Security investment fund transaction data processing method and system

Abstract

The invention relates to the technical field of fund transaction data processing, in particular to a security investment fund transaction data processing method and system, and the method comprises the following steps: capturing external original information, and completely storing the external original information in an undetermined information pool without content screening; identifying fund transaction; analyzing statistical characteristics of fund outflow behaviors; judging whether the fund transaction is in a collaborative low-speed outflow state or not; if it is judged that the state is the collaborative slow outflow state, first-level early warning is generated; when the total fund outflow rate of the fund exceeds a first preset threshold value in a preset first time window, extracting corresponding fund outflow information, and querying whether first-level early warning exists or not; if yes, the fund outflow information and the first-level early warning are combined to form an event record, and the potential external inducement information is attached to the event record to form a composite abnormal event report. Cooperative low-speed fund outflow caused by hidden external information can be effectively identified and early warned.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of fund transaction data processing, and particularly relates to a fund transaction data processing method and system. BACKGROUND

[0002] In the field of financial market risk monitoring, especially in the analysis of fund transaction data, how to timely and accurately identify and warn the abnormal outflow of funds caused by external information volatility is an important technical challenge.

[0003] The existing monitoring system usually relies on association rules based on past market events, and identifies the direct causal relationship between external information and fund flow by inductive and learning historical data. However, it may not be able to identify potential risks. SUMMARY

[0004] The present application aims at the above-mentioned deficiencies, and provides a fund transaction data processing method and system.

[0005] The present application adopts the following technical scheme: A fund transaction data processing method, the method comprising the following steps: S1: capturing external original information and storing it to a pending information pool without content screening, and synchronously attaching the metadata of the external original information during storage; S2: analyzing the fund transaction data stream independently of the content of the external original information, to identify fund movement; S3: based on the segment of the fund transaction data stream of the fund movement, analyzing the statistical characteristics of the fund outflow behavior, the statistical characteristics of the fund outflow behavior including the total fund share change rate and the account dispersion, the total fund share change rate being defined as the total fund outflow rate when the change direction is redemption; S4: determining whether the fund movement is in a coordinated slow outflow state according to the statistical characteristics of the fund outflow behavior; if it is determined to be in a coordinated slow outflow state, generating a first-level warning, and generating an internal investigation request containing the fund code of the fund movement, the start time, the duration and the behavior characteristic description; S5: receiving the internal investigation request of the behavior characteristic description of the fund movement, and according to the fund movement spatiotemporal characteristics contained in the internal investigation request of the behavior characteristic description of the fund movement, reversely retrieving the stored external original information in the pending information pool, comparing the metadata of the external original information with the fund movement spatiotemporal characteristics, and screening out the external original information that has spatiotemporal association with the fund movement to obtain potential external trigger information; S6: when the total fund outflow rate exceeds a first preset threshold within a preset first time window, extracting the corresponding fund outflow information, and querying whether there is a first-level warning; if there is, merging the fund outflow information and the first-level warning to form an event record, and adding the potential external trigger information to the event record to form a composite abnormal event report.

[0006] Through the above scheme, the coordinated slow fund outflow caused by hidden external information can be effectively identified and warned, and subsequent composite abnormal events can be associated, thereby solving the problem that the prior art cannot identify hidden fund movements and cannot associate time misalignment events.

[0007] To further solve the problem, the application further provides that in step S3, the analysis of the fund total share change rate comprises the following steps: obtaining fund total share data recorded in order of specified time points within a segment of the fund movement transaction data stream; performing linear regression on the fund total share data within a sliding time window to obtain a trend line describing the change of the fund total share data over time within the sliding time window; and calculating the slope of the trend line, wherein the slope is taken as the fund total share change rate, and when the slope is negative, the absolute value of the negative value is taken as the fund total outflow rate.

[0008] Through the above scheme, a quantitative analysis method of the fund total share change rate is provided, so that the judgment of the fund outflow trend is more accurate.

[0009] To perfect the solution, the application further provides that in step S3, the analysis of the account dispersion degree comprises the following steps: based on the segment of the fund movement transaction data stream, obtaining a set of unique identifiers of accounts that initiate redemption operations within a sliding time window as a set of redemption account identifiers; obtaining a set of unique identifiers of all accounts that have transaction behaviors within the sliding time window as a set of active account identifiers; and based on the ratio of the number of the set of redemption account identifiers to the number of the set of active account identifiers, calculating the account dispersion degree, or based on the Shannon entropy value of the set of redemption account identifiers in the redemption amount distribution, calculating the account dispersion degree.

[0010] Through the above scheme, a quantitative analysis method of the account dispersion degree is provided, which is helpful to identify the coordination of fund outflow.

[0011] To perfect the solution, the application further provides that in step S4, the determination step of the coordinated slow outflow state comprises: analyzing the time distribution of each redemption transaction constituting the fund movement; identifying multiple redemption transactions initiated by different accounts within a preset second time window and with a single amount lower than a preset amount threshold according to the time distribution; counting the occurrence density of the multiple redemption transactions; and when the occurrence density exceeds a preset density threshold, determining that the fund movement is in a coordinated slow outflow state in combination with the occurrence density, the fund total share change rate and the account dispersion degree.

[0012] Through the above scheme, the determination standard of the coordinated slow outflow state is refined, and the accuracy of the warning is improved.

[0013] To perfect the solution, the application further proposes that in step S5, the internal investigation request including the behavior characteristic description of the fund transaction is received; the information preliminary retrieval is performed according to the fund transaction space-time characteristics contained in the behavior characteristic description of the fund transaction in the internal investigation request, the reverse retrieval of the external original information stored in the pending information pool is performed, and the preliminary information set is obtained; the independent account identifier set performing the redemption operation in the transaction data stream of the collaborative slow outflow state is extracted; the interaction behavior record of the independent account identifier set on the external information platform is queried according to the independent account identifier set; the information item commonly concerned by multiple members in the independent account identifier set is identified according to the interaction behavior record, and the commonly concerned information set is obtained; the preliminary information set and the commonly concerned information set are compared, the metadata of the external original information and the fund transaction space-time characteristics are combined, the information item existing in the preliminary information set and the commonly concerned information set at the same time and having the space-time correlation with the fund transaction is screened out as the potential external inducement information.

[0014] Through the above scheme, the retrieval and screening capability of the potential external inducement information is enhanced, and the hidden external information related to the fund transaction can be more accurately located.

[0015] To perfect the solution, the application further proposes that on the basis of the potential external inducement information screened out, further comprising: arranging the potential external inducement information in time sequence and source channel, identifying multiple information items composed of different sources and different data types within a preset detection window; judging the publishing time continuity of the multiple information items, when the publishing time continuity meets the preset condition, combining the multiple information items into a composite information unit; analyzing the account interaction behavior record of the composite information unit on the external information platform based on the independent account identifier set, verifying the correlation of the composite information unit and the fund transaction; when the publishing time continuity, the source channel diversity and the account interaction intensity of the composite information unit all meet the preset correlation determination standard, the composite information unit is confirmed as the final potential external inducement information.

[0016] Through the above scheme, the correlation of the potential external inducement information is further verified and confirmed, and the information reliability is improved.

[0017] To perfect the solution, the application further proposes that within the preset detection window, the publishing time interval of any two adjacent information items is less than or equal to a preset time interval threshold, and it is determined that the publishing time continuity of the composite information unit meets the preset correlation determination standard.

[0018] Through the above scheme, the determination standard of the publishing time continuity of the composite information unit is determined, and the rationality of the information time sequence is ensured.

[0019] To perfect the solution, the application further proposes that the composite information unit contains information entries from at least two different source channels, and is identified as satisfying the preset relevance determination standard in terms of source channel diversity.

[0020] Through the above solution, the determination standard of the source channel diversity of the composite information unit is determined, and the credibility of the information is enhanced.

[0021] To perfect the solution, the application further proposes that the proportion of the number of accounts in the independent account identifier set that interact with the composite information unit to the total number of the independent account identifier set is not less than a preset proportion threshold, and the composite information unit is identified as satisfying the preset relevance determination standard in terms of account interaction intensity.

[0022] Through the above solution, the determination standard of the account interaction intensity of the composite information unit is determined, and the influence of the information is reflected.

[0023] To perfect the solution, the application further proposes a securities investment fund transaction data processing system applied to a securities investment fund transaction data processing method. The system comprises: an information processing module for capturing external raw information and storing it to a pending information pool without content screening; a data analysis module for analyzing the transaction data stream of the securities investment fund independently of the content of the external raw information to identify fund movements; a feature analysis module for analyzing the statistical characteristics of fund outflow behavior based on the segment of the transaction data stream of the fund movement, the statistical characteristics of the fund outflow behavior including the total fund share change rate and the account dispersion, and the total fund share change rate being defined as the total fund outflow rate when the change direction is redemption; a determination module for determining whether the fund movement is in a coordinated slow outflow state according to the statistical characteristics of the fund outflow behavior; if it is determined to be in a coordinated slow outflow state, a first-level warning is generated, and an internal investigation request containing the fund code of the fund movement, the start time, the duration and the behavior characteristic description is generated; a retrieval module for receiving the internal investigation request of the behavior characteristic description of the fund movement, and retrieving the stored external raw information in the pending information pool according to the fund movement spatiotemporal characteristics contained in the internal investigation request of the behavior characteristic description of the fund movement, comparing the metadata of the external raw information with the fund movement spatiotemporal characteristics, and screening out external raw information that has spatiotemporal correlation with the fund movement to obtain potential external inducement information; a generation module for extracting the corresponding fund outflow information when the total fund outflow rate exceeds a first preset threshold within a preset first time window, querying whether there is a first-level warning, merging the fund outflow information and the first-level warning to form an event record, and adding the potential external inducement information to the event record to form a composite abnormal event report.

