Programmed abnormal securities trading risk identification method, device, computer equipment and storage medium

Abstract

This invention relates to the field of financial transaction risk identification technology, and discloses a method for identifying risks in programmed abnormal securities transactions. The method includes: acquiring current transaction data for the current time period; extracting features from the current transaction data to obtain current transaction features corresponding to the current transaction data; constructing current graph structure data based on the current transaction features; inputting the current graph structure data into a first transaction risk identification model to obtain a first risk identification result; the first transaction risk model is obtained by training a graph neural network model based on graph structure sample data; the graph structure sample data is constructed based on transaction feature data of programmed transaction samples from historical time periods; the first risk identification result includes account information indicating transaction risks in the current time period. Through the above method, this invention effectively improves the accuracy of identifying programmed abnormal transactions.

Description

Technical Field

[0001] This invention relates to the field of financial transaction risk identification technology, specifically to a method, apparatus, computer equipment, and storage medium for identifying programmatic abnormal securities transactions. Background Technology

[0002] Currently, against the backdrop of strengthened regulation of algorithmic trading, enhancing institutions' ability to identify and manage abnormal algorithmic trading has become a key issue. Traditional methods for identifying abnormal securities trading primarily rely on expert rules, which filter out trading records that do not meet certain trading patterns using established rules. However, traditional rule-based identification techniques struggle to distinguish whether anomalies originate from algorithmic trading. Furthermore, the increasing prevalence of algorithmic trading in the market has introduced new challenges to identifying algorithmic anomalies within the abnormal trading identification process.

[0003] Compared to ordinary abnormal trading, algorithmic trading presents new difficulties and challenges, primarily due to its unique nature and complexity. The identification and regulation of algorithmic trading face challenges such as the difficulty of analyzing and processing massive amounts of data, the inability of expert rules to uncover complex and hidden anomalies, and the difficulty of real-time monitoring of high-frequency trading data. Traditional rule-based identification methods are no longer applicable to this new type of algorithmic trading. Expert rules struggle to uncover complex and hidden anomalies. Limited by the complexity, diversity, and anonymity of algorithmic trading, existing expert rules suffer from difficulties in data discovery, low update efficiency, and poor adaptability. Algorithmic trading involves multiple assets, trading strategies, and trading entities. Each trading strategy may have different behavioral patterns and rules, and also involves complex algorithmic logic and trading strategies. Rules based on expert experience are insufficient to cover all possible abnormal trading situations, especially hidden anomalies; the financial market environment and conditions are constantly changing, including market trends, liquidity, and trading rules. This rapid change makes it difficult for expert rules to be adjusted and adapted to new market conditions in a timely manner, resulting in difficulty in quickly discovering and identifying new types of abnormal trading behaviors; some complex abnormal trading behaviors involve complex trading patterns, data correlations and nonlinear relationships, which are not easy to detect with simple rules.

[0004] To address these new challenges, financial institutions need to continuously upgrade their monitoring systems, integrating advanced technologies, algorithms, and analytical methods to more effectively identify potential algorithmic anomalous trading. This also underscores the compliance and regulatory challenges, necessitating the development of flexible and adaptable regulatory frameworks.

[0005] Currently, there is no mature solution for intelligent programmatic anomaly securities trading identification. Some algorithms exist for detecting abnormal transfer transactions using artificial intelligence, often simply referred to as anomaly trading algorithms, but their modeling methods and application scenarios differ significantly from those for anomaly securities trading. Existing schemes for detecting abnormal financial entities use graph neural networks to process the feature graph of credit card transaction relationships, thereby determining the anomaly detection structure of financial entities and accurately detecting them, thus improving financial security. However, firstly, this method of obtaining transaction relationship graphs cannot be applied to securities trading; in fact, obtaining securities trading relationship graphs is far more complex and challenging. In securities trading, the trading entities are not engaged in peer-to-peer transactions but are matched with centralized exchanges, and the counterparties are not clearly defined. The relationships between trading nodes cannot be described using simple transfer relationships. How to generate a graph structure in securities trading is a major challenge for this technical solution. Secondly, existing technologies use static graph structures, requiring retraining and feature extraction processes after adding new nodes. In securities trading, the number of trading nodes to be judged is dynamically changing, meaning new trader accounts are constantly being added to the graph network. Furthermore, due to the massive scale of the securities trading graph, frequent retraining is unsustainable. Moreover, traditional graph neural networks cannot address the scale explosion problem in securities trading. Anomaly nodes in securities trading are characterized by account-entity-time, and the number of nodes to be judged increases dramatically with the daily trading hours, requiring effective pruning and model updating methods, which this method cannot solve. In addition, securities anomaly identification suffers from extreme imbalance in abnormal behavior data, meaning there are extremely few anomalous samples. For such problems, effective data and sample augmentation techniques are needed to enhance the effectiveness of actual anomaly detection; imbalanced sample handling mechanisms are something this method cannot address. Summary of the Invention

[0006] In view of the above problems, embodiments of the present invention provide a method, apparatus, computer equipment and storage medium for identifying risks in programmed abnormal securities trading, which are used to solve the technical problem of inaccurate identification of risks in programmed trading in the prior art.

[0007] According to one aspect of the present invention, a method for identifying risks in programmed abnormal securities trading is provided, the method comprising:

[0008] Get the current transaction data for the current time period;

[0009] Feature extraction is performed on the current transaction data for the current time period to obtain the current transaction features corresponding to the current transaction data;

[0010] Based on the current transaction characteristics of the current transaction data, a current graph structure data is constructed; the current graph structure data includes multiple graph nodes and edges; the graph nodes are used to represent a current transaction data; the edges are used to represent the relationships between various current transaction data.

[0011] The current graph structure data is input into the first transaction risk identification model to obtain the first risk identification result; the first transaction risk model is obtained by training a graph neural network model based on the graph structure sample data; the graph structure sample data is constructed based on the transaction feature data of the programmed transaction samples at historical times; the first risk identification result includes account information that has transaction risks in the current time period.

[0012] In an optional embodiment, the method further includes: inputting the current trading features into a second trading risk identification model and a third trading risk identification model respectively to obtain a second risk identification result and a third risk identification result; the second trading risk model is obtained by training a preset unsupervised time series neural network model based on programmed trading samples; the third trading risk model is obtained by training a preset supervised time series neural network model based on programmed trading samples; and a target risk identification result is obtained based on the first risk identification result, the second risk identification result, and the third risk identification result.

[0013] In one optional approach, before inputting the current graph structure data into the first trading risk identification model to obtain the first risk identification result, the method includes: determining a programmatic trading sample according to a preset programmatic trading judgment rule; the programmatic trading sample includes programmatic trading sample feature data and corresponding sample labels; the programmatic trading sample feature data includes sample basic feature data and sample time series feature data; constructing graph structure sample data based on the programmatic trading sample feature data; the graph structure sample data includes graph nodes and edges; the graph nodes are used to represent a programmatic trading sample, and the graph nodes include investor information, target information, and trading time information of the programmatic trading sample; the edges are used to represent the association between various programmatic trading samples; the edges between the graph nodes are established based on whether the various graph nodes are from the same investor, the same account, and / or trade the same target; inputting the graph structure sample data into a graph neural network model for training to obtain the first trading risk identification model.

[0014] In one optional approach, the preset algorithmic trading determination rules include whether the number of transactions exceeds a preset transaction number threshold, or whether the transaction amount exceeds a preset transaction amount threshold, or whether the transaction percentage exceeds a preset percentage threshold; the step of determining the algorithmic trading sample according to the preset algorithmic trading determination rules includes: based on the account identifier in historical trading data, statistically determining historical trading data where the number of transactions corresponding to the account identifier within a preset time period is greater than a preset transaction number threshold as the algorithmic trading sample; based on the account identifier in historical trading data, statistically determining trading data where the transaction amount corresponding to the account identifier is greater than a preset transaction amount threshold as the algorithmic trading sample; based on the account identifier in historical trading data, statistically determining trading data where the transaction percentage corresponding to the account identifier within a preset time period is greater than a preset percentage threshold as the algorithmic trading sample.

[0015] In one optional approach, constructing graph structure sample data based on the programmatic trading sample feature data of the programmatic trading samples includes: performing data cleaning and standardization on the sample information of the programmatic trading samples to obtain preprocessed programmatic trading sample feature data; performing dimensionality reduction on the preprocessed programmatic trading sample feature data to obtain dimensionality-reduced programmatic trading sample feature data; treating each programmatic trading sample as a graph node, and constructing edges between programmatic trading samples with related relationships to obtain initial graph structure sample data; the node attributes of the graph nodes include the dimensionality-reduced programmatic trading sample feature data of the programmatic trading samples. The algorithm first generates programmatic trading sample feature data by using graph contrastive learning to enhance the feature representation of graph nodes. Then, it performs sample enhancement on the enhanced feature representation of the programmatic trading sample feature data through oversampling to generate a first type of enhanced sample. Next, it performs sample enhancement through sample mixing techniques to generate a second type of enhanced sample. Finally, it performs sample enhancement through conditional generative adversarial networks to generate a third type of enhanced sample. Based on a gradient descent boosting tree model, it performs feature filtering on the enhanced feature representation of the programmatic trading sample feature data, the first type of enhanced sample, the second type of enhanced sample, and the third type of enhanced sample to obtain the final programmatic trading sample feature data of the graph structure sample data.

