Early warning method and device for entrusted payment fund reflux

Abstract

This application discloses a method and apparatus for early warning of entrusted payment fund repatriation, relating to the field of artificial intelligence. The method includes: acquiring transaction data between a target lender and a target payee; performing fund repatriation risk monitoring on the transaction data based on a first model to obtain a first risk monitoring result; performing fund repatriation risk monitoring on a two-layer network using first and second operations to obtain a second risk monitoring result; identifying risky fund repatriation transactions based on the first and second risk monitoring results, and issuing an early warning for these risky transactions. This application solves the technical problem of low monitoring accuracy, leading to low early warning accuracy, in existing technologies that rely on rule engines and manual review for entrusted payment fund repatriation monitoring.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and more specifically, to a method and apparatus for early warning of the return of entrusted payment funds. Background Technology

[0002] Entrusted payment loans, as a financial innovation, aim to ensure that loan funds are used for designated legitimate purposes and prevent borrowers from diverting funds to high-risk investments or other unauthorized activities. This loan model helps increase financing convenience, improve the efficiency and transparency of fund use, and reduce credit risk.

[0003] However, under the entrusted payment model, monitoring the return of loan funds also presents certain challenges to banks' risk management. Some borrowers may use complex transaction structures to attempt to circumvent regulations, indirectly channeling funds back to themselves or companies they control. This could result in loan funds not being fully used for the real economy, leading not only to misappropriation of funds but also potentially to high-risk investments.

[0004] Currently, the primary challenge for banks in handling entrusted payment risks lies in the integration of internal data and the acquisition of external data. Although banks possess a vast amount of transaction data, the lack of an effective integration mechanism, due to the data being distributed across different business systems, makes it difficult to grasp the full picture of fund flows in real time. Secondly, banks often rely on rule engines and manual review to monitor risks. This method is not only time-consuming and labor-intensive but also ill-suited to the increasingly complex and volatile risks of fund defaults and repatriation methods, especially when facing highly concealed operations such as fund splitting and multi-layered transfers. Finally, the lack of intelligent risk warning models makes it difficult to promptly identify and address sudden risks, easily missing the optimal window for warning and intervention.

[0005] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0006] The main objective of this application is to provide an early warning method and apparatus for the return of entrusted payment funds, so as to at least solve the technical problem that the monitoring accuracy is low when relying on rule engines and manual review to monitor the return of entrusted payment funds, resulting in low early warning accuracy.

[0007] To achieve the above objectives, according to one aspect of this application, a method for early warning of entrusted payment fund repatriation is provided. The method includes: acquiring transaction data between a target lender and a target payee; performing fund repatriation risk monitoring on the transaction data based on a first model to obtain a first risk monitoring result, wherein the first model is used to analyze the fund flow status changing over time; performing fund repatriation risk monitoring on a two-layer network using a first operation and a second operation to obtain a second risk monitoring result, wherein the first operation is used to identify abnormal paths in the two-layer network, and the second operation is used to extract transaction network features based on the two-layer network and determine abnormal transaction behavior based on the transaction network features. The two-layer network includes a first relationship network and a second relationship network, wherein the first relationship network is used to represent the related enterprise information of the lender and the payee, and the second relationship network is used to represent the flow of funds in the accounts of the lender and the payee; determining fund repatriation risk transactions based on the first risk monitoring result and the second risk monitoring result, and issuing an early warning for fund repatriation risk transactions.

[0008] Optionally, target parameters of the first model are set based on preset rules, wherein the target parameters are used to monitor abnormal fund flow information; a target algorithm is obtained, wherein the target algorithm is used to identify abnormal flow paths from transactions; the transaction data is calculated according to the target algorithm and target parameters to obtain a target sequence, wherein the target sequence includes transaction information of abnormal transactions; and a first risk monitoring result is determined according to the target sequence.

[0009] Optionally, anomaly nodes and a first anomaly path are determined based on a two-layer network. Anomaly nodes represent borrowers or payees with abnormal transactions, and the first anomaly path represents the flow trajectory of abnormal funds. The two-layer network includes multiple network paths, including the first anomaly path. A second anomaly path in the two-layer network is detected based on a first operation. The second anomaly path is a different network path from the first anomaly path. Features are extracted from each node, each network path, the anomaly node, the first anomaly path, and the second anomaly path in the two-layer network to obtain a target feature vector. The target feature vector represents the attribute information of the transaction pattern. An anomalous state classification is performed on the target feature vector using a second operation to obtain a second risk monitoring result.

[0010] Optionally, a first set and a second set are determined based on the two-layer network, wherein the first set includes a set of other nodes connected to the target payee through direct or indirect relationships, and the second set includes a set of other nodes connected to the target lender through direct or indirect relationships; and abnormal nodes and a first abnormal path are determined based on the intersection of the first set and the second set.

[0011] Optionally, feature extraction is performed on each transaction path in the two-layer network to obtain the target features corresponding to each transaction path. The target features corresponding to each transaction path are used to characterize the potential abnormal transaction patterns of the transaction path. Based on the target features corresponding to each transaction path, an abnormal score for each transaction path is determined through a first operation. If the abnormal score of any transaction path in the two-layer network is greater than a preset score, the transaction path is determined to be a second abnormal path. If the abnormal score of any transaction path in the two-layer network is less than or equal to the preset score, the transaction path is determined to be a normal transaction path.

[0012] Optionally, if both the first and second risk monitoring results for the i-th transaction indicate that the risk value of the i-th transaction is the first risk value, a first warning value is generated for the i-th transaction according to the risk model, where i is an integer greater than or equal to 1, the first risk value is greater than or equal to a preset risk threshold, and the risk model is used to assess and warn of the risk of fund flow in entrusted payment business; if one of the first and second risk monitoring results for the i-th transaction indicates that the risk value of the i-th transaction is the first risk value, and the other risk monitoring result indicates that the risk value of the i-th transaction is the second risk value, a second warning value is generated for the i-th transaction according to the risk model, where the first warning value is greater than the second warning value, and the second risk value is less than the first risk value; if both the first and second risk monitoring results for the i-th transaction indicate that the risk value of the i-th transaction is the second risk value, no warning is issued for the i-th transaction.

[0013] Optionally, the target neural network is used to analyze the two-layer network, abnormal nodes, the first abnormal path, and the second abnormal path to obtain abnormal transaction classification results. The target neural network is used to identify and warn of different types of fund return risks. The warning method is determined based on the abnormal transaction classification results.

[0014] To achieve the above objectives, according to another aspect of this application, an early warning device for entrusted payment fund repatriation is also provided, comprising: a first acquisition unit for acquiring transaction data between a target lender and a target payee; a first monitoring unit for monitoring fund repatriation risk based on a first model to obtain a first risk monitoring result, wherein the first model is used to analyze the fund flow status changing over time; a second monitoring unit for monitoring fund repatriation risk on a two-layer network using a first operation and a second operation to obtain a second risk monitoring result, wherein the first operation is used to identify abnormal paths in the two-layer network, the second operation is used to extract transaction network features based on the two-layer network, and determine abnormal transaction behavior based on the transaction network features, the two-layer network including a first relationship network and a second relationship network, wherein the first relationship network is used to represent the related enterprise information of the lender and the payee, and the second relationship network is used to represent the flow of funds in the accounts of the lender and the payee; and a first early warning unit for determining fund repatriation risk transactions based on the first risk monitoring result and the second risk monitoring result, and issuing an early warning for fund repatriation risk transactions.

