral characteristics of the trading entity, the number of related accounts, and the frequency of fund loops to construct a multi-level risk factor system, thereby generating a comprehensive risk assessment vector that reflects the entity's scores across different risk dimensions. For example, in a financial regulatory scenario, if a company frequently appears in multiple fund loop paths and its node influence in the graph significantly increases, the system will accordingly improve its scores in risk dimensions such as money laundering and related-party transaction manipulation, thus providing accurate risk judgment criteria for subsequent identification and early warning of improper behavior.

[0026] Step S4: When the comprehensive risk assessment vector exceeds the preset risk threshold, the inappropriate behavior type of the market entity is classified and identified based on the comprehensive risk assessment vector to obtain the inappropriate behavior type identification result.

[0027] Specifically, when the comprehensive risk assessment vector exceeds a preset risk threshold, the system classifies and identifies the types of misconduct by the market entity based on the comprehensive risk assessment vector, obtaining a result for identifying the type of misconduct risk. This process involves inputting quantified risk features into a trained classification model and using machine learning algorithms to perform pattern matching and classification judgments on different types of misconduct. Specifically, the system pre-constructs a dataset of labels for various typical misconduct behaviors, such as fraudulent transactions, misappropriation of funds, and related-party arbitrage, and trains a classifier with high-precision discrimination capabilities using supervised or semi-supervised learning methods. Once the comprehensive risk assessment vector breaks through the set risk warning line, the system initiates the classification and identification process. Based on the distribution characteristics of the vector across various risk dimensions, it automatically matches the most likely type of misconduct, thereby outputting a structured result for identifying the type of misconduct. For example, in a financial regulatory scenario, if a company's comprehensive risk assessment vector shows outstanding scores in the dimensions of "frequent closed-loop transactions" and "abnormal transfers between related accounts," the system will identify its behavior as more consistent with money laundering or illicit transfer of benefits, thus providing clear behavioral qualitative support for subsequent early warning responses.

[0028] Step S5: The inappropriate behavior type identification results are used to determine the real-time early warning trigger conditions through a dynamic threshold adjustment mechanism to obtain an intelligent early warning response scheme.

[0029] Specifically, a dynamic threshold adjustment mechanism is used to determine the real-time early warning trigger conditions based on the identification results of the improper behavior types, resulting in an intelligent early warning response scheme. The core of this step lies in building a risk early warning control system with adaptive learning capabilities to address the dynamic evolution of market participants' behavior patterns and the changing demands of the external regulatory environment. The specific implementation involves the system continuously optimizing the threshold parameters used to determine whether to trigger an early warning, based on historical early warning records, current market behavior distribution trends, and regulatory policy guidance, using time series analysis and reinforcement learning algorithms. This avoids the risk of increased false alarms or missed alarms due to fixed thresholds. For example, in a financial regulatory scenario, if a company is identified as engaging in "related-party transaction arbitrage" within a specific time period, and its risk characteristics show an upward trend over time, the system will automatically lower the early warning trigger threshold for this type of behavior based on the dynamic threshold adjustment mechanism, and promptly generate a corresponding intelligent early warning response scheme, including risk warnings, regulatory intervention suggestions, or account freezing plans, ensuring the accuracy and timeliness of regulatory measures.

[0030] In a specific embodiment, the multi-dimensional semantic vectorization encoding processing of the market participants' transaction record data to obtain a structured transaction behavior feature matrix includes: The transaction record data of the market participants are decomposed into time series to obtain transaction trend components, seasonal components and random fluctuation components, and a multi-level time feature vector is constructed based on the transaction trend components, seasonal components and random fluctuation components; The text information in the transaction record data is semantically encoded using adaptive word embedding technology to obtain a transaction semantic feature vector. Context relevance analysis is then performed based on the transaction semantic feature vector to obtain a transaction semantic association network. A structured transaction behavior feature matrix is ​​constructed based on the multi-level time feature vector and the transaction semantic association network.