[0016] In one optional approach, before inputting the graph structure sample data into a graph neural network model for training to obtain a first transaction risk identification model, the method further includes: pruning the programmatic transaction sample feature data of the graph structure sample data according to preset business rules to obtain first-pruned programmatic transaction sample feature data; performing feature aggregation on the first-pruned programmatic transaction sample feature data, calculating similarity, and pruning the first-pruned programmatic transaction sample feature data again based on the similarity and a similarity threshold to obtain second-pruned programmatic transaction sample feature data; and calculating the local structure of the graph according to a community detection partitioning algorithm, and pruning the second-pruned programmatic transaction sample feature data again to obtain third-pruned programmatic transaction sample feature data.

[0017] In one alternative approach, the graph neural network model is a GraphSage model; the step of inputting the graph structure sample data into the graph neural network model for training to obtain the first transaction risk identification model includes: inputting the graph structure sample data into the GraphSage model for training to obtain the first transaction risk identification model.

[0018] According to another aspect of the present invention, a programmed abnormal securities trading risk identification device is provided, comprising:

[0019] The data determination module is used to obtain the current transaction data for the current time period;

[0020] The feature extraction module is used to extract features from the current transaction data in the current time period to obtain the current transaction features corresponding to the current transaction data.

[0021] A construction module is used to construct a current graph structure data based on the current transaction characteristics of the current transaction data; the current graph structure data includes multiple graph nodes and edges; the graph nodes are used to represent a current transaction data; the edges are used to represent the relationships between various current transaction data.

[0022] The identification module is used to input the current graph structure data into a first transaction risk identification model to obtain a first risk identification result; the first transaction risk model is obtained by training a graph neural network model based on graph structure sample data; the graph structure sample data is constructed based on the transaction feature data of the programmed transaction samples at historical times; the first risk identification result includes account information that has transaction risks in the current time period.

[0023] According to another aspect of the present invention, a computer device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; the memory is used to store at least one executable instruction, the executable instruction causing the processor to perform the operation of the programmed abnormal securities trading risk identification method. According to yet another aspect of the present invention, a computer-readable storage medium is provided, the storage medium storing at least one executable instruction, which, when executed on a computer device, causes the computer device to perform the operation of the programmed abnormal securities trading risk identification method.

[0024] This invention constructs graph-structured data of securities trading data based on spatiotemporal data, preprocesses and filters the features of the graph data structure, and uses graph neural networks for risk identification. This approach can better capture complex trading patterns and correlations, thereby improving the accuracy and efficiency of abnormal trading identification, finding hidden new types of abnormal trading, enhancing compliance management, reducing the risk of illegal trading, improving market stability and fairness, and achieving regulatory objectives. The graph neural network-based method for monitoring spatiotemporal anomalies in programmed trading also features automation and scalability, allowing it to better adapt to market dynamics and emerging new forms of abnormal trading. This invention adds intuitive programmed trading identification logic for securities trading anomalies, facilitating the generalization of programmed trading identification; and designs effective data and sample augmentation techniques to address the extreme imbalance problem of abnormal behavior data in securities trading, improving the effectiveness of anomaly detection.

[0025] Furthermore, by fusing multiple models, the prediction results of unsupervised and supervised neural network models are averaged to obtain an average value as the final output, which effectively improves the accuracy of programmatic risk identification.

[0026] The above description is merely an overview of the technical solutions of the embodiments of the present invention. In order to better understand the technical means of the embodiments of the present invention and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0027] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0028] Figure 1 A flowchart illustrating the algorithmic abnormal securities trading risk identification method provided in an embodiment of the present invention is shown.

[0029] Figure 2 This diagram illustrates the sample construction in the algorithmic abnormal securities trading risk identification method provided by an embodiment of the present invention.

[0030] Figure 3 This diagram illustrates the structure of the algorithmic abnormal securities trading risk identification method provided in this embodiment of the invention.

[0031] Figure 4 This diagram illustrates the training process in the programmed abnormal securities trading risk identification method provided in an embodiment of the present invention.

[0032] Figure 5 This diagram illustrates the structure of the programmed abnormal securities trading risk identification device provided in an embodiment of the present invention.

[0033] Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention is shown. Detailed Implementation

[0034] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0035] First, the relevant data in the embodiments of the present invention will be explained:

[0036] Securities trading: Securities trading refers to the process of buying and selling securities, where a security is a financial instrument representing an interest in a company or other entity. Securities can include stocks, bonds, options, ETFs (exchange-traded funds), etc.

[0037] Algorithmic trading: Algorithmic trading is a financial trading strategy that uses computer programs to automatically execute trades. This trading method relies on pre-set rules and algorithms to automatically execute buy and sell decisions through a computer system without human intervention. Algorithmic trading is also known as algorithmic trading or automated trading.

[0038] Abnormal Securities Trading: Definition: Abnormal securities trading refers to unusual, unusual, or attention-grabbing trading activities in the securities market. These anomalies may involve securities prices, trading volumes, trading patterns, or other phenomena inconsistent with normal market behavior. Characteristics: This may include sharp fluctuations in stock prices, sudden increases in trading volume, unusual trading patterns, etc. Abnormal securities trading may be caused by insider trading, market manipulation, erroneous trading, or other reasons. Monitoring: Regulatory agencies typically use monitoring systems and algorithms to detect abnormal securities trading in the market to maintain market fairness and transparency.

[0039] Exceptional Transaction Types: Definition: Exceptional transaction types typically refer to unusual or unusual fund transfers or transactions occurring within a money flow and payment system. Characteristics: This may include unusually large fund transfers, frequent fund flows, and unusual payment patterns. Exceptional transaction types may involve money laundering, fraud, illicit fund flows, etc. Monitoring: Financial institutions, payment system providers, and regulatory agencies typically use anti-money laundering (AML) and anti-fraud systems to monitor unusual transaction types to prevent potential illicit activities.

[0040] Abnormal programmed securities trading: refers to unusual or abnormal trading activities that occur in automated trading strategies executed by computer programs.

[0041] Temporal neural networks: Deep learning neural network models primarily used for processing time series data.

[0042] Graph Neural Networks (GNNs) are a class of deep learning models specifically designed for processing graph-structured data. Graph-structured data consists of nodes (or vertices) and edges (or connections) used to represent relationships between entities. The goal of GNNs is to learn the complex relationships between nodes, thereby enabling efficient inference and prediction on graph-structured data.

[0043] Here, the background technology of the embodiments of the present invention will be further described in detail:

[0044] Against the backdrop of enhanced regulation of algorithmic trading, strengthening the ability to identify and manage abnormal algorithmic trading in compliance supervision has become a key issue.

[0045] Traditional methods for identifying abnormal securities transactions primarily rely on expert rules, which filter out transaction records that do not meet certain trading patterns using established rules. However, traditional rule-based identification techniques struggle to distinguish whether anomalies originate from algorithmic trading. Furthermore, the increasing prevalence of algorithmic trading in the market presents new challenges in identifying algorithmic anomalies within the abnormal transaction identification process.

[0046] Compared to ordinary abnormal trading, algorithmic trading presents new difficulties and challenges, primarily due to its unique nature and complexity. The identification and regulation of algorithmic trading face challenges such as the difficulty of analyzing and processing massive amounts of data, the inability of expert rules to uncover complex and hidden anomalies, and the difficulty of real-time monitoring of high-frequency trading data. Traditional rule-based identification methods are no longer applicable to this new type of algorithmic trading. Expert rules struggle to uncover complex and hidden anomalies. Limited by the complexity, diversity, and anonymity of algorithmic trading, existing expert rules suffer from difficulties in data discovery, low update efficiency, and poor adaptability. Algorithmic trading involves multiple assets, trading strategies, and trading entities. Each trading strategy may have different behavioral patterns and rules, and also involves complex algorithmic logic and trading strategies. Rules based on expert experience are insufficient to cover all possible abnormal trading situations, especially hidden anomalies; the financial market environment and conditions are constantly changing, including market trends, liquidity, and trading rules. This rapid change makes it difficult for expert rules to be adjusted and adapted to new market conditions in a timely manner, resulting in difficulty in quickly discovering and identifying new types of abnormal trading behaviors; some complex abnormal trading behaviors involve complex trading patterns, data correlations and nonlinear relationships, which are not easy to detect with simple rules.

[0047] To address these new challenges, financial institutions need to continuously upgrade their monitoring systems, integrating advanced technologies, algorithms, and analytical methods to more effectively identify potential algorithmic anomalous trading. This also underscores the compliance and regulatory challenges, necessitating the development of flexible and adaptable regulatory frameworks.

[0048] Currently, there is no mature solution for intelligent, programmatic identification of abnormal securities transactions. While some algorithms exist that use artificial intelligence to detect abnormal transfer transactions (often simply referred to as abnormal transactions), their modeling methods and application scenarios differ significantly from those for identifying abnormal securities transactions.