[0015] Optionally, the first monitoring unit includes: a first setting subunit, a first acquisition subunit, a first calculation subunit, and a first determination subunit. The first setting subunit is used to set target parameters for the first model based on preset rules, wherein the target parameters are used to monitor abnormal fund flow information; the first acquisition subunit is used to acquire a target algorithm, wherein the target algorithm is used to identify abnormal flow paths from transactions; the first calculation subunit is used to calculate transaction data according to the target algorithm and target parameters to obtain a target sequence, wherein the target sequence includes transaction information of abnormal transactions; and the first determination subunit is used to determine a first risk monitoring result based on the target sequence.

[0016] Optionally, the second monitoring unit includes: a second determination subunit, a first detection subunit, a first extraction subunit, and a first classification subunit. The second determination subunit is used to determine abnormal nodes and a first abnormal path based on the two-layer network. The abnormal node represents a borrower or payee with abnormal transactions, and the first abnormal path represents the flow trajectory of abnormal funds. The two-layer network includes multiple network paths, including the first abnormal path. The first detection subunit is used to detect a second abnormal path in the two-layer network based on a first operation. The second abnormal path is a different network path from the first abnormal path. The first extraction subunit is used to extract features from each node, each network path, the abnormal node, the first abnormal path, and the second abnormal path in the two-layer network to obtain a target feature vector. The target feature vector represents the attribute information of the transaction pattern. The first classification subunit is used to classify the target feature vector into abnormal states using a second operation to obtain a second risk monitoring result.

[0017] Optionally, the second determining subunit includes: a first determining module and a second determining module. The first determining module is used to determine a first set and a second set based on the two-layer network, wherein the first set includes a set of other nodes connected to the target payee through direct or indirect relationships, and the second set includes a set of other nodes connected to the target lender through direct or indirect relationships; the second determining module is used to determine abnormal nodes and a first abnormal path based on the intersection of the first set and the second set.

[0018] Optionally, the first detection subunit includes: a first extraction module, a third determination module, a fourth determination module, and a fifth determination module. The first extraction module is used to extract features from each transaction path in the two-layer network to obtain target features corresponding to each transaction path, wherein the target features corresponding to each transaction path are used to characterize the potential abnormal transaction patterns of that transaction path. The third determination module is used to determine the abnormality score of each transaction path based on the target features corresponding to each transaction path through a first operation. The fourth determination module is used to determine that a transaction path is a second abnormal path if the abnormality score of any transaction path in the two-layer network is greater than a preset score. The fifth determination module is used to determine that a transaction path is a normal transaction path if the abnormality score of any transaction path in the two-layer network is less than or equal to a preset score.

[0019] Optionally, the first early warning unit includes: a first generation subunit, a second generation subunit, and a first processing subunit. The first generation subunit generates a first early warning value for the i-th transaction based on a risk model if both the first and second risk monitoring results for the i-th transaction indicate that the risk value of the i-th transaction is the first risk value. Here, i is an integer greater than or equal to 1, and the first risk value is greater than or equal to a preset risk threshold. The risk model is used to assess and warn of the risk of fund flow in entrusted payment business. The second generation subunit generates a second early warning value for the i-th transaction based on a risk model if one of the first and second risk monitoring results for the i-th transaction indicates that the risk value of the i-th transaction is the first risk value, and the other risk monitoring result indicates that the risk value of the i-th transaction is the second risk value. Here, the first early warning value is greater than the second early warning value, and the second risk value is less than the first risk value. The first processing subunit does not issue an early warning for the i-th transaction if both the first and second risk monitoring results for the i-th transaction indicate that the risk value of the i-th transaction is the second risk value.

[0020] Optionally, the early warning device for entrusted payment fund repatriation further includes: an analysis unit and a determination unit. The analysis unit is used to analyze the two-layer network, abnormal nodes, the first abnormal path, and the second abnormal path using a target neural network to obtain abnormal transaction classification results. The target neural network is used to identify and issue early warnings for different types of fund repatriation risks. The determination unit is used to determine the early warning method based on the abnormal transaction classification results.

[0021] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored executable program, wherein, when the executable program is running, it controls the device where the computer-readable storage medium is located to execute the above-described early warning method for the return of entrusted payment funds.

[0022] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a memory storing an executable program; and a processor for running the program, wherein the program executes the above-described early warning method for the return of entrusted payment funds during runtime.

[0023] According to another aspect of the embodiments of this application, a computer program product is also provided, including computer instructions, which, when executed by a processor, implement the steps of the above-described early warning method for the return of entrusted payment funds.

[0024] In this application, transaction data between the target borrower and the target payee is first obtained. Then, based on a first model, the transaction data is used to monitor the risk of fund reflux, resulting in a first risk monitoring result. The first model is used to analyze the fund flow status over time. Next, a first operation and a second operation are used to monitor the risk of fund reflux in a two-layer network, resulting in a second risk monitoring result. The first operation is used to identify abnormal paths in the two-layer network, and the second operation is used to extract transaction network features based on the two-layer network and determine abnormal transaction behaviors based on these features. The two-layer network includes a first relationship network and a second relationship network, where the first relationship network is used to represent the loan... The system uses information about the related companies of the lender and payee, and a second relationship network to characterize the flow of funds in the accounts of the lender and payee. Finally, based on the results of the first and second risk monitoring, it identifies transactions with risk of fund reflux and issues early warnings for these transactions. By combining time-series analysis and network structure analysis in a two-layer monitoring and early warning approach, it achieves real-time, comprehensive, and intelligent early warning of fund reflux risks. This improves the accuracy of early warnings for entrusted payment fund reflux and solves the technical problem of low monitoring accuracy and low early warning accuracy in existing technologies that rely on rule engines and manual review for monitoring entrusted payment fund reflux. Attached Figure Description

[0025] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0026] Figure 1 A hardware block diagram of a computer terminal for implementing an early warning method for the return of entrusted payment funds is shown.

[0027] Figure 2 This is a flowchart of an optional early warning method for the return of entrusted payment funds according to an embodiment of this application;

[0028] Figure 3 This is a schematic diagram of an optional corporate related account relationship network according to an embodiment of this application;

[0029] Figure 4 This is a schematic diagram illustrating an optional HMM model application according to an embodiment of this application;

[0030] Figure 5 This is a schematic diagram of an optional m-degree node association network structure according to an embodiment of this application;

[0031] Figure 6 This is a schematic diagram of an optional risk warning based on a fusion risk model according to an embodiment of this application;

[0032] Figure 7 This is a schematic diagram of an optional early warning device for the return of entrusted payment funds according to an embodiment of this application;

[0033] Figure 8 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0034] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0035] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0036] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0037] Example 1

[0038] According to an embodiment of this application, an embodiment of an early warning method for the return of entrusted payment funds is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0039] It should be noted that an intelligent early warning system can serve as the executing entity for the early warning method for the return of entrusted payment funds in this application embodiment. It is understood that the early warning method for the return of entrusted payment funds provided in this application embodiment can also be executed by other systems or devices, and this application embodiment does not specifically limit this.

[0040] The method embodiments provided in this application can be executed in a mobile terminal, computer terminal or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing an early warning method for the return of entrusted payment funds is shown. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0041] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits can be implemented wholly or partially as software, hardware, firmware, or any other combination. Furthermore, the data processing circuits can be a single, independent processing module, or wholly or partially integrated into any other element within the computer terminal 10 (or mobile device). As in the early warning method for the return of entrusted payment funds as described in the embodiments of this application, the data processing circuit serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0042] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the early warning method for the return of entrusted payment funds in the embodiments of this application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned early warning method for the return of entrusted payment funds. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0043] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0044] The display may be a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0045] Under the aforementioned operating environment, this application provides the following: Figure 2 The method shown is an early warning system for the return of entrusted payment funds. Figure 2 This is a flowchart of an optional early warning method for the return of entrusted payment funds according to an embodiment of this application. Figure 2 As shown, the method includes the following steps:

[0046] Step S201: Obtain transaction data between the target lender and the target payee.