[0031] Specifically, in this method, the step of "performing multi-dimensional semantic vectorization encoding of market participants' transaction record data to obtain a structured transaction behavior feature matrix" is the foundation of the entire system's identification and early warning process. Its core objective is to transform the raw transaction data into a high-dimensional numerical representation with semantic consistency and structural integrity, so that it can be used for subsequent fund flow topology analysis, risk assessment, and identification of inappropriate behavior. Specifically, this process includes the following three sub-steps: time series decomposition to construct multi-level time feature vectors, semantic encoding of textual information to generate transaction semantic feature vectors, and further extraction of transaction semantic association networks based on these, finally integrating the information from the above two dimensions to construct a structured transaction behavior feature matrix that can comprehensively reflect the behavioral characteristics of market participants. First, in the part of "performing time series decomposition of the market participants' transaction record data to obtain transaction trend components, seasonal components, and random fluctuation components," the system will perform time series modeling on the market participants' historical transaction data (such as daily transfer amounts, transaction frequency, account changes, etc.). For example, assuming a company has daily transaction records over the past year, the system uses time series decomposition algorithms (such as STL or wavelet transform) to divide the time series of its transaction amounts into three main components: a transaction trend component (reflecting long-term trends), a seasonal component (capturing periodic patterns, such as weekly or monthly fixed patterns), and a random fluctuation component (describing short-term uncertainty). By extracting these components, the system can more clearly understand the entity's behavior at different time scales and construct a multi-level time feature vector based on these three components. For example, if a company's transaction trend is upward and there are significant transaction peaks at the end of each quarter, its seasonal component will show strong periodic signals, while the random fluctuation component may reflect the existence of abnormal transaction activities, thus providing time-dimensional support for subsequent risk assessment. Secondly, in the stage of "semantically encoding the textual information in the transaction record data using adaptive word embedding technology to obtain a transaction semantic feature vector," the system performs deep semantic modeling on the non-numerical textual information contained in the transaction records. This textual information may include transaction notes, transaction purpose descriptions, payee names, bank statement summaries, etc. For example, if a company repeatedly includes terms like "payment settlement," "cooperative investment," and "equipment procurement" in transaction remarks, the system will use adaptive word embedding technology (such as an improved version of BERT or Word2Vec) to map these terms into a unified semantic space, forming corresponding transaction semantic feature vectors. This vectorization process not only preserves the semantic similarity between words but also dynamically adjusts the word vectors according to the context, allowing the same word to present different expressions in different contexts.For example, the term "investment" might refer to capital operation activities in the context of "equity investment," while in the context of "project investment," it might be closer to actual business transactions. The system can effectively distinguish between these two situations through an adaptive mechanism, thereby improving the accuracy of semantic expression. Subsequently, to further explore the deep relationships between transaction texts, the system will "perform contextual relevance analysis based on the transaction semantic feature vectors to obtain a transaction semantic association network." This step aims to establish semantic connections between different transaction items. For example, if a company uses terms such as "supply chain financing," "accounts receivable pledging," and "factoring" in multiple transactions, the system will detect their similarity in the semantic space and connect these keyword nodes through a graph approach to construct a transaction semantic association network that reflects the company's transaction semantic logic. In this way, the system can not only identify whether a company frequently uses specific terms to conceal the actual use of funds, but also discover potential closed-loop funding paths or related transaction chains. For example, if company A frequently mentions "technical service fees" in transactions, but its counterparties B, C, and D have numerous similar transaction records, the system can infer that these transactions may involve fraudulent contracts or the transfer of benefits. Finally, the system will "construct a structured transaction behavior feature matrix based on the multi-level time feature vectors and the transaction semantic association network," that is, integrate information from the time and semantic dimensions to form a unified representation structure that simultaneously reflects dynamic changes over time and semantic behavioral characteristics. For example, a company might exhibit a surge in transactions at the end of a quarter and significant fluctuations within a month in the time dimension, while frequently using terms like "equity repurchase" and "asset transfer" in the semantic dimension, forming a semantic association network with multiple related parties. The system will integrate this information into a high-dimensional matrix, where each row represents transaction behavior within a time window, and each column corresponds to a different time or semantic feature dimension. Through this structured representation, the system can more comprehensively depict the behavioral trajectory of market participants, providing a precise data foundation for subsequent topological analysis of fund flows and risk assessment. In summary, this step obtains multi-level temporal features through time series decomposition, extracts transaction semantic features using adaptive word embedding technology, and constructs a semantic association network. Finally, it merges these two elements to form a structured transaction behavior feature matrix, achieving the transformation from raw transaction records to high-dimensional semantic features. This provides solid technical support for subsequent intelligent identification and early warning. For example, in a financial regulatory scenario, if a company frequently appears in a closed-loop funding path, and its semantic feature vector shows that its transaction content involves sensitive terms such as "related-party transactions" and "equity holding on behalf of others," the system will determine that its behavior carries a high risk and proceed to the next step of risk assessment and early warning.