[0049] To address the above pain points, a need for a securities market abnormal trading behavior feature detection and early warning system was proposed. The applicant proposed a method for detecting spatiotemporal anomalies in algorithmic trading based on graph neural networks. This method constructs AI models using deep learning and machine learning to empower algorithmic trading supervision, mining hidden abnormal patterns from large-scale trading data to identify algorithmic anomalies. This assists compliance and risk control personnel in identifying, judging, and monitoring abnormal algorithmic trading, improving the efficiency of compliance and risk control management. Ultimately, it helps improve the intelligent application level of compliance and risk control, contributing to the digital upgrade of compliance supervision.

[0050] In existing technologies, abnormal algorithmic trading detection is generally based on expert rules. Securities trading regulatory requirements dictate that the established rule models and derived expert scoring card models typically include the following aspects:

[0051] 1. False Orders: This refers to abnormal trading behavior that, without the intention of completing a transaction, involves submitting and canceling a large number of orders to induce, mislead, or influence the normal trading decisions of other investors. Examples include situations occurring during the opening call auction or continuous trading phase. 2. Price Manipulation: This refers to abnormal trading behavior where large, continuous, or concentrated orders are submitted, or orders are submitted at prices significantly deviating from the latest stock price, resulting in a significant increase (decrease) in the stock price. 3. Maintaining Price Limits: This refers to abnormal trading behavior that uses large, continuous, or concentrated orders to maintain the stock price within its price limit range. 4. Self-Dealing or Counterparty Trading: This refers to abnormal trading behavior involving large-scale stock transactions between a single account, accounts under one's actual control, or suspected related accounts, affecting the stock price or trading volume. 5. Severe Abnormal Fluctuations in Stock Order Rate: Severe abnormal fluctuations refer to situations where the main board stock auction trading exhibits severe abnormal fluctuations as defined in the trading rules. 6. Other abnormal trading behaviors that violate laws, administrative regulations, departmental rules, normative documents, or the exchange's business rules. Traditional rule-based identification methods are no longer applicable to new types of algorithmic trading. Expert rules are relatively simple and fixed, making it difficult to cover all possible abnormal trading situations and uncover complex, hidden anomalies. Current rule-based identification technologies only pinpoint ordinary trading anomalies; there are no clear expert guidelines for algorithmic trading, making it difficult to distinguish whether anomalies originate from algorithmic trading. The financial market environment and conditions change frequently, including market trends, liquidity, and trading rules. This rapid change makes it difficult for expert rules to adjust and adapt to new market conditions in a timely manner, resulting in difficulties in quickly detecting and identifying new types of abnormal trading behavior. Furthermore, due to the complexity, diversity, and anonymity of algorithmic trading, adding new expert rules faces challenges such as high difficulty in data discovery, low update efficiency, and poor adaptability. Some complex abnormal trading behaviors involve intricate trading patterns, data correlations, and nonlinear relationships, making them difficult to detect with simple rules.

[0052] While existing technologies utilize transaction relationship graphs for detecting anomalous financial entities, they are not applicable to securities trading. Obtaining a securities trading relationship graph is far more complex and challenging. In securities trading, transactions are not peer-to-peer but are matched with centralized exchanges, and the counterparties are often unclear. The relationships between trading nodes cannot be described using simple transfer relationships. Generating a graph structure in securities trading is a major challenge of this technical solution. This method extracts features from a credit card transaction relationship graph to obtain a credit card transaction relationship feature graph; this feature graph is then input into a graph neural network to obtain anomaly predictions for each financial entity. The graph neural network includes at least one graph convolutional layer and a prediction layer. However, this method still considers the static graph structure, requiring retraining and feature extraction after adding nodes. In securities trading, the number of trading nodes to be judged changes dynamically, with new trader accounts constantly joining the graph network. Furthermore, the massive scale of the securities trading graph makes frequent retraining impractical. A dynamic scalability technique for the graph is needed, which this method lacks. Traditional graph neural networks cannot solve the problem of scale explosion in securities trading. Anomaly nodes in securities trading are characterized by account-target-time, and the number of nodes to be identified increases dramatically as daily trading hours expand. Effective pruning and model updating methods are needed, which this method cannot address. Furthermore, in securities anomaly identification, there is the problem of extremely imbalanced data, meaning anomaly samples are extremely scarce. For such problems, effective data and sample augmentation techniques are needed to enhance the effectiveness of actual anomaly detection; imbalanced sample processing mechanisms are also beyond the scope of this method.

[0053] Compared to traditional methods, this invention provides a method for detecting spatiotemporal anomalies in programmatic trading using spatiotemporal data deep neural networks and graph neural networks. This method possesses the capability to perform complex modeling, analysis, mining, and prediction on massive high-frequency trading data, effectively assisting in the accurate prediction of programmatic anomalies. Graph neural networks are a type of neural network used to process graph data. Graph neural networks have already achieved excellent results in areas such as social network analysis and recommendation systems. In programmatic trading, graph neural networks can be used to model trading data, thereby extracting spatiotemporal patterns. Neural networks can better capture complex trading patterns and correlations, thereby improving the accuracy and efficiency of anomaly identification, finding hidden new types of anomalies, enhancing compliance management, reducing the risk of illegal trading, improving market stability and fairness, and achieving regulatory goals. The graph neural network-based method for detecting spatiotemporal anomalies in programmatic trading also features automation and scalability, better adapting to market dynamics and emerging new forms of anomalies. This method first converts trading data into spatiotemporal data, constructing a time-series deep neural network model; further, it combines the spatiotemporal data with the account node structure to construct a graph network and embed graph vectors, building a graph neural network model. Figure 4 As shown, feature and sample augmentation algorithms are used during model training to mine hidden anomalies from large-scale transaction data, ensuring the accuracy, reliability, and timeliness of the abnormal transaction identification model and improving the efficiency of compliance and risk control business management.

[0054] This invention addresses anomaly detection in algorithmic trading, specifically the complex spatiotemporal relationships of trading behavior. It researches a method for monitoring spatiotemporal patterns of abnormal trading based on graph neural networks. By employing graph neural networks to fuse different types of relationships within trading data and utilizing network structures such as recurrent neural networks and attention mechanisms to model the temporal connections between transactions, it achieves real-time detection of abnormal trading patterns and provides anomaly clues to support the automatic generation of regulatory reports. Key technologies include: time-series deep neural network modeling, graph neural network modeling, feature and sample augmentation algorithms, and model deployment, ensuring the accuracy, reliability, and efficiency of the abnormal trading identification model, guaranteeing high accuracy, reliability, and timeliness.

[0055] Figure 1 A flowchart of a method for identifying risks in programmed abnormal securities trading provided by an embodiment of the present invention is shown. This method is executed by a computer device. The computer device may include a computer, a smart terminal, a distributed device, etc., and the embodiments of the present invention do not impose specific limitations. Figure 1 As shown, the method includes the following steps:

[0056] Step 110: Obtain the current transaction data for the current time period.

[0057] In this embodiment of the invention, securities trading data is acquired periodically, with the current period being one cycle of the data acquisition cycle. By periodically acquiring securities trading data and using programmed securities trading data identified in historical periods to predict the risks of current trading data in the current period, the model incorporates the temporal characteristics of the data.

[0058] In this embodiment of the invention, the current transaction data is in the form of a spatiotemporal sequence. A single current transaction data entry includes information such as transaction time, customer identifier (customer ID), account information, fund flow, transaction flow, transaction target, and transaction unit time. Specifically, information such as Shanghai and Shenzhen stock market snapshots, customer basic information tables, customer asset flow tables, and customer order cancellation flow tables are obtained, and the current transaction data is extracted based on this information.

[0059] Step 120: Extract features from the current transaction data for the current time period to obtain the current transaction features corresponding to the current transaction data.

[0060] The process begins with feature extraction from the current trading data, followed by data cleaning and standardization to obtain preprocessed current trading features. Specifically, after data collection, data cleaning includes removing duplicate data and handling outliers. Outliers are handled, such as negative prices or quantities, or extremely unusual trading data requiring inspection and processing. Missing values ​​may exist in the data, such as missing investor or account information in some trading records. For missing values, methods such as imputation, deletion, or interpolation are used to ensure data integrity. For numerical data, standardization is required to eliminate differences in units between variables, ensuring the stability and accuracy of the model. Then, based on pre-set trading feature dimensions, the preprocessed current trading features are filtered to obtain the final current trading features. These pre-set trading feature dimensions are the trading feature dimensions required for model prediction obtained after feature extraction, preprocessing, dimensionality reduction, feature enhancement, and sample augmentation of the programmed trading samples during training.

[0061] Step 130: Construct the current graph structure data based on the current transaction characteristics of the current transaction data.

[0062] The current graph structure data includes multiple graph nodes and edges. In this embodiment of the invention, the graph nodes of the current graph structure data are used to represent a current transaction data; the edges are used to represent the relationships between various current transaction data.

[0063] In embodiments of the present invention, such as Figure 3As shown, after determining the current transaction data, each current transaction data is treated as a graph node, and edges are constructed between the current transaction data that have a relationship to each other to obtain the initial graph structure of the current transaction data; the node attributes of the graph nodes include the current transaction characteristics of the current transaction data.

[0064] Step 140: Input the current graph structure data into the first transaction risk identification model to obtain the first risk identification result.

[0065] In this embodiment of the invention, the first trading risk model is obtained by training a graph neural network model based on graph structure sample data. The graph structure sample data is constructed from the trading characteristic data of the programmed trading samples at historical time points.