[0047] Optionally, the intelligent early warning system will obtain relevant transaction details of the borrower and the payee, including but not limited to transfers, remittances, receipts, and withdrawals.

[0048] Step S202: Based on the first model, perform risk monitoring on the return of funds in the transaction data to obtain the first risk monitoring result.

[0049] In step S202, the first model is used to analyze the changing state of capital flow over time.

[0050] Optionally, there are three main forms of fund repatriation: direct split repatriation, indirect repatriation, and implicit repatriation. Direct split repatriation refers to the payee of the entrusted payment splitting the funds into multiple transactions and transferring them to the borrower's account over multiple days; indirect repatriation refers to the payee of the entrusted payment transferring the funds to an external bank and then repatriating them to the borrower within the same bank; and implicit repatriation refers to the repatriation of funds to the borrower's affiliated companies or to funds transferred out of the bank and then repatriated to the borrower through affiliated companies.

[0051] Optionally, to address the risk of the payee of entrusted payments splitting funds into multiple transactions and returning them to the borrower over multiple days, and to reduce labor and time costs and further improve the accuracy of risk identification for such fund return methods, an HMM model is used for monitoring. Specifically, the first model is an HMM (Hidden Markov Model), a statistical model in which the system is viewed as a sequence of states that change randomly according to a Markov process, and the observed data sequence is generated from these states. In this embodiment, it is used to analyze the fund flow status changing over time to identify the risk of direct splitting and returning funds, i.e., the payee directly or indirectly returning funds to the borrower's account. HMM provides a method for identifying immediate and cross-day splitting behaviors, supports real-time data stream processing, identifies abnormal transaction time-series dependencies, performs probability estimation of transaction status in a dynamic environment, and implements tiered early warning monitoring for suspicious transactions.

[0052] Optionally, the intelligent early warning system analyzes transaction data using an HMM model and obtains preliminary assessment results regarding the risk of fund return, including the normal state, low-risk state, medium-risk state, and high-risk state of the transaction.

[0053] Step S203: Use the first and second operations to monitor the risk of fund reflux in the two-layer network and obtain the second risk monitoring result.

[0054] In step S203, the first operation is used to identify abnormal paths in the two-layer network, and the second operation is used to extract transaction network features based on the two-layer network and determine abnormal transaction behavior based on the transaction network features. The two-layer network includes a first relationship network and a second relationship network.

[0055] In step S203, the first relationship network is used to represent the related enterprise information of the lender and the payee, and the second relationship network is used to represent the flow of funds in the accounts of the lender and the payee.

[0056] Optionally, abnormal transactions include, but are not limited to, abnormal amounts, abnormal transaction frequency, abnormal timing, abnormal counterparties, abnormal purposes, and abnormal patterns. Abnormal amounts refer to transaction amounts far exceeding the average or normal range of historical transactions, or amounts exhibiting regular changes, such as being split into multiple small transactions to evade regulation. Abnormal transaction frequency refers to a sudden increase or decrease in transaction frequency that is inconsistent with historical transaction patterns, potentially indicating unusual fund flows. Abnormal timing refers to transactions occurring at times that do not conform to typical transaction patterns, such as large transactions outside of business hours or frequent transactions within a short period. Abnormal counterparties refer to counterparties being uncommon or unrelated entities, especially when funds flow to the borrower's affiliated companies or accounts, which may signal fund repatriation. Abnormal purposes refer to unusual descriptions in the transaction summary or purpose notes, such as purposes unrelated to the borrower's business, or vague descriptions, which may indicate improper use of funds. Abnormal patterns refer to sudden changes in transaction patterns, such as a shift from typical physical transactions to frequent electronic transfers, or the emergence of complex fund transfer chains, all of which may involve illegal activities.

[0057] Optionally, the intelligent early warning system, driven by the fusion of internal and external data, constructs a two-layer network. First, it builds a comprehensive, three-dimensional, and highly accurate customer-related enterprise relationship network. Second, it constructs a dynamic network of account-level fund flows based on embedded text and time series data from transaction events. Third, between the two layers, account nodes in the transaction network are connected to enterprise nodes in the enterprise relationship network, forming a two-layer network that accurately depicts a panoramic view of fund flows. The intelligent early warning system monitors the risks of indirect and hidden fund reflux through this two-layer network.

[0058] Optionally, the intelligent early warning system builds an anomaly detection model based on a two-layer network. This two-layer network effectively integrates transaction information between accounts, information about the companies associated with the accounts, and information about the relationships between customers. Based on the two-layer network, indirect, multi-layered monitoring of fund flows can be carried out across multiple cycles, time series, and transaction volumes, achieving intelligent risk control and early warning from "one-point" detection to "comprehensive" prevention and control.

[0059] Optionally, Figure 3 This is a schematic diagram of an optional corporate related account relationship network according to an embodiment of this application, such as... Figure 3As shown, the company's related account network includes, but is not limited to, third-party asset pledge relationships, kinship relationships, other relationships (such as contacts with the same mobile phone number or the same address), joint cardholders, credit relationships, equity relationships, guarantee relationships, and corporate executive / legal person relationships. Among these, third-party asset pledge relationships include third-party legal person client asset pledges, third-party legal person representative client asset pledges, and third-party individual client asset pledges; kinship relationships include spousal relationships and other kinship relationships; joint cardholders include joint business card holders, joint credit card associated customers, and joint cardholders of customer leaders; credit relationships include credit connection numbers and credit amounts; equity relationships include controlling shareholders, largest shareholders, and general shareholders; guarantee relationships include mutual guarantees among customers, shareholder guarantees, and joint guarantees among customers; and corporate executive / legal person relationships include corporate legal representatives, the same legal representative, legal representatives holding positions elsewhere, and joint executives.

[0060] Optionally, the first step involves identifying abnormal paths and capturing potential indirect or hidden fund repatriation through network node correlation analysis. The second step uses Isolation Forest (Isolation Forest Algorithm) and XGBoost (Extreme Gradient Boosting Algorithm) to extract transaction network features, determine abnormal trading behavior, and further refine the monitoring of fund repatriation risks.

[0061] It should be noted that Isolation Forest is an unsupervised learning anomaly detection algorithm, mainly used to identify a small number of outliers or isolated points in a dataset. The Isolation Forest algorithm utilizes two quantitative attributes of sample anomalous data: few and different. Few means that the anomalous data points are few in number, and different means that there is a significant difference between the attribute values ​​of the anomalous data points and the attribute values ​​of the normal data points. Compared with normal data points, they are easier to isolate and are more suitable for anomaly detection of a large number of network node data. The XGBoost algorithm is a machine learning algorithm based on gradient boosting decision trees. It performs well in tasks such as classification, regression, and ranking, especially in processing large-scale data, where it is efficient and accurate. XGBoost constructs multiple decision trees and uses an additive model to combine the prediction results of these trees to form the final output. Due to its high efficiency, superior performance, and strong ability to handle heterogeneous data, this application selects the XGBoost model as the classifier for monitoring whether the return of funds is abnormal.

[0062] Step S204: Based on the first risk monitoring results and the second risk monitoring results, identify transactions with risk of fund repatriation and issue an early warning for such transactions.

[0063] Optionally, the intelligent early warning system integrates the detection results of the HMM model and the two-layer network to issue warnings for transactions identified as having a risk of fund outflow, prompting banks to take timely measures to prevent the expansion of credit risk and ensure fund security.