[0024] Through the above scheme, a system for implementing the above method is provided, so that the method can be practically deployed and run.

[0025] For further understanding of the features and technical contents of the present application, please refer to the following detailed description and drawings of the present application. However, the drawings provided are only for reference and illustration, and are not intended to limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0026] Figure 1 A method flow chart of a security investment fund transaction data processing method of the present application; Figure 2 A structure schematic diagram of a security investment fund transaction data processing system of the present application. DETAILED DESCRIPTION

[0027] The following is to illustrate the embodiments of the present application through specific embodiments. The advantages and effects of the present application can be understood by the skilled in the art from the disclosure of the present specification. The present application can be implemented or applied through other different embodiments, and the details in the present specification can be modified and changed based on different viewpoints and applications without departing from the spirit of the present application. In addition, the drawings of the present application are only simple schematic illustrations, and are not drawn according to the actual size, which is declared in advance. The following embodiments will further illustrate the related technical contents of the present application in detail, but the disclosure is not intended to limit the protection scope of the present application.

[0028] The present embodiment provides a security investment fund transaction data processing method and system, which combines Figure 1 and Figure 2 as shown.

[0029] Reference Figure 1The application provides a security investment fund transaction data processing method, which comprises the following steps: S1, capturing external original information and storing the information into a pending information pool without content screening, and synchronously attaching metadata of the external original information during storage; S2, analyzing a security investment fund transaction data stream to identify fund movement independently of content analysis of the external original information; S3, based on a fund movement transaction data stream segment, analyzing statistical characteristics of fund outflow behavior, wherein the statistical characteristics of fund outflow behavior comprise a fund total share change rate and an account dispersion degree, and the fund total share change rate is defined as a fund total outflow rate when the change direction is redemption; S4, determining whether the fund movement is in a coordinated slow outflow state according to the statistical characteristics of fund outflow behavior; if the fund movement is in the coordinated slow outflow state, generating a first-level warning, and generating an internal investigation request comprising a fund movement code, a starting time, a duration and a behavior characteristic description of the fund movement; S5, receiving the internal investigation request of the behavior characteristic description of the fund movement, and reversely searching the stored external original information in the pending information pool according to fund movement spatiotemporal characteristics contained in the internal investigation request of the behavior characteristic description of the fund movement, comparing the metadata of the external original information with the fund movement spatiotemporal characteristics, and screening external original information having spatiotemporal correlation with the fund movement to obtain potential external inducement information; and S6, when the fund total outflow rate exceeds a first preset threshold in a preset first time window, extracting corresponding fund outflow information, and inquiring whether there is a first-level warning; if there is, merging the fund outflow information and the first-level warning to form an event record, and attaching the potential external inducement information to the event record to form a composite abnormal event report.

[0030] Among them, the external original information refers to the original data obtained from various external channels without any content filtering or semantic analysis, which can include text, pictures, audio, video, symbol sequences and other forms, such as social media posts, news reports, forum discussions or any unstructured data, which is mainly to ensure that all potential external signals, including hidden or non-traditional forms, can be captured completely, avoiding missing key information due to preset filtering rules. Without content screening, complete storage means that the captured external original information is not subjected to any content or semantic based preprocessing, filtering or classification operation before being stored in the pending information pool, which can be realized by direct data stream writing, raw file copying and other ways, which is mainly to preserve the originality and integrity of the information, and to ensure that even abstract symbols or meaningless texts that cannot be recognized by traditional systems can be preserved, providing a comprehensive data basis for subsequent in-depth analysis. The pending information pool refers to a database or storage area specially used to store external original information without content screening, which can be realized by distributed file system, object storage or non-relational database technology, which is mainly to provide a raw, unprocessed information warehouse as a data source for subsequent reverse search and correlation analysis. Metadata refers to data describing the properties of external original information, which can include information source, publication time, file size, format type, author identifier, etc., which is mainly to provide structured indexing and contextual information for information storage, retrieval and comparison without analyzing the information content.

[0031] Content analysis independent of external raw information refers to a process of analyzing transaction data flow independent of content analysis of external raw information, which does not depend on semantic understanding or classification results of external information, and can be implemented in parallel processing and modular design, etc. The main purpose is to ensure that even if external information cannot be identified or understood, the abnormality of transaction data flow can be discovered in time, avoiding the risk monitoring blind spot caused by lag or failure of external information identification. Capital movement refers to the capital flow behavior deviating from the normal trading mode in the transaction data flow of securities investment funds, which can be manifested as abnormal inflow or outflow of funds, such as abnormal fluctuation of redemption amount or subscription amount. The main purpose is to identify the non-rational or external factor affected capital behavior in the market. The statistical characteristics of capital outflow behavior refer to the indicators used to quantify and describe the pattern of capital outflow from the fund, which can include fund total share change rate, account dispersion, etc. The main purpose is to describe the intensity, speed and dispersion degree of participants of capital outflow from multiple dimensions, and provide quantitative basis for determining the nature of capital movement. The fund total share change rate refers to the change speed of the total share of the fund in a certain period of time. When the change direction is redemption, the absolute value of the negative value is defined as the total capital outflow rate. It can be calculated by using linear regression analysis, time series difference, etc. The main purpose is to measure the overall trend and intensity of capital outflow. The account dispersion refers to the dispersion degree of the number or amount distribution of accounts participating in the capital outflow behavior, which can be calculated by using the ratio of redemption account number to active account number, the shannon entropy of redemption amount distribution, etc. The main purpose is to identify whether the capital outflow behavior is dominated by a few large accounts or initiated by a large number of small accounts.

[0032] The coordinated slow outflow state refers to a special capital outflow mode, which is manifested as a small amount of redemption transactions initiated by a large number of different accounts in a period of time. These transactions are distributed in time, but as a whole, they form a sustained and slow capital outflow trend. The main purpose is to identify the organized and hidden capital withdrawal behavior that traditional systems cannot detect. The first level warning refers to the preliminary risk prompt sent by the system when it identifies that the capital movement is in the coordinated slow outflow state. It can be manifested as system internal notification, log record or low-level alarm. The main purpose is to start the internal investigation process in time and intervene in the potential risk at an early stage. The internal investigation request refers to the request automatically generated and sent to the internal investigation department or personnel by the system after the first level warning is generated, which contains the fund code, start time, duration and behavior characteristic description of the capital movement, etc. The main purpose is to guide the investigation personnel to conduct in-depth analysis on the specific capital movement and trace back the external causes.

[0033] The fund movement spatiotemporal feature refers to information describing the time point, duration and fund code involved in the fund movement, which is mainly used to provide accurate time and space positioning as a key matching condition for reverse searching external original information in the pending information pool. The reverse search refers to a process of searching and screening external original information associated with the movement in time and space from the pending information pool according to the identified fund movement spatiotemporal feature, which can be achieved by database query, index matching and other technologies based on time stamp and fund code. The main purpose is to accurately locate the external causes that may be related to the fund movement from a large amount of original information, even if these causes are not identified at the initial capture. The potential external cause information refers to the external original information associated with the fund movement in time and space, which is screened from the pending information pool through reverse search and comparison. It can include any form of external signal that may affect investor behavior, and its main purpose is to reveal the external driving factors behind the fund movement and make up for the broken cause-effect chain caused by information filtering in the traditional system. The first time window refers to the time range used to evaluate whether the total fund outflow rate of the fund exceeds the preset threshold, which can be a fixed time length, such as 24 hours, 48 hours or a week. The main purpose is to dynamically monitor the intensity of fund outflow within a specific time period. The first preset threshold refers to the critical value used to determine whether the total fund outflow rate of the fund reaches the trigger standard of the final report, which can be a specific fund outflow amount or outflow rate value. The main purpose is to distinguish between normal market fluctuations and abnormal outflows that need further attention. The composite abnormal event report refers to a comprehensive report formed by integrating large-scale fund outflow information, first-level early warning information and potential external cause information, which can include the complete timeline of the event, fund outflow pattern, related external information and its correlation analysis. The main purpose is to provide a comprehensive and coherent view of abnormal events, overcome the time dislocation problem of cause-effect relationship, and support decision-makers in risk assessment and response.