[0032] In a specific embodiment, the step of topologically analyzing the capital flow trajectory of market participants based on the structured transaction behavior feature matrix to obtain a capital flow topology map includes: Multi-dimensional clustering analysis is performed on the structured transaction behavior feature matrix to obtain transaction entity groups, and the capital flow trajectory of the market entities is analyzed based on the topology of the transaction entity groups to generate an initial capital flow network; The importance of nodes in the initial fund flow network is evaluated by using a complex network centrality measurement method to obtain a set of key fund hub nodes. Based on the set of key fund hub nodes, community detection is performed to obtain the fund flow community structure. Dynamic graph embedding technology is applied to the aforementioned fund flow community structure to obtain a time-varying fund flow graph representation. Based on the time-varying fund flow graph representation, a time-series consistency analysis is performed to obtain fund flow pattern characteristics. Based on the characteristics of the fund flow pattern and the set of key fund hub nodes, a graph neural network is used to perform dynamic evolution analysis on the fund flow topology to obtain a fund flow topology graph.

[0033] Specifically, in this method, the technical step of "analyzing the capital flow trajectory of market participants based on the structured transaction behavior feature matrix to obtain a capital flow topology graph" is the core link of the entire system for identifying complex capital flow relationships between market participants. Its purpose is to transform high-dimensional, multi-source transaction behavior data into a capital network model with semantic interpretability and temporal evolution capabilities, thereby providing a visualized and quantifiable analytical foundation for subsequent risk assessment and early warning. This step includes four key sub-processes: First, multi-dimensional clustering analysis is performed on the structured transaction behavior feature matrix to identify transaction entity groups, and an initial capital flow network is constructed accordingly; then, the importance of nodes is evaluated using a complex network centrality measurement method, key capital hub node sets are extracted, and community detection is performed to form a capital flow community structure; next, dynamic graph embedding technology is applied to capture the time-varying characteristics of the community structure and extract capital flow pattern features; finally, graph neural networks are combined to model the dynamic evolution path of the capital flow topology structure, generating a complete capital flow topology graph. Specifically, after obtaining the structured transaction behavior feature matrix output from the previous step, the system performs multi-dimensional clustering analysis to identify sets of transaction entities with similar behavioral characteristics in terms of time trends, seasonal fluctuations, and semantic expressions. For example, in a financial regulatory scenario, Company A had 12,000 transactions in the past year, involving 500 different transaction counterparties. Each record contains fields such as timestamp, amount, transaction type, and remarks. This information has been encoded into a 12,000×300-dimensional structured transaction behavior feature matrix. The system uses algorithms such as K-Means or DBSCAN to cluster this matrix, ultimately dividing it into multiple transaction entity groups, such as "high-frequency small-amount transfer groups," "large-amount periodic settlement groups," and "semantically sensitive transaction groups." Suppose the system identifies 6 main groups, with the 4th group containing 120 transaction entities. These entities frequently engage in cross-regional, large-amount transactions, and transactions with terms such as "equity transfer" and "investment funds" in their remarks. This indicates that this group may constitute part of a potential closed-loop funding path. Based on these groups, the system further performs topological analysis on the capital flow paths between market participants, constructing an initial capital flow network. Each node represents a transaction entity, and edges represent the direction and frequency of capital flow between two entities. Next, to gain a deeper understanding of the structural characteristics of this capital flow network, the system introduces a node centrality measurement method from complex network theory to assess the importance of each node in the initial capital flow network. Specifically, the system calculates the degree centrality (measuring the number of connections), proximity centrality (reflecting the efficiency of reaching other nodes), betweenness centrality (reflecting the ability to control information flow), and PageRank value (simulating the influence of a node under random walk) for each node. A weighted comprehensive scoring method is then used to identify the set of key capital hub nodes that play a core role in the network.For example, in the aforementioned case, the system identified eight nodes that ranked highly on multiple centrality indicators. These nodes, distributed across multiple trading entity groups, possessed the ability to connect different groups and were thus identified as part of a set of key funding hub nodes. Based on these hub nodes, the system further conducted community detection, using the Louvain algorithm to identify several funding flow community structures with tight internal connections and sparse external connections. For instance, it discovered a community composed of 40 trading entities, with frequent fund inflows between them, forming a highly self-consistent funding loop. This structure is often closely related to related-party transactions or money laundering. To more accurately depict the dynamic evolution of funding flows, the system continued to apply dynamic graph embedding technology to the identified funding flow community structures, mapping them to a low-dimensional vector space to obtain a time-varying funding flow graph representation. For example, the system updates the funding flow network every month and converts it into a 100-dimensional graph embedding vector, allowing observation of the changing trends of community structures over time. By performing temporal consistency analysis on these graph embedding vectors, the system can determine which community structures remain stable over a longer period and which exhibit dramatic fluctuations. For example, if the graph embedding vector of a community remains highly consistent over four consecutive months, it indicates that its capital flow pattern is relatively fixed. Conversely, if the graph embedding vector of another community changes significantly within two months, the system will determine that its capital structure is undergoing restructuring or abnormal changes, thus providing a basis for subsequent risk identification. Finally, based on the extracted capital flow pattern features and the set of key capital hub nodes, the system uses a graph neural network (GNN) to model the evolution path of the capital flow topology. Specifically, the system uses historical capital flow graph sequences as input to train a GNN model to predict the graph structure changes at the next moment, thereby simulating the dynamic evolution of the capital network. For example, in the aforementioned case, the system trained a predictive GNN model based on graph embedding data from the past six months and successfully predicted that the capital inflow of a certain capital hub node would increase by 30% in the next month, while the graph embedding vector of its community would also shift. This means that the capital structure of the community is about to change, and there may be a risk of capital concentration or transfer. Finally, the system integrates all analysis results to generate a complete fund flow topology map. This map not only reflects the current state of fund flows but also reveals their historical evolution path and future development trends, providing comprehensive data support for subsequent integrated risk assessment and identification of inappropriate behavior. In summary, this step identifies transaction entity groups and constructs an initial fund flow network through multi-dimensional clustering analysis. It then combines complex network centrality assessment and community detection to mine the local structure of fund flows, captures their time-varying characteristics through dynamic graph embedding and temporal consistency analysis, and finally models their dynamic evolution process using graph neural networks, thereby generating a fund flow topology map with high interpretability and predictive power.For example, in a financial regulatory scenario, if a company frequently appears in multiple community structures and the graph embedding vector of its community shows a rapid changing trend, the system will judge that its behavior is highly abnormal and proceed to the next step of the risk assessment process, providing accurate basis for intelligent early warning.