[0064] As can be seen from steps S201 to S204, in this application, transaction data between the target lender and the target payee is first obtained. Then, based on a first model, the transaction data is used to monitor the risk of fund reflux, resulting in a first risk monitoring result. The first model is used to analyze the fund flow status over time. Then, a first operation and a second operation are used to monitor the risk of fund reflux in a two-layer network, resulting in a second risk monitoring result. The first operation is used to identify abnormal paths in the two-layer network, and the second operation is used to extract transaction network features based on the two-layer network and determine abnormal transaction behaviors based on these features. The two-layer network includes a first relationship network and a second relationship network. A first relationship network is used to represent the related enterprise information of the lender and the payee, and a second relationship network is used to represent the flow of funds in the accounts of the lender and the payee. Finally, based on the results of the first and second risk monitoring, risky transactions involving fund repatriation are identified, and early warnings are issued for these transactions. This dual-layer monitoring and early warning approach, combining time series analysis and network structure analysis, achieves real-time, comprehensive, and intelligent early warning of fund repatriation risks. This improves the accuracy of early warnings for entrusted payment fund repatriation and solves the technical problem of low monitoring accuracy and low early warning accuracy in existing technologies that rely on rule engines and manual review for monitoring entrusted payment fund repatriation.

[0065] In one optional embodiment, the intelligent early warning system first sets target parameters for a first model based on preset rules, wherein the target parameters are used to monitor abnormal fund flow information; secondly, it obtains a target algorithm, wherein the target algorithm is used to identify abnormal flow paths from transactions; then, it calculates transaction data according to the target algorithm and target parameters to obtain a target sequence, wherein the target sequence includes transaction information of abnormal transactions; and finally, it determines a first risk monitoring result based on the target sequence.

[0066] Optionally, the target algorithm is the Viterbi algorithm, a dynamic programming algorithm used to find the most probable sequence of hidden states in a Hidden Markov Model (HMM). In an HMM, the true state of the system is hidden, but the system produces observable outputs based on its internal states. The task of the Viterbi algorithm is, given an observation sequence, to find the most probable sequence of hidden states that produced this observation sequence. In short, it is used to decode HMMs by inferring the most probable sequence of hidden states from the known observation sequence.

[0067] Optionally, the intelligent early warning system sets the parameters of the HMM model based on data exploration and relevant business experts' rules. Then, it uses the obtained HMM model in combination with the Viterbi algorithm to calculate the most likely hidden state sequence corresponding to the currently observed fund transaction sequence, thereby classifying each fund transaction into normal, medium-risk, and high-risk transactions, and realizing a risk monitoring and early warning mechanism for real-time monitoring and hierarchical management.

[0068] Optionally, Figure 4 This is a schematic diagram illustrating an optional HMM model application according to an embodiment of this application, such as... Figure 4 As shown, the first step is data preparation. The bank system stores customer account transaction history, observation sequence O, and hidden state space Q. The observation sequence consists of the detailed transaction records of each fund transaction in the historical data, including transfers, remittances, receipts, and withdrawals, involving transaction amounts, transaction types, etc. These attributes are directly observable. The hidden state space refers to the set of possible internal states, such as normal, low-risk, medium-risk, and high-risk states. These states are defined based on the potential risk level of the transaction behavior. Next, relevant personnel formulate rules based on the prepared data to set the three parameters of the HMM model. The three parameters are π, A, and B. π is a vector representing the probability of the model being in each hidden state at the beginning. A is the state transition probability matrix (describing the probability of transitioning between any two hidden states, i.e., from one state to the next). B is the probability matrix of observations (the probability of a specific observation result in a given hidden state, i.e., the probability of observing a certain transaction attribute when the model is in a certain state). Then, based on the Viterbi algorithm, each newly added transaction (such as o1, o2...ot, each new transaction data received by the bank is added to the existing transaction data sequence to form a constantly updated sequence. This is a dynamic process because new transactions occur in the account every day, and these transaction data need to be processed by the model in real time) is analyzed. The Viterbi algorithm will predict the most likely hidden sequence corresponding to this transaction based on historical transaction data and model parameters, i.e., the risk state (which one it belongs to: normal, low risk, medium risk, or high risk). Finally, based on real-time monitoring and hierarchical management, the most likely hidden state sequence is output, and transactions with different risk states are managed hierarchically.

[0069] As described above, the intelligent early warning system, through the combined application of the Hidden Markov Model (HMM) and the Viterbi algorithm, achieves efficient and accurate identification of the risk of direct repatriation of entrusted payment funds. The system can monitor every transaction in real time, dynamically capture abnormal patterns in the transaction sequence, and provide timely warnings for abnormal transactions, significantly improving the ability of banking institutions to defend against credit risk. Simultaneously, the introduction of the Viterbi algorithm ensures accurate estimation of the true state of fund flows even in complex transaction environments, effectively identifying whether funds are flowing back to the borrower or their controlled related companies, even in scenarios with frequent transactions and large fluctuations in amounts. Furthermore, the use of the intelligent early warning system reduces reliance on manual review, increases the automation level of risk monitoring, reduces response time, and helps banks take immediate measures to prevent the expansion of credit risk and ensure fund security.

[0070] In one optional embodiment, the intelligent early warning system determines abnormal nodes and a first abnormal path based on a two-layer network. The abnormal node is used to represent a borrower or payee with abnormal transactions, and the first abnormal path is used to represent the flow trajectory of abnormal funds. The two-layer network includes multiple network paths, and the multiple network paths include the first abnormal path. Then, a second abnormal path in the two-layer network is detected based on a first operation. The second abnormal path is a different network path from the first abnormal path. Features are extracted from each node, each network path, the abnormal node, the first abnormal path, and the second abnormal path in the two-layer network to obtain a target feature vector. The target feature vector is used to represent the attribute information of the transaction pattern. Finally, the target feature vector is classified into abnormal states using a second operation to obtain a second risk monitoring result.

[0071] Optionally, the intelligent early warning system identifies abnormal nodes and the first abnormal path based on the analysis of network node association nodes. Based on the identification of the first abnormal path, the system detects a second abnormal path that is different from the first abnormal path through further network analysis. These paths may involve more complex or concealed fund return methods, such as multi-level transfers and interbank transactions. Then, for each node and each network path, including abnormal nodes and abnormal paths, the system extracts features and constructs a target feature vector. These features include, but are not limited to, node centrality indicators, path length, transaction amount, transaction time interval, and transaction summary text. The target feature vector integrates multi-dimensional information of fund transactions, providing rich attribute information for abnormal state classification. Then, XGBoost is used to classify the target feature vector for abnormal states to obtain the second risk monitoring result.

[0072] Optionally, before building the XGBoost model, detailed data labeling is required for subgraphs or nodes that have been initially identified as potentially abnormal. If there are no problems, i.e., the transaction is normal, it is labeled as 0; if there are doubts, and the transaction may be abnormal or risky, it is labeled as 1. Then, for XGBoost model training, the labeled data is randomly divided into training and validation sets in an 8:2 ratio and input into the XGBoost model for training. The model's performance is then evaluated using the F1-score (a statistical metric used to measure classifier performance).

[0073] Optionally, the intelligent early warning system combines the node features, edge features, embedded time features, text features, and the aforementioned early warning information, as well as abnormal nodes and abnormal paths (first abnormal path, second abnormal path) as transaction features (target feature vectors) into the XGBoost model for abnormal state classification to obtain the second risk monitoring result.

[0074] Optionally, Table 1 is an example of an optional model feature according to an embodiment of this application. As shown in Table 1, the input features of the XGBoost model include, but are not limited to, node features, edge features, temporal features, text features, warning features, and isolated features (i.e., anomaly scores).

[0075] Table 1

[0076]

[0077] As can be seen from the above, the intelligent early warning system, by constructing and analyzing a two-layer network, ensures comprehensive risk monitoring of various fund return patterns, such as indirect and implicit return flows. Through the comprehensive application of feature extraction and machine learning algorithms, the system can more accurately identify abnormal nodes and abnormal paths, reduce false alarms and false negatives, and improve the accuracy of risk warnings. Furthermore, the construction and analysis of the two-layer network can dynamically reflect the fund flow status, supporting real-time monitoring and immediate response. This enables banks to take swift measures to avoid or reduce losses after detecting risk signals. At the same time, because the system automatically monitors and warns of abnormal fund flows, it significantly reduces reliance on manual review and shortens risk response time.