[0034] The scheme of the present application constructs a complete monitoring system capable of identifying and reporting complex abnormal fund outflow events through a series of closely linked steps. First, in the information capture stage, the system captures external raw information and stores it in the pending information pool without content screening, while synchronously attaching the metadata of the external raw information. This step ensures that all external information, including hidden signals or unstructured data that may be ignored by traditional filtering mechanisms, is preserved without loss, laying the foundation for subsequent in-depth analysis. At the same time, the system analyzes the transaction data stream of securities investment funds independently of the content analysis of external raw information to identify fund movements. This independent analysis mechanism ensures that even if external information is not identified or understood in time, abnormal transactions can be captured in time. Once a fund movement is identified, the system further analyzes the statistical characteristics of the fund outflow behavior based on the segment of the transaction data stream of the movement, including the total fund share change rate and the account dispersion, where the total fund share change rate is defined as the total fund outflow rate when the change direction is redemption. Through the analysis of these statistical characteristics, the system can quantify the intensity, speed, and dispersion of participating accounts of the fund outflow, thereby gaining a deeper understanding of the pattern of fund movements. Subsequently, the system determines whether the fund movement is in a coordinated slow outflow state based on the statistical characteristics of the fund outflow behavior. If it is determined to be in a coordinated slow outflow state, it indicates that there may be hidden, organized fund withdrawal behavior, and the system will immediately generate a first-level warning and simultaneously generate an internal investigation request containing the fund code of the fund movement, the start time, the duration, and the behavior characteristic description. This early warning mechanism aims to intervene early in potential risks and initiate targeted internal investigations. After receiving the internal investigation request containing the behavior characteristic description of the fund movement, the system retrieves the stored external raw information in the pending information pool based on the temporal and spatial characteristics of the fund movement contained in the request. By comparing the metadata of the external raw information with the temporal and spatial characteristics of the fund movement, the system can filter out external raw information that is temporally and spatially related to the fund movement, thereby obtaining potential external trigger information. This reverse retrieval mechanism is the key to the present scheme, allowing the system to backtrack and identify external signals that may have been overlooked or misunderstood early on, thereby establishing a causal relationship between the fund movement and the external trigger, even if the causal relationship is temporally misaligned. Finally, when the total fund outflow rate exceeds the first preset threshold within the first preset time window, the system extracts the corresponding fund outflow information and queries whether there is a first-level warning generated previously. If there is, the system combines the large-scale fund outflow information and the first-level warning to form an event record and adds the potential external trigger information obtained through reverse retrieval to the event record, ultimately forming a composite abnormal event report.The integrated reporting mode links the early concealed fund movement, the subsequent large-scale outflow and the potential external incentives behind them together, overcomes the detection failure problem caused by the time dislocation of cause and effect in traditional systems, and provides a comprehensive and coherent event view for risk management.

[0035] In some preferred embodiments, the application is implemented as follows. The system can be deployed on a cloud server cluster, capturing external raw information through data collection agents. For example, these agents can continuously listen to social media APIs, news website RSS feeds, forum crawler interfaces, etc., and store all the data obtained, including text, pictures, video files, without any content analysis or keyword filtering, directly in the form of raw binary streams into a pending information pool composed of distributed file systems or object storage services. When storing, each file will be accompanied by its metadata, such as capture timestamp, source URL, file type, original file name, etc. At the same time, a separate transaction data analysis service continuously receives real-time transaction data streams from fund companies. This service does not rely on the content of external information, but focuses on analyzing transaction data itself. When detecting abnormal fluctuations in fund redemptions, a fund movement is identified. For example, by the deviation of the sliding window average value from the current redemption amount. Once a fund movement is identified, the system extracts the corresponding transaction data segment for the time period and the fund involved. Then, the system calculates the total share change rate within the segment, for example by linear regression fitting a trend line to the total share data and calculating its slope; at the same time, the account dispersion is calculated, for example by calculating the ratio of the number of unique identifiers of the redemption accounts to the total number of active accounts. Based on these statistical features, the system runs a coordinated slow outflow judgment model. This model can be a rule-based expert system or a machine learning model to identify whether there are a large number of small, dispersed redemption transactions occurring continuously within a period of time. If it is determined to be a coordinated slow outflow state, the system will immediately generate a first-level warning in the internal log and send an internal investigation request to the internal investigation service through the message queue, which contains the fund code, start time, duration, and a brief description of the fund outflow behavior pattern. When the internal investigation service receives this request, it extracts the spatiotemporal features of the fund movement, such as "a coordinated slow outflow of a certain fund occurred in a certain year, month, day, and time period". Then, the service uses these spatiotemporal features as query conditions to reverse search the pending information pool. For example, by querying the metadata index of the distributed file system or object storage, it finds all external raw information that may be related to the fund (for example, by fuzzy matching the fund name or code in the metadata) within the time period. The system compares the metadata (such as the publication time) of these external raw information with the spatiotemporal features of the fund movement, and filters out the external raw information that is highly related in time and space, which is considered as potential external trigger information. Finally, when the system monitors that the total fund outflow rate of the fund exceeds the first preset threshold (for example, 5% of the total share) within the first preset time window (for example, the past 24 hours), it usually means that a large-scale fund outflow has occurred.At this time, the system extracts the large-scale fund outflow information and checks whether there is a first-level early warning issued previously for the fund. If there is, the system combines the large-scale fund outflow information with the early first-level early warning information to form a complete event record. At the same time, the potential external trigger information obtained through the reverse search is attached to the event record, and finally a comprehensive composite abnormal event report is generated for risk management personnel to make decisions.

[0036] The application further proposes that the analysis of the fund total share change rate comprises the following steps: obtaining fund total share data recorded in order of specified time points in a segment of the fund transaction data stream; performing linear regression on the fund total share data in a sliding time window to fit a trend line describing the change of the fund total share data over time in the sliding time window; and calculating the slope of the trend line, which is the fund total share change rate, and when the slope is negative, the absolute value of the negative value is the fund total outflow rate.

[0037] Wherein, the sliding time window refers to a fixed-size window moving on a continuous data sequence, each movement containing a part of new data and a part of old data, the purpose of which is to process and analyze data locally, so as to capture the dynamic change trend of data; wherein, linear regression refers to a statistical method for establishing a linear relationship model between the dependent variable (fund total share data) and one or more independent variables (time), which can be fitted by least squares method and other algorithms, the purpose of which is to extract the potential linear trend from discrete data; wherein, the trend line refers to the straight line fitted by linear regression, which represents the overall direction and intensity of the change of the fund total share data over time in a certain time window, the purpose of which is to smooth the data fluctuations and intuitively show the long-term or medium-term trend of the fund total share; wherein, the slope refers to the degree of inclination of the trend line, which quantifies the rate of change of the fund total share data over time, which can be calculated by the coefficient of the independent variable in the trend line equation, the purpose of which is to provide an accurate numerical value to measure the speed of fund inflow or outflow.

[0038] The scheme of the present application ensures that the data source of the analysis is directly related to the fund movement by obtaining the fund total share data recorded in sequence at the specified time points within the segment of the transaction data stream of the fund movement, laying a foundation for subsequent accurate analysis. On this basis, in order to overcome the noise and short-term fluctuations existing in the original data, the scheme performs linear regression on the fund total share data within the sliding time window, thereby fitting a trend line describing the change of the fund total share data with time within the sliding time window. This processing method can smooth the instantaneous disturbance in the data and extract the inherent trend of the change of the fund total share. It is precisely because of the use of the sliding time window that the analysis of the trend can maintain real-time, and through the mathematical model of linear regression, the complex fund flow pattern is simplified into a trend line that is easy to quantify. Further, by calculating the slope of the trend line and taking the slope as the change rate of the fund total share, the present scheme quantifies the dynamic change of the fund total share into a clear numerical value. When the slope is negative, its absolute value is defined as the fund outflow rate, which clearly defines the direction and strength of the fund flow. This analysis method based on the slope of the trend line can capture the overall trend of the fund flow, thereby realizing the differentiation between market fluctuations and fund outflow in the analysis of the change rate of the fund total share, providing the reliability of the statistical characteristics for the subsequent determination of whether the fund movement is in a coordinated slow outflow state. Compared with directly using the original data for analysis in the basic scheme, this improves the accuracy and stability of the identification of the fund movement, making the early warning of potential risks timely.

[0039] In some preferred embodiments, the present application is implemented as follows: when the system identifies a fund has a fund movement, for example, the fund has a significant increase in the amount of redemptions in a trading day, the system will immediately obtain a segment of the transaction data stream related to the fund movement. This segment can contain the total share data of the fund recorded in chronological order by minute or second level time points in the past few hours or days. In order to accurately analyze the rate of change of the total share of the fund, the system can start a data processing module. The module will set a sliding time window, for example, a window lasting 30 minutes, and slide forward with a step of every 5 minutes. In each 30-minute sliding time window, the module will collect all the fund total share data recorded in chronological order within the window. Then, the module can perform a linear regression algorithm on these data, for example, use the least squares method to fit a straight line, which is the trend line describing the change of the total share of the fund over time within the window. After fitting, the module will calculate the slope of the trend line. If the calculated slope is positive, it means that the total share of the fund is increasing; if the slope is negative, it means that the total share of the fund is decreasing, and the absolute value of the negative value can be defined as the outflow rate of the total fund. In this way, the system can continuously and smoothly monitor the trend of the change of the total share of the fund and quantify its outflow rate, thereby providing stable and reliable data support for subsequent risk assessment.

[0040] The present application further proposes that in step S3, the analysis of account dispersion includes the following steps: based on the segment of the fund movement transaction data stream; obtaining the unique identifier set of the accounts that initiated the redemption operation within the sliding time window as the redemption account identifier set; obtaining the unique identifier set of all accounts with transaction behavior within the sliding time window as the active account identifier set; based on the ratio of the number of the redemption account identifier set and the number of the active account identifier set, calculating the account dispersion, or based on the Shannon entropy value of the redemption account identifier set on the redemption amount distribution, calculating the account dispersion.