[0066] Specifically, the graph structure sample data is obtained in the following way:

[0067] Step 001: Determine the algorithmic trading sample according to the preset algorithmic trading judgment rules.

[0068] The algorithmic trading samples include algorithmic trading sample feature data and corresponding sample labels; the algorithmic trading sample feature data includes basic sample feature data and sample time-series feature data. For example... Figure 2 As shown, the basic feature data of the sample includes investor / client identifier, trading target, and trading time information. The sample time-series feature data includes fields such as client identifier, sample label, trading identifier, trading unit time, account information, fund flow, and trading flow. Among these, the sample label is a label indicating whether the algorithmic trading sample is positive or negative. Clients / investors who have exhibited algorithmic trading behavior within a historical period are considered capable of algorithmic trading. Therefore, based on the client identifier, if there is trading behavior that meets the definition of ordinary abnormal trading within a historical period, the label for the corresponding trading unit time at the time of that historical trading behavior is 1, meaning it is judged as a positive sample with abnormal algorithmic trading behavior within that trading period.

[0069] In this embodiment of the invention, the preset algorithmic trading determination rules include whether the number of transactions exceeds a preset transaction number threshold, or whether the transaction amount exceeds a preset transaction amount threshold, or whether the transaction percentage exceeds a preset percentage threshold. Specifically, based on the account identifiers in historical transaction data, historical transaction data where the number of transactions corresponding to the account identifier within a preset time period exceeds the preset transaction number threshold is statistically determined as algorithmic trading samples; based on the account identifiers in the historical transaction data, transaction data where the transaction amount corresponding to the account identifier exceeds the preset transaction amount threshold is statistically determined as algorithmic trading samples; based on the account identifiers in the historical transaction data, transaction data where the transaction percentage corresponding to the account identifier within a preset time period exceeds the preset percentage threshold is statistically determined as algorithmic trading samples. This yields algorithmic trading samples in spatiotemporal data format.

[0070] Step 002: Construct graph structure sample data based on the programmatic trading sample feature data of the programmatic trading sample.

[0071] like Figure 3 As shown, the graph structure sample data includes graph nodes and edges. Each graph node represents a programmatic trading sample, and includes investor information, target information, and trading time information. Edges represent the relationships between different programmatic trading samples. The edges between graph nodes are established based on whether the nodes belong to the same investor, the same account, and / or trade the same target. Specifically, graph nodes are constructed based on investor-target-time, and the relationships between nodes can be represented by a graph structure. Edges represent the relationships between them, and here, the edge relationships are established based on whether the nodes belong to the same investor, the same account, or trade the same stock.

[0072] After establishing the graph structure sample data, the final algorithmic trading sample feature data of the graph structure sample data is determined through the following steps (that is, the dimensions that can be used as algorithmic trading sample feature data are determined through the following methods):

[0073] Step 0021: Perform data cleaning and standardization on the sample information of the programmatic trading sample to obtain preprocessed programmatic trading sample feature data.

[0074] Specifically, after data collection, data cleaning is performed, including removing duplicate data and handling outliers. Outliers are handled, such as negative prices or quantities, or extremely unusual transaction data, which need to be checked and processed. Missing values ​​may exist in the data; for example, some transaction records may lack investor or account information. Missing values ​​can be handled using methods such as imputation, deletion, or interpolation to ensure data integrity. For numerical data, standardization is required to eliminate differences in units of measurement between different variables, ensuring the stability and accuracy of the model.

[0075] Step 0022: Perform dimensionality reduction on the preprocessed algorithmic trading sample feature data to obtain dimensionality-reduced algorithmic trading sample feature data.

[0076] This invention reduces the dimensionality of algorithmic trading sample feature data by calculating the similarity between features, resulting in dimensionality-reduced algorithmic trading sample feature data. In one specific implementation, 111-dimensional algorithmic trading sample feature data was constructed. Through similarity calculation, 26 features with a correlation greater than 0.9 were removed, confirming 85 effective features. As shown in Table 1, typical features obtained include order cancellation ratio, market share of valid orders at price limits, order amount in the opening call auction range, number of order cancellations, transaction amount of reverse transactions, number of large orders, and number of high-buy, low-sell transactions, etc.

[0077] Table 1:

[0078] Step 0023: Use graph contrastive learning to enhance the feature representation of graph nodes to obtain the enhanced feature representation of programmatic trading sample feature data.

[0079] Based on sample features and label results, and combined with generalized samples obtained through data augmentation techniques, a model for identifying abnormal algorithmic trading is constructed. In detecting abnormal algorithmic trading, trading data is represented as a graph structure, where nodes represent trading processes within a time period. The participants in the algorithmic trading process are called investors, and a single investor can have up to 20 trading accounts. Each account can trade multiple instruments, and trading times can also be grouped. Therefore, as... Figure 3 As shown, a graph of nodes is constructed based on the investor-target-time structure, and the relationships between nodes can be represented by a graph structure. Edges represent the relationships between them; here, the edge relationships are established based on whether nodes belong to the same investor, the same account, or trade the same stock. The attribute information of the nodes consists of the features constructed above, including transaction time, price, and quantity.

[0080] This invention employs graph contrastive learning to enhance the feature representation of graph nodes and mine deep features. By learning the embedding representations of nodes or graphs, the similarity between positive samples is emphasized, while the differences between negative samples are widened. This helps to bring nodes or graphs of the same category closer together in the embedding space, and nodes or graphs of different categories further apart. In graph contrastive learning, two identical graph neural networks share weights and process positive and negative samples respectively, causing them to move closer or further apart in the embedding space.

[0081] In this embodiment of the invention, after enhancing the feature representation of graph nodes through graph comparison learning, the positive samples need to be enhanced due to the highly unbalanced ratio of positive to negative samples. Furthermore, transactions themselves are influenced by various random factors, and specific features do not necessarily lead to specific results. Therefore, during data enhancement, it is necessary to simulate the randomness of prices and returns to a certain extent. To increase the applicability of the enhanced samples, this embodiment of the invention employs multiple methods to extract enhanced samples in steps 0024-0026, and uses a supervised model to filter and screen the enhanced samples, retaining reliable enhanced samples to improve the sample enhancement effect.

[0082] Step 0024: Perform sample enhancement on the enhanced feature representation of the programmatic trading sample feature data by oversampling to generate the first type of enhanced sample.

[0083] The first type of augmented samples is generated by using the Synthetic Minority Over-sampling Technique. This technique involves finding neighboring samples for all minority class samples using the k-nearest neighbor algorithm and then performing linear random interpolation to synthesize the samples, thereby enhancing the diversity of the samples.

[0084] Step 0025: Perform sample enhancement using sample mixing techniques to generate a second type of enhanced sample.

[0085] The second type of enhanced samples is generated using sample mixing technology. Specifically, the strategy of adding Gaussian noise to all feature columns and label columns is as follows:

[0086] X' = ​​X + noise_b * noise_n

[0087] X.shape=(batch_size, col_size)

[0088] noise_b ~ Bernoulli(1,p_noise, size=(batch_size, col_size)),

[0089] noise_n ~ Normal(0, x_var, size=(batch_size, col_size))

[0090] y' = y + noise_b * noise_n

[0091] y.shape=(batch_size, 1)

[0092] noise_b ~ Bernoulli(1,p_noise,size=(batch_size, 1)),

[0093] noise_n ~ Normal(0, x_var, size=(batch_size, 1)).

[0094] Step 0026: Perform sample augmentation using a conditional generative adversarial network to generate a third type of augmented sample.

[0095] The Conditional Generative Adversarial Network (cGAN) consists of a generator and a discriminator. The generator produces realistic data to "fool" the discriminator, which determines whether a sample is real or fabricated. Training a GAN is essentially a process of mutual learning and interaction between the two. However, because the data generated by a traditional GAN ​​is random and unpredictable, it's impossible to control the network's output of data with specific attributes, resulting in poor controllability. To address this issue, cGAN was proposed. Its core lies in integrating attribute information 'y' into both the generator and the discriminator. Here, 'y' represents a programmed anomaly label. Finally, cGAN is used to generate a third type of augmented sample.

[0096] Step 0027: Based on the gradient descent boosting tree model, perform feature filtering on the enhanced feature representation of the programmed trading sample feature data, the first type of enhanced sample, the second type of enhanced sample, and the third type of enhanced sample to obtain the final programmed trading sample feature data of the graph structure sample data.

[0097] While the diversity of augmented samples is ensured through various methods, their effectiveness and applicability are not guaranteed. Therefore, this embodiment of the invention further trains a gradient descent boosting tree model based on the obtained (X,y) augmented samples and the original samples, selecting the top 30 important feature columns. The min_q quantile and max_q quantile of these feature columns and label columns on the validation set are calculated. In (X',y'), rows with feature values ​​and label values ​​between these two values ​​are extracted. This process, through machine learning generalization, retains effective samples and removes outlier samples.

[0098] By using the above methods, we can ensure the diversity of samples and effectively eliminate false samples.

[0099] Step 003: Input the graph structure sample data into the graph neural network model for training to obtain the first transaction risk identification model.

[0100] Specifically, the augmented graph structure sample data can be divided into training and testing sets for model training and evaluation.