[0078] In one optional embodiment, the intelligent early warning system determines a first set and a second set based on a two-layer network, wherein the first set includes a set of other nodes connected to the target payee through direct or indirect relationships, and the second set includes a set of other nodes connected to the target lender through direct or indirect relationships. Based on the intersection of the first set and the second set, abnormal nodes and a first abnormal path are determined.

[0079] Optionally, in business scenarios, when fund repatriation is detected—such as when the recipient of entrusted payment transfers funds outside the bank and then back to the lender within the bank, ultimately flowing back to the lender's affiliated company, or when funds are transferred out across banks and then flow back to the lender through an affiliated company—this is reflected in the network as the set of associated nodes of the recipient node and the set of associated nodes of the lender node having the same nodes, i.e., there is an intersection. Therefore, the intelligent early warning system detects fund repatriation in two steps: first, it calculates the set of associated nodes of the recipient and the lender; second, it determines whether there is an intersection between the associated nodes of the recipient and the lender.

[0080] Optionally, the first step involves calculating the first set of n-degree related nodes of the entrusted payment recipient. The goal here is to identify the set of nodes directly or indirectly related to the entrusted payment recipient. The recipient is selected as the starting node, and a graph traversal algorithm is used to calculate the shortest distance from other nodes in the graph to the recipient. Nodes within the n-degree range (i.e., nodes reachable within n steps) are collected into a set. This set represents the related businesses or accounts that the recipient may have direct or indirect transactions with. The second step involves calculating the second set of users with m-degree financial transaction relationships with the lender. Starting with the lender, the shortest distance is calculated for all nodes in the graph that have financial transaction relationships with the lender. Nodes with a distance less than or equal to m are collected into the second set. This set reflects the direct or indirect related businesses or accounts that the lender may have financial transactions with, where n and m can be equal or unequal.

[0081] Optionally, the second step is to determine whether the first set and the second set have an intersection. Specifically, check if any of the n-degree related nodes of the payee are also m-degree related nodes of the lender. An intersection implies that funds may have flowed back between the payee and the lender, or between their related companies.

[0082] For example, Figure 5 This is a schematic diagram of an optional m-degree node association network structure according to an embodiment of this application, as shown below. Figure 5As shown, when m is 3, all destination nodes in the fund transaction graph need to be traversed three times. Taking the starting calculation node B as the source node, in the first traversal, node B sends information to nodes C and D, indicating that the distance between these two nodes and node B is 1, satisfying the condition (i.e., m>=1), and they can be considered as directly related nodes of node B. In the second traversal, since nodes C and D have already been explored, their distance from node B is greater than 1 but not more than 3. Therefore, the algorithm continues to explore connections starting from nodes C and D. When node D sends information to node E, it indicates that the distance between node E and node B is 2, satisfying the condition (i.e., m>=2). Therefore, node E is added to the set of m-degree related nodes of node B. In the second traversal, node B tries to send information to nodes C and D again, but since nodes C and D have already been explored in the first traversal, and reaching nodes C and D again from node B does not increase the breadth or depth of network exploration, the conditions for further exploration are not met, and information will not be sent repeatedly. Similarly, in the third traversal, node F is added to the set of m-degree related nodes of node B. Therefore, the set of users with 3-degree financial transaction relationships of node B is {C, D, E, F}.

[0083] As can be seen from the above, the intelligent early warning system uses graph algorithms to check whether there is an intersection between the first set and the second set. The appearance of an intersection means that funds may have flowed back between the payee and the lender or between their related companies. This intersection analysis method based on network structure can quickly and accurately locate potential risk points, providing key information for timely early warning and intervention. Furthermore, by analyzing the intersection of the first set and the second set, the intelligent early warning system can identify abnormal nodes, namely borrowers or payees exhibiting abnormal transaction behavior, as well as the first abnormal path, namely the fund flow trajectory suspected of fund backflow, thereby improving the coverage of risk warning.

[0084] In one optional embodiment, the intelligent early warning system extracts features from each transaction path in the two-layer network to obtain target features corresponding to each transaction path. The target features corresponding to each transaction path are used to characterize the potential abnormal transaction patterns of the transaction path. Then, based on the target features corresponding to each transaction path, the system determines the abnormal score of each transaction path through a first operation. If the abnormal score of any transaction path in the two-layer network is greater than a preset score, the transaction path is determined to be a second abnormal path. If the abnormal score of any transaction path in the two-layer network is less than or equal to the preset score, the transaction path is determined to be a normal transaction path.

[0085] Optionally, in the scenario of identifying fund repatriation, the actual goal is to identify transactions that differ from normal fund transactions. In real-world scenarios, many objects have rich interrelationships, which provide valuable supplementary information for anomaly detection. Taking a two-layer network as an example, fund repatriation and general fund transactions may share structural characteristics, but there may be differences in time frequency and counterparties. Therefore, these abnormal fund repatriations may form dense and unexpected connections, indicating a deviation from benign behavior. The graph anomaly detection problem utilizes the structural information contained in the graph to identify abnormal graph objects (nodes, edges, or subgraphs) and abnormal graphs in graph atlases / databases. That is, in our abnormal fund repatriation detection, the goal is to identify abnormal nodes (i.e., payees, lenders), abnormal edges (i.e., abnormal fund transactions), and abnormal subgraphs (i.e., abnormal fund repatriations). Therefore, Isolation Forest is used for anomaly detection in such scenarios.

[0086] Optionally, the intelligent early warning system first performs deep feature extraction on each transaction path in the two-layer network to obtain the target features corresponding to each path. The target features integrate multiple key attributes on the transaction path, including but not limited to transaction amount (the amount of each transaction, reflecting the scale of capital flow), transaction frequency (the number of transactions within a specific time window, revealing the activity level of capital flow), transaction time interval (the time interval between consecutive transactions, analyzing the continuity and regularity of transactions), path length (the length of the transfer path from the lender to the payee and then to the potential return node, assessing the complexity of capital flow), account node attributes (including account centrality indicators, clustering coefficients, etc., reflecting the importance and relevance of accounts in the network), and transaction summary embedding (using natural language processing technology to convert transaction summary text into vector representation to capture the semantic features of transactions). The system uses a trained Isolation Forest model to predict the extracted features, outputs an anomaly score for each path, sets a threshold based on the anomaly score, and identifies abnormal paths.

[0087] As described above, the intelligent early warning system, by extracting features from transaction paths and combining them with the Isolation Forest algorithm, can accurately identify potential abnormal transaction patterns, especially complex and concealed fund repatriation behaviors, significantly improving the accuracy of risk monitoring. Simultaneously, the system supports online processing of streaming transaction data and instant calculation of anomaly scores, enabling rapid response to changes in fund flow status and real-time early warning of abnormal transactions, reducing the lag in risk monitoring. Furthermore, the Isolation Forest algorithm can automatically filter and isolate abnormal transaction paths, reducing reliance on manual review, improving the efficiency of risk early warning, and shortening the time from risk identification to taking countermeasures.

[0088] In one optional embodiment, if both the first risk monitoring result and the second risk monitoring result of the i-th transaction indicate that the risk value of the i-th transaction is the first risk value, a first warning value is generated for the i-th transaction according to the risk model, where i is an integer greater than or equal to 1, the first risk value is greater than or equal to a preset risk threshold, and the risk model is used to assess and warn of the risk of fund flow in entrusted payment business; if one of the first risk monitoring result and the second risk monitoring result of the i-th transaction indicates that the risk value of the i-th transaction is the first risk value, and the other risk monitoring result indicates that the risk value of the i-th transaction is the second risk value, a second warning value is generated for the i-th transaction according to the risk model, where the first warning value is greater than the second warning value, and the second risk value is less than the first risk value; if both the first risk monitoring result and the second risk monitoring result of the i-th transaction indicate that the risk value of the i-th transaction is the second risk value, no warning is issued for the i-th transaction.