[0034] In a specific embodiment, the step of evaluating the node importance of the initial fund flow network using a complex network centrality measurement method to obtain a set of key fund hub nodes includes: Degree centrality is calculated on the initial fund flow network to obtain a node connectivity degree distribution sequence, and feature entropy is calculated on the node connectivity degree distribution sequence to obtain a node connectivity entropy matrix, wherein the node connectivity entropy matrix includes in-degree entropy, out-degree entropy, and connectivity strength entropy. Based on the node connection entropy matrix, the betweenness centrality of the initial capital flow network is analyzed to obtain a path control index set, and the path control index set is decomposed hierarchically to obtain a multi-level node influence spectrum. The proximity centrality measure of the influence spectrum of the multi-level nodes is performed to obtain the node proximity metric, and the feature subspace is mapped based on the node proximity metric to obtain the node importance feature vector group. Based on the node importance feature vector group, the node proximity metric is threshold-filtered to obtain a set of key funding hub nodes.

[0035] Specifically, in this method, "evaluating the importance of nodes in the initial fund flow network using a complex network centrality measurement method to obtain a set of key fund hub nodes" is a crucial technical step in constructing the fund flow topology graph, used to identify core transaction entities and reveal their control and influence within the network structure. This step aims to systematically analyze the multi-dimensional centrality characteristics of each node in the initial fund flow network, ultimately selecting a set of market entities with significant fund hub roles, providing structural support for subsequent community detection and dynamic evolution modeling. In practice, this step first calculates the degree centrality of the initial fund flow network to obtain the connectivity of each node during the fund flow process, and then generates a node connectivity distribution sequence accordingly. Here, degree centrality includes in-degree (representing a node's ability to receive funds), out-degree (representing a node's ability to output funds), and connectivity strength (i.e., the total amount of fund flow). For example, in a financial regulatory scenario, if a company receives inflows from 150 different accounts and initiates outflows to 120 accounts over the past year, with a total cumulative fund flow of 300 million yuan, then the company has high in-degree, out-degree, and connection strength. The system organizes this information into a node connectivity distribution sequence containing the in-degree, out-degree, and connection strength of all nodes, and further calculates its feature entropy to measure the uncertainty or diversity of each node's connection behavior. For example, if a node's in-degree distribution is relatively concentrated (e.g., mainly concentrated among a few accounts), its in-degree entropy value is low; while if a node's in-degree distribution is wide and balanced, its in-degree entropy value is high. The system constructs a node connection entropy matrix containing in-degree entropy, out-degree entropy, and connection strength entropy values ​​in this way, thereby quantifying the stability and diversity of each node's connection patterns. Next, the system performs betweenness centrality analysis on the initial fund flow network based on the above node connection entropy matrix to identify nodes that act as intermediaries in the fund paths. Betweenness centrality reflects the frequency with which a node is traversed in the global capital flow path. A higher value indicates that the node is more likely to become a key point controlling the flow of funds. For example, in an initial capital flow network consisting of 500 trading entities, even if company X's transaction amount is not the largest, it frequently appears in multiple capital flow paths, acting as a "middleman" between several other nodes, resulting in a very high betweenness centrality score. The system defines this indicator as a path control power indicator set and further decomposes it hierarchically to distinguish the influence of nodes at different levels. For example, the system can set three influence levels: high influence (top 5% of nodes), medium influence (5%-20%), and low influence (bottom 80%), and assign each node to the corresponding level according to its path control power, thus forming a multi-level node influence spectrum. Through this hierarchical processing, the system can more clearly identify which nodes have a strategic position in the entire capital network.Subsequently, the system performs a proximity centrality measure on each node in the aforementioned multi-level node influence spectrum to assess its reachability to other nodes. Higher proximity centrality indicates that the node is closer to other nodes in the network, possessing stronger information dissemination or fund allocation capabilities. For example, if company Y can reach most other nodes in the network within a few hops, its proximity centrality score will be high, meaning it may be an important coordinator in the entire funding network. The system uses this measure as a node proximity metric and integrates it with the aforementioned node connection entropy, path control, and other information to form a comprehensive set of node importance descriptive features. Based on this, the system further performs feature subspace mapping on these features, projecting them into different semantic subspaces to mine the importance performance of nodes under different dimensions. For example, the system may map certain features to a "fund control subspace," a "network connection stability subspace," or a "liquidity activity subspace," thus forming a node importance feature vector set containing features from multiple subspaces. Finally, the system uses the extracted node importance feature vector set to perform threshold screening on the node proximity metrics to determine which nodes truly have the potential to become funding hubs. For example, the system can set a comprehensive scoring threshold. Only when a node's weighted score across multiple dimensions, such as path control, proximity centrality, and connectivity entropy, exceeds this threshold will it be included in the final set of key funding hub nodes. Suppose in a case where the system identifies 480 transaction entities, only 32 nodes perform exceptionally well across all indicators. These nodes are not only located in the middle of multiple funding paths but also possess high connectivity diversity and network reachability, thus being identified as part of the key funding hub node set. These nodes often correspond to market entities playing crucial roles in closed-loop funding, related-party transactions, and money laundering operations, making them key targets for subsequent risk identification and early warning responses. In summary, this step obtains node connectivity characteristics through degree centrality and feature entropy analysis, identifies path control through betweenness centrality and hierarchical decomposition, constructs a node importance feature system using proximity centrality measures and feature subspace mapping, and finally accurately extracts the key funding hub node set through threshold screening. For example, in a financial regulatory scenario, if a company appears multiple times in the middle of several funding paths and has a high connection entropy and strong proximity, the system will determine that it has significant funding control capabilities and include it in the set of key funding hub nodes, providing basic data support for subsequent community structure identification and dynamic evolution analysis.