[0101] In this embodiment of the invention, the graph neural network model training scheme uses GraphSage as the base model. GraphSage is a node representation learning method for graph data, aiming to learn the representation vectors of nodes to facilitate subsequent tasks such as node classification, link prediction, and graph clustering. The core idea of ​​GraphSage is to update the representation of a node by aggregating the features of its neighboring nodes, thereby obtaining global information about the node. The graph structure sample data is input into the GraphSage model for training to obtain the first transaction risk identification model. GraphSage can significantly reduce the problem scale, eliminating the need to train an entire graph containing millions of nodes; only low-order aggregation and retraining of target nodes are required. Secondly, in anomaly detection problems with extremely imbalanced samples, a small number of positive samples can be used as target nodes. GraphSage can also efficiently handle unseen nodes. When a new node appears in the graph, the adjacency matrix of GCN or GAT changes, requiring retraining. When making predictions, GraphSage only needs to aggregate the neighbor information of the new node to make predictions for the new node, without needing to update the entire adjacency matrix of millions of nodes. The method for detecting spatiotemporal anomalies in programmed trading using graph neural networks in this embodiment of the invention constructs a graph network with each trading interval (preset period) of each account as a node, and models it as a graph neural network node classification model.

[0102] When the graph structure sample data is input into the GraphSage model for training, the GraphSage model performs pruning operations on the graph structure sample data through the following steps to make predictions:

[0103] 1. Randomly sample neighbors, with no more than N neighbors sampled in each hop;

[0104] 2. Generate the target node's aggregation: First, aggregate the features of two-hop neighbors to generate the embedding vectors of one-hop neighbors, then aggregate the embedding vectors of one-hop neighbors to generate the embedding vector of the target node;

[0105] 3. Input the embedding vector of the target node into the fully connected network to obtain the predicted value of the target node.

[0106] To control the graph size, the programmatic trading sample feature data of the graph structure sample data is pruned according to preset business rules to obtain the first pruned programmatic trading sample feature data. Feature aggregation is then performed on the first pruned programmatic trading sample feature data, and similarity is calculated. Based on the similarity and a similarity threshold, the first pruned programmatic trading sample feature data is pruned again to obtain the second pruned programmatic trading sample feature data. Finally, the local structure of the graph is calculated using a community detection partitioning algorithm, and the second pruned programmatic trading sample feature data is pruned again to obtain the third pruned programmatic trading sample feature data. Specifically, this embodiment of the invention employs three methods: first, relying on manual rules and business experience; second, pruning edges based on aggregated features; third, calculating the n% quantile of cosine similarity to determine a threshold, discarding edges below the threshold; and finally, relying on a community detection partitioning algorithm to calculate the local structure of the graph and prune nodes. This is because during training, it may be found that some graph nodes have no abnormalities after being connected, so they are deleted; some accounts are whitelisted (such as institutional accounts, which have lower risk), so the data corresponding to these accounts is deleted.

[0107] In this embodiment of the invention, the GraphSage model training process is as follows: 1. The positive and negative sample points agreed upon above are used as target nodes. 2. For each target node, M one-hop samples and N two-hop samples are sampled (2 layers of message passing). Samples before the transaction time of the target node need to be sampled to prevent leakage of sample time sequence. If there are enough samples, sampling without replacement is adopted; if there are not enough samples, resampling is performed. 3. The M*N samples are aggregated to the target node through the aggregation operation of GraphSage. 4. The problem scale is reduced from the full graph scale to a small scale of graph node data, and trained through FC layer and anomaly labels. Through the above method, the first transaction risk identification model after training is obtained. During training, considering that the programmatic abnormal transaction detection belongs to the extreme sample imbalance problem, the usual machine learning evaluation methods such as precision and recall are difficult to fully characterize the accuracy of this problem. This embodiment of the invention uses downsampling precision, top k% sample recall, and AUC to measure the accuracy of the model. The accuracy of downsampling precision can reach 85%.

[0108] After obtaining the first trading risk identification model, the current graph structure data for the current time period is input into the first trading risk identification model to obtain the first risk identification result. The first risk identification result represents accounts with algorithmic trading risk in the current time period, including account information such as account identifier, investor information, and trading target information.

[0109] In this embodiment of the invention, the current transaction data for the current time period is in the form of a spatiotemporal sequence. To improve the accuracy of prediction, the method uses multi-model fusion for risk identification. The method further includes: inputting the current transaction features into a second transaction risk identification model and a third transaction risk identification model respectively to obtain a second risk identification result and a third risk identification result; the second transaction risk model is obtained by training a preset unsupervised time series neural network model based on programmed trading samples; the third transaction risk model is obtained by training a preset supervised time series neural network model based on programmed trading samples; and a target risk identification result is obtained based on the first risk identification result, the second risk identification result, and the third risk identification result. The unsupervised time series neural network model can be an Isolation Forest, and the supervised time series neural network model can be a lightGBM (LSTM, CNN-LSTM+attention). An average value is obtained as the final output by averaging the prediction results of multiple models.

[0110] This invention constructs graph-structured data of securities trading data based on spatiotemporal data, preprocesses and filters the features of the graph data structure, and uses graph neural networks for risk identification. This approach can better capture complex trading patterns and correlations, thereby improving the accuracy and efficiency of abnormal trading identification, finding hidden new abnormal trading patterns, enhancing compliance management, reducing illegal trading risks, improving market stability and fairness, and achieving regulatory objectives. The graph neural network-based method for monitoring spatiotemporal anomalies in programmed trading also features automation and scalability, better adapting to market dynamics and emerging new forms of abnormal trading. This invention adds intuitive programmed trading identification logic for securities trading anomalies, facilitating the generalization of programmed trading identification. Based on the extreme imbalance problem of abnormal behavior data in securities trading, effective data and sample augmentation techniques are designed to improve the effectiveness of anomaly detection. Furthermore, through multi-model fusion, the prediction results of multiple neural network models, including unsupervised and supervised models, are averaged to obtain an average value as the final output, effectively improving the accuracy of programmed risk identification.

[0111] Figure 5 A schematic diagram of the structure of the programmed abnormal securities trading risk identification device provided in an embodiment of the present invention is shown. Figure 5 As shown, the device 500 includes:

[0112] The data determination module 510 is used to obtain the current transaction data for the current time period;

[0113] The feature extraction module 520 is used to extract features from the current transaction data in the current time period to obtain the current transaction features corresponding to the current transaction data;

[0114] The construction module 530 is used to construct a current graph structure data based on the current transaction characteristics of the current transaction data; the current graph structure data includes multiple graph nodes and edges; the graph nodes are used to represent a current transaction data; the edges are used to represent the relationships between various current transaction data.

[0115] The identification module 540 is used to input the current graph structure data into the first transaction risk identification model to obtain the first risk identification result; the first transaction risk model is obtained by training a graph neural network model based on the graph structure sample data; the graph structure sample data is constructed based on the transaction feature data of the programmed transaction samples at historical times; the first risk identification result includes account information that has transaction risks in the current period.

[0116] In one optional embodiment, the device further includes: a second identification module, configured to input the current transaction features into a second transaction risk identification model and a third transaction risk identification model respectively, to obtain a second risk identification result and a third risk identification result; a third identification module, configured to obtain the second transaction risk model by training a preset unsupervised time series neural network model based on programmed trading samples; and the third transaction risk model by training a preset supervised time series neural network model based on programmed trading samples; and a target identification module, configured to obtain a target risk identification result based on the first risk identification result, the second risk identification result, and the third risk identification result.

[0117] In an optional embodiment, the apparatus further includes: a programmatic determination module, configured to determine programmatic trading samples according to preset programmatic trading judgment rules; the programmatic trading samples include programmatic trading sample feature data and corresponding sample labels; the programmatic trading sample feature data includes sample basic feature data and sample time series feature data; a sample graph structure construction module, configured to construct graph structure sample data based on the programmatic trading sample feature data of the programmatic trading samples; the graph structure sample data includes graph nodes and edges; the graph nodes are used to represent a programmatic trading sample, and the graph nodes include investor information, target information, and trading time information of the programmatic trading sample; the edges are used to represent the association between various programmatic trading samples; the edges between the graph nodes are established based on whether the various graph nodes are from the same investor, whether they are the same account, and / or whether they trade the same target; the graph structure sample data is input into a graph neural network model for training to obtain a first trading risk identification model.

[0118] In one optional approach, the preset algorithmic trading determination rules include whether the number of transactions exceeds a preset transaction number threshold, or whether the transaction amount exceeds a preset transaction amount threshold, or whether the transaction percentage exceeds a preset percentage threshold; the step of determining the algorithmic trading sample according to the preset algorithmic trading determination rules includes: based on the account identifier in historical trading data, statistically determining historical trading data where the number of transactions corresponding to the account identifier within a preset time period is greater than a preset transaction number threshold as the algorithmic trading sample; based on the account identifier in historical trading data, statistically determining trading data where the transaction amount corresponding to the account identifier is greater than a preset transaction amount threshold as the algorithmic trading sample; based on the account identifier in historical trading data, statistically determining trading data where the transaction percentage corresponding to the account identifier within a preset time period is greater than a preset percentage threshold as the algorithmic trading sample.