[0041] The sliding time window refers to a fixed-length time period that moves continuously on the time axis. Specifically, it can be a preset number of minutes, hours, or days. The purpose is to dynamically capture and analyze the transaction behavior occurring within a specific time period, thereby reflecting the changes in account characteristics of the fund outflow behavior in real time. The account dispersion refers to an index that measures the dispersion degree of the fund outflow behavior among different accounts. The purpose is to identify whether the fund outflow is concentrated in a few accounts or dispersed in a large number of accounts. Specifically, there can be two calculation methods: the first method is to calculate the account dispersion based on the ratio of the number of redemption account identifiers to the number of active account identifiers. Specifically, the ratio can be obtained by dividing the number of unique accounts that initiate redemption operations within the sliding time window by the number of all unique accounts with transaction behavior within the same sliding time window. The purpose is to measure the concentration degree of fund outflow by the proportion of redemption accounts in active accounts. The smaller the ratio, the more dispersed the redemption behavior, and the relatively larger the number of accounts participating in redemption. The second method is to calculate the account dispersion based on the Shannon entropy value of the redemption account identifier set on the redemption amount distribution. Specifically, the Shannon entropy value can be obtained by logarithmic operation and summation on the proportion of the redemption amount of each redemption account to the total redemption amount. The purpose is to measure the dispersion degree of fund outflow by the uniformity of the distribution of redemption amount among different accounts. The higher the entropy value, the more evenly the redemption amount is distributed among each redemption account, i.e., the more dispersed the fund outflow.

[0042] The scheme of the present application makes up for the deficiency of relying only on the change rate of total fund shares by introducing the statistical feature of account dispersion, thereby making a more detailed analysis of the fund outflow behavior. Specifically, after identifying the fund movement, the system will first process based on the segment of the transaction data stream of the fund movement, ensuring that the data for subsequent analysis is directly related to the movement event. On this basis, in order to dynamically capture the changes in account behavior, the system will use a sliding time window to continuously obtain the set of unique identifiers of accounts that initiate redemption operations within the window, forming a set of redemption account identifiers. At the same time, in order to provide a reference benchmark, the system will also obtain the set of unique identifiers of all accounts with transaction behavior within the same sliding time window, forming a set of active account identifiers. Subsequently, in order to quantify the dispersion degree of fund outflow, the system can calculate the account dispersion in two ways. One way is to calculate the ratio of the number of the set of redemption account identifiers to the number of the set of active account identifiers, which can intuitively reflect the proportion of redemption behavior in the overall active accounts. The smaller the ratio, the more dispersed the redemption behavior. The other way is to calculate the Shannon entropy value of the set of redemption account identifiers in the redemption amount distribution, which can measure the uniformity of the distribution of redemption amount among different accounts. The higher the entropy value, the more dispersed the distribution of redemption amount. By using either of the two ways or in combination, the system can obtain a comprehensive account dispersion index. By combining the change rate of total fund shares with the account dispersion, the system, when determining whether the fund movement is in a coordinated slow outflow state, no longer focuses only on the total amount and speed of fund outflow, but can also in-depth analyze the structural features of fund outflow, i.e., whether the fund outflow is concentrated or dispersed. This combination enables the system to more accurately identify slow outflow behaviors that are not large in total amount but are coordinated by a large number of dispersed accounts, as such behaviors are often difficult to be discovered when relying only on the change rate of total shares. Therefore, by supplementing and deepening the statistical features of fund outflow behavior, the present scheme enhances the ability to identify hidden fund movements, providing a more solid data foundation for subsequent early warning and investigation.

[0043] In some preferred embodiments, when the system identifies a fund experiencing a fund movement, e.g., by monitoring the transaction data stream in real time, and finds that the amount of redemptions has abnormally increased in a short period of time, the system extracts the segment of the transaction data stream related to the fund movement. Specifically, to analyze the account dispersion, the system can maintain a sliding time window, e.g., set to the past 1 hour. The system continuously filters all the redemption transaction records that occurred within the 1 hour from the fund movement segment. For each redemption transaction, the system extracts its corresponding account unique identifier and collects these identifiers to form a dynamically updated set of redemption account identifiers. Meanwhile, the system also filters the unique identifiers of all the accounts that have experienced a buy-in or redemption transaction within the same 1 hour from the fund movement segment to form a set of active account identifiers. These sets of identifiers can be stored in a hash set data structure in memory to ensure the uniqueness of each account identifier and support efficient lookup and insertion operations. Subsequently, the system can calculate the account dispersion. As one specific implementation, the system can first calculate the number of accounts in the set of redemption account identifiers, e.g., N redemption, and the number of accounts in the set of active account identifiers, e.g., N active. Then, the account dispersion is obtained by calculating the ratio N redemption / N active. For example, if N redemption is 100 accounts and N active is 1000 accounts, the account dispersion is 0.1. The smaller the ratio, the more dispersed the redemptions are. As another specific implementation, the system can calculate the Shannon entropy value of the set of redemption account identifiers over the distribution of redemption amounts. This requires first calculating the total redemption amount of each redemption account within the sliding time window. Suppose there are K redemption accounts, and the redemption amount of each account i is Amount i, and the total redemption amount is Total Amount. Then, the redemption amount proportion of each account can be calculated as p i = Amount i / Total Amount. The Shannon entropy value can be calculated according to the formula H = -∑(p i * log2(p i)). For example, if the redemption amounts are evenly distributed among a large number of accounts, the entropy value will be high, indicating that the outflow of funds is highly dispersed; if the redemption amounts are concentrated in a few accounts, the entropy value will be low, indicating that the outflow of funds is concentrated. In this way, the system can obtain a quantitative account dispersion indicator, thereby providing more comprehensive data support for subsequent coordinated slow outflow state determination.

[0044] The application further proposes a determination step of the cooperative slow outflow state, including: analyzing time distribution of each redemption transaction constituting the fund movement; identifying multiple redemption transactions initiated by different accounts and with an amount lower than a preset amount threshold within a preset second time window according to the time distribution; counting occurrence density of the multiple redemption transactions; and determining that the fund movement is in the cooperative slow outflow state in combination with the occurrence density, a total share change rate of the fund, and an account dispersion when the occurrence density exceeds a preset density threshold.

[0045] The analysis of the time distribution of each redemption transaction constituting the fund movement refers to collecting and sorting time points of all redemption transactions in a specific time period to reveal the aggregation, dispersion or periodicity of the transactions on the time axis, which can be achieved by using methods such as time series analysis, histogram statistics or cluster analysis, and the purpose is to provide basic data and preliminary observation basis for identifying the cooperative slow outflow mode. The counting of the occurrence density of the multiple redemption transactions refers to calculating a ratio of the number of redemption transactions meeting specific conditions (for example, initiated by different accounts and with an amount lower than a preset amount threshold) to the length of the time window within a specific time window, which can be quantified by using indicators such as the number of transactions per unit time, transaction frequency or transaction rate, and the purpose is to quantify the activity level and intensity of the cooperative slow outflow behavior.

[0046] The scheme of the application improves the accuracy of the fund movement state determination by introducing a more detailed analysis dimension of the redemption transaction. First, by analyzing the time distribution of each redemption transaction constituting the fund movement, the original information of the transaction behavior on the time axis can be obtained, laying a foundation for subsequent refined identification. On this basis, the system identifies multiple redemption transactions initiated by different accounts and with an amount lower than a preset amount threshold within a preset second time window according to the time distribution. This identification process is aimed at the core feature of the cooperative slow outflow mode, i.e. small, dispersed and continuous transaction behavior. By limiting the time window, the account source and the single amount, transactions that do not meet the cooperative slow outflow characteristics, such as large and concentrated redemption or split transactions of a single account, can be effectively filtered out, so as to focus on the real hidden outflow with cooperative nature.

[0047] Further, the system counts the occurrence density of these identified multiple redemption transactions. As a quantitative indicator, the occurrence density can reflect the frequency of small and dispersed redemption behavior in a unit of time, thereby converting the "slow" and "continuous" characteristics of the coordinated slow outflow into measurable numerical values. When the occurrence density exceeds the preset density threshold, it indicates that the activity level of the redemption transactions has reached a level that requires attention. At this time, the system combines the occurrence density with the total share change rate of the fund and the account dispersion to make a judgment. The total share change rate of the fund and the account dispersion are macro-level statistical characteristics, while the occurrence density provides micro-level transaction activity information. This macro-micro combined judgment method enables the system to not only observe the fund outflow from the overall trend, but also capture coordinated behavior in detail. Through this multi-dimensional and hierarchical judgment logic, the present scheme can effectively identify the coordinated slow outflow state that is difficult to capture by the total share change rate of the fund and the account dispersion alone. For example, when the total share change rate of the fund has not yet changed significantly, or the account dispersion is still within the normal range, if the occurrence density of small and dispersed transactions has reached the threshold, the potential coordinated slow outflow risk can be identified in advance. This enables the system to generate a first-level warning and internal investigation request at the initial stage of the fund movement, when the traditional method may misjudge it as normal market fluctuations, thereby bringing the originally hidden and difficult-to-detect abnormal fund outflow pattern into the risk monitoring system, providing an earlier and more accurate trigger condition for the subsequent search for potential external inducement information and the generation of a complex abnormal event report, significantly improving the recognition ability and early warning timeliness of the entire securities investment fund transaction data processing method for new risk patterns.