[0089] Optionally, the intelligent early warning system uses account transaction details time-series data streams and HMM models to detect whether a series of fund flow behaviors have an abnormal state at a certain moment. It uses XGboost to detect anomalies in transaction nodes or paths based on features on a two-layer network and establishes a fusion risk model. The fusion risk model is a comprehensive risk early warning scheme that combines direct fund splitting and backflow monitoring based on Hidden Markov Model (HMM) and indirect and implicit fund backflow monitoring based on a two-layer network to detect and warn for each transaction.

[0090] Optionally, Figure 6 This is a schematic diagram of an optional risk warning based on a fusion risk model, according to an embodiment of this application, such as... Figure 6 As shown, when a transaction shows high risk in both anomaly detection models, it requires an alert, as it may be a transaction involving fund repatriation in entrusted payment business. When a transaction shows high risk due to path anomalies, such as a fund transaction loop, but is not detected as a high-risk anomaly in the HMM, the transaction may be a normal fund transfer and requires further attention. When a transaction shows high risk due to time anomalies, such as excessively frequent transactions, but is not detected as a high-risk path anomaly, the transaction may be a normal refund operation and requires further investigation. When a transaction is not detected as a high-risk anomaly in either model, we can consider it a normal transaction.

[0091] As the above demonstrates, the risk warning quadrant diagram generated by the intelligent early warning system through the fusion of risk models helps optimize the overall early warning effect and facilitates risk stratification and refined management, better supporting decision optimization. On one hand, by integrating the Hidden Markov Model (HMM) and a two-layer complex network, the system organically combines the temporal dependencies and path relationships of capital flows, comprehensively considering multi-dimensional risk factors and leveraging the complementary effects between various models to improve the comprehensiveness and accuracy of risk monitoring and early warning. On the other hand, the quadrant diagram's risk display format intuitively shows the distribution of different risk levels, allowing management and decision-makers to understand the risk situation more quickly and easily identify high-risk areas. Furthermore, the refined risk scoring provided by the fusion model helps to more accurately classify risk levels in the quadrant diagram, enabling managers to implement differentiated management strategies and improve risk management efficiency.

[0092] In one optional embodiment, the intelligent early warning system uses a target neural network to analyze a two-layer network, abnormal nodes, a first abnormal path, and a second abnormal path to obtain abnormal transaction classification results. The target neural network is used to identify and warn of different types of fund return risks, and then the early warning method is determined based on the abnormal transaction classification results.

[0093] Optionally, considering the following two aspects: First, fund transactions have a clear network structure with nodes and edges, and graph neural networks are well-suited to this structure. Furthermore, the characteristics of fund reflux are relatively obvious, mainly related to amount and time, and exhibit clear structural features. Second, graph neural networks primarily focus on the out-degree (debit transactions) and in-degree (credit transactions) of the starting point to determine whether funds have refluxed, without focusing on the fund flow process itself, thus possessing a certain degree of generalization ability. The intelligent early warning system employs GNN (Graph Neural Network) technology to conduct in-depth analysis of abnormal nodes, the first abnormal path, and the second abnormal path involved in the two-layer network, aiming to identify and warn of different types of fund reflux risks.

[0094] It's important to note that GNNs are neural network models specifically designed for processing graph-structured data. Unlike traditional neural networks that primarily handle one-dimensional sequence data or two-dimensional image data, GNNs can learn and predict directly on graphs. Nodes in the graph can represent entities such as users, items, and molecules, while edges represent relationships or interactions between entities. Furthermore, GNNs can accept both structured and unstructured data as input, effectively integrating text sequences and time series data into the model for better identification of fund repatriation scenarios.

[0095] Optionally, to better provide early warnings for fund repatriation under various risks and improve the model's generalization ability, the intelligent early warning system uses graph neural networks to conduct in-depth analysis of abnormal nodes, first abnormal paths, and second abnormal paths involved in the two-layer network. That is, it uses graph neural networks to mine the structure of the graph and classifies the constructed network into specific risk types based on downstream graph classification tasks, thereby identifying fund repatriation links and identifying the risk types of abnormal transactions, including direct split repatriation, indirect repatriation, and hidden repatriation. The system can classify each abnormal transaction and determine the corresponding early warning method, using refined risk management strategies to deal with complex and ever-changing abnormal fund scenarios.

[0096] As can be seen from the above, by further using graph neural networks for structure mining and downstream graph classification tasks, the intelligent early warning system can more accurately identify and classify various risks of fund return, achieve precise early warning of abnormal transaction links, and improve the model's ability to generalize to newly emerging complex transaction patterns.

[0097] The entrusted payment fund return method provided in this application solves the technical problem of low monitoring accuracy and low early warning accuracy in the prior art when relying on rule engines and manual review for entrusted payment fund return monitoring, by combining time series analysis and network structure analysis in a two-layer monitoring and early warning approach. This achieves the effect of high accuracy in entrusted payment fund return early warning.

[0098] Example 2

[0099] This application also provides an early warning device for the return of entrusted payment funds. It should be noted that this early warning device can be used to execute the early warning method for the return of entrusted payment funds provided in this application. The early warning device for the return of entrusted payment funds provided in this application is described below.

[0100] According to an embodiment of this application, a warning device for implementing the above-mentioned early warning system for the return of entrusted payment funds is also provided. Figure 7 This is a schematic diagram of an optional early warning device for the return of entrusted payment funds according to an embodiment of this application, such as... Figure 7 As shown, the device includes: a first acquisition unit 701, a first monitoring unit 702, a second monitoring unit 703, and a first early warning unit 704.

[0101] Optionally, the first acquisition unit 701 acquires transaction data between the target borrower and the target payee; the first monitoring unit 702 performs fund repatriation risk monitoring on the transaction data based on a first model to obtain a first risk monitoring result, wherein the first model is used to analyze the fund flow status changing over time; the second monitoring unit 703 uses a first operation and a second operation to perform fund repatriation risk monitoring on a two-layer network to obtain a second risk monitoring result, wherein the first operation is used to identify abnormal paths in the two-layer network, the second operation is used to extract transaction network features based on the two-layer network, and determine abnormal transaction behavior based on the transaction network features, wherein the two-layer network includes a first relationship network and a second relationship network, wherein the first relationship network is used to represent the related enterprise information of the borrower and the payee, and the second relationship network is used to represent the flow of funds in the accounts of the borrower and the payee; and the first early warning unit 704 determines fund repatriation risk transactions based on the first risk monitoring result and the second risk monitoring result, and issues an early warning for fund repatriation risk transactions.

[0102] Optionally, the first monitoring unit 702 includes: a first setting subunit, a first acquisition subunit, a first calculation subunit, and a first determination subunit. The first setting subunit is used to set target parameters of the first model based on preset rules, wherein the target parameters are used to monitor abnormal fund flow information; the first acquisition subunit is used to acquire a target algorithm, wherein the target algorithm is used to identify abnormal flow paths from transactions; the first calculation subunit is used to calculate transaction data according to the target algorithm and target parameters to obtain a target sequence, wherein the target sequence includes transaction information of abnormal transactions; and the first determination subunit is used to determine a first risk monitoring result based on the target sequence.