[0119] In one optional approach, constructing graph structure sample data based on the programmatic trading sample feature data of the programmatic trading samples includes: performing data cleaning and standardization on the sample information of the programmatic trading samples to obtain preprocessed programmatic trading sample feature data; performing dimensionality reduction on the preprocessed programmatic trading sample feature data to obtain dimensionality-reduced programmatic trading sample feature data; treating each programmatic trading sample as a graph node, and constructing edges between programmatic trading samples with related relationships to obtain initial graph structure sample data; the node attributes of the graph nodes include the dimensionality-reduced programmatic trading sample feature data of the programmatic trading samples.

[0120] The feature representations of graph nodes are enhanced using graph contrastive learning to obtain the enhanced feature representations of programmatic trading sample feature data. Oversampling is then used to augment the enhanced feature representations of the programmatic trading sample feature data, generating a first type of augmented samples. Sample fusion is then used to further augment the samples, generating a second type of augmented samples. A conditional generative adversarial network (GAN) is then used to further augment the samples, generating a third type of augmented samples. Finally, based on a gradient descent boosting tree model, feature filtering is performed on the enhanced feature representations of the programmatic trading sample feature data, the first type of augmented samples, the second type of augmented samples, and the third type of augmented samples to obtain the final programmatic trading sample feature data of the graph structure sample data.

[0121] In one optional embodiment, the apparatus further includes: a first pruning module, configured to prune the programmatic trading sample feature data of the graph structure sample data according to preset business rules, to obtain first-pruned programmatic trading sample feature data; a second pruning module, configured to perform feature aggregation on the first-pruned programmatic trading sample feature data, calculate similarity, and prune the first-pruned programmatic trading sample feature data again according to the similarity and a similarity threshold, to obtain second-pruned programmatic trading sample feature data; and a third pruning module, configured to calculate the local structure of the graph according to a community detection partitioning algorithm, and prune the second-pruned programmatic trading sample feature data again, to obtain third-pruned programmatic trading sample feature data.

[0122] In one alternative approach, the graph neural network model is a GraphSage model; the step of inputting the graph structure sample data into the graph neural network model for training to obtain the first transaction risk identification model includes: inputting the graph structure sample data into the GraphSage model for training to obtain the first transaction risk identification model.

[0123] This invention constructs graph-structured data of securities trading data based on spatiotemporal data, preprocesses and filters the features of the graph data structure, and uses graph neural networks for risk identification. This approach can better capture complex trading patterns and correlations, thereby improving the accuracy and efficiency of abnormal trading identification, finding hidden new abnormal trading patterns, enhancing compliance management, reducing illegal trading risks, improving market stability and fairness, and achieving regulatory objectives. The graph neural network-based method for monitoring spatiotemporal anomalies in programmed trading also features automation and scalability, better adapting to market dynamics and emerging new forms of abnormal trading. This invention adds intuitive programmed trading identification logic for securities trading anomalies, facilitating the generalization of programmed trading identification. Based on the extreme imbalance problem of abnormal behavior data in securities trading, effective data and sample augmentation techniques are designed to improve the effectiveness of anomaly detection. Furthermore, through multi-model fusion, the prediction results of multiple neural network models, including unsupervised and supervised models, are averaged to obtain an average value as the final output, effectively improving the accuracy of programmed risk identification.

[0124] Figure 6 The diagram shows a structural schematic of a computer device provided in an embodiment of the present invention. The specific embodiments of the present invention do not limit the specific implementation of the computer device.

[0125] like Figure 6 As shown, the computer device may include: a processor 602, a communications interface 604, a memory 606, and a communications bus 608.

[0126] The processor 602, communication interface 604, and memory 606 communicate with each other via communication bus 608. Communication interface 604 is used to communicate with other network elements such as clients or other servers. The processor 602 executes program 610, specifically performing the relevant steps described in the embodiment of the method for identifying risks in programmed abnormal securities trading. Specifically, program 610 may include program code, which includes computer-executable instructions.

[0127] Processor 602 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The computer device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0128] Memory 606 is used to store program 610. Memory 606 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0129] Specifically, program 610 can be called by processor 602 to cause the computer device to perform the following operations:

[0130] Get the current transaction data for the current time period;

[0131] Feature extraction is performed on the current transaction data for the current time period to obtain the current transaction features corresponding to the current transaction data;

[0132] Based on the current transaction characteristics of the current transaction data, a current graph structure data is constructed; the current graph structure data includes multiple graph nodes and edges; the graph nodes are used to represent a current transaction data; the edges are used to represent the relationships between various current transaction data.

[0133] The current graph structure data is input into the first transaction risk identification model to obtain the first risk identification result; the first transaction risk model is obtained by training a graph neural network model based on the graph structure sample data; the graph structure sample data is constructed based on the transaction feature data of the programmed transaction samples at historical times; the first risk identification result includes account information that has transaction risks in the current time period.

[0134] In one optional approach, the current trading characteristics are input into a second trading risk identification model and a third trading risk identification model respectively to obtain a second risk identification result and a third risk identification result; the second trading risk model is obtained by training a preset unsupervised time series neural network model based on programmatic trading samples; the third trading risk model is obtained by training a preset supervised time series neural network model based on programmatic trading samples.

[0135] Based on the first risk identification result, the second risk identification result, and the third risk identification result, the target risk identification result is obtained.

[0136] In one alternative approach, before inputting the current graph structure data into the first transaction risk identification model to obtain the first risk identification result, the method includes:

[0137] Based on preset algorithmic trading judgment rules, algorithmic trading samples are determined; the algorithmic trading samples include algorithmic trading sample feature data and corresponding sample labels; the algorithmic trading sample feature data includes sample basic feature data and sample time series feature data;

[0138] Based on the algorithmic trading sample feature data, a graph structure sample data is constructed. The graph structure sample data includes graph nodes and edges. Each graph node represents an algorithmic trading sample and includes investor information, target information, and trading time information. The edges represent the relationships between different algorithmic trading samples. The edges between graph nodes are established based on whether the graph nodes belong to the same investor, the same account, and / or trade the same target.

[0139] The graph structure sample data is input into the graph neural network model for training to obtain the first transaction risk identification model.

[0140] In one optional approach, the preset algorithmic trading determination rules include whether the number of transactions exceeds a preset transaction number threshold, or whether the transaction amount exceeds a preset transaction amount threshold, or whether the transaction percentage exceeds a preset percentage threshold; the step of determining the algorithmic trading sample according to the preset algorithmic trading determination rules includes: based on the account identifier in historical trading data, statistically determining historical trading data where the number of transactions corresponding to the account identifier within a preset time period is greater than a preset transaction number threshold as the algorithmic trading sample; based on the account identifier in historical trading data, statistically determining trading data where the transaction amount corresponding to the account identifier is greater than a preset transaction amount threshold as the algorithmic trading sample; based on the account identifier in historical trading data, statistically determining trading data where the transaction percentage corresponding to the account identifier within a preset time period is greater than a preset percentage threshold as the algorithmic trading sample.

[0141] In one optional approach, constructing graph structure sample data based on the programmatic trading sample feature data of the programmatic trading samples includes: performing data cleaning and standardization on the sample information of the programmatic trading samples to obtain preprocessed programmatic trading sample feature data; performing dimensionality reduction on the preprocessed programmatic trading sample feature data to obtain dimensionality-reduced programmatic trading sample feature data; treating each programmatic trading sample as a graph node, and constructing edges between programmatic trading samples with related relationships to obtain initial graph structure sample data; the node attributes of the graph nodes include the dimensionality-reduced programmatic trading sample feature data of the programmatic trading samples. The algorithm first generates programmatic trading sample feature data by using graph contrastive learning to enhance the feature representation of graph nodes. Then, it performs sample enhancement on the enhanced feature representation of the programmatic trading sample feature data through oversampling to generate a first type of enhanced sample. Next, it performs sample enhancement through sample mixing techniques to generate a second type of enhanced sample. Finally, it performs sample enhancement through conditional generative adversarial networks to generate a third type of enhanced sample. Based on a gradient descent boosting tree model, it performs feature filtering on the enhanced feature representation of the programmatic trading sample feature data, the first type of enhanced sample, the second type of enhanced sample, and the third type of enhanced sample to obtain the final programmatic trading sample feature data of the graph structure sample data.

[0142] In one optional approach, before inputting the graph structure sample data into a graph neural network model for training to obtain a first transaction risk identification model, the method further includes: pruning the programmatic transaction sample feature data of the graph structure sample data according to preset business rules to obtain first-pruned programmatic transaction sample feature data; performing feature aggregation on the first-pruned programmatic transaction sample feature data, calculating similarity, and pruning the first-pruned programmatic transaction sample feature data again based on the similarity and a similarity threshold to obtain second-pruned programmatic transaction sample feature data; and calculating the local structure of the graph according to a community detection partitioning algorithm, and pruning the second-pruned programmatic transaction sample feature data again to obtain third-pruned programmatic transaction sample feature data.

[0143] In one alternative approach, the graph neural network model is a GraphSage model; the step of inputting the graph structure sample data into the graph neural network model for training to obtain the first transaction risk identification model includes: inputting the graph structure sample data into the GraphSage model for training to obtain the first transaction risk identification model.