[0048] In some preferred embodiments, the application is implemented as follows: when determining whether a fund movement is in a coordinated slow outflow state, the system first analyzes the time distribution of each redemption transaction that constitutes the fund movement. For example, the system can collect and record the precise timestamps of all redemption transactions within a certain monitoring period, and organize them into a time series dataset. Subsequently, the system identifies multiple redemption transactions initiated by different accounts within a preset second time window and with a single amount below a preset amount threshold based on the time series dataset. For example, the second time window can be set to "every 4 hours", and the preset amount threshold can be set to "single redemption amount below 10,000 yuan". The system will go through all the redemption transactions and filter out a set of transactions that are initiated by at least two different accounts within any consecutive 4-hour period and each with a redemption amount less than 10,000 yuan. Then, the system calculates the occurrence density of these identified multiple redemption transactions. For example, if 30 redemption transactions that meet the above conditions are identified within a certain 4-hour second time window, the occurrence density is 30 / 4 hours. Finally, when the calculated occurrence density exceeds a preset density threshold, for example, the preset density threshold is "25 / 4 hours", the system will make a comprehensive judgment on the fund total share change rate and the account dispersion calculated before. Specifically, the system can use a multi-factor decision model. For example, if the occurrence density reaches a high-risk level, the fund total share change rate shows a negative trend, and the account dispersion is also at a high level, the system will determine that the current fund movement is in a coordinated slow outflow state. In this way, even if the fund total share change rate has not reached the traditional warning of sharp decline, or the account dispersion has not been extreme, as long as the occurrence density of small and dispersed transactions reaches a certain level, the system can identify this hidden coordinated outflow pattern and generate a first-level warning and an internal investigation request in time.

[0049] The application further proposes that step S5 includes: receiving an internal investigation request for a behavior feature description of the fund movement; performing preliminary information retrieval according to the fund movement spatiotemporal features contained in the internal investigation request for the behavior feature description of the fund movement, reverse searching the stored external original information in the pending information pool to obtain a preliminary information set; extracting a set of independent account identifiers performing redemption operations in the transaction data stream of the coordinated slow outflow state; querying the interaction behavior records of the set of independent account identifiers on the external information platform according to the set of independent account identifiers; identifying information items commonly concerned by multiple members in the set of independent account identifiers according to the interaction behavior records to obtain a commonly concerned information set; comparing the preliminary information set and the commonly concerned information set, combining the metadata of the external original information and the fund movement spatiotemporal features, and filtering out information items that exist in both the preliminary information set and the commonly concerned information set and have spatiotemporal association with the fund movement as potential external trigger information.

[0050] For a clearer understanding of the above solutions, some of the technical features involved are explained as follows. Among them, the independent account identifier set refers to the set of unique identification codes of each independent account performing the redemption operation in the cooperative slow outflow state, which can be implemented by account ID, user ID or other codes that can uniquely identify a transaction account, and its purpose is to focus on those investor groups that have actually participated in the redemption behavior, which may be affected by common external information; the external information platform refers to an online or offline channel for publishing, disseminating or storing various external information, which can be implemented by social media platforms, news aggregation websites, professional forums, investment communities, data analysis agencies' report platforms, etc., and its purpose is to obtain the information that investors contact and focus on outside the financial market to discover potential non-traditional external incentives; the interaction behavior record refers to various operation traces of accounts in the independent account identifier set on the external information platform, which can be implemented by like, comment, forward, collect, browse time, click link, subscribe to specific content, etc. Behavior data, its purpose is to reveal the degree of attention and interaction mode of these accounts to specific information, so as to judge the potential influence of the information; the common attention information set refers to the set of information items that are interacted by multiple members in the independent account identifier set, which can be implemented by finding out specific news reports, analysis articles, social media posts or video contents that are frequently browsed, discussed or shared by multiple independent accounts within a certain time period through statistical analysis, and its purpose is to identify information with high consensus or influence in a specific investor group from a large amount of information, which is more likely to become an external incentive to trigger fund movement.

[0051] Specifically, upon receiving an internal investigation request with a description of the behavioral characteristics of the fund movement, the system first performs a preliminary search on the stored external raw information according to the spatiotemporal characteristics of the fund movement contained in the request, thereby obtaining a preliminary information set. This preliminary screening ensures that the information analyzed subsequently is spatiotemporally related to the fund movement. On this basis, the scheme further extracts a set of independent account identifiers that perform redemption operations from the transaction data stream in the state of coordinated slow outflow. This step is crucial because it shifts the focus of the analysis from the general external information to the investor group directly related to the actual fund movement behavior. Subsequently, the system queries the interaction behavior records of these independent account identifier sets on various external information platforms. Through in-depth analysis of these interaction behavior records, the system can identify information items that are commonly focused on by multiple members of the independent account identifier set, thereby forming a commonly focused information set. This set represents information with a high degree of consensus and influence among a specific investor group. Finally, the system compares the preliminary information set with the commonly focused information set, and again combines the metadata of the external raw information and the spatiotemporal characteristics of the fund movement to screen out information items that exist in both sets and are spatiotemporally related to the fund movement, which are considered as potential external trigger information.

[0052] To further illustrate the implementation of the present application, in some preferred embodiments, the present application is implemented as follows: when the system receives an internal investigation request about the occurrence of a coordinated slow outflow state of a certain fund, the request will contain the fund code, the transaction initiation time, the duration, and the behavior characteristic description. The system first performs preliminary retrieval from the pending information pool according to these spatiotemporal characteristics, such as all external news, social media posts, forum discussions, etc. about the “XX Growth Fund” during the period from October 1 to October 15, 2023, to obtain a preliminary information set. At the same time, the system will identify all independent accounts that are in a coordinated slow outflow state and have executed a redemption operation from the trading data stream of the “XX Growth Fund” during the period from October 1 to October 15, 2023, such as account A100, account B200, account C300, etc., to form an independent account identifier set. Subsequently, the system will use these independent account identifiers to query their historical interaction behavior records on mainstream social media platforms (such as Weibo, WeChat public accounts, and Snowball), professional financial forums (such as the East Fortune Stock Bar and Xinxun Forum), and news aggregation websites (such as Sina Finance and Tencent Securities) through API interfaces or crawler technology. These records can include that account A100 liked a post about fund manager changes on Weibo, account B200 commented on an article about market risks on Snowball, and account C300 browsed multiple reports on macroeconomic trends on a certain financial news website. Then, the system will aggregate and analyze these interaction behavior records to identify information items that are commonly focused on by multiple members of the independent account identifier set. For example, if accounts A100, B200, and C300 all liked or forwarded a deep analysis article about the potential risks of the “XX Growth Fund” during the same time period, then this deep analysis article will be identified as an information item in the commonly focused information set. Finally, the system will cross-compare the preliminary information set (information filtered based on spatiotemporal characteristics) with the commonly focused information set (information filtered based on account behavior). Only those information items that are in both the preliminary information set and the commonly focused information set, and whose metadata (such as publication time and source) are highly matched with the spatiotemporal characteristics of the fund transaction, will be finally screened out as potential external inducement information. For example, if there is a negative news about the “XX Growth Fund” in the preliminary information set, and this news is also commonly focused on by most accounts in the independent account identifier set, and its publication time coincides with the time of the fund transaction, then this news will be confirmed as potential external inducement information.

[0053] The application further proposes a step of processing the potential external inducement information screened, including: arranging the potential external inducement information in time sequence and source channel, identifying multiple information entries constituted by different sources and different data types within a preset detection window; judging the continuity of the publishing time of the multiple information entries, when the continuity of the publishing time meets the preset condition, combining the multiple information entries into a composite information unit; based on the independent account identifier set, analyzing the account interaction behavior record of the composite information unit on the external information platform, verifying the relevance of the composite information unit and the fund movement; when the continuity of the publishing time, the diversity of the source channel and the account interaction intensity of the composite information unit all meet the preset relevance determination standard, the composite information unit is confirmed as the final potential external inducement information.

[0054] Among them, the preset detection window refers to a pre-set time range, which is used to limit the collection and combination of information entries, and its purpose is to ensure that the identified information entries have certain concentration in time, so as to facilitate the subsequent judgment of their relevance. Different sources and different data types refer to the fact that information entries can come from multiple channels, such as news media, social platforms, forums, professional reports, etc., and can take the form of text, pictures, videos, audio, etc., which aims to obtain more comprehensive and multi-dimensional information, avoiding the limitations brought by single information source or data type. The continuity of the publishing time refers to the closeness of the multiple information entries on the time axis, that is, whether the time interval of their publishing is within a certain range, and its purpose is to judge whether there is an internal logical association or transmission chain between these information entries. The composite information unit refers to the logical whole composed of multiple information entries within the preset detection window and whose publishing time continuity meets the preset condition, and its purpose is to integrate scattered information into a more explanatory information block, so as to facilitate deeper relevance analysis. The account interaction behavior record refers to the interactive behavior data of the accounts in the independent account identifier set with specific information content on the external information platform, such as browsing, liking, commenting, forwarding, collecting, etc., and its purpose is to quantify the influence of information on a specific investor group, thereby verifying the relevance of information and fund movement. The relevance determination standard refers to a series of preset rules or thresholds for evaluating the degree of relevance between the composite information unit and the fund movement, including specific requirements for the continuity of the publishing time, the diversity of the source channel and the intensity of the account interaction, and its purpose is to ensure that the final determined potential external inducement information has high reliability and explanatory power.