[0103] Optionally, the second monitoring unit 703 includes: a second determination subunit, a first detection subunit, a first extraction subunit, and a first classification subunit. The second determination subunit is used to determine abnormal nodes and a first abnormal path based on the two-layer network. The abnormal node represents a borrower or payee with abnormal transactions, and the first abnormal path represents the flow trajectory of abnormal funds. The two-layer network includes multiple network paths, including the first abnormal path. The first detection subunit is used to detect a second abnormal path in the two-layer network based on a first operation. The second abnormal path is a different network path from the first abnormal path. The first extraction subunit is used to extract features from each node, each network path, the abnormal node, the first abnormal path, and the second abnormal path in the two-layer network to obtain a target feature vector. The target feature vector represents the attribute information of the transaction pattern. The first classification subunit is used to classify the target feature vector into abnormal states using a second operation to obtain a second risk monitoring result.

[0104] Optionally, the second determining subunit includes: a first determining module and a second determining module. The first determining module is used to determine a first set and a second set based on the two-layer network, wherein the first set includes a set of other nodes connected to the target payee through direct or indirect relationships, and the second set includes a set of other nodes connected to the target lender through direct or indirect relationships; the second determining module is used to determine abnormal nodes and a first abnormal path based on the intersection of the first set and the second set.

[0105] Optionally, the first detection subunit includes: a first extraction module, a third determination module, a fourth determination module, and a fifth determination module. The first extraction module is used to extract features from each transaction path in the two-layer network to obtain target features corresponding to each transaction path, wherein the target features corresponding to each transaction path are used to characterize the potential abnormal transaction patterns of that transaction path. The third determination module is used to determine the abnormality score of each transaction path based on the target features corresponding to each transaction path through a first operation. The fourth determination module is used to determine that a transaction path is a second abnormal path if the abnormality score of any transaction path in the two-layer network is greater than a preset score. The fifth determination module is used to determine that a transaction path is a normal transaction path if the abnormality score of any transaction path in the two-layer network is less than or equal to a preset score.

[0106] Optionally, the first early warning unit 704 includes: a first generation subunit, a second generation subunit, and a first processing subunit. The first generation subunit generates a first early warning value for the i-th transaction based on a risk model if both the first and second risk monitoring results for the i-th transaction indicate that the risk value of the i-th transaction is the first risk value, where i is an integer greater than or equal to 1, and the first risk value is greater than or equal to a preset risk threshold. The risk model is used to assess and warn of the risk of fund flow in entrusted payment business. The second generation subunit generates a second early warning value for the i-th transaction based on a risk model if one of the first and second risk monitoring results for the i-th transaction indicates that the risk value of the i-th transaction is the first risk value, and the other risk monitoring result indicates that the risk value of the i-th transaction is the second risk value, where the first early warning value is greater than the second early warning value, and the second risk value is less than the first risk value. The first processing subunit does not issue an early warning for the i-th transaction if both the first and second risk monitoring results for the i-th transaction indicate that the risk value of the i-th transaction is the second risk value.

[0107] Optionally, the early warning device for entrusted payment fund repatriation further includes: an analysis unit and a determination unit. The analysis unit is used to analyze the two-layer network, abnormal nodes, the first abnormal path, and the second abnormal path using a target neural network to obtain abnormal transaction classification results. The target neural network is used to identify and issue early warnings for different types of fund repatriation risks. The determination unit is used to determine the early warning method based on the abnormal transaction classification results.

[0108] Example 3

[0109] Embodiments of this application may provide an electronic device. Figure 8 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 8 As shown, the electronic device may include: one or more ( Figure 8 Only one of the components is shown: processor 802, memory 804, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module, and display.

[0110] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0111] The processor can access information and applications stored in the memory via a transmission device to execute the following steps: acquiring transaction data between the target lender and the target payee; performing fund repatriation risk monitoring on the transaction data based on a first model to obtain a first risk monitoring result, wherein the first model is used to analyze the fund flow status changing over time; performing fund repatriation risk monitoring on a two-layer network using a first operation and a second operation to obtain a second risk monitoring result, wherein the first operation is used to identify abnormal paths in the two-layer network, and the second operation is used to extract transaction network features based on the two-layer network and determine abnormal transaction behavior based on the transaction network features, wherein the two-layer network includes a first relationship network and a second relationship network, wherein the first relationship network is used to represent the related enterprise information of the lender and the payee, and the second relationship network is used to represent the flow of funds in the accounts of the lender and the payee; determining fund repatriation risk transactions based on the first risk monitoring result and the second risk monitoring result, and issuing an early warning for fund repatriation risk transactions.

[0112] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: setting the target parameters of the first model based on preset rules, wherein the target parameters are used to monitor abnormal fund flow information; obtaining the target algorithm, wherein the target algorithm is used to identify abnormal flow paths from transactions; calculating the transaction data according to the target algorithm and the target parameters to obtain the target sequence, wherein the target sequence includes transaction information of abnormal transactions; and determining the first risk monitoring result according to the target sequence.

[0113] The processor can also invoke information and applications stored in the memory via a transmission device to perform the following steps: determining abnormal nodes and a first abnormal path based on a two-layer network, wherein the abnormal node is used to characterize the borrower or payee with abnormal transactions, and the first abnormal path is used to characterize the flow trajectory of abnormal funds, wherein the two-layer network includes multiple network paths, and the multiple network paths include the first abnormal path; detecting a second abnormal path in the two-layer network based on a first operation, wherein the second abnormal path is a different network path from the first abnormal path; extracting features from each node, each network path, abnormal node, first abnormal path, and second abnormal path in the two-layer network to obtain a target feature vector, wherein the target feature vector is used to represent the attribute information of the transaction pattern; classifying the target feature vector into abnormal states using a second operation to obtain a second risk monitoring result.

[0114] The processor can also invoke information and applications stored in the memory via a transmission device to perform the following steps: determining a first set and a second set based on a two-layer network, wherein the first set includes a set of other nodes connected to the target payee through a direct or indirect relationship, and the second set includes a set of other nodes connected to the target lender through a direct or indirect relationship; and determining abnormal nodes and a first abnormal path based on the intersection of the first set and the second set.

[0115] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: extracting features from each transaction path in the two-layer network to obtain target features corresponding to each transaction path, wherein the target features corresponding to each transaction path are used to characterize the potential abnormal transaction patterns of the transaction path; determining the abnormal score of each transaction path based on the target features corresponding to each transaction path through a first operation; determining the transaction path as a second abnormal path if the abnormal score of any transaction path in the two-layer network is greater than a preset score; and determining the transaction path as a normal transaction path if the abnormal score of any transaction path in the two-layer network is less than or equal to the preset score.

[0116] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: If both the first risk monitoring result and the second risk monitoring result of the i-th transaction indicate that the risk value of the i-th transaction is the first risk value, generate a first warning value for the i-th transaction according to the risk model, where i is an integer greater than or equal to 1, the first risk value is greater than or equal to a preset risk threshold, and the risk model is used to assess and warn of the risk of fund flow in entrusted payment business; If one of the first risk monitoring results and the second risk monitoring result of the i-th transaction indicates that the risk value of the i-th transaction is the first risk value, and the other risk monitoring result indicates that the risk value of the i-th transaction is the second risk value, generate a second warning value for the i-th transaction according to the risk model, where the first warning value is greater than the second warning value, and the second risk value is less than the first risk value; If both the first risk monitoring result and the second risk monitoring result of the i-th transaction indicate that the risk value of the i-th transaction is the second risk value, do not issue a warning for the i-th transaction.

[0117] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: using the target neural network to analyze the two-layer network, abnormal nodes, the first abnormal path and the second abnormal path to obtain abnormal transaction classification results, wherein the target neural network is used to identify and warn of different types of fund return risks; and determining the warning method based on the abnormal transaction classification results.

[0118] Those skilled in the art will understand that Figure 8 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones (such as Android phones, iOS phones, etc.), tablets, PDAs, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 8 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 8 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 8 The different configurations shown.