[0036] In a specific embodiment, the step of conducting risk assessment on the market entities based on the capital flow topology map to obtain a comprehensive risk assessment vector includes: Entropy values ​​are calculated for the node degree centrality and edge weight distribution in the fund flow topology graph to obtain an anomaly measurement index for fund flow, and quantile statistics are performed on the anomaly measurement index to obtain an abnormal fund flow feature set. Based on the abnormal fund flow feature set, subgraph extraction is performed on the fund flow topology graph to obtain a high-risk fund flow subnetwork, and time-series evolution analysis is performed on the high-risk fund flow subnetwork to obtain risk propagation path characteristics. The risk propagation path characteristics are decomposed into multiple layers using spectral clustering to obtain hierarchical risk assessment indicators. Based on these hierarchical risk assessment indicators, a hierarchical risk measurement system is constructed to obtain multidimensional risk quantification parameters. Based on the multidimensional risk quantification parameters, a multidimensional correlation analysis is performed on the market participants to obtain a risk correlation strength matrix. Then, feature vectors are extracted from the risk correlation strength matrix to obtain a comprehensive risk assessment vector, which includes risk level, risk volatility, and risk transmission coefficient.

[0037] Specifically, in this method, the technical step of "conducting risk assessment on the market entities based on the fund flow topology graph to obtain a comprehensive risk assessment vector" is one of the core analytical modules for the entire system to achieve risk identification and early warning. Its goal is to extract multi-dimensional risk characteristic indicators through in-depth mining of the fund flow network structure, and ultimately generate a comprehensive risk assessment vector that reflects the performance of market entities under different risk dimensions. This step includes four main sub-processes: First, anomaly measurement indicators of fund flows are obtained by calculating the entropy values ​​of node degree centrality and edge weight distribution, and an abnormal fund flow feature set is extracted accordingly; then, high-risk fund flow sub-networks are extracted based on these features, and their temporal evolution paths are analyzed; next, the risk propagation path features are decomposed hierarchically using spectral clustering to construct a hierarchical risk measurement system; finally, correlation analysis is performed using multi-dimensional risk quantification parameters to generate a comprehensive risk assessment vector with clear interpretability. Specifically, after obtaining the fund flow topology graph, the system first calculates the entropy values ​​of node degree centrality and edge weight distribution in the graph to measure the concentration of funds in the network and the uncertainty of liquidity distribution. For example, in a financial regulatory scenario, company A, as a node in a graph, has an in-degree of 180 and an out-degree of 165, connecting multiple upstream and downstream trading entities. Its edge weights (i.e., the amount of funds flowing) are highly unevenly distributed, mainly concentrated among a few accounts. In this case, its connection entropy value will be low, indicating that its fund flows are relatively concentrated, potentially suggesting related-party transactions or hidden control links. The system calculates the entropy value of all nodes in the graph based on their degree centrality and edge weight distribution, thus deriving a set of abnormal fund flow metrics to describe the degree of abnormality in fund flows. Next, the system performs quantile statistics on these metrics, taking the top 10% of nodes as highly abnormal nodes to form an abnormal fund flow feature set. Assuming there are 450 nodes in the graph, 45 nodes are assigned to this feature set; these nodes often represent companies or accounts whose fund flow patterns significantly deviate from normal behavior. Next, based on the extracted abnormal fund flow feature set, the system performs subgraph extraction on the original fund flow topology graph, focusing on local areas with highly abnormal fund flows to generate a high-risk fund flow subnetwork. For example, the system might extract a sub-network of 32 transaction entities from the original graph. These entities have frequent and closed-loop fund flows, such as the fund return path of enterprise B→C→D→B, which is usually closely related to misconduct such as money laundering and fraudulent transactions. To further understand the behavioral evolution of these high-risk sub-networks, the system performs temporal evolution analysis to track their structural changes over time.For example, the system divides the graph by month and observes the changing trends of indicators such as the number of nodes, edge density, and average path length of the sub-network over the past six months. It finds that the number of nodes has increased from the initial 18 to 32, and the edge density has risen from 0.3 to 0.7, indicating that the sub-network is rapidly expanding and the flow of funds is becoming more complex. Based on this, the system extracts a set of risk propagation path features to characterize the diffusion path and evolution speed of high-risk behaviors. Building on this, the system uses spectral clustering to decompose the aforementioned risk propagation path features into multiple layers to reveal the risk manifestations at different levels. For example, the system divides risk propagation into three levels based on the similarity of path features: the first level represents high-frequency, short-path propagation, such as funds completing a closed loop within a week; the second level is medium-frequency, medium-to-long-path propagation, such as funds being transferred multiple times through intermediary accounts; and the third level is low-frequency, long-path propagation, involving complex fund operations across regions and industries. By clustering the propagation paths at each level, the system extracts corresponding hierarchical risk assessment indicators, including path frequency, path length, and path coverage, and constructs a hierarchical risk measurement system based on these indicators. For example, if a path appears 12 times per month in the first level and has a path length of only 3 hops, it is classified as a high-risk path with a risk level coefficient of 0.9. Conversely, if another path appears only occasionally and has a longer path length, its risk level coefficient is set to 0.3, thus forming a set of quantifiable multidimensional risk parameters. Finally, the system conducts multidimensional correlation analysis on market entities based on these multidimensional risk parameters to assess the strength of their association under different risk factors. For example, the system analyzes whether company X frequently appears in high-risk paths, whether it is located in a key hub position, and whether its capital flow exhibits periodic abnormal fluctuations, and integrates this information into a risk correlation strength matrix. Each element in this matrix represents the correlation strength between two risk dimensions. For example, the correlation coefficient between "funding loop frequency" and "node mediating ability" is 0.85, indicating a high correlation between the two, meaning that funding loop behavior often occurs at nodes with strong mediating capabilities. The system further extracts feature vectors from this matrix to obtain a comprehensive risk assessment vector that reflects the overall risk situation. This includes risk level (e.g., low, medium, high, extremely high), risk volatility (e.g., the standard deviation of the average risk score over the past six months), and risk transmission coefficient (reflecting the ability of risk to spread from one entity to other entities). For example, the comprehensive risk assessment vector of company Y shows that its risk level is "high," its risk volatility is 0.28, and its risk transmission coefficient is 0.72, indicating that it not only has high risk itself but may also become a source of risk propagation, requiring close monitoring.In summary, this step extracts abnormal fund flow characteristics by entropy modeling of node degree centrality and edge weight distribution in the fund flow topology graph; further, it extracts high-risk subnetworks and analyzes their evolution paths; then, it uses spectral clustering to conduct hierarchical risk assessment, constructing a multi-level risk measurement system; finally, it combines multi-dimensional quantitative parameters to perform correlation modeling, outputting a comprehensive risk assessment vector with clear semantic interpretation. For example, in a financial regulatory scenario, if a company repeatedly appears in multiple high-risk paths and its risk level continues to rise, the system will determine that it has a high probability of violating regulations and proceed to the next step of the inappropriate behavior type identification process, providing accurate risk judgment basis for intelligent early warning.