[0144] This invention constructs graph-structured data of securities trading data based on spatiotemporal data, preprocesses and filters the features of the graph data structure, and uses graph neural networks for risk identification. This approach can better capture complex trading patterns and correlations, thereby improving the accuracy and efficiency of abnormal trading identification, finding hidden new abnormal trading patterns, enhancing compliance management, reducing illegal trading risks, improving market stability and fairness, and achieving regulatory objectives. The graph neural network-based method for monitoring spatiotemporal anomalies in programmed trading also features automation and scalability, better adapting to market dynamics and emerging new forms of abnormal trading. This invention adds intuitive programmed trading identification logic for securities trading anomalies, facilitating the generalization of programmed trading identification. Based on the extreme imbalance problem of abnormal behavior data in securities trading, effective data and sample augmentation techniques are designed to improve the effectiveness of anomaly detection. Furthermore, through multi-model fusion, the prediction results of multiple neural network models, including unsupervised and supervised models, are averaged to obtain an average value as the final output, effectively improving the accuracy of programmed risk identification.

[0145] This invention provides a computer-readable storage medium storing at least one executable instruction that, when executed on a computer device, causes the computer device to perform the programmed abnormal securities trading risk identification method in any of the above method embodiments.

[0146] Executable instructions can be used to cause computer devices to perform the following operations:

[0147] Get the current transaction data for the current time period;

[0148] Feature extraction is performed on the current transaction data for the current time period to obtain the current transaction features corresponding to the current transaction data;

[0149] Based on the current transaction characteristics of the current transaction data, a current graph structure data is constructed; the current graph structure data includes multiple graph nodes and edges; the graph nodes are used to represent a current transaction data; the edges are used to represent the relationships between various current transaction data.

[0150] The current graph structure data is input into the first transaction risk identification model to obtain the first risk identification result; the first transaction risk model is obtained by training a graph neural network model based on the graph structure sample data; the graph structure sample data is constructed based on the transaction feature data of the programmed transaction samples at historical times; the first risk identification result includes account information that has transaction risks in the current time period.

[0151] In one optional approach, the current trading characteristics are input into a second trading risk identification model and a third trading risk identification model respectively to obtain a second risk identification result and a third risk identification result; the second trading risk model is obtained by training a preset unsupervised time series neural network model based on programmatic trading samples; the third trading risk model is obtained by training a preset supervised time series neural network model based on programmatic trading samples; and the target risk identification result is obtained based on the first risk identification result, the second risk identification result, and the third risk identification result.

[0152] In one optional approach, before inputting the current graph structure data into the first trading risk identification model to obtain the first risk identification result, the method includes: determining a programmatic trading sample according to a preset programmatic trading judgment rule; the programmatic trading sample includes programmatic trading sample feature data and corresponding sample labels; the programmatic trading sample feature data includes sample basic feature data and sample time series feature data; constructing graph structure sample data based on the programmatic trading sample feature data; the graph structure sample data includes graph nodes and edges; the graph nodes are used to represent a programmatic trading sample, and the graph nodes include investor information, target information, and trading time information of the programmatic trading sample; the edges are used to represent the association between various programmatic trading samples; the edges between the graph nodes are established based on whether the various graph nodes are from the same investor, the same account, and / or trade the same target; inputting the graph structure sample data into a graph neural network model for training to obtain the first trading risk identification model.

[0153] In one optional approach, the preset algorithmic trading determination rules include whether the number of transactions exceeds a preset transaction number threshold, or whether the transaction amount exceeds a preset transaction amount threshold, or whether the transaction percentage exceeds a preset percentage threshold; the step of determining the algorithmic trading sample according to the preset algorithmic trading determination rules includes: based on the account identifier in historical trading data, statistically determining historical trading data where the number of transactions corresponding to the account identifier within a preset time period is greater than a preset transaction number threshold as the algorithmic trading sample; based on the account identifier in historical trading data, statistically determining trading data where the transaction amount corresponding to the account identifier is greater than a preset transaction amount threshold as the algorithmic trading sample; based on the account identifier in historical trading data, statistically determining trading data where the transaction percentage corresponding to the account identifier within a preset time period is greater than a preset percentage threshold as the algorithmic trading sample.

[0154] In one optional approach, constructing graph structure sample data based on the programmatic trading sample feature data of the programmatic trading samples includes: performing data cleaning and standardization on the sample information of the programmatic trading samples to obtain preprocessed programmatic trading sample feature data; performing dimensionality reduction on the preprocessed programmatic trading sample feature data to obtain dimensionality-reduced programmatic trading sample feature data; treating each programmatic trading sample as a graph node, and constructing edges between programmatic trading samples with related relationships to obtain initial graph structure sample data; the node attributes of the graph nodes include the dimensionality-reduced programmatic trading sample feature data of the programmatic trading samples. The algorithm first generates programmatic trading sample feature data by using graph contrastive learning to enhance the feature representation of graph nodes. Then, it performs sample enhancement on the enhanced feature representation of the programmatic trading sample feature data through oversampling to generate a first type of enhanced sample. Next, it performs sample enhancement through sample mixing techniques to generate a second type of enhanced sample. Finally, it performs sample enhancement through conditional generative adversarial networks to generate a third type of enhanced sample. Based on a gradient descent boosting tree model, it performs feature filtering on the enhanced feature representation of the programmatic trading sample feature data, the first type of enhanced sample, the second type of enhanced sample, and the third type of enhanced sample to obtain the final programmatic trading sample feature data of the graph structure sample data.

[0155] In one optional approach, before inputting the graph structure sample data into a graph neural network model for training to obtain a first transaction risk identification model, the method further includes: pruning the programmatic transaction sample feature data of the graph structure sample data according to preset business rules to obtain first-pruned programmatic transaction sample feature data; performing feature aggregation on the first-pruned programmatic transaction sample feature data, calculating similarity, and pruning the first-pruned programmatic transaction sample feature data again based on the similarity and a similarity threshold to obtain second-pruned programmatic transaction sample feature data; and calculating the local structure of the graph according to a community detection partitioning algorithm, and pruning the second-pruned programmatic transaction sample feature data again to obtain third-pruned programmatic transaction sample feature data.

[0156] In one alternative approach, the graph neural network model is a GraphSage model; the step of inputting the graph structure sample data into the graph neural network model for training to obtain the first transaction risk identification model includes: inputting the graph structure sample data into the GraphSage model for training to obtain the first transaction risk identification model.

[0157] This invention constructs graph-structured data of securities trading data based on spatiotemporal data, preprocesses and filters the features of the graph data structure, and uses graph neural networks for risk identification. This approach can better capture complex trading patterns and correlations, thereby improving the accuracy and efficiency of abnormal trading identification, finding hidden new abnormal trading patterns, enhancing compliance management, reducing illegal trading risks, improving market stability and fairness, and achieving regulatory objectives. The graph neural network-based method for monitoring spatiotemporal anomalies in programmed trading also features automation and scalability, better adapting to market dynamics and emerging new forms of abnormal trading. This invention adds intuitive programmed trading identification logic for securities trading anomalies, facilitating the generalization of programmed trading identification. Based on the extreme imbalance problem of abnormal behavior data in securities trading, effective data and sample augmentation techniques are designed to improve the effectiveness of anomaly detection. Furthermore, through multi-model fusion, the prediction results of multiple neural network models, including unsupervised and supervised models, are averaged to obtain an average value as the final output, effectively improving the accuracy of programmed risk identification.

[0158] The algorithms or displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is readily apparent from the above description. Furthermore, the embodiments of the present invention are not directed to any particular programming language. It should be understood that the contents of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention. Numerous specific details are set forth in the specification provided herein. However, it is to be understood that embodiments of the invention can be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification. Similarly, it should be understood that, in order to simplify the invention and aid in understanding one or more aspects of the invention, various features of the embodiments of the invention are sometimes grouped together in a single embodiment, figure, or description thereof in the above description of exemplary embodiments of the invention. Those skilled in the art will understand that modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules or units or components in the embodiments can be combined into a single module or unit or component, and can be divided into multiple sub-modules or sub-units or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination may be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or apparatus so disclosed. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0159] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and those skilled in the art can devise alternative embodiments without departing from the scope of this application. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims listing several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names. Unless otherwise specified, the steps in the above embodiments should not be construed as limiting the order of execution.