[0055] Specifically, after receiving the preliminary potential external trigger information, the system first arranges it in chronological order and by source channel, which allows the potential association between information to be revealed, for example, the order of information release and the breadth of information sources can be observed. On this basis, the system identifies multiple information entries composed of different sources and different data types within a preset detection window, which helps to integrate information from different dimensions and channels to form a more comprehensive information view. Subsequently, the system judges the continuity of the release time of these multiple information entries. If these information are continuously released in a short time, it indicates that there is a high correlation between them, at this time, these information entries will be combined into a composite information unit. This combination allows the system to construct a more explanatory information block from scattered information, thereby more comprehensively assessing its impact on fund movements. Further, based on the set of independent account identifiers extracted from the transaction data stream in the state of collaborative slow flow, the system analyzes the account interaction behavior records of the composite information unit on the external information platform. Through this analysis, it can be determined whether the composite information unit has actually influenced the specific investor group performing the redemption operation. This interaction behavior verification provides direct evidence for the association between information and fund movements, avoiding false judgments based solely on temporal and spatial coincidence. Finally, only when the composite information unit meets the preset association determination criteria in the three dimensions of release time continuity, source channel diversity and account interaction intensity, will the composite information unit be confirmed as the final potential external trigger information. This multiple verification mechanism allows the system to effectively distinguish between true and false, identifying the truly influential external factors that can explain fund movements from the preliminary screened information.

[0056] In some preferred embodiments, after receiving the preliminarily screened potential external trigger information, for example, the information can include a series of network news reports, social media posts, forum discussion strings, and short videos related to a specific fund. The system first arranges these information in chronological order according to their publication time, and further classifies them according to their source channels, for example, separates the information from financial news websites from the information from anonymous social forums. Then, the system identifies multiple information entries from different sources and different data types within a preset detection window, for example, within a 24-hour time range. For example, the system can identify that on the same day, a financial media published a report on the change of fund manager, followed by multiple discussions on the future trend of the fund on a social platform, and a risk-suggesting abstract symbol video appeared on a video sharing website. Then, the system judges the publication time continuity of the multiple information entries. If the publication time interval between any two adjacent information entries is less than or equal to a preset time interval threshold, for example, 6 hours, it is considered that they have publication time continuity. When this continuity meets the preset conditions, these information entries are combined into a composite information unit. For example, the financial report, social media discussions, and abstract symbol video described above are combined into a composite information unit due to their close publication time. On this basis, the system analyzes the account interaction behavior records of the composite information unit on the external information platform based on the set of independent account identifiers extracted from the coordinated slow flow state transaction data stream. Specifically, the system queries whether the accounts in the set of independent account identifiers have performed operations such as browsing, liking, commenting, or forwarding on any information entry in the composite information unit. For example, if most of the accounts in the set of independent account identifiers have browsed or forwarded the financial report or abstract symbol video in the composite information unit, it indicates that the information unit has actually affected these investors. Finally, when the composite information unit meets the preset relevance determination criteria in the three dimensions of publication time continuity, source channel diversity, and account interaction intensity, for example, if the composite information unit contains information entries from at least two different source channels, and the number of accounts in the set of independent account identifiers that interact with the composite information unit accounts for a proportion of the total number of independent account identifiers that is not less than a preset proportion threshold, the composite information unit is confirmed as the final potential external trigger information. In this way, the system can accurately identify those external triggers that are actually strongly associated with fund movements from a large number of preliminarily screened information.

[0057] The application further provides that the step of the composite information unit meeting the preset relevance determination criteria in publication time continuity comprises: within the preset detection window, the publication time interval between any two adjacent information entries is less than or equal to a preset time interval threshold.

[0058] wherein the preset detection window refers to a time period for defining the time range of the information entries, which can be a fixed time window with a fixed time length, such as 24 hours or 48 hours, or a time window dynamically adjusted according to the duration of the fund movement, and the purpose is to ensure that the analyzed information entries have relevance in time with the fund movement; the publishing time interval refers to the time difference between any two adjacent information entries, which can be specifically obtained by calculating the publishing time of the latter information entry minus the publishing time of the former information entry, and the purpose is to quantify the closeness of the information entries in time; the preset time interval threshold refers to an upper limit value for judging the time continuity of the information entries, which can be specifically a fixed time value, such as 5 minutes, 10 minutes or 30 minutes, or a dynamic value determined according to historical data analysis or expert experience, and the purpose is to filter out information entries with strong time relevance to improve the accuracy of the composite information unit; the preset relevance determination standard refers to rules or conditions for evaluating the degree of relevance between the composite information unit and the fund movement, which can specifically include multiple dimensions such as time continuity, source channel diversity and account interaction intensity, and the purpose is to ensure that the formed composite information unit can reflect potential external incentives.

[0059] The scheme of the present application introduces the quantitative judgment of the publishing time interval of any two adjacent information entries when judging the publishing time continuity of multiple information entries, and compares it with the preset time interval threshold, so as to ensure that only the information entries with close time will be recognized as having continuity. Specifically, within the preset detection window, the system first arranges the potential external incentive information in time sequence and source channel to form a series of information entries. Then, for these information entries arranged in time sequence, the system will calculate the publishing time interval between each pair of adjacent information entries one by one. Only when the calculated time interval is less than or equal to the preset time interval threshold, it is considered that the two information entries are continuous in time. This time interval limitation makes the finally combined composite information unit be able to reflect different aspects of the same event or trend, avoiding the error combination of scattered information irrelevant in time. In this way, the scheme of the present application can improve the relevance of the composite information unit and the fund movement, and further improve the recognition accuracy of the potential external incentive information, overcoming the problem of insufficient relevance caused by only considering whether there is a time interval but ignoring its size. This determination of time continuity makes the process of filtering and integrating external information from multiple dimensions more accurate, thereby providing a composite information unit meeting the requirements for subsequent relevance verification.

[0060] As a specific implementation, after identifying potential external trigger information and arranging them in chronological order and source channels, the system sets a preset detection window, for example, which can be set to 48 hours before and after the fund movement occurs. Within this detection window, the system will iterate through all arranged information items and calculate the publishing time interval between each information item and its adjacent next information item. For example, if the first information item is published at 9:00 am and the second information item is published at 9:08 am, the publishing time interval is 8 minutes. At this time, the system will preset a time interval threshold, for example, 15 minutes. If the calculated 8 minutes is less than or equal to the preset 15-minute threshold, the two information items are identified as having continuity in publishing time. The system will continue to make this judgment until all adjacent information items are evaluated. Only when the publishing time interval between all adjacent information items constituting the potential composite information unit meets the preset time interval threshold, the composite information unit is identified as meeting the preset relevance determination standard in publishing time continuity. This way ensures that the information items in the composite information unit are associated in time, thus improving their reliability as potential triggers for fund movements.

[0061] The application further proposes a step of identifying that the composite information unit meets the preset relevance determination standard in source channel diversity, which includes that the composite information unit contains information items from at least two different source channels.

[0062] Wherein, the composite information unit refers to a logical whole composed of multiple information items, which have continuity in time and collectively point to a potential external trigger. The source channel refers to the original platform or institution where the information item is published, such as news media, social media platforms, professional forums, research report publishing institutions, government bulletin websites, etc. The information item refers to the smallest independent information unit that constitutes the composite information unit, which can be a news report, a social media post, a research report, a forum discussion string, or any other form of independent data record. The preset relevance determination standard refers to a set of rules or thresholds preset within the system to evaluate whether the source channel diversity of the composite information unit reaches the reliability level required to identify potential external triggers.

[0063] The scheme of the present application ensures higher reliability and representativeness of the identified potential external incentive information by requiring the composite information unit to contain information entries from at least two different source channels. On the basis of arranging the potential external incentive information in chronological order and source channel, identifying multiple information entries composed of different sources and different data types, and judging the continuity of the publication time to meet the preset conditions, the scheme further introduces strict verification of the diversity of source channels. Specifically, after forming the preliminary composite information unit, the system will identify and count the source channel of each information entry contained in it. Only when the composite information unit contains at least two or more information entries from different source channels, it will be recognized as meeting the preset relevance determination standard in terms of source channel diversity. This mechanism avoids the information bias or one-sidedness that may be caused by relying on a single information source. For example, if all the information comes from the same media, even if it is time-continuous, its reliability may be limited. By strictly requiring the diversity of information sources, the present scheme can more comprehensively reflect the complexity and multidimensional influence of external incentives, making the composite information unit ultimately confirmed as a potential external incentive more convincing. This is complementary to the method of only considering the continuity of the publication time and the strength of account interaction, together building a multidimensional and more robust framework for identifying potential external incentives, significantly improving the ability to identify hidden and complex abnormal events, and overcoming the problem of judgment errors caused by the single information source of traditional systems.

[0064] In some preferred embodiments, when the system identifies multiple information entries within a preset detection window and the publication time continuity of these information entries satisfies a preset condition, the system further performs source channel diversity analysis on the composite information unit. Specifically, the system can maintain a list of known source channels, including, for example, mainstream news websites, specific social media platforms, industry analysis report databases, government bulletin platforms, etc. For each information entry in the composite information unit, the system extracts the source information contained in its metadata and compares it with the list of known source channels to determine the source channel to which the information entry belongs. Subsequently, the system counts the number of different source channels contained in the composite information unit. For example, if a composite information unit contains a report from Xinhua News Agency, a hot topic discussion on Weibo, and a brief report published by a certain research institution, the composite information unit contains three different source channels. At this time, since the number of three source channels is greater than or equal to the preset threshold of "at least two", the system can determine that the composite information unit satisfies the preset relevance determination standard in terms of source channel diversity. In this way, the system can ensure that the identified potential external inducement information does not come from a single, possibly biased channel, but is confirmed by multiple independent information sources, thereby improving the reliability and credibility of the composite information unit as a potential external inducement.

[0065] The application further proposes a step of verifying the relevance between the composite information unit and the fund movement, including: the proportion of the number of accounts in the independent account identifier set that interact with the composite information unit to the total number of independent account identifiers is not less than a preset proportion threshold, which is determined that the account interaction intensity of the composite information unit satisfies the preset relevance determination standard.