[0038] In a specific embodiment, the step of classifying and identifying the types of inappropriate behavior of the market entity based on the comprehensive risk assessment vector, and obtaining the inappropriate behavior type identification result, includes: The comprehensive risk assessment vector is transformed in the feature space to obtain a risk feature subspace mapping matrix, and the risk feature subspace mapping matrix is ​​decoupled in terms of behavior patterns to obtain a set of behavior feature components. Density clustering analysis is performed on the risk feature subspace mapping matrix based on the behavioral feature component set to obtain behavioral type clusters. Then, it is identified whether there are inappropriate clusters in the behavioral type clusters. If there are, the boundary features in the behavioral type clusters are extracted by a preset boundary-sensitive heuristic algorithm to obtain an inappropriate behavior boundary feature map. The boundary feature map of the inappropriate behavior is subjected to map matching analysis to obtain the mapping relationship of inappropriate behavior types. Based on the mapping relationship of inappropriate behavior types, the clusters of behavior types are semantically labeled to obtain the semantic description sequence of inappropriate behavior. Based on the semantic description sequence of the inappropriate behavior, the mapping relationship of the inappropriate behavior type is classified in a multi-level manner to obtain the inappropriate behavior type identification result.

[0039] Specifically, in this method, "classifying and identifying the types of inappropriate behavior of the market entities based on the comprehensive risk assessment vector, and obtaining the identification results of inappropriate behavior types" is the key step in the entire system's transition from quantitative risk assessment to qualitative behavior classification. The core objective of this step is to transform abstract risk indicators into specific labels for inappropriate behavior types by using techniques such as feature decoupling, cluster analysis, and graph matching on the comprehensive risk assessment vector output from the previous step. This provides clear behavioral criteria for subsequent early warning responses. In the specific implementation process, the system first performs a feature space transformation on the input comprehensive risk assessment vector, mapping it to multiple risk subspaces with specific semantic meanings, forming a risk feature subspace mapping matrix. For example, in a financial regulatory scenario, a company's comprehensive risk assessment vector might contain values ​​such as "risk level: high," "risk volatility: 0.32," and "risk transmission coefficient: 0.78." These indicators reflect the company's abnormal performance in terms of capital loop frequency, path control, and node influence. The system projects these comprehensive indicators into different risk dimension subspaces, such as "related-party transaction risk subspace," "money laundering risk subspace," and "fraudulent transaction risk subspace," through linear or nonlinear transformations, thereby generating a risk feature subspace mapping matrix that reflects the potential tendencies of these indicators under different behavioral patterns. Subsequently, the system decouples this mapping matrix by separating the features under different risk dimensions, extracting several independent and interpretable behavioral feature component sets. For example, the system might identify that Company A scores as high as 92 points in the "related-party transaction" dimension, 85 points in the "fund closure" dimension, but only 40 points in the "cross-regional flow" dimension. This indicates that its main risks are concentrated in related-party transactions and fund repatriation, rather than cross-border fund operations. This decoupling process helps to identify its behavioral types more precisely in subsequent steps. Next, based on the extracted behavioral feature component sets, the system performs density clustering analysis on the original risk feature subspace mapping matrix to identify sets of market entities with similar behavioral patterns, i.e., behavioral type clusters. For example, the system divides all market participants into multiple clusters based on their risk characteristics. Cluster 1 contains 25 companies that generally exhibit high frequency of related-party transactions and low liquidity. Cluster 2 contains 18 companies, characterized by frequent fund loops and short fund flow paths. The system further detects whether there are inappropriate clusters within each cluster, i.e., groups with overall risk levels significantly higher than normal and highly consistent behavioral patterns. For example, if more than 80% of the companies in a cluster have been marked as high-risk in the past six months and their fund flows exhibit a clear closed-loop structure, then that cluster is considered an inappropriate cluster.Once an inappropriate cluster is identified, the system employs a pre-defined boundary-sensitive heuristic algorithm to deeply analyze its internal structure, extracting distinguishable boundary features to construct an inappropriate behavior boundary feature map. For example, the system identifies a large number of cyclical uses of terms such as "payment settlement" → "technical service fee" → "investment funds" among companies in an inappropriate cluster. Combining this with the fund flow path, it extracts boundary features such as "closed-loop fund path length ≤ 3 hops," "transaction note keyword repetition rate ≥ 60%," and "frequency of high-frequency transfers between related accounts ≥ 5 times per week," serving as key criteria for identifying this type of inappropriate behavior. Subsequently, the system performs graph matching analysis on the aforementioned inappropriate behavior boundary feature map, comparing it with known inappropriate behavior templates in the historical database to identify the most matching inappropriate behavior type, forming an inappropriate behavior type mapping relationship. For example, if a set of boundary features matches the "related-party transaction arbitrage" template by 92%, the system determines that the companies in that cluster are mainly involved in related-party transactions. If another set of features matches the "money laundering" template by an even higher percentage (e.g., 88%), it is classified as a money laundering risk category. This process relies not only on the topological similarity of the graph structure but also incorporates multimodal information such as textual semantics and time series data to ensure the accuracy and interpretability of the classification results. Finally, based on the obtained mapping relationship of improper behavior types, the system semantically annotates the corresponding behavior type clusters, generating a set of semantic description sequences of improper behavior with natural language capabilities. For example, for a certain improper cluster, the semantic description sequence output by the system is: "This market entity frequently conducts closed-loop fund operations through multiple related accounts, repeatedly using terms such as 'technical service fee' and 'investment funds' in the transaction notes, suspected of using fictitious transactions to conceal the true purpose of funds." This semantic description is not only easy for regulators to understand but also provides semantic support for subsequent multi-level classification. Finally, based on this semantic description sequence, the system performs multi-level classification of the improper behavior type mapping relationship and outputs the final improper behavior type identification result. For example, the system categorizes misconduct into primary categories (such as "misappropriation of funds," "related-party transactions," and "money laundering") and secondary categories (such as "short-term fund loops," "multi-layered nested account transfers," and "fabricated contracts for cover-ups"), and assigns one or more manually verifiable and interpretable labels to each market entity. Suppose a company is identified as "related-party transaction arbitrage" in multiple classification models, and its semantic description highly matches the characteristics of this type of behavior; then, its final misconduct type identification result is "related-party transaction arbitrage." In summary, this step extracts behavioral feature component sets by performing feature space transformation and behavioral pattern decoupling on the comprehensive risk assessment vector; then, it identifies improper clusters using density clustering analysis and extracts key boundary features using a boundary-sensitive heuristic algorithm; next, it determines the behavioral type mapping relationship through graph matching and generates behavioral description sequences using semantic annotation; finally, it completes multi-level classification and outputs semantically interpretable misconduct type identification results.For example, in a financial regulatory scenario, if a company exhibits a high degree of consistency across multiple risk dimensions and its behavioral boundary characteristics closely match historical money laundering templates, the system will classify it as "money laundering behavior" to provide accurate behavioral qualitative support for subsequent early warning responses.

[0040] In a specific embodiment, the step of using a dynamic threshold adjustment mechanism to determine the real-time early warning trigger conditions for the inappropriate behavior type identification results, thereby obtaining an intelligent early warning response scheme, includes: The results of the identification of the inappropriate behavior type are processed by a dynamic threshold adjustment mechanism to obtain a warning threshold hierarchy matrix. The warning threshold hierarchy matrix is ​​then dynamically updated in time to obtain an adaptive warning threshold sequence. The adaptive warning threshold sequence includes a behavior type risk threshold, a trigger time window threshold, and a warning level determination threshold. Based on the adaptive warning threshold sequence, the results of the identification of the inappropriate behavior type are classified and warning is determined to obtain a warning trigger instruction set. Then, the warning trigger instruction set is matched with a response strategy to obtain an intelligent warning response scheme. The intelligent warning response scheme includes a warning level identifier, a list of handling measures, and response time limit requirements.