[0119] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0120] Example 4

[0121] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the early warning method for entrusted payment fund return provided in Embodiment 1.

[0122] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0123] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing early warning method steps for the return of entrusted payment funds.

[0124] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0125] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0126] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0127] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0128] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0129] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0130] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for early warning of the return of entrusted payment funds, characterized in that, include: Obtain transaction data between the target borrower and the target payee; Based on the first model, the transaction data is used to monitor the risk of fund return and obtain a first risk monitoring result, wherein the first model is used to analyze the fund flow status that changes over time. The first and second operations are used to monitor the risk of fund reflux in the two-layer network and obtain a second risk monitoring result. The first operation is used to identify abnormal paths in the two-layer network, and the second operation is used to extract transaction network features based on the two-layer network and determine abnormal transaction behavior based on the transaction network features. The two-layer network includes a first relationship network and a second relationship network. The first relationship network is used to represent the related enterprise information of the lender and the payee, and the second relationship network is used to represent the flow of funds in the accounts of the lender and the payee. Based on the first risk monitoring results and the second risk monitoring results, transactions with risk of fund repatriation are identified, and warnings are issued for the transactions with risk of fund repatriation. The method of monitoring the risk of fund reflux based on the transaction data using a first model to obtain a first risk monitoring result includes: setting target parameters for the first model based on preset rules, wherein the target parameters are used to monitor abnormal fund flow information; obtaining a target algorithm, wherein the target algorithm is used to identify abnormal flow paths from transactions; calculating the transaction data according to the target algorithm and the target parameters to obtain a target sequence, wherein the target sequence includes transaction information of abnormal transactions; and determining the first risk monitoring result based on the target sequence. The process involves using a first operation and a second operation to monitor the risk of fund reflux in a two-layer network, resulting in a second risk monitoring result. This includes: identifying abnormal nodes and a first abnormal path based on the two-layer network, where the abnormal node represents a borrower or payee with abnormal transactions, and the first abnormal path represents the trajectory of abnormal fund flows. The two-layer network includes multiple network paths, including the first abnormal path. Based on the first operation, a second abnormal path is detected in the two-layer network, where the second abnormal path is a different network path from the first abnormal path. Features are extracted from each node, each network path, the abnormal node, the first abnormal path, and the second abnormal path in the two-layer network to obtain a target feature vector, where the target feature vector represents attribute information of the transaction pattern. The second operation is then used to classify the target feature vector for abnormal states, resulting in the second risk monitoring result.

2. The early warning method for the return of entrusted payment funds according to claim 1, characterized in that, Determining the abnormal node and the first abnormal path based on the two-layer network includes: A first set and a second set are determined based on the two-layer network, wherein the first set includes a set of other nodes that are directly or indirectly connected to the target payee, and the second set includes a set of other nodes that are directly or indirectly connected to the target lender. The abnormal node and the first abnormal path are determined based on the intersection of the first set and the second set.

3. The early warning method for the return of entrusted payment funds according to claim 1, characterized in that, The second abnormal path in the two-layer network is detected based on the first operation, including: Feature extraction is performed on each transaction path in the two-layer network to obtain the target features corresponding to each transaction path, wherein the target features corresponding to each transaction path are used to characterize the potential abnormal transaction patterns of the transaction path; Based on the target characteristics corresponding to each transaction path, the first operation determines the anomaly score of each transaction path. If the abnormal score of any transaction path in the two-layer network is greater than the preset score, the transaction path is determined to be the second abnormal path. If the abnormal score of any transaction path in the two-layer network is less than or equal to the preset score, the transaction path is determined to be a normal transaction path.

4. The early warning method for the return of entrusted payment funds according to claim 1, characterized in that, Based on the first risk monitoring results and the second risk monitoring results, transactions with risk of fund repatriation are identified, and early warnings are issued for these transactions, including: If both the first risk monitoring result and the second risk monitoring result of the i-th transaction indicate that the risk value of the i-th transaction is the first risk value, a first warning value is generated for the i-th transaction according to the risk model, where i is an integer greater than or equal to 1, the first risk value is greater than or equal to a preset risk threshold, and the risk model is used to assess and warn of the risk of fund flow in entrusted payment business. If one of the first risk monitoring results and the second risk monitoring results of the i-th transaction indicates that the risk value of the i-th transaction is a first risk value, and the other risk monitoring result indicates that the risk value of the i-th transaction is a second risk value, a second warning value is generated for the i-th transaction according to the risk model, wherein the first warning value is greater than the second warning value, and the second risk value is less than the first risk value; If both the first risk monitoring result and the second risk monitoring result of the i-th transaction indicate that the risk value of the i-th transaction is the second risk value, no warning will be issued for the i-th transaction.

5. The early warning method for the return of entrusted payment funds according to claim 1, characterized in that, After identifying risky transactions involving fund repatriation based on the first and second risk monitoring results, and issuing an early warning for these transactions, the early warning method for entrusted payment fund repatriation further includes: The target neural network is used to analyze the two-layer network, the abnormal node, the first abnormal path, and the second abnormal path to obtain abnormal transaction classification results. The target neural network is used to identify and warn of different types of fund return risks. The warning method is determined based on the abnormal transaction classification results.

6. An early warning device for the return of entrusted payment funds, characterized in that, include: The first acquisition unit acquires transaction data between the target borrower and the target payee; The first monitoring unit performs fund return risk monitoring on the transaction data based on the first model to obtain a first risk monitoring result, wherein the first model is used to analyze the fund flow status that changes over time. The second monitoring unit uses a first operation and a second operation to monitor the risk of fund return in the two-layer network and obtain a second risk monitoring result. The first operation is used to identify abnormal paths in the two-layer network, and the second operation is used to extract transaction network features based on the two-layer network and determine abnormal transaction behavior based on the transaction network features. The two-layer network includes a first relationship network and a second relationship network. The first relationship network is used to represent the related enterprise information of the lender and the payee, and the second relationship network is used to represent the flow of funds in the accounts of the lender and the payee. The first determining unit determines risky transactions involving the return of funds based on the first risk monitoring result and the second risk monitoring result, and issues an early warning for the risky transactions involving the return of funds. The first monitoring unit includes: a first setting subunit, used to set target parameters of the first model based on preset rules, the target parameters being used to monitor abnormal fund flow information; a first acquisition subunit, used to acquire a target algorithm, the target algorithm being used to identify abnormal flow paths from transactions; a first calculation subunit, used to calculate transaction data according to the target algorithm and target parameters to obtain a target sequence, the target sequence including transaction information of abnormal transactions; and a first determination subunit, used to determine a first risk monitoring result based on the target sequence. The second monitoring unit includes: a second determination subunit, used to determine abnormal nodes and a first abnormal path based on the two-layer network, wherein the abnormal node represents a borrower or payee with abnormal transactions, and the first abnormal path represents the flow trajectory of abnormal funds; the two-layer network includes multiple network paths, and the multiple network paths include the first abnormal path; a first detection subunit, used to detect and obtain a second abnormal path in the two-layer network based on a first operation, wherein the second abnormal path is a different network path from the first abnormal path; a first extraction subunit, used to extract features from each node, each network path, abnormal node, first abnormal path, and second abnormal path in the two-layer network to obtain a target feature vector, wherein the target feature vector represents the attribute information of the transaction pattern; and a first classification subunit, used to classify the target feature vector into abnormal states using a second operation to obtain a second risk monitoring result.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the computer-readable storage medium is located to perform the early warning method for the return of entrusted payment funds as described in any one of claims 1 to 5.

8. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein, when the program runs, the processor executes the early warning method for the return of entrusted payment funds as described in any one of claims 1 to 5.

9. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the early warning method for the return of entrusted payment funds as described in any one of claims 1 to 5.

Images