Claims

1. A method for identifying risks in programmed abnormal securities trading, characterized in that, The method includes: Obtaining current transaction data for the current time period includes: periodically acquiring securities transaction data, which is in the form of a spatiotemporal sequence; the securities transaction data includes snapshots of Shanghai and Shenzhen stock market data, customer basic information tables, customer asset transaction records, and customer order cancellation records; within each transaction unit time period of the current time period, each transaction data entry is formatted as date-customer-target-transaction unit time; the current transaction data includes transaction time, customer identifier, account information, fund flow, transaction flow, transaction target, and transaction unit time. Feature extraction is performed on the current transaction data for the current time period to obtain the current transaction features corresponding to the current transaction data. Based on pre-set transaction feature dimensions, the pre-processed current transaction features are filtered to obtain the final current transaction features. The current transaction data includes 111-dimensional features. Dimensionality reduction processing is performed on the current transaction data, and through similarity calculation, 26 features with a correlation greater than 0.9 are removed, resulting in 85-dimensional current transaction features. These current transaction features include the order cancellation-to-execution ratio, the market share of valid orders at the price limit up / down, the order amount in the opening call auction range, the number of order cancellations, the transaction amount of reverse transactions, the number of large orders, and the number of high-buy, low-sell transactions. Based on the current transaction characteristics of the current transaction data, a current graph structure data is constructed; the current graph structure data includes multiple graph nodes and edges; each graph node is used to represent a current transaction data, representing the transaction process information of a time period set, and the node attributes of the graph node include the current transaction characteristics of the current transaction data; the edges are used to represent the associations between the various current transaction data. The current graph structure data is input into the first transaction risk identification model to obtain the first risk identification result; the first transaction risk identification model is trained based on graph structure sample data; the graph structure sample data is constructed based on the transaction feature data of programmatic trading samples at historical moments; the first risk identification result includes account information with transaction risks in the current period; wherein, the graph neural network model training scheme uses GraphSage as the base model; When the graph structure sample data is input into the GraphSage model for training, the GraphSage model performs pruning operations on the graph structure sample data: Based on preset business rules, the programmatic trading sample feature data of the graph structure sample data is pruned to obtain first-pruned programmatic trading sample feature data; feature aggregation is performed on the first-pruned programmatic trading sample feature data, and similarity is calculated; based on the similarity and a similarity threshold, the first-pruned programmatic trading sample feature data is pruned again to obtain second-pruned programmatic trading sample feature data; based on the community detection partitioning algorithm, the local structure of the graph is calculated, and the second-pruned programmatic trading sample feature data is pruned again to obtain third-pruned programmatic trading sample feature data; The current trading characteristics are input into the second and third trading risk identification models respectively to obtain the second and third risk identification results; based on the first, second, and third risk identification results, the target risk identification result is obtained; the second trading risk identification model is obtained by training a preset unsupervised time series neural network model based on programmatic trading samples; the third trading risk identification model is obtained by training a preset supervised time series neural network model based on programmatic trading samples. The graph structure sample data is obtained in the following way: Based on the preset algorithmic trading judgment rules, algorithmic trading samples are determined; wherein, an algorithmic trading sample includes data on algorithmic trading behavior for a trading target within a trading period, including date, client, and trading unit time. Based on the algorithmic trading sample feature data of the algorithmic trading samples, a graph structure sample data is constructed; wherein, the algorithmic trading sample feature data includes basic sample feature data and sample time-series feature data; the basic sample feature data includes investor / client identifier, trading target, and trading time information, and the sample time-series feature data includes client identifier, sample tag, trading identifier, trading unit time, account information, fund flow, and trading flow field; wherein, based on the client identifier, if there is a trading behavior that meets the definition of ordinary abnormal trading within a historical period, then the tag of the trading unit time corresponding to the time of occurrence of the corresponding historical trading behavior is 1, which is a positive sample with algorithmic abnormal trading behavior within this trading period; The final programmatic trading sample feature data is determined through the following steps: The sample information of the algorithmic trading samples is cleaned and standardized to obtain preprocessed algorithmic trading sample feature data; the sample information of the algorithmic trading samples is cleaned and standardized to obtain preprocessed algorithmic trading sample feature data; graph contrastive learning is used to enhance the feature representation of graph nodes to obtain algorithmic trading sample feature data with enhanced feature representation. The algorithmic trading sample feature data after the enhanced feature representation is augmented by oversampling to generate a first type of augmented sample; the sample is augmented by sample mixing to generate a second type of augmented sample; the sample is augmented by a conditional generative adversarial network to generate a third type of augmented sample; the algorithmic trading sample feature data after the enhanced feature representation, the first type of augmented sample, the second type of augmented sample, and the third type of augmented sample are subjected to feature filtering according to the gradient descent boosting tree model to obtain the final algorithmic trading sample feature data of graph structure sample data; wherein, during data augmentation, the randomness of price and return is simulated.

2. The method according to claim 1, characterized in that, Before inputting the current graph structure data into the first transaction risk identification model to obtain the first risk identification result, the method includes: The graph structure sample data is input into the graph neural network model for training to obtain the first transaction risk identification model.

3. The method according to claim 2, characterized in that, The preset algorithmic trading judgment rules include whether the number of transactions exceeds a preset transaction number threshold, or whether the transaction amount exceeds a preset transaction amount threshold, or whether the transaction percentage exceeds a preset percentage threshold. The step of determining algorithmic trading samples according to preset algorithmic trading judgment rules includes: Based on the account identifiers in historical transaction data, historical transaction data in which the number of transactions corresponding to the account identifiers within a preset time period is greater than a preset transaction number threshold are identified as programmatic trading samples. Based on the account identifiers of the historical transaction data, transaction data whose transaction amounts corresponding to the account identifiers are greater than a preset transaction amount threshold are identified as programmatic trading samples. Based on the account identifiers in the historical transaction data, transaction data with an account identifier whose corresponding transaction percentage within a preset time period is greater than a preset percentage threshold are identified as programmatic trading samples.

4. A programmed abnormal securities trading risk identification device, characterized in that, The device includes: The data determination module is used to acquire current transaction data for the current time period, including: periodically acquiring securities transaction data, which is in the form of a spatiotemporal sequence; the securities transaction data includes snapshots of Shanghai and Shenzhen stock market data, customer basic information tables, customer asset transaction records, and customer order cancellation records; within each transaction unit time period of the current time period, each transaction data entry is based on date-customer-target-transaction unit time; the current transaction data includes transaction time, customer identifier, account information, fund flow, transaction flow, transaction target, and transaction unit time. The feature extraction module is used to extract features from the current transaction data in the current time period to obtain the current transaction features corresponding to the current transaction data. Based on pre-set transaction feature dimensions, the pre-processed current transaction features are filtered to obtain the final current transaction features. The current transaction data includes 111-dimensional features. Dimensionality reduction processing is performed on the current transaction data, and through similarity calculation, 26 features with a correlation greater than 0.9 are removed, resulting in 85-dimensional current transaction features. These current transaction features include the order cancellation-to-execution ratio, the market share of valid orders at the price limit up / down, the order amount in the opening call auction range, the number of order cancellations, the transaction amount of reverse transactions, the number of large orders, and the number of high-buy, low-sell transactions. A construction module is used to construct a current graph structure data based on the current transaction characteristics of the current transaction data; the current graph structure data includes multiple graph nodes and edges; each graph node is used to represent a current transaction data, representing the transaction process information of a time period set, and the node attributes of the graph node include the current transaction characteristics of the current transaction data; the edges are used to represent the association between the various current transaction data. The identification module is used to input the current graph structure data into a first transaction risk identification model to obtain a first risk identification result; the first transaction risk identification model is trained based on graph structure sample data input into a graph neural network model; the graph structure sample data is constructed based on the transaction feature data of programmatic trading samples at historical moments; the first risk identification result includes account information with transaction risks in the current time period, wherein the graph neural network model training scheme uses GraphSage as the base model; When the graph structure sample data is input into the GraphSage model for training, the GraphSage model performs pruning operations on the graph structure sample data: Based on preset business rules, the programmatic trading sample feature data of the graph structure sample data is pruned to obtain first-pruned programmatic trading sample feature data; feature aggregation is performed on the first-pruned programmatic trading sample feature data, and similarity is calculated; based on the similarity and a similarity threshold, the first-pruned programmatic trading sample feature data is pruned again to obtain second-pruned programmatic trading sample feature data; based on the community detection partitioning algorithm, the local structure of the graph is calculated, and the second-pruned programmatic trading sample feature data is pruned again to obtain third-pruned programmatic trading sample feature data; The current trading characteristics are input into the second and third trading risk identification models respectively to obtain the second and third risk identification results; based on the first, second, and third risk identification results, the target risk identification result is obtained; the second trading risk identification model is obtained by training a preset unsupervised time series neural network model based on programmatic trading samples; the third trading risk identification model is obtained by training a preset supervised time series neural network model based on programmatic trading samples. The second identification module is used to input the current transaction characteristics into the second transaction risk identification model and the third transaction risk identification model respectively to obtain the second risk identification result and the third risk identification result. The third identification module is used to obtain the second trading risk identification model by training a preset unsupervised time series neural network model based on programmatic trading samples; the third trading risk identification model is obtained by training a preset supervised time series neural network model based on programmatic trading samples. The target identification module is used to obtain the target risk identification result based on the first risk identification result, the second risk identification result, and the third risk identification result; The algorithmic trading determination module is used to determine algorithmic trading samples according to preset algorithmic trading judgment rules; the algorithmic trading samples include algorithmic trading sample feature data and corresponding sample labels; the algorithmic trading sample feature data includes sample basic feature data and sample time series feature data; A sample graph structure module is used to construct graph structure sample data based on the algorithmic trading sample feature data of the algorithmic trading samples. The graph structure sample data includes graph nodes and edges. Each graph node represents an algorithmic trading sample and includes investor information, target information, and trading time information of the algorithmic trading sample. The edges represent the relationships between different algorithmic trading samples. The edges between graph nodes are established based on whether the graph nodes belong to the same investor, the same account, and / or trade the same target. The graph structure sample data is input into the graph neural network model for training to obtain the first transaction risk identification model.

5. A computer device, characterized in that, include: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction that causes the processor to perform the operation of the programmed abnormal securities trading risk identification method as described in any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The storage medium stores at least one executable instruction, which, when executed on a computer device, causes the computer device to perform the operation of the programmed abnormal securities trading risk identification method as described in any one of claims 1-3.

Images