[0066] The independent account identifier set refers to a set of unique account identifiers performing redemption operations in transaction data streams in a collaborative slow outflow state, and its purpose is to identify a potential investor group related to a specific fund movement; the composite information unit refers to a set of information entries composed of different sources and different data types within a preset detection window, and the information set is formed after the continuity of the publication time meets the preset condition, and its purpose is to integrate scattered external information that may have relevance; the interactive operation refers to various interactive behaviors of account members in the independent account identifier set on the external information platform to the composite information unit, which can include likes, comments, forwards, collections, click views or dwell time, etc., and its purpose is to reflect the degree of attention or participation of the account to the specific information; the preset proportion threshold refers to a numerical limit for quantitatively judging whether the account interaction intensity meets the relevance determination standard, which can be set according to historical data analysis, expert experience or risk preference, and its purpose is to provide a quantitative standard to evaluate the universality of the interactive behavior.

[0067] The scheme of the present application introduces a quantitative evaluation mechanism for account interaction intensity, solving the problem of how to judge the attention degree of the account group to the specific information when verifying the relevance of the composite information unit and the fund movement. Specifically, after identifying the potential external inducement information that has a spatio-temporal correlation with the fund movement and combining it into a composite information unit, the system extracts a set of independent account identifiers performing redemption operations. Subsequently, the system queries the interactive behavior records of the independent account identifier set on the external information platform to analyze its attention degree to the composite information unit. Traditional evaluation methods may only focus on the number or frequency of interactive accounts, but this cannot fully reflect the collective behavior tendency of the entire independent account identifier set. The present scheme calculates the proportion of the number of accounts interacting with the composite information unit to the total number of independent account identifiers. This proportion calculation method can reflect the overall attention and participation of the independent account identifier set to the composite information unit. If only a few accounts interact, even if the interaction behavior is strong, it may be an individual phenomenon and cannot represent the will of the entire independent account identifier set. On the contrary, if most accounts participate in the interaction, it indicates that the composite information unit has a stronger relevance to the independent account identifier set and is more likely to affect its transaction decision. By setting a preset proportion threshold, the present scheme provides a quantitative standard for judging whether the account interaction intensity supports the existence of relevance between the composite information unit and the fund movement. This proportion-based determination method can filter out accidental and non-universal interactive behaviors, avoid incorrectly judging non-strongly correlated interactions as having relevance with the fund movement, and thus improve the accuracy of relevance determination. This enables the system to identify composite information units related to the fund movement, thereby improving the effectiveness of risk warning, avoiding misjudgment, and thus enhancing the reliability of the entire transaction data processing system.

[0068] In some embodiments, the application is implemented as follows: assuming that the system has identified a complex information unit, such as a series of abstract symbolic videos about a certain fund, and has extracted a set of independent account identifiers related to the fund's coordinated slow outflow, which contains 1000 accounts. In order to verify the relevance of the complex information unit to the fund transaction, the system will analyze the interaction records of the 1000 accounts on the external information platform to the complex information unit. For example, the system will count how many accounts have liked, forwarded or commented on the videos. If the statistics show that 800 accounts have interacted with the complex information unit, the proportion of the number of interacting accounts to the total number of independent account identifiers is 800 / 1000, i.e. 80%. At this time, if the system's preset proportion threshold is 70%, since 80% is not lower than 70%, the system will determine that the complex information unit meets the preset relevance determination standard in terms of account interaction intensity. This means that the complex information unit has gained attention and participation in the set of independent account identifiers, thereby enhancing its credibility as a potential external trigger for fund transaction. In this way, the system can avoid mistakenly judging information with only a few accidental interactions as a strong correlation trigger, ensuring the accuracy of the relevance determination.

[0069] Reference Figure 2The application further provides a securities investment fund transaction data processing system applied to a securities investment fund transaction data processing method. The system comprises: an information processing module, which is used for capturing external original information and storing the external original information to a pending information pool without content screening, and synchronously attaching metadata of the external original information during storage; a data analysis module, which is independent of content analysis of the external original information, and is used for analyzing transaction data flow of the securities investment fund to identify fund movement; a feature analysis module, which is used for analyzing statistical characteristics of fund outflow behavior based on a segment of the transaction data flow of the fund movement, wherein the statistical characteristics of the fund outflow behavior comprise a total fund share change rate and an account dispersion, and the total fund share change rate is defined as a total fund outflow rate when the change direction is redemption; a judgment module, which is used for judging whether the fund movement is in a coordinated slow outflow state according to the statistical characteristics of the fund outflow behavior; if the fund movement is in the coordinated slow outflow state, a first-level warning is generated, and an internal investigation request containing a fund code of the fund movement, a starting time, a duration and a behavior characteristic description of the fund movement is generated; and a retrieval module, which is used for receiving the internal investigation request of the behavior characteristic description of the fund movement, and is used for inversely retrieving the external original information stored in the pending information pool according to fund movement spatiotemporal characteristics contained in the internal investigation request of the behavior characteristic description of the fund movement, comparing metadata of the external original information with the fund movement spatiotemporal characteristics, and screening external original information having spatiotemporal correlation with the fund movement to obtain potential external inducement information; and a generation module, which is used for extracting corresponding fund outflow information when the total fund outflow rate exceeds a first preset threshold in a preset first time window, and is used for querying whether there is the first-level warning; if there is the first-level warning, the fund outflow information and the first-level warning are combined to form an event record, and the potential external inducement information is attached to the event record to form a composite abnormal event report.

[0070] Among them, the information processing module refers to the unit responsible for obtaining raw data from external sources and storing it initially, which can be implemented by a data collection server, a message queue system or a distributed file storage system. The data analysis module refers to a unit specially used for independent analysis and abnormal identification of transaction data stream, which can be implemented by a stream processing engine, a big data analysis platform or a special data mining algorithm cluster. The feature analysis module refers to a unit used to extract and quantify behavior pattern statistical indicators from specific data segments, which can be implemented by a statistical calculation engine, a time series analysis tool or a machine learning model. The judgment module refers to a unit that judges the data analysis result according to the preset rule or model and triggers the corresponding response, which can be implemented by a rule engine, a decision tree model or a classifier algorithm. The retrieval module refers to a unit that quickly locates and extracts relevant information from a large amount of stored data according to specific query conditions, which can be implemented by a full-text search engine, a relational database query interface or a graph database query engine. The generation module refers to a unit responsible for integrating, formatting and outputting the final report of information of different sources and types, which can be implemented by a report generator, a data visualization tool or an automated document system.

[0071] The scheme of the present application constructs an automatic and efficient data processing flow by implementing each step in the method of processing securities investment fund transaction data by a special module. Specifically, the information processing module is responsible for capturing and storing external raw information and its metadata to the pending information pool, ensuring that all potentially relevant information is retained, avoiding the omission of key information caused by initial screening. Subsequently, the data analysis module is independent of the content of external raw information and focuses on analyzing the transaction data stream of securities investment funds to identify fund movements. This independence ensures the objectivity of transaction data analysis. On this basis, the feature analysis module further analyzes the statistical characteristics of fund outflow behavior based on the identified fund movement segments, including the total share change rate and account dispersion, thereby quantifying the fund outflow pattern. Then, the judgment module determines whether the fund movement is in a coordinated slow outflow state based on these statistical characteristics. If the determination is true, a first-level warning is immediately generated and an internal investigation request is issued, starting the risk response mechanism. When the internal investigation request is issued, the retrieval module receives the request and uses the spatiotemporal characteristics of the fund movement contained therein to retrieve the stored external raw information in the pending information pool. By comparing the metadata and spatiotemporal characteristics, external information that is spatiotemporally associated with the fund movement is filtered out, thereby discovering potential external triggers. Finally, the generation module extracts fund outflow information when the total fund outflow rate reaches a certain threshold and queries whether there is a first-level warning. If there is, the fund outflow information, first-level warning, and potential external trigger information are combined to form a comprehensive composite abnormal event report. This modular system design automates the method steps that would otherwise require human intervention or time-consuming processing, significantly improving the efficiency and accuracy of data processing. In particular, through the non-screening storage of the information processing module and the reverse retrieval mechanism of the retrieval module, the system can effectively deal with the problem of temporal misalignment of cause-and-effect relationships at the data record level. Even hidden, prior fund movements can be identified later and traced back to their early, indirectly related external triggers, thereby determining the two stages of the entire abnormal event (slow outflow triggered by hidden signals and rapid outflow triggered by subsequent public information) as a continuous event with internal logical connections, overcoming the detection failure problem caused by the linear temporal logic limitation of traditional systems. This design enables the system to more comprehensively and timely identify and respond to complex market risks, ensuring the integrity of data processing and the depth of risk identification.