[0041] Specifically, in this method, "real-time early warning triggering conditions are determined based on the identification results of the improper behavior types through a dynamic threshold adjustment mechanism to obtain an intelligent early warning response scheme" is the key link in realizing the closed loop from behavior identification to intelligent response in the entire system. This step aims to construct an adaptive early warning triggering and response mechanism based on the identified improper behavior types and their risk levels of market entities, combined with historical data, changes in the market environment, and regulatory policy requirements, thereby improving the flexibility, accuracy, and timeliness of the early warning system. In specific implementation, the system first uses a dynamic threshold adjustment mechanism to set and optimize the thresholds of the improper behavior type identification results output in the previous step at multiple levels. For example, in a financial regulatory scenario, a company is identified as engaging in "related-party transaction arbitrage," and its comprehensive risk assessment vector shows that it has a high risk level, frequent fund closures, and strong risk transmission capabilities. To ensure that the early warning mechanism can make differentiated responses based on different behavioral characteristics, the system divides the early warning thresholds into multiple levels, forming an early warning threshold hierarchy matrix. This matrix typically includes three core dimensions: First, a risk threshold for behavior type, used to measure the severity of different types of inappropriate behavior, such as setting the risk weight for money laundering at 0.9, fraudulent transactions at 0.7, and related-party transactions at 0.6; second, a trigger time window threshold, i.e., whether the frequency of a certain behavior within a specific time range exceeds the warning line, such as "≥5 closed-loop fund operations within 3 consecutive days" triggering a Level 1 warning; and third, a warning level determination threshold, used to classify different levels of warning signals, such as a red warning triggered by a comprehensive score exceeding 85 points, an orange warning triggered by 70-85 points, and a yellow warning triggered by 50-70 points. Based on this, the system further performs time-series dynamic updates to the aforementioned warning threshold hierarchy matrix to address the characteristics of market behavior patterns evolving over time. For example, the system automatically collects the latest transaction data and risk identification results every 24 hours, and performs a weighted average calculation based on historical trends, dynamically adjusting the thresholds at each level. Suppose that the average risk score for a certain type of related-party transaction behavior was 68 points in the past month, but rose to 75 points in the most recent week, the system will automatically raise the trigger threshold for that behavior type to avoid excessively high false alarm rates. The final generated adaptive warning threshold sequence not only includes static risk scores but also incorporates time-sensitive factors, enabling the warning system to better reflect real-time market changes. Next, based on the constructed adaptive warning threshold sequence, the system performs tiered warning determinations for each market participant's misconduct type identification results. For example, if a company's behavior falls under the category of "money laundering" and its current risk score reaches 89 points, exceeding the preset red warning threshold (85 points), the system will generate a high-priority warning trigger instruction. Similarly, if another company, although not meeting the red warning standard, experiences a significant increase in its closed-loop fund activity within a short period, meeting the trigger conditions for an orange warning, the system will also generate a corresponding warning instruction.All these triggering instructions are aggregated into early warning triggering instruction sets and categorized according to dimensions such as urgency, scope of impact, and behavior type. Subsequently, the system performs response strategy matching on these early warning triggering instruction sets, automatically matching corresponding measures based on different early warning levels to form an intelligent early warning response plan. For example, for a red alert, the system automatically associates the highest priority response strategy, including measures such as "immediately freezing relevant accounts," "initiating on-site investigation procedures," and "reporting to regulatory authorities," with a response time limit of "completing preliminary verification within 2 hours." For orange or yellow alerts, relatively milder measures are matched, such as "issuing a risk warning letter," "requiring the company to submit explanatory materials," and "setting an observation period to monitor its subsequent behavior," with response time limits of "24 hours" and "72 hours," respectively. Furthermore, the system embeds early warning level identifiers into the response plan, such as four-level early warning indicators (red / orange / yellow / blue), to facilitate rapid risk identification by regulatory personnel. It is worth noting that this dynamic early warning mechanism is not static but has the ability to continuously learn and optimize based on feedback. For example, the system periodically evaluates the actual consequences of each alert trigger. If a certain behavior is marked as high-risk but does not cause substantial harm afterward, its triggering conditions will be appropriately relaxed in the next round of threshold adjustments, and vice versa. This mechanism effectively avoids the "oversensitivity" or "sluggishness" problems common in traditional fixed-threshold alert systems, improving the overall intelligence and practicality of the alert system. In summary, this step performs multi-threshold hierarchical processing on the results of inappropriate behavior type identification through a dynamic threshold adjustment mechanism, generates an adaptive alert threshold sequence by combining time series analysis, performs hierarchical alert determination based on this sequence, extracts the alert trigger instruction set, and finally matches the optimal response strategy to generate an intelligent alert response plan that includes alert level identifiers, a list of disposal measures, and response time limits. For example, in a financial regulatory scenario, if a company exceeds the alert threshold in multiple dimensions, the system will immediately generate a red alert response plan and link the risk control system to execute account freezing and clue reporting, achieving a fully automated response from behavior identification to risk control.

[0042] The above describes the AI-driven intelligent identification and early warning method for improper market behavior in embodiments of the present invention. The following describes the AI-driven intelligent identification and early warning device for improper market behavior in embodiments of the present invention. Please refer to [link / reference]. Figure 2 One embodiment of the AI-driven intelligent identification and early warning device for improper behavior of market entities in this invention includes: Encoding module 21 is used to perform multi-dimensional semantic vectorization encoding on the transaction record data of market participants to obtain a structured transaction behavior feature matrix; Analysis module 22 is used to perform topological analysis of the capital flow trajectory of the market participants based on the structured transaction behavior feature matrix to obtain a capital flow topological relationship map; Assessment module 23 is used to conduct risk assessment on the market entities based on the fund flow topology map to obtain a comprehensive risk assessment vector; The identification module 24 is used to classify and identify the types of improper behavior of the market entity based on the comprehensive risk assessment vector when the comprehensive risk assessment vector exceeds a preset risk threshold, and obtain the identification result of the improper behavior type. The judgment module 25 is used to judge the real-time early warning trigger conditions of the inappropriate behavior type identification results through a dynamic threshold adjustment mechanism, so as to obtain an intelligent early warning response scheme.

[0043] In this embodiment, the specific implementation of each unit in the above device embodiment is described in the above method embodiment, and will not be repeated here.

[0044] Reference Figure 3 This invention also provides a computer device whose internal structure can be as follows: Figure 3 As shown, the computer device includes a processor, memory, display screen, input device, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores the data corresponding to this embodiment. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements the above-described method.

[0045] Those skilled in the art will understand that Figure 3 The structures shown are merely block diagrams of some structures related to the present invention and do not constitute a limitation on the computer devices on which the present invention is applied.

[0046] An embodiment of the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method. It is understood that the computer-readable storage medium in this embodiment can be a volatile readable storage medium or a non-volatile readable storage medium.

[0047] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the present invention and embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual-rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM, etc.

[0048] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, apparatus, article, or method. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0049] The above description is only a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. An AI-driven intelligent identification and early warning method for improper behavior of market entities, characterized in that, Includes the following steps: The transaction record data of market participants are processed by multi-dimensional semantic vectorization encoding to obtain a structured transaction behavior feature matrix; Based on the structured transaction behavior feature matrix, the fund flow trajectory of the market participants is analyzed to obtain a fund flow topology map; Based on the aforementioned capital flow topology map, a risk assessment is conducted on the market entities to obtain a comprehensive risk assessment vector; When the comprehensive risk assessment vector exceeds the preset risk threshold, the inappropriate behavior type of the market entity is classified and identified based on the comprehensive risk assessment vector to obtain the inappropriate behavior type identification result; By using a dynamic threshold adjustment mechanism to determine the real-time early warning trigger conditions based on the identification results of the inappropriate behavior types, an intelligent early warning response scheme is obtained.

2. The AI-driven intelligent identification and early warning method for improper behavior of market entities according to claim 1, characterized in that, The process of performing multi-dimensional semantic vectorization encoding on the transaction record data of market participants yields a structured transaction behavior feature matrix, including: The transaction record data of the market participants are decomposed into time series to obtain transaction trend components, seasonal components and random fluctuation components, and a multi-level time feature vector is constructed based on the transaction trend components, seasonal components and random fluctuation components; The text information in the transaction record data is semantically encoded using adaptive word embedding technology to obtain a transaction semantic feature vector. Context relevance analysis is then performed based on the transaction semantic feature vector to obtain a transaction semantic association network. A structured transaction behavior feature matrix is ​​constructed based on the multi-level time feature vector and the transaction semantic association network.