[0072] In some preferred embodiments, the application is implemented as follows. The information processing module can be a data collection service deployed on a cloud server, which continuously listens to and captures raw data from various external information sources (e.g. news APIs, social media data streams, regulatory announcement platforms, etc.), and writes them to a distributed file system (e.g. HDFS or Amazon S3) in their original format, while generating and attaching metadata such as timestamps, source identifiers, file sizes, etc. for each piece of raw information. The data analysis module can be a real-time stream processing application built on Apache Flink or Spark Streaming, which independently receives transaction data streams from the fund company's transaction database interface, and uses a pre-set rule set or machine learning model to analyze transaction patterns in real time to identify potential fund movements, such as large transactions, abnormal frequency transactions, etc. The feature analysis module can be a sub-component integrated into the data analysis module, which, after identifying fund movements, will call statistical analysis libraries (e.g. Python's Pandas or R's statistical package) to calculate the fund total share change rate (by linear regression analysis of historical share data) and account dispersion (by calculating the ratio of redemption account number to active account number or Shannon entropy) for the transaction data segment involved in the movement. The decision module can be a microservice based on a rule engine (e.g. Drools) or a decision model (e.g. support vector machine), which receives statistical features output by the feature analysis module, and according to the pre-set collaborative slow outflow judgment logic, judges whether the current fund movement meets the conditions of the collaborative slow outflow state; if so, it sends a first-level warning message to the internal warning system through the message queue (e.g. Kafka), and sends a survey request containing the fund code, time range and behavior feature description to the internal investigation management system. The retrieval module can be a search service built on Elasticsearch, which receives survey requests from the internal investigation management system, and parses the spatio-temporal features of the fund movements, then uses Elasticsearch's query capabilities to reverse search external raw information matching these spatio-temporal features in the pending information pool, and by comparing the timestamps and source information in the metadata, filters out external raw information with spatio-temporal correlation as potential external trigger information. The generation module can be a batch job running at a fixed time or an event-driven reporting service, which continuously monitors the fund total outflow rate, and when the rate exceeds the threshold within a pre-set time window, it extracts the corresponding fund outflow information from the transaction database and queries the warning system for first-level warnings for the fund; if so, it integrates the fund outflow information, first-level warning details and potential external trigger information provided by the retrieval module into a structured report, which can be stored in JSON, XML format or displayed through a web interface to risk management personnel.

[0073] The above disclosed are only the preferred and feasible embodiments of the present application, and are not intended to limit the protection scope of the present application, so any equivalent technical changes made according to the content of the present application and the drawings are included in the protection scope of the present application, and furthermore, the elements can be updated as the technology develops.

Claims

1. A method for processing transaction data of a security investment fund, characterized by, The method comprises the following steps: S1: capturing external raw information and storing it completely to a pending information pool without content screening, and synchronously attaching metadata of the external raw information during storage; S2: analyzing the transaction data stream of the securities investment fund independently of the content of the external raw information to identify a fund movement; S3: based on the segment of the transaction data stream of the fund movement, analyzing statistical characteristics of the fund outflow behavior, the statistical characteristics of the fund outflow behavior including a total fund share change rate and an account dispersion, the total fund share change rate being defined as a total fund outflow rate when the change direction is redemption; S4: determining whether the fund movement is in a coordinated slow outflow state according to the statistical characteristics of the fund outflow behavior; if it is determined that the fund movement is in the coordinated slow outflow state, generating a first-level warning, and generating an internal investigation request containing a fund code of the fund movement, a start time, a duration and a behavior characteristic description of the fund movement; S5: receiving the internal investigation request of the behavior characteristic description of the fund movement, and based on the fund movement spatiotemporal characteristics contained in the internal investigation request of the behavior characteristic description of the fund movement, reversely retrieving the external raw information stored in the pending information pool, comparing the metadata of the external raw information with the fund movement spatiotemporal characteristics, and screening out the external raw information having a spatiotemporal correlation with the fund movement to obtain potential external inducement information; S6: when the total fund outflow rate exceeds a first preset threshold within a preset first time window, extracting corresponding fund outflow information, and querying whether there is a first-level warning; if there is, merging the fund outflow information and the first-level warning to form an event record, and attaching the potential external inducement information to the event record to form a composite abnormal event report.

2. The method of claim 1, wherein the fund transaction data is processed by the fund transaction data processing server. In step S3, the analysis of the total fund share change rate comprises the following steps: obtaining fund total share data recorded in order of specified time points in the segment of the transaction data stream of the fund movement; performing linear regression on the fund total share data in a sliding time window to obtain a trend line describing the change of the fund total share data with time in the sliding time window; calculating the slope of the trend line, and the slope as the total fund share change rate, and when the slope is negative, the absolute value of the negative value as the total fund outflow rate.

3. The method of claim 1, wherein the fund transaction data is processed by the fund transaction data processing server. In step S3, the analysis of the account dispersion comprises the following steps: based on the segment of the transaction data stream of the fund movement; obtaining a set of unique identifiers of accounts initiating redemption operations in the sliding time window as a set of redemption account identifiers; obtaining a set of unique identifiers of all accounts having transaction behaviors in the sliding time window as a set of active account identifiers; calculating the account dispersion based on the ratio of the number of the set of redemption account identifiers to the number of the set of active account identifiers, or calculating the account dispersion based on the Shannon entropy value of the set of redemption account identifiers in the redemption amount distribution.

4. The method of claim 1, wherein the fund transaction data is processed by the fund transaction data processing server. In step S4, the determination step of the coordinated slow outflow state comprises: analyzing the time distribution of each redemption transaction constituting the fund movement; according to the time distribution, identifying multiple redemption transactions initiated by different accounts within a preset second time window and with a single amount lower than a preset amount threshold; Analyze the frequency of multiple redemption transactions; When the occurrence density exceeds the preset density threshold, the fund abnormality is determined to be in a coordinated slow outflow state by combining the occurrence density, the rate of change of total fund shares and the account dispersion.

5. The method of claim 1, wherein the fund transaction data is processed by: Step S5 includes: ​ Receive internal investigation requests describing the behavioral characteristics of the aforementioned abnormal fund movements; Based on the spatiotemporal characteristics of fund anomalies described in the internal investigation request, a preliminary information retrieval is performed, and the external raw information stored in the pending information pool is retrieved in reverse to obtain a preliminary information set. Extract the set of independent account identifiers that perform redemption operations from the transaction data stream in a coordinated slow outflow state; Based on the set of independent account identifiers, query the interaction records of the independent account identifier set on the external information platform; Based on the interaction behavior records, identify the information items that are commonly followed by multiple members in the set of independent account identifiers to obtain the set of information that are commonly followed. By comparing the preliminary information set and the information set of common concern, and combining the metadata of the original external information and the spatiotemporal characteristics of fund fluctuations, information items that exist in both the preliminary information set and the information set of common concern and have a spatiotemporal correlation with fund fluctuations are selected as potential external trigger information.

6. The method of claim 5, wherein the step of processing the transaction data of the securities investment fund is characterized by, Based on the information obtained from the screening of potential external triggers, the following further includes: The potential external trigger information is arranged in chronological order and by source channel to identify multiple information entries composed of different sources and data types within a preset detection window; Determine the continuity of the publication time of multiple information items. When the continuity of the publication time meets the preset conditions, combine the multiple information items into a composite information unit. Based on a set of independent account identifiers, we analyze the account interaction records of composite information units on external information platforms to verify the correlation between composite information units and fund anomalies. When a composite information unit meets the preset relevance criteria in terms of continuity of publication time, diversity of source channels, and intensity of account interaction, the composite information unit is identified as the final potential external trigger information.

7. The method of claim 6, wherein the step of processing the fund transaction data is performed by a computer system. Within a preset detection window, if the time interval between any two adjacent information entries is less than or equal to a preset time interval threshold, the composite information unit is considered to meet the preset correlation judgment criteria in terms of the continuity of its publication time.

8. The method of claim 6, wherein the step of processing the transaction data of the securities investment fund is characterized by, A composite information unit containing information items from at least two different sources is considered to meet a preset relevance criterion in terms of the diversity of its sources. ​ 9. The method of claim 6, wherein the step of processing the fund transaction data is performed by a computer system. If the number of accounts that interact with composite information units in the set of independent account identifiers is not less than a preset threshold, the composite information unit is considered to meet the preset correlation criteria in terms of account interaction intensity.

10. A mutual fund transaction data processing system for use in the mutual fund transaction data processing method of claim 1, wherein The system includes: The information processing module is used to capture raw external information and store it completely in the pending information pool without content filtering, and to attach metadata of the raw external information at the same time during storage. The data analysis module, independent of external raw information content analysis, analyzes the transaction data flow of securities investment funds to identify abnormal fund movements; The feature analysis module analyzes the statistical characteristics of fund outflow behavior based on fragments of transaction data streams showing abnormal fund movements. The statistical characteristics of fund outflow behavior include the rate of change of total fund units and account dispersion. The rate of change of total fund units is defined as the total fund outflow rate when the direction of change is redemption. The judgment module determines whether the abnormal fund movement is in a coordinated slow outflow state based on the statistical characteristics of the fund outflow behavior. If it is determined to be in a coordinated slow outflow state, a first-level warning is generated, and an internal investigation request containing the fund code, start time, duration and behavioral characteristics description of the abnormal fund movement is generated. The retrieval module is used to receive internal investigation requests describing the behavioral characteristics of fund anomalies, and to retrieve external raw information stored in the pending information pool based on the spatiotemporal characteristics of fund anomalies contained in the internal investigation requests describing the behavioral characteristics of fund anomalies. It compares the metadata of the external raw information with the spatiotemporal characteristics of fund anomalies and filters out external raw information that has a spatiotemporal correlation with fund anomalies in order to obtain potential external trigger information. The generation module extracts the corresponding fund outflow information when the total fund outflow rate exceeds the first preset threshold within a preset first time window, and checks whether there is a first-level warning. If there is, it merges the fund outflow information and the first-level warning to form an event record, and attaches potential external trigger information to the event record to form a composite abnormal event report.

Images