3. The AI-driven intelligent identification and early warning method for improper behavior of market entities according to claim 1, characterized in that, The topological analysis of the market participants' capital flow trajectory based on the structured transaction behavior feature matrix yields a capital flow topological relationship map, including: Multi-dimensional clustering analysis is performed on the structured transaction behavior feature matrix to obtain transaction entity groups, and the capital flow trajectory of the market entities is analyzed based on the topology of the transaction entity groups to generate an initial capital flow network; The importance of nodes in the initial fund flow network is evaluated by using a complex network centrality measurement method to obtain a set of key fund hub nodes. Based on the set of key fund hub nodes, community detection is performed to obtain the fund flow community structure. Dynamic graph embedding technology is applied to the aforementioned fund flow community structure to obtain a time-varying fund flow graph representation. Based on the time-varying fund flow graph representation, a time-series consistency analysis is performed to obtain fund flow pattern characteristics. Based on the characteristics of the fund flow pattern and the set of key fund hub nodes, a graph neural network is used to perform dynamic evolution analysis on the fund flow topology to obtain a fund flow topology graph.

4. The AI-driven intelligent identification and early warning method for improper behavior of market entities according to claim 3, characterized in that, The initial fund flow network is evaluated for node importance using a complex network centrality measurement method to obtain a set of key fund hub nodes, including: Degree centrality is calculated on the initial fund flow network to obtain a node connectivity degree distribution sequence, and feature entropy is calculated on the node connectivity degree distribution sequence to obtain a node connectivity entropy matrix, wherein the node connectivity entropy matrix includes in-degree entropy, out-degree entropy, and connectivity strength entropy. Based on the node connection entropy matrix, the betweenness centrality of the initial capital flow network is analyzed to obtain a path control index set, and the path control index set is decomposed hierarchically to obtain a multi-level node influence spectrum. The proximity centrality measure of the influence spectrum of the multi-level nodes is performed to obtain the node proximity metric, and the feature subspace is mapped based on the node proximity metric to obtain the node importance feature vector group. Based on the node importance feature vector group, the node proximity metric is threshold-filtered to obtain a set of key funding hub nodes.

5. The AI-driven intelligent identification and early warning method for improper behavior of market entities according to claim 1, characterized in that, The risk assessment of the market entities based on the aforementioned capital flow topology map yields a comprehensive risk assessment vector, including: Entropy values ​​are calculated for the node degree centrality and edge weight distribution in the fund flow topology graph to obtain an anomaly measurement index for fund flow, and quantile statistics are performed on the anomaly measurement index to obtain an abnormal fund flow feature set. Based on the abnormal fund flow feature set, subgraph extraction is performed on the fund flow topology graph to obtain a high-risk fund flow subnetwork, and time-series evolution analysis is performed on the high-risk fund flow subnetwork to obtain risk propagation path characteristics. The risk propagation path characteristics are decomposed into multiple layers using spectral clustering to obtain hierarchical risk assessment indicators. Based on these hierarchical risk assessment indicators, a hierarchical risk measurement system is constructed to obtain multidimensional risk quantification parameters. Based on the multidimensional risk quantification parameters, a multidimensional correlation analysis is performed on the market participants to obtain a risk correlation strength matrix. Then, feature vectors are extracted from the risk correlation strength matrix to obtain a comprehensive risk assessment vector, which includes risk level, risk volatility, and risk transmission coefficient.

6. The AI-driven intelligent identification and early warning method for improper behavior of market entities according to claim 1, characterized in that, The process of classifying and identifying the types of inappropriate behavior of market entities based on the comprehensive risk assessment vector, and obtaining the results of inappropriate behavior type identification, includes: The comprehensive risk assessment vector is transformed in the feature space to obtain a risk feature subspace mapping matrix, and the risk feature subspace mapping matrix is ​​decoupled in terms of behavior patterns to obtain a set of behavior feature components. Density clustering analysis is performed on the risk feature subspace mapping matrix based on the behavioral feature component set to obtain behavioral type clusters. Then, it is identified whether there are inappropriate clusters in the behavioral type clusters. If there are, the boundary features in the behavioral type clusters are extracted by a preset boundary-sensitive heuristic algorithm to obtain an inappropriate behavior boundary feature map. The boundary feature map of the inappropriate behavior is subjected to map matching analysis to obtain the mapping relationship of inappropriate behavior types. Based on the mapping relationship of inappropriate behavior types, the clusters of behavior types are semantically labeled to obtain the semantic description sequence of inappropriate behavior. Based on the semantic description sequence of the inappropriate behavior, the mapping relationship of the inappropriate behavior type is classified in a multi-level manner to obtain the inappropriate behavior type identification result.

7. The AI-driven intelligent identification and early warning method for improper behavior of market entities according to claim 1, characterized in that, The intelligent early warning response scheme is obtained by judging the real-time early warning trigger conditions of the inappropriate behavior type identification results through a dynamic threshold adjustment mechanism, including: The results of the identification of the inappropriate behavior type are processed by a dynamic threshold adjustment mechanism to obtain a warning threshold hierarchy matrix. The warning threshold hierarchy matrix is ​​then dynamically updated in time to obtain an adaptive warning threshold sequence. The adaptive warning threshold sequence includes a behavior type risk threshold, a trigger time window threshold, and a warning level determination threshold. Based on the adaptive warning threshold sequence, the results of the identification of the inappropriate behavior type are classified and warning is determined to obtain a warning trigger instruction set. Then, the warning trigger instruction set is matched with a response strategy to obtain an intelligent warning response scheme. The intelligent warning response scheme includes a warning level identifier, a list of handling measures, and response time limit requirements.

8. An AI-driven intelligent identification and early warning system for improper behavior of market entities, characterized in that, include: The encoding module is used to perform multi-dimensional semantic vectorization encoding on the transaction record data of market participants to obtain a structured transaction behavior feature matrix; The analysis module is used to perform topological analysis of the capital flow trajectory of the market participants based on the structured transaction behavior feature matrix, and obtain a capital flow topological relationship map; The assessment module is used to conduct risk assessment on the market entities based on the fund flow topology map to obtain a comprehensive risk assessment vector; The identification module is used to classify and identify the types of improper behavior of the market entity based on the comprehensive risk assessment vector when the comprehensive risk assessment vector exceeds a preset risk threshold, and obtain the identification result of the improper behavior type. The judgment module is used to judge the real-time early warning trigger conditions of the inappropriate behavior type identification results through a dynamic threshold adjustment mechanism, so as to obtain an intelligent early warning response scheme